O17 Entries in my HJT log!!

[dairyman]

Before punching a big hole in my LCD monitor, I decided to take a look at my HJT log.

I noticed an O17 entry in it, and I remembered that O17 entries were related to Lop.com domain hijacks.

Since I'm still learning how to read HJT logs (bloody ages to get a reply from a trainer), I'll have to leave it to the experts.

I'm using Firefox with IE Tab and Windows XP Home Edition SP2.

Thank you in advance.

(saving space, log deleted -- dairyman)

[Broni]

O17 - those IPs belongs to OPTUSNET1, and OPTUSINTERNET-AU, respectively, both located in Australia, so, if you don't recognize them, you may fix O17

Fix also:
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - (no file)

You have also quiet a few unnecessary O4 entries, but I'm going to bed now, so I'll take care of them tomorrow.
Nothing dangerous, though.

[dairyman]

Thank you.

OptusNet is my ISP, so they shouldn't do any harm.
Will fix the BHO and Toolbar.

[Broni]

Will fix the BHO and Toolbar.

They are just "cosmetic" fixes. You won't see any difference.
Do you want me to check your startups (O4s)?

[dairyman]

No, most of the O4 entries are valid, except for IOBit SmartDefrag. I heard that it had some uninstall problems, but I'm not having any problems.

Thank you for the help.

[Broni]

I know, they are valid, but number of them are not needed as startups. The more startups you have the slower your computer is.

[dairyman]

OK, check the O4s.

[Broni]

OK.

[Broni]

Open HJT, and checkmark following items:
- O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
- O4 - HKLM\..\Run: [SmartDefrag] "C:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe" /StartUp
(you don't defrag every day, do you?)
- O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
- O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
- O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
If you don't use more then one language in MS Office, disable CTFMON.EXE from starting: http://support.microsoft.com/default.aspx?scid=kb;en-us;282599, and fix also these:
- O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
- O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
- O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
- O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')

Remember, by fixing the above entries, you don't remove/uninstall any programs.

[dairyman]

Thank you so much.

I don't defrag daily, but when I had IOBit SmartDefrag installed (uninstalled already) it always defragmented at startup.

[Broni]

Then, you don't need that entry anyway.