This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

O17 Hijack - Can't Permanently Delete

1 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Folks, Thanks in advance for your assistance. Have posted the relevant log below, but so far as I can tell the issue here is simply how to get rid of the O17 hijack that's crept into my system. We have a couple of users on the computer and I've tried deleting it (using Hijack This) through both accounts. Hijack This dumps the O17 and keeps it away until the next time I log on to the net – but then it pops right back up again. Any tips on how to get rid of it? Am no IT wizard but I got this far without wrecking the Dell so I'm willing to try something a bit more dramatic if necessary. Apologies if this has been covered in an earlier post; my ISP keeps kicking me off the system so am rushing to get this in. Thanks MHG Logfile of HijackThis v1.99.1 Scan saved at 10:53:58 AM, on 6/26/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe C:\WINDOWS\Nhksrv.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\WINDOWS\System32\cisvc.exe C:\WINDOWS\System32\CTsvcCDA.EXE C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\PAStiSvc.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\DELLMMKB.EXE C:\Program Files\Creative\ShareDLL\CtNotify.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\WINDOWS\system32\devldr32.exe C:\WINDOWS\system32\ElkCtrl.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe C:\Program Files\Creative\ShareDLL\MediaDet.Exe C:\WINDOWS\system32\lvcomsx.exe C:\Program Files\Outlook Express\msimn.exe C:\Program Files\Netropa\OSD.exe C:\WINDOWS\system32\cidaemon.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Messenger\msmsgs.exe C:\Documents and Settings\MHG\Local Settings\Temp\Temporary Directory 1 for hijackthis[1].zip\HijackThis.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{D6AF9A50-9735-40C1-8302-D0A37FD44C03}: NameServer = 203.220.72.8
Welcome to the forum :wavey:

Not all "O17" items are a "Hijack".

I traced that IP address to:

WHOIS results for 203.220.72.8
Generated by www.DNSstuff.com
Location: Australia [City: Wollongong, New South Wales]

inetnum: [removed] - [removed]
netname: SPEEDLINK
descr: Speedlink ISP
descr: Kell Building, 83-85 Market Street
descr: Wollongong, 2500
country: AU
admin-c: MH187-AP
tech-c: MH187-AP
mnt-by: MAINT-AU-COMINDICO
status: ASSIGNED NON-PORTABLE
changed: ********@comindico.com.au 20010710
changed: **********@apnic.net 20040927
source: APNIC

person: Matthew Hobbs
address: 1a 83-85 Market Street
address: Wollongong
address: 2500
country: AU
phone: +61-2-4229-4111
fax-no: +61-2-4229-5900
e-mail: *******@speedlink.com.au
nic-hdl: MH187-AP
mnt-by: MAINT-AU-COMINDICO
changed: ********@comindico.com.au 20010710
source: APNIC


Any of that look familiar?
:unsure:

All that "O17" is telling your PC is to go to that server when you do "searches", to find "links" to the things you've searched for.
This topic is now closed.

If you need this topic reopened, please request this by sending an email to us at the following link

(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI