Jenney
I ran spybot today and it showed I had another hijacker. I got rid of it, but they keep coming back – UGH – I don't really know what to do.
Spyware / Malware / Virus Removal
Help With Hijackers
13 min read
Budfred
I may be wrong, but I believe you need more than just the patch to protect against Blaster… You will probably need the full updates….
I am not seeing anything else that would be installing the garbage after you have fixed it, so I am not sure what else to do here….. I will ask others to come help out and see if anyone else has any ideas…..
Edit:
I was just reading another thread and had a thought. Do you have System Restore turned on??? If you do, try clearing it, do the HijackThis fixes and reboot. Run Spybot again and reboot. Check HijackThis and see if that dubious file is gone. These things can hide in System Restore and reinstall themselves…
Jenney
That's a great idea. I have forgotten to disable it. i'll do it and see what happens.
Jenney
Here's my new log. I think everything's the same, though.
Logfile of HijackThis v1.97.7
Scan saved at 8:57:53 PM, on 12/16/2003
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Nhksrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb06.exe
C:\WINDOWS\System32\InetCntrl\InetCntrl.exe
C:\Program Files\AIM95\aim.exe
C:\WINDOWS\system32\ntvdm.exe
C:\WINDOWS\system32\winlogon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\MOMDAD\Local Settings\Temp\Temporary Directory 8 for hijackthis.zip\HijackThis.exe
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb06.exe
O4 - HKLM\..\Run: [InetCntrl] C:\WINDOWS\System32\InetCntrl\InetCntrl.exe
O4 - HKLM\..\Run: [fhwxjyk] "C:\WINDOWS\System32\fhwxjyk.exe"
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM95\aim.exe -cnetwait.odl
O4 - Startup: M-W Link to Collegiate® Dictionary.lnk = C:\Program Files\MWED\MWLINK.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O10 - Broken Internet access because of LSP provider 'inetcntrl.dll' missing
O17 - HKLM\System\CCS\Services\Tcpip\..\{870AACFD-75D2-455E-A93A-BB5161C129C7}: NameServer
Budfred
Did you use HJT to fix this after you turned off System Restore??
O4 - HKLM\..\Run: [fhwxjyk] "C:\WINDOWS\System32\fhwxjyk.exe"
If not, do so, reboot, run HJT again and see if is still there.
If you already did, hang on and hopefully more help will be here, I posted a request for more help elsewhere…
Budfred
A suggestion in the thread where I asked for help suggested that this:
C:\WINDOWS\Nhksrv.exe
may not be a legit file. HJT can't fix this since it is not directly listed as a process. However, you could find and delete it in your file manager after first fixing that
O4 - HKLM\..\Run: [fhwxjyk] "C:\WINDOWS\System32\fhwxjyk.exe" in HJT.
If it is a legit file, you may have to reinstall software for your keyboard since this is supposed to be a file for a multimedia keyboard. Do you actually have a multimedia keyboard???
Guest
I don't have a multimedia keyboard, but I'm kind of afraid to delete anything. There were two Nhksrv.exe files that were created today, the other Nhksrv files (3, not exe) were created when I bought the computer. I'm really getting confused.
When I ran Hijack this today and fixed that fhwxjyk file, I rebooted and tried to delete the file and it said I couldn't because it was being used by something else.
Can I just live with these problems and dl the updates for windows? My browser page hijacker is gone. The other one just pops up every now and then.
Jenney
The above post is from me.
Jenney
Budfred
You can probably run with hijackers and other spyware installed, but you are taking a risk since they can take over your computer and steal personal information, like credit cards….
You certainly can download and install the updates and I would encourage you to do so. That could end up solving the problem.
The fact that you couldn't delete the fhwxjyk file since it was being used is an indication that it is actively messing with something in your system. Try booting to Safe Mode and removing it from there.
From what I can tell, if that Nhksrv is legit, it is a hotkey utility that apparently is not particularly useful and has a tendency to take over your CPU. It is your system, so it is your choice. I would probably at least try to disable it if I weren't using hotkeys…
And OOPS, I just noticed that I said the fhwxjyk file was for the keyboard, but I meant the Nhksrv file…. Sorry…
Jenney
I just realized yesterday that Hijack this wasn't getting rid of that fhwxjyk file. I thought it was and that it was coming back, but…after I supposedly fixed it, I scanned again and it was still there.
Jenney
Also, Budfred, thanks for all your help.
Budfred
Try to find the actual file and check the properties on it. You could try simply deleting it if you don't mind risking that it is actually not a piece or crud or you could change .exe to .old and see if it reappears in the log… Post back whatever you find out in the properties…
Jenney
under properties, the - fhwxjyk reads type of file: application, location is C:\\windows\syst32 (but we already knew that)
for the fhwxjyk exe. file, it says it's a pf file, whatever that is, and its location is c:\windows\prefetch
I tried to delete them, but I can't. Remember it said something else is using it.
Budfred
Did you try it in Safe Mode??? Generally in Safe Mode most automatically run programs are not installed so they can be deleted. If that doesn't work, we will have to go to DOS to get rid of it and that will be really hard if your drive is formatted in NTFS. I am pretty sure that this is at least one of the nasty programs, so try the Safe Mode approach and see if it works. After you find and delete it, reboot and run HJT again to see if it is gone…
Jenney
it won't delete… even in safe mode.
Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI