[proyal03]

hi there.. i was having problems with my pc and followed all advice from this site... posting my hijack this log to see if i am safe..

[evilfantasy]

Did you do the other steps in the guide?


Open HijackThis and select Do a system scan only.

Place a check mark next to the following entries:

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

Close all windows except for HijackThis and click Fix checked.

Exit Hijackthis.


Nothing as far as malware, are there any problems still?

[proyal03]

so does that mean its healthy now.. as everything seems to have speeded up immensely. and is it worthwhile keeping an eye on hijack this.

[evilfantasy]

I think everything is fine from what I can see.


This is a good time to clear your infected system restore points and establish a new clean restore point:

• Go to Start > All Programs > Accessories > System Tools > System Restore
• Select Create a restore point, and click Next.
• Next, go to Start > Run and type in cleanmgr
• Select the More options tab
• Next to System Restore click Clean up...

This will remove all restore points except the new one you just created.

Check out Keeping Yourself safe On The Web for tips and free tools to keep you safe in the future.

Also see Slow Computer? It May Not Be Malware for free cleaning/maintenance tools to help keep your computer running smooth.

Let us know if anything else comes up.

[proyal03]

you read my mind that was my next question...

[proyal03]

thanks..

[evilfantasy]

No problem.

Safe surfing.........

[proyal03]

hi there.. was doing a bit of research.. and the BHO you told me to delete of my hijack log is a legitimate one according to castlecorps..according to their register its to do with windows live.. just a query...

[evilfantasy]

Hi, you are right that it is a legit program that is associated with Windows Live Messenger so let me explain why I had you remove it. Notice the blue highlighted descriptions.

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
No name & no file means that it is deactivated. It may have been cleaned by an antispyware scan or your antivirus. Possibly it is left behind from an update to the messenger. Not sure on that, but since it is deactivated and has no file it is like an open door. If you were to go to a page that exploits BHOs then the door is wide open on this entry for the malware to exploit.

If messenger needs it to function it would simply be replaced the next time you started messenger. BHOs add functionality but are not critical components and are easily replaced if missing.

Hope this helps.

[proyal03]

nice .. i am still learning..