# My Hijack This log-help?

**URL:** <https://boards.straightdope.com/t/my-hijack-this-log-help/290979>\
**Category:** Factual Questions\
**Created:** [February 20, 2005, 2:30am UTC](https://boards.straightdope.com/t/my-hijack-this-log-help/290979 "2005-02-20T02:30:20Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Guinastasia](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/guinastasia/32/5751_2.png) [@Guinastasia](https://boards.straightdope.com/u/Guinastasia)\
**Post date:** [February 20, 2005, 2:30am UTC](https://boards.straightdope.com/t/my-hijack-this-log-help/290979/1 "2005-02-20T02:30:20Z")

</div>

Would someone be willing to help me with my log from HijackThis, as mentioned [here](http://boards.straightdope.com/sdmb/showthread.php?t=303111&page=1&pp=50)?

> [@](#):
>
> Logfile of HijackThis v1.99.0  
> Scan saved at 1:56:55 PM, on 2/19/2005  
> Platform: Windows XP SP1 (WinNT 5.01.2600)  
> MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
> 
> Running processes:  
> C:\WINDOWS\System32\smss.exe  
> C:\WINDOWS\system32\winlogon.exe  
> C:\WINDOWS\system32\services.exe  
> C:\WINDOWS\system32\lsass.exe  
> C:\WINDOWS\system32\svchost.exe  
> C:\WINDOWS\System32\svchost.exe  
> c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe  
> C:\WINDOWS\Explorer.EXE  
> c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe  
> C:\WINDOWS\system32\spoolsv.exe  
> c:\Program Files\Norton AntiVirus  
> avapsvc.exe  
> c:\Program Files\Norton AntiVirus\SAVScan.exe  
> C:\Program Files\Java\j2re1.4.2\_03\bin\jusched.exe  
> C:\windows\system\hpsysdrv.exe  
> C:\WINDOWS\System32\hkcmd.exe  
> C:\WINDOWS\System32\hphmon05.exe  
> C:\HP\KBD\KBD.EXE  
> C:\Program Files\Common Files\Real\Update\_OB\realsched.exe  
> C:\Program Files\Common Files\Symantec Shared\ccApp.exe  
> C:\WINDOWS\LTMSG.exe  
> C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe  
> C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm\_tray.exe  
> C:\Program Files\Logitech\MouseWare\system\em\_exec.exe  
> C:\Program Files\QuickTime\qttask.exe  
> C:\WINDOWS\ALCXMNTR.EXE  
> C:\Program Files\0oh7ujrx\0oh7ujrx.exe  
> C:\Program Files\Microsoft AntiSpyware\gcasServ.exe  
> C:\Program Files\Messenger\msmsgs.exe  
> C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe  
> C:\WINDOWS\System32\sysmonnt.exe  
> C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe  
> C:\Program Files\Windows NT\Accessories\wordpad.exe  
> C:\Program Files\Compaq Connections\1940576\Program\BackWeb-1940576.exe  
> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe  
> C:\WINDOWS\System32\wuauclt.exe  
> C:\Program Files\Jasc Software Inc\Paint Shop Pro 7\psp.exe  
> C:\Program Files\Jasc Software Inc\Paint Shop Pro 8\Paint Shop Pro.exe  
> C:\WINDOWS\System32\svchost.exe  
> C:\Program Files\Mozilla Firefox\firefox.exe  
> C:\PROGRA~1\Netscape\Netscape\Netscp.exe  
> C:\Documents and Settings\Owner\Desktop\HijackThis.exe
> 
> R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default\_Page\_URL = [http://qus10.hpwis.com/](http://qus10.hpwis.com/)  
> R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default\_Search\_URL = [http://srch-qus10.hpwis.com/](http://srch-qus10.hpwis.com/)  
> R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = [http://srch-qus10.hpwis.com/](http://srch-qus10.hpwis.com/)  
> R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = [http://srch-qus10.hpwis.com/](http://srch-qus10.hpwis.com/)  
> R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [http://www.angelfire.com/theforce/guin](http://www.angelfire.com/theforce/guin)  
> R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default\_Page\_URL = [http://qus10.hpwis.com/](http://qus10.hpwis.com/)  
> R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default\_Search\_URL = [http://srch-qus10.hpwis.com/](http://srch-qus10.hpwis.com/)  
> R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [http://srch-qus10.hpwis.com/](http://srch-qus10.hpwis.com/)  
> R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [http://qus10.hpwis.com/](http://qus10.hpwis.com/)  
> R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = [http://qus10.hpwis.com/](http://qus10.hpwis.com/)  
> N3 - Netscape 7: user\_pref(“browser.startup.homepage”, “file:///C:/Kat/StarWars/Stories/”); (C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\ys16yc3p.slt\prefs.js)  
> N3 - Netscape 7: user\_pref(“browser.search.defaultengine”, “engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb\_01.src”); (C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\ys16yc3p.slt\prefs.js)  
> O2 - BHO: (no name) - {217DB13B-FE67-42B5-8803-B35C622790F3} - C:\Program Files\0oh7ujrx\0oh7ujrx.dll  
> O2 - BHO: (no name) - {C00C8552-26E6-47B1-BB64-254B4D673543} - C:\Program Files\0oh7ujrx\0oh7ujrx.dll  
> O4 - HKLM…\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2\_03\bin\jusched.exe  
> O4 - HKLM…\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe  
> O4 - HKLM…\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe  
> O4 - HKLM…\Run: [HPHUPD05] c:\Program Files\HP{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe  
> O4 - HKLM…\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe  
> O4 - HKLM…\Run: [KBD] C:\HP\KBD\KBD.EXE  
> O4 - HKLM…\Run: [UpdateManager] “C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe” /r  
> O4 - HKLM…\Run: [TkBellExe] “C:\Program Files\Common Files\Real\Update\_OB\realsched.exe” -osboot  
> O4 - HKLM…\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE  
> O4 - HKLM…\Run: [VTTimer] VTTimer.exe  
> O4 - HKLM…\Run: [ccApp] “c:\Program Files\Common Files\Symantec Shared\ccApp.exe”  
> O4 - HKLM…\Run: [LTMSG] LTMSG.exe 7  
> O4 - HKLM…\Run: [PS2] C:\WINDOWS\system32\ps2.exe  
> O4 - HKLM…\Run: [Reminder] “C:\Windows\Creator\Remind\_XP.exe”  
> O4 - HKLM…\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe  
> O4 - HKLM…\Run: [Logitech Utility] Logi\_MwX.Exe  
> O4 - HKLM…\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm\_tray.exe  
> O4 - HKLM…\Run: [SSC\_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe  
> O4 - HKLM…\Run: [QuickTime Task] “C:\Program Files\QuickTime\qttask.exe” -atboottime  
> O4 - HKLM…\Run: [CSV10P70] C:\Program Files\CSBB\CSv10P070.exe  
> O4 - HKLM…\Run: [AlcxMonitor] ALCXMNTR.EXE  
> O4 - HKLM…\Run: [iipqnxxf] c:\windows\system32\iipqnxxf.exe  
> O4 - HKLM…\Run: [C:\WINDOWS\eekiae.exe] C:\WINDOWS\eekiae.exe  
> O4 - HKLM…\Run: [0oh7ujrx] C:\Program Files\0oh7ujrx\0oh7ujrx.exe  
> O4 - HKLM…\Run: [gcasServ] “C:\Program Files\Microsoft AntiSpyware\gcasServ.exe”  
> O4 - HKLM…\Run: [antiware] C:\windows\system32\elitexxv32.exe  
> O4 - HKCU…\Run: [MSMSGS] “C:\Program Files\Messenger\msmsgs.exe” /background  
> O4 - HKCU…\Run: [Mozilla Quick Launch] “C:\Program Files\Netscape\Netscape\Netscp.exe” -turbo  
> O4 - HKCU…\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe  
> O4 - HKCU…\Run: [cnetcfg] C:\WINDOWS\System32\cnetcfg.exe  
> O4 - HKCU…\Run: [hlink] C:\WINDOWS\System32\hlink.exe  
> O4 - HKCU…\Run: [sysmonnt] C:\WINDOWS\System32\sysmonnt  
> O4 - Startup: Organize.lnk = ?  
> O4 - Global Startup: Compaq Connections.lnk = C:\Program Files\Compaq Connections\1940576\Program\BackWeb-1940576.exe  
> O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe  
> O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe  
> O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE  
> O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe  
> O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000  
> O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll  
> O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll  
> O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL  
> O16 - DPF: {1D0D9077-3798-49BB-9058-393499174D5D} - file://c:\counter.cab  
> O17 - HKLM\System\CCS\Services\Tcpip…{5D57D754-20AD-4258-A433-61F61AB36A3F}: NameServer = 207.69.188.187 207.69.188.186  
> O23 - Service: Symantec Event Manager - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe  
> O23 - Service: Symantec Password Validation - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe  
> O23 - Service: Symantec Settings Manager - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe  
> O23 - Service: Norton AntiVirus Auto Protect Service - Symantec Corporation - c:\Program Files\Norton AntiVirus  
> avapsvc.exe  
> O23 - Service: SAVScan - Symantec Corporation - c:\Program Files\Norton AntiVirus\SAVScan.exe  
> O23 - Service: SymWMI Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

