hijack this help

By SEashell
Jan 17, 2006
  1. Please could you check this hijack this file. I have been trying to run my new norton anti-virus software and it always gets to a certain stage then just stops and an error message pops up. Is there anything that needs to be deleted using the hijack this program.
  2. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Hello and welcome to Techspot.

    Boot into safe mode, and turn off system restore.

    Go to add remove programmes in your control panel, and uninstall anything to do with.

    C:\Program Files\DeskSite\binex\DeskSiteAlert.exe

    Then open your task manager, and on the processes tab, select, and end process for these(if there)


    Then run HJT with no other programmes open, and let HJT fix the following(if there)

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBR
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBR
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.bt.yahoo.com/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.bt.yahoo.com/
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBR

    O4 - HKLM\..\Run: [d6SQQe89S] C:\documents and settings\user\local settings\temp\d6SQQe89S.exe
    O4 - HKLM\..\Run: [DeskSiteAlert] C:\Program Files\DeskSite\binex\DeskSiteAlert.exe
    O4 - HKLM\..\Run: [Desksite CMA] C:\Program Files\desksite\bin\cma.exe

    Have HJT fix all your 016 dpf entries.

    These three entries should be fixed if they do not belong to your isp.

    O17 - HKLM\System\CCS\Services\Tcpip\..\{5DCAEE05-623B-43A6-8750-8065506853D8}: NameServer =,
    O17 - HKLM\System\CCS\Services\Tcpip\..\{95E2A622-38AD-4EAB-BBF1-70A4DB544BE5}: NameServer =
    O17 - HKLM\System\CCS\Services\Tcpip\..\{C36ACEA7-D671-4673-8331-BDE3A656E277}: NameServer =,

    Fix these as well.

    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

    O23 - Service: DeskSiteCMA - - C:\Program Files\DeskSite\binex\DeskSiteCMA.exe

    Then go into the following directory(if there), and delete the bold files.

    C:\Program Files\DeskSite

    Reboot in normal mode, and turn system restore back on.

    Regards Howard :wave: :wave:
Topic Status:
Not open for further replies.

Similar Topics

Add your comment to this article

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...