Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

HIJACKTHIS


  • Please log in to reply

#1
VirusGirl123

VirusGirl123

    Member

  • Member
  • PipPipPip
  • 150 posts
I recently installes HIJACKTHIS on my computer and i deleted everything it came up with <_< .. i now realize u werent supposed to fo that.. now i have all of these icons on my desktop called backup icons... what do i do?
  • 0

Advertisements


#2
Metallica

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 31,676 posts
Run HijackThis again. Click Config > Backups
Select everything and click Restore.

Then use HijackThis to scan and save the log.
Post the log here.

Regards,

Pieter
  • 0

#3
VirusGirl123

VirusGirl123

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 150 posts
Thank you soo much! but what about all these icons on ym desktop.. can i delete them(after i restore them all)?
  • 0

#4
Metallica

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 31,676 posts
Please wait with deleting until we are done. Once they are gone there will be no options left.

Regards,

Pieter
  • 0

#5
VirusGirl123

VirusGirl123

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 150 posts
Thank you! lol.. i have restored them all..what is next?
  • 0

#6
Metallica

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 31,676 posts
Skip the part you already did:
http://home.planet.n...xplanation.html

Or follow the instructions here:
http://www.geekstogo...hp?showtopic=61

Post the log when you are done, so we can have a look and decide what really needed to go, if any.

Regards,

Pieter

Edited by Metallica, 27 November 2004 - 03:41 PM.

  • 0

#7
VirusGirl123

VirusGirl123

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 150 posts
how do i post my logs? <_<
  • 0

#8
VirusGirl123

VirusGirl123

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 150 posts
and am i suppossed to do to follow these steps to "You Must Read This Before Posting A Hijackthis Log, Required steps before posting your log".?
  • 0

#9
admin

admin

    Founder Geek

  • Administrator
  • 24,504 posts
Save HijackThis in its own folder (i.e. C:\HJT). DO NOT run it from within a zip manager (Winzip), as no backups will be saved.

Posted Image
This is how HijackThis looks when it first opened.

You do not have to change any settings at this point.
Notice the empty section in the middle. This is where the scan results will be listed later.
Examine the two sets of buttons. To start the scan, Click the Scan button on the left.

Posted Image
HijackThis after the scan.

The Scan Button has a new Caption. Save Log. Click the Save Log button to create a file named Hijackthis.log. A dialog box will pop up. Use it to select the location where you will save the log. Close the program.

Return to the Forum and reply to your original post. Open the Log in Notepad. Highlight the entire contents. Copy and paste the contents of the HijackThis log into your post. Wait for help.

Additional Copy and Paste Instructions
Having problems with cut and paste? Open the text file. Go to the Toolbar of your text editor, Notepad for example and click Edit. Move the mouse down to Select All and click on Select All to highlight the text. Go back to Edit again and move the mouse down to Copy. Click Copy. Go to the Forum and reply to your original post. When the page opens, click on an empty space in the reply window with your mouse to set focus for the paste operation. Finally, hold down the Ctrl button and click the letter v on the keyboard to paste the text into your post.
  • 0

#10
VirusGirl123

VirusGirl123

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 150 posts
Logfile of HijackThis v1.97.7
Scan saved at 4:45:31 PM, on 11/27/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\System32\msrpc32.exe
C:\WINDOWS\System32\msrpc32.exe
C:\Program Files\AIM95\aim.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us6.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://hsremove.com/done.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://us6.hpwis.com/
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {ED103D9F-3070-4580-AB1E-E5C179C1AE41} - C:\WINDOWS\ELITES~1\ELITES~1.DLL
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [MS Remote Procedure Call] msrpc32.exe
O4 - HKLM\..\Run: [Windows AdControl] C:\Program Files\Windows AdControl\WinAdCtl.exe
O4 - HKLM\..\Run: [SoloSchedule] C:\PROGRA~1\SRNMIC~1\SOLOCFG.EXE
O4 - HKLM\..\Run: [Cryptographic Service] C:\WINDOWS\System32\pjsse.exe
O4 - HKLM\..\Run: [Windows Update] C:\WINDOWS\System32\rfpeja.exe
O4 - HKLM\..\Run: [Microsoft Windows System Update] rpcxupdtsys.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [Sygate Personal Firewall Start] servic.exe
O4 - HKLM\..\Run: [Windows AdTools] C:\Program Files\Windows AdTools\WinAdTools.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Microsoft Manager] winspoolsv32.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [DDCM] "C:\Program Files\WildTangent\DDC\DDCManager\DDCMan.exe" -Background
O4 - HKLM\..\Run: [checktime] c:\program files\HPSelect\Frontend\ct.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\RunServices: [MS Remote Procedure Call] msrpc32.exe
O4 - HKLM\..\RunServices: [Sygate Personal Firewall Start] servic.exe
O4 - HKLM\..\RunServices: [MSN Updater] msnms.exe
O4 - HKCU\..\Run: [MS Remote Procedure Call] msrpc32.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM95\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Microsoft Windows System Update] rpcxupdtsys.exe
O4 - HKCU\..\Run: [Microsoft Works Update Detection] \WkDetect.exe
O4 - HKCU\..\Run: [Notn] C:\Documents and Settings\Owner.YOUR-US67PI6LUV\Application Data\eber.exe
O4 - HKCU\..\Run: [Uau] C:\WINDOWS\System32\?xplorer.exe
O4 - Global Startup: Event Reminder.lnk = ?
O4 - Global Startup: hp center UI.lnk = C:\Program Files\hp center\137903\Shadow\ShadowBar.exe
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O9 - Extra button: AIM (HKLM)
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{05DE8BA8-3F60-47DE-9BE4-A3BB9B500C7B}: NameServer = 205.152.144.23 205.152.37.23
O17 - HKLM\System\CS1\Services\Tcpip\..\{05DE8BA8-3F60-47DE-9BE4-A3BB9B500C7B}: NameServer = 205.152.144.23 205.152.37.23
  • 0

Advertisements


#11
admin

admin

    Founder Geek

  • Administrator
  • 24,504 posts
We can definitely help you, but first you need to help us. The first step in this process is to apply Service Pack 1a for Windows XP. Without this update, you're wide open to re-infection, and we're both just wasting our time.
Click here: http://www.microsoft...p1/default.mspx
Apply the update, reboot, and post a fresh Hijack This log.
  • 0

#12
VirusGirl123

VirusGirl123

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 150 posts
Ok cool! will u be helping me once i install the service pack or will it b someone else?
  • 0

#13
VirusGirl123

VirusGirl123

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 150 posts
And lastly, im on the site right now.. what do i click to download it..
  • 0

#14
VirusGirl123

VirusGirl123

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 150 posts
every time im on that windowsupdate site it says its scanning for my windows version and never does anything... <_<
  • 0

#15
admin

admin

    Founder Geek

  • Administrator
  • 24,504 posts
Do you have a legitimate copy of Windows?
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP