Trying to post hijackthis log

By Dunamis5000 ยท 5 replies
Jan 14, 2005
  1. I'm trying to post my hijackthis log but it kept saying that there were URL's in my crap they're part of the log. Even after I deleted the URL's it still said I had some in the message...what's up with this?
  2. RealBlackStuff

    RealBlackStuff TS Rookie Posts: 6,503

  3. Dunamis5000

    Dunamis5000 TS Rookie Topic Starter

    My hijackthis log...

    Could someone check over my log? I would greatly appreciate it. And I apologize for asking "silly" questions blackstuff i'll do more research in the future. I attached the log as a txt file to this message. Thanks for your help!
  4. RealBlackStuff

    RealBlackStuff TS Rookie Posts: 6,503

    Run HJT in safe mode, on its own, and let it "fix":

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =*
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =*
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =*
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer =
    R3 - URLSearchHook: (no name) - {D6DFF6D8-B94B-4720-B730-1C38C7065C3B} - (no file)
    O2 - BHO: C:\WINDOWS\lbbho.dll - {C7DD1DE5-AF66-4198-A7CA-220FD13DA42E} - C:\WINDOWS\lbbho.dll
    O3 - Toolbar: (no name) - {8E4C16F3-45C8-4B24-99E6-F55082B7C4F1} - (no file)
    O3 - Toolbar: (no name) - {57E69D5A-6539-4d7d-9637-775DE8A385B4} - (no file)
    O8 - Extra context menu item: Power Search - res://C:\PROGRA~1\COMMON~1\MSIETS\msielink.dll//iemenu
    O16 - DPF: Yahoo! Pool 2 -
    O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} -
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
    O16 - DPF: {7A32634B-029C-4836-A023-528983982A49} -
    O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) -
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) -
    O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) -
    O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (&Yahoo! Companion) -
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList =
    O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList =
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList =
    O18 - Protocol: relatedlinks - {CD8D1CAA-FE4A-45DF-A06C-028AAF1821DE} - (no file)

    Delete the bold files. When a directory is also bold, delete everything in it, including that directory itself.
  5. Dunamis5000

    Dunamis5000 TS Rookie Topic Starter

    one more problem...

    I really appreciate your help blackstuff, and I'm sorry to bother you again. I have Norton Internet Security and Norton Antivirus, and every couple of hours I get a notification that a virus has been detected and deleted. It keeps happening (for about a week now) and I've been searching google for help on the issue but can't find much about it besides what it is and what happens if the file is opened. Do I have reason to be concerned? Here are the 2 viruses:

    Object Name C:\WINDOWS\system 32\ftpupd.exe
    Virus Name W32.Korgo.W

    Object Name C:\WINDOWS\system 32\QuicktimeMngr.exe
    Virus Name W32.spybot.worm
  6. RealBlackStuff

    RealBlackStuff TS Rookie Posts: 6,503

    See removal-instructions here:

    Boot in Safe Mode, in Taskmanager (Ctrl/Alt/Del) try to STOP the process. Then delete the file if you can.
    Click Start/Run and type in msconfig and hit Enter.
    See if it is mentioned in a startup-section. If in the Registry, delete that entry using Regedit. If in Startup, delete it from there.

    Check if you have a file c:\windows\system32\c.bat. If so, delete it
    Then make sure you have your Windoze FULLY updated with ALL the security patches.
    Let us know how you get on.
Topic Status:
Not open for further replies.

Similar Topics

Add your comment to this article

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...