Can Anyone help me analyze my Hijack This Log?

7 thoughts on “Can Anyone help me analyze my Hijack This Log?”

1. Mark S says:

   January 26, 2010 at 3:16 am

   In addition to the forum just mentioned, you can also try here:

   http://forums.spywareinfo.com/

   and post your HiJackThis log. You will get an extremely rapid, very precise answer as to whether or not you still have any infections and, if so, exactly what to do.

   After everything is all cleaned up I recommend installing SpyBot (it’s free; just make sure to keep it updated):
   http://www.safer-networking.org/

   and SpywareTerminator (also free):
   http://www.spywareterminator.com/

   Good luck!

2. MUff!N says:

   January 26, 2010 at 3:16 am

   You have 26 BAD entries that need removing!!! And a bunch of other Fuzzy Algorithmchecks….
   Copy/Paste your logfile in the box and click analyze.
   So, here’s the site you go to (bookmark this for future use like I did!) To find out what’s bad and good in the hijackthis logfile…
   http://www.hijackthis.de/

3. sambeeesh says:

   January 26, 2010 at 3:16 am

   -Please mentioned what is exactly your problem so we can help you.
   -I suggest to you that to uninstall ( Symantec SystemWorks ) or any Symantec Norton Antivirus from your computer, and go with ( AVG Anti-Virus Free Edition 7.5.467 ) it is much better than Norton.

4. Dan L says:

   January 26, 2010 at 3:16 am

   Wow, your computer must be hella slow. You have so much updating software and on top of it all Symantec is all over the place. You probably take forever opening a program or doing anything. Anything in system32 is neccessary. Try to go to
   Start>Run>Msconfig (type that and hit ok)
   Than go to the startup tab and uncheck everything that is not in system32. Or just everything. Click ok and save changes and restart. See how much faster your computer is now…
   to unchange just do the same thing but check stuff you want to run.

5. ntlgnce says:

   January 26, 2010 at 3:16 am

   http://hjt.networktechs.com/ This provides three links to helping you determin whats what.

   http://www.prevx.com/hijackthis.asp
   Paste your log here. It will tell you whats what automaticly. (it does not get everything though.. Most of the commen things.

   http://exelib.com/hijack
   Here is another one that will auto analize what you have runnning.

   http://www.bleepingcomputer.com/tutorials/tutorial42.html#HowToUse
   A great tool for hijack this, It tells you how to use hijack this, and what the BHO, R1, R2 R3 and such stands for

6. Spyware fighter says:

   January 26, 2010 at 3:16 am

   let the experts take a look at whats happening on your computer.Visit the HijackThis Logs and Analysis forum.
   http://www.bleepingcomputer.com/forums/index.php?showforum=22

7. Anonymous girl says:

   January 26, 2010 at 3:16 am

   You certainly have a bunch of things running. The first 7 entries are necessary. The PowerDVD entry is unnecessary but harmless.

   C:\WINDOWS\MMKeybd.exe – not sure, maybe a keyboard driver?

   C:\Program Files\Common Files\Symantec Shared\ccApp.exe – Part of Norton Anti-Virus

   C:\WINDOWS\AGRSMMSG.exe – This is part of the Softmodem Assistant. It is non-essential, but probably should not be terminated unless it is causing problems.

   C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe – part of Adobe Acrobat, but not necessary.

   C:\Program Files\iTunes\iTunesHelper.exe – This was installed with Quicktime, it is not particularly necessary.

   C:\WINDOWS\system32\ctfmon.exe – part of Microsoft Office. It activates the Alternative User Input Text Input Processor (TIP) and the Microsoft Office XP Language Bar. It probably should not be terminated unless it is causing trouble.

   C:\Program Files\Microsoft ActiveSync\Wcescomm.exe – Windows synchonization manager for Windows CE handhelds. Do not terminate this advice while connected to the handheld.

   C:\PROGRA~1\MICROS~3\rapimgr.exe – Another part of ActiveSync for synchronizing with mobile devices.

   I don’t know why you have 3 copies Yahoo! Widget Engine or exactly what it is. I believe it is a toolbar, but I’m not sure.

   OSD.EXE has something to do with the display. It is not a critical component.

   Nhksrv.exe is related to owning a Dell PC. It is used to disable hotkeys while the screen saver is active. It is non-essential.

   All the Symantec and Norton stuff are okay, but you may wish to do what others suggested and get a less greedy utilities suite. New versions of NAV and NSW keep getting larger and larger and having more and more processes.

   The dllhost.exe file is necessary.

   LSSrvc.exe is for Nero LightScribe. It is not system critical, but you may lose the label writing capability.

   iPodService.exe is a part of ITunes. It is not system critical, but ITunes might not work properly.

   Msmsgs.exe is the main part of MSN Messenger. It is not system critical. This loads a tray bar as well.

   The multiple svchost.exe files are fishy. That is a necessary system file, but it can be used in conjuction with malware, so if the reason it is running cannot be found, it could be fishy:

   http://www.liutilities.com/products/wintaskspro/processlibrary/svchost/

   The R0 entries are fine.

   All the O1 entries (hosts entries) are fine. That just means that PiePatch is installed to make WinMX work.

   The 2 O9’s with missing files should be fixed.

   I may update this later….analyzing this is a lot of work.

Comments are closed.