Thread: HJT Log Help...
View Single Post
Old 04-13-2006, 12:07 PM   #5 (permalink)
Vikesrock8411
Analyst, Security Team
 
Vikesrock8411's Avatar
 
Join Date: Jun 2005
Posts: 3,065
OS: Windows XP


Alright, we will try to simply remove the offending entries. Do not be alarmed if they come back, they may be related to a specific infection, but it is impossible to tell from your HJT log. If they come back we wil know that the infection is present and we can remove it.

HijackThis!
Open Hijack This and click on Scan. Check the following entries (make sure you do not miss any)
O17 - HKLM\System\CCS\Services\Tcpip\..\{3132AD10-F2E2-4451-8E79-E4CB8D43B802}: NameServer = 85.255.115.92,85.255.112.10
O17 - HKLM\System\CCS\Services\Tcpip\..\{39974B80-532A-45CA-986F-1B1D3ABE1EAB}: NameServer = 85.255.115.92,85.255.112.10
O17 - HKLM\System\CCS\Services\Tcpip\..\{9DE1A8C9-5831-4F99-A44A-C94C62530FBF}: NameServer = 85.255.115.92,85.255.112.10
O17 - HKLM\System\CCS\Services\Tcpip\..\{DD51599B-6D2D-4DBD-8FD1-6073829D359B}: NameServer = 85.255.115.92,85.255.112.10
O17 - HKLM\System\CS1\Services\Tcpip\..\{3132AD10-F2E2-4451-8E79-E4CB8D43B802}: NameServer = 85.255.115.92,85.255.112.10
O17 - HKLM\System\CS2\Services\Tcpip\..\{3132AD10-F2E2-4451-8E79-E4CB8D43B802}: NameServer = 85.255.115.92,85.255.112.10


Please remember to close all other windows, including browsers then click Fix checked.

Reboot your computer, then post a new Hijackthis log here.
Vikesrock8411 is offline