This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Another Hijackthis Log

9 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

OK, I reran the regsrch program and noticed a few strange things. When I ran the first string, it came back saying it didn't find anything. The same thing happened on the 4th string. For the 2nd and 3rd strings, it found two occurrances. I reran the 1st and 4th strings and the 4th came back with two occurrances, while the 1st still didn't find anything. I ran the 4th one again (for the 3rd time) and it too came back with two occurrances. The logs are attached below. Something similar happened when I did this a few days ago. I assumed it was because I copied and pasted an extra blank at the end of the string or something like that, but I thought I'd mention it. If this is more of a pain than it's worth, I can live with these fragments - assuming they don't cause any problems. The computer seems to be running much better and the original problems seem to be fixed. RegSrch logs: REGEDIT4 ; RegSrch.vbs © Bill James ; Registry search results for string "9642AAEE-ADF9-B6AF-287A-6D3802ACCC2A" 1/2/2005 1:12:26 PM ; NOTE: This file will be deleted when you close WordPad. ; You must manually save this file to a new location if you want to refer to it again later. ; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.) [HKEY_USERS\S-1-5-21-1709136994-1037202297-1567011825-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9642AAEE-ADF9-B6AF-287A-6D3802ACCC2A}] [HKEY_USERS\S-1-5-21-1709136994-1037202297-1567011825-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9642AAEE-ADF9-B6AF-287A-6D3802ACCC2A}\iexplore] REGEDIT4 ; RegSrch.vbs © Bill James ; Registry search results for string "B5FB2470-E99F-25B2-39AA-D8E94323B645" 1/2/2005 1:13:31 PM ; NOTE: This file will be deleted when you close WordPad. ; You must manually save this file to a new location if you want to refer to it again later. ; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.) [HKEY_USERS\S-1-5-21-1709136994-1037202297-1567011825-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B5FB2470-E99F-25B2-39AA-D8E94323B645}] [HKEY_USERS\S-1-5-21-1709136994-1037202297-1567011825-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B5FB2470-E99F-25B2-39AA-D8E94323B645}\iexplore] REGEDIT4 ; RegSrch.vbs © Bill James ; Registry search results for string "E8450C1F-806D-9812-8DFD-5A8D7D2A16F9" 1/2/2005 1:16:40 PM ; NOTE: This file will be deleted when you close WordPad. ; You must manually save this file to a new location if you want to refer to it again later. ; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.) [HKEY_USERS\S-1-5-21-1709136994-1037202297-1567011825-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E8450C1F-806D-9812-8DFD-5A8D7D2A16F9}] [HKEY_USERS\S-1-5-21-1709136994-1037202297-1567011825-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E8450C1F-806D-9812-8DFD-5A8D7D2A16F9}\iexplore] REGEDIT4 ; RegSrch.vbs © Bill James ; Registry search results for string "1E8B267B-E051-7189-3573-4FAE56717A61" 1/2/2005 1:17:46 PM ; NOTE: This file will be deleted when you close WordPad. ; You must manually save this file to a new location if you want to refer to it again later. ; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.) [HKEY_USERS\S-1-5-21-1709136994-1037202297-1567011825-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1E8B267B-E051-7189-3573-4FAE56717A61}] [HKEY_USERS\S-1-5-21-1709136994-1037202297-1567011825-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1E8B267B-E051-7189-3573-4FAE56717A61}\iexplore]
Odd. If you are comfortable using regedit you can just navigate to each of those keys and delete them. Otherwise just ignore them - they aren't harmful.

To help keep you clean follow the recommendations in Tony's article here:

So how did I get infected in the first place?



As this problem has been resolved the topic will be closed. If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)

The subject of the email must be "Reopen". Include your post username and details about why you need it reopened, with a valid link to your post.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI