my hijackthis log in increments


I am trying to find out which part of my log is infected, so i am posting my log in increments



Logfile of HijackThis v1.97.7  

Scan saved at 1:34:32 PM, on 4/22/2004  

Platform: Windows XP SP1 (WinNT 5.01.2600)  

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)  

Running processes:  

C:\WINDOWS\System32\smss.exe  

C:\WINDOWS\system32\winlogon.exe  

C:\WINDOWS\system32\services.exe  

C:\WINDOWS\system32\lsass.exe  

C:\WINDOWS\system32\svchost.exe  

C:\WINDOWS\System32\svchost.exe  

C:\WINDOWS\system32\spoolsv.exe  

C:\Program Files\Softex\OmniPass\Omniserv.exe  

C:\Program Files\Softex\OmniPass\OPXPApp.exe  

C:\windows\system\hpsysdrv.exe  

C:\HP\KBD\KBD.EXE  

C:\Program Files\Common Files\Real\Update\_OB\realsched.exe  

C:\Program Files\interMute\SpamSubtract\SpamSubtract.exe  

C:\WINDOWS\wt\updater\wcmdmgr.exe  

C:\WINDOWS\System32\wuauclt.exe  

C:\WINDOWS\explorer.exe  

C:\Program Files\Internet Explorer\iexplore.exe  

C:\Documents and Settings\Owner.BOLIVER\Local Settings\Temp\Temporary Directory 1 for hijackthis[1].zip\HijackThis.exe  

C:\Program Files\WindowsUpdate\wuaudnld.tmp\cabs\com\_microsoft.811630\_XP\_SP1\_5915\Q811630\_WXP\_SP2\_EN.exe  

c:\c868ac0b70f3f4b8b0\xpsp1hfm.exe  

c:\c868ac0b70f3f4b8b0\sp2\update\update.exe
You have some minor problems to remove. This first batch is useless paid-search listings to make money for **HP**:



R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = [http://srch-qus9.hpwis.com/](/posts/bad_link/25407?url=http%3A%2F%2Fsrch-qus9.hpwis.com%2F)  

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = [http://srch-qus9.hpwis.com/](/posts/bad_link/25407?url=http%3A%2F%2Fsrch-qus9.hpwis.com%2F)  

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default\_Page\_URL = [http://qus9.hpwis.com/](/posts/bad_link/25407?url=http%3A%2F%2Fqus9.hpwis.com%2F)  

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default\_Search\_URL = [http://srch-qus9.hpwis.com/](/posts/bad_link/25407?url=http%3A%2F%2Fsrch-qus9.hpwis.com%2F)  

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [http://qus9.hpwis.com/](/posts/bad_link/25407?url=http%3A%2F%2Fqus9.hpwis.com%2F)  

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = [http://srch-qus9.hpwis.com/](/posts/bad_link/25407?url=http%3A%2F%2Fsrch-qus9.hpwis.com%2F)  

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [http://srch-qus9.hpwis.com/](/posts/bad_link/25407?url=http%3A%2F%2Fsrch-qus9.hpwis.com%2F)  

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default\_Page\_URL = [http://qus9.hpwis.com/](/posts/bad_link/25407?url=http%3A%2F%2Fqus9.hpwis.com%2F)  

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default\_Search\_URL = [http://srch-qus9.hpwis.com/](/posts/bad_link/25407?url=http%3A%2F%2Fsrch-qus9.hpwis.com%2F)



This is a problem BHO:



O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)



That's all I see for now. Are you running **DSL**?
this issue is now confirmed fixed by a large percentage of our user base. if you're still having issues, please make sure you on the latest version of malwarebytes (at the time of this article, it's malwarebytes 3.5.1.2522 with component package version 1.0.441).
 


 


 if you continue to have issues after that, please make a new post using the following as a guideline then yes, this is version 1.3.0. 
could you download the latest version 1.4.0 (use the same download link)? it has some installer fixes. 
in case you still cannot install it, please send us the logs from c:\users\username\appdata\local\temp. Hello, 
  

  
Try this 1 
  

  
Click on the below hyperlink "Download" and download the file 
  

  
**Download**
  

  
First backup your registry by following the below instruction 
  

  
Click on Start --> In search box, type regedt32 and press Enter. 
  

  
"Registry Editor" will be opened. Click on File --> Export 
  

  
Now extract the downloaded file --> Double click on that file --> Click on "Yes" 
  

  
Now restart your PC 
  

  
Good Luck the problem has been solved.

i got in contact with our provider and they were able to apply the proper access to the folder for verification.

thank you for all of your help and patience. this thread can now be closed. Otherway, if there is an Active session exist on the firewall, you may grab the session ID and see detailed info as mentioned below:

> show session all filter source x.x.x.x destination y.y.y.y

**9936**         dns            ACTIVE  FLOW  NS   100.100.100.1[53621]/trust-L3/17  (1.1.1.2[43506])

vsys1                                          8.8.8.4[53]/untrust-L3  (8.8.8.4[53])

admin@31-PA-3020> show session id 9936

Session            9936

        c2s flow:

                source:      100.100.100.1 [trust-L3]

                dst:         8.8.8.4

                proto:       17

                sport:       53621           dport:      53

                state:       ACTIVE          type:       FLOW

                src user:    plano2003\csharma  >>>>>>>>>>>>>>> Source User

                dst user:    unknown

        s2c flow:

                source:      8.8.8.4 [untrust-L3]

                dst:         1.1.1.2

                proto:       17

                sport:       53              dport:      43506

                state:       ACTIVE          type:       FLOW

                src user:    unknown

                dst user:    plano2003\csharma

        start time                    : Thu Jul 24 12:33:04 2014

        timeout                       : 30 sec

        time to live                  : 12 sec

        total byte count(c2s)         : 240

        total byte count(s2c)         : 0

        layer7 packet count(c2s)      : 3

        layer7 packet count(s2c)      : 0

        vsys                          : vsys1

        application                   : dns

        rule                          : trust-to-untrust  >>>>>>> Security rule

        session to be logged at end   : True

        session in session ager       : True

        session synced from HA peer   : False

        address/port translation      : source + destination

        nat-rule                      : nat-inside-2-outside(vsys1) >>>>>>>>>>>>>> NAT policy name

        layer7 processing             : enabled

        URL filtering enabled         : True

        URL category                  : any

        session via syn-cookies       : False

        session terminated on host    : False

        session traverses tunnel      : True

        captive portal session        : False

        ingress interface             : tunnel.1  >>>>>>>>>>>>>> Incoming interface

        egress interface              : ethernet1/3  >>>>>>>>>>>>>>>> Outgoing interface

        session QoS rule              : N/A (class 4)

Thanks




[View solution in original post](/t5/general-topics/logs/m-p/33969#M24908) see the attached file: [extractnumberregex.xaml](/uploads/short-url/qbznpruo2eviur9srhj8qzzs7yn.xaml) (5.1 kb)

[image]

[image] Dear Jay Nelish


Your Question is incomplete


is the specific system is not on Network? its might be a problem discovered last year, that system ping but not share any data, or cannot access the system


you click on start menu and then click on run  

type serivces.msc  

and run the computer browser service, Remote Procedure call service, Server, and Client service


and your problem will resolved  

but actually this is because of virus change your antivirus program and scan your system wtih updated A/V sometimes one or both of these patches help, especially if the system is showing high ram and/or cpu usage when checking updates:
https://support.microsoft.com/en-us/kb/3050265




https://support.microsoft.com/en-us/kb/3102810﻿﻿
﻿ thanks, this will be fixed for 0.7.6. It seems that updating Windows 7 has become a task that tests our patience and is accompanied by many unforeseen events.
**If you have installed Windows 7 and you are not able to update it because Windows Update is constantly looking for updates, here you will find the solution.**




![image](https://technowikis.com/sites/technowikis.com/uploads/084/8408675506832124429.jpg)




The problem of the search for updates is accompanied by a high consumption of RAM and CPU that does not allow even a good use of the PC while looking for updates. The problem is with Windows Update and how Microsoft has implemented the updates.




Windows 7 does not update, it keeps looking for updates forever and finds nothing.




**The first thing you need to know is if you are installing Windows 7 32bit or 64bit.**
Once we have this information, we can begin the process.



 
Disable Windows Update to make the update process faster.



First
[we open a terminal with administrator permissions](https://translate.googleusercontent.com/translate_c?act=url&depth=2&hl=en&ie=UTF8&prev=_t&rurl=translate.google.com&sl=es&sp=nmt4&tl=en&u=https://www.vozidea.com/abrir-consola-comandos-terminal-windows&xid=17259,15700023,15700186,15700190,15700256,15700259,15700262,15700265&usg=ALkJrhhqpP0r1As5JhHykWgqvcIjB7PXng)
to
**stop the Windows Update service**
with the command:
  

`net stop wuauserv`




![image](https://technowikis.com/sites/technowikis.com/uploads/133/13323206954024179447.jpg)



 
Manually install update KB3020369.



**Installing this update is an essential requirement to solve this problem.**
It is the first step and if we do not install this update first, we will not be able to follow all the steps in this tutorial.




We know that the error is generated by a Windows Update client error, which hangs when scanning new updates. Microsoft released a patch that solves the problem, but in order to install it, it requires that we download and install the KB3020369
*"April 2015 servicing stack update" update first*
:



* KB3020369 for Windows 7
**32bit**
:
<https://www.microsoft.com/es-ES/download/details.aspx?id=46827>
* KB3020369 for Windows 7
**64bit**
:
<https://www.microsoft.com/es-ES/download/details.aspx?id=46817>



Two options to finish solving the Windows Update error in Windows 7.




At this point we have two options:



* **Download and manually install updates KB3172605 and KB3138612.**
Once installed, Windows Update should work correctly and we could update Windows 7 without problems.
* **Download and install the KB3125574 package released by Microsoft with all security updates until April 2016 and that allows you to update a Windows 7 installation faster.**
This package occupies more than 316MB in 32bit systems and 476.9MB in 64bit systems.



Both options work correctly, but it is true that
**downloading and installing the cumulative update KB3125574 is a more convenient and faster process, so it is the option I recommend for most users**
. Even so, I will explain both options.



 
Recommended option, download and install the KB3125574 package released by Microsoft with all security updates until April 2016.



![image](https://technowikis.com/sites/technowikis.com/uploads/171/17135527325084971355.jpg)




This update package can be found through the
[Microsoft Update Catalog](https://translate.googleusercontent.com/translate_c?act=url&depth=2&hl=en&ie=UTF8&prev=_t&rurl=translate.google.com&sl=es&sp=nmt4&tl=en&u=http://www.catalog.update.microsoft.com/Search.aspx%3Fq%3D3125574&xid=17259,15700023,15700186,15700190,15700256,15700259,15700262,15700265&usg=ALkJrhgYZAtq0r4K4ryYk_7h4_sjeQs_-A)
or you can download it directly from the following links:



* Update package for Windows 7
**32bit**
:
[windows6.1-kb3125574-v4-x86\_ba1ff5537312561795cc04db0b02fbb0a74b2cbd.msu](http://download.windowsupdate.com/d/msdownload/update/software/updt/2016/05/windows6.1-kb3125574-v4-x86_ba1ff5537312561795cc04db0b02fbb0a74b2cbd.msu)
* Update package for Windows 7
**64bit**
:
[windows6.1-kb3125574-v4-x64\_2dafb1d203c8964239af3048b5dd4b1264cd93b9.msu](http://download.windowsupdate.com/d/msdownload/update/software/updt/2016/05/windows6.1-kb3125574-v4-x64_2dafb1d203c8964239af3048b5dd4b1264cd93b9.msu)



Once the system is installed and restarted, we can now run Windows Update normally that will detect the remaining updates without problems.



 
Alternative option, manually download and install updates KB3172605 and KB3138612.



Next
**we download and install the KB3172605 patch**
:



* Download for Windows 7
**32bit**
:
<https://www.microsoft.com/es-ES/download/details.aspx?id=53335>
* Download for Windows 7
**64bit**
:
<https://www.microsoft.com/es-ES/download/details.aspx?id=53332>



Finally,
**we download and install the update for the Windows Update client of March 2016 (KB3138612)**
:



* For Windows 7
**32bit**
:
<https://www.microsoft.com/en-us/download/details.aspx?id=51208>
* For Windows 7
**64bit**
:
<https://www.microsoft.com/en-us/download/details.aspx?id=51212>



**Now we restart Windows 7 and rerun Windows Update to search for all available updates.**
In my case it has been a little more than 20 minutes looking for updates until it finally allowed me to install all the updates.