---

<div class="post-metadata">

**Author:** ![GuanoLad](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/guanolad/32/42_2.png) [@GuanoLad](https://boards.straightdope.com/u/GuanoLad)\
**Post date:** [February 20, 2005, 2:46am UTC](https://boards.straightdope.com/t/my-hijack-this-log-help/290979/2 "2005-02-20T02:46:29Z")

</div>

Could [this](http://forum.iamnotageek.com/t-813297.html) help?

It seems like it’s the [hpwis.com](http://hpwis.com) that has overtaken your search pages that’s at fault. But maybe it’s not.

Notice these processes with the random letters:  
O4 - HKLM…\Run: [iipqnxxf] c:\windows\system32\iipqnxxf.exe  
O4 - HKLM…\Run: [C:\WINDOWS\eekiae.exe] C:\WINDOWS\eekiae.exe  
O4 - HKLM…\Run: [0oh7ujrx] C:\Program Files\0oh7ujrx\0oh7ujrx.exe

They are the spyware in action. Those are the files you should be attempting to delete.

---

<div class="post-metadata">

**Author:** ![Guinastasia](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/guinastasia/32/5751_2.png) [@Guinastasia](https://boards.straightdope.com/u/Guinastasia)\
**Post date:** [February 20, 2005, 2:56am UTC](https://boards.straightdope.com/t/my-hijack-this-log-help/290979/3 "2005-02-20T02:56:50Z")

</div>

Yep, I’ve seen the hpwis before-it used to change my homepage. Not pretty.

Thanks, I’ll give it a look.