PCTech Forums

Logfile of HijackThis v1.99.1
Scan saved at 7:10:39 PM, on 1/4/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Documents and Settings\Fred\Desktop\HJT\HijackThis.exe

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\ntop32.exe (file missing)

In safe mode I went to the above deleted every thing I could find ran hjt and deleted the sucker on reboot and it still came back.
What is jusched.exe

Heres a new log!
Why does my start page show up as a hijack now?
Is it safe to ignore

Logfile of HijackThis v1.99.1
Scan saved at 8:09:24 PM, on 1/4/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Fred\Desktop\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://forums.thedieselstop.com/ubbthre ... s.php?Cat=
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

Turn off system restore by right clicking on My Computer and go to Properties->System Restore and check the box for Turn off System Restore. Click Apply and then OK. (Turn it back on after this is repaired and you've rebooted.)
Close all other open Windows and have HiJackThis Fix:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://forums.thedieselstop.com/ubbthre ... s.php?Cat=
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

Now that your system is clean, this is a good time to set up protection against further attacks.

1) Watch what you download!
Read all security warnings, license agreements, and privacy statements associated with any software you download.
Only download programs from Web sites you trust. If you're not sure whether to trust a program you are considering downloading,
enter the name of the program into your favorite search engine to see if anyone else has reported that it contains spyware.
Never click "agree" or "OK" to close a window. Instead, click the red "x" in the corner of the window
or press the Alt + F4 buttons on your keyboard to close a window.

2) Keep Windows up to date!
Go to IE > Tools > Windows Update > Product Updates, and install ALL Security
Updates listed. If you're running Windows XP, that of course includes the Service Pack 2!
Don't forget to check for updates every week or so.
Or you can set Windows to Automatically update itself:
Go to, Start > Control panel > System > Automatic Update tab > check Automatic.


3) Internet Explorer security settings!
Go to Internet Options/Security/Internet, press 'default level', then OK.
Now press "Custom Level."
In the ActiveX section, set the first two options ("Download signed and unsigned
ActiveX controls) to 'prompt', and 'Initialize and Script ActiveX controls not marked as safe" to 'disable'.

4.) Anti-Virus program!
Make sure you have an Anti-Virus program installed, updated and running.
There are a number of free ones available like or

5.) Use a Firewall!
If you do not have a hardware firewall like a router, then you need to use a software firewall like or Windows XP’s built in one.

6.) Real time protection!
Real time protection for spyware refers to the same protection a virus scan gives you for viruses.
It is constantly monitoring files coming into and leaving from your computer for potential dangers.
Here are two free programs that offer this type of protection:

Here is a list of common Processes and their meanings

http://www.neuber.com/taskmanager/process/

The one you asked about, Jusched.exe is for the Sun Java. It's their automatic updater and nothing to worry about.

As you can see the about browser hijack is still in there after deleting it with restore turned off What can i remove that with?It keeps switching my start page.
Logfile of HijackThis v1.99.1
Scan saved at 7:59:04 PM, on 1/5/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Fred\Desktop\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://forums.thedieselstop.com/ubbthre ... s.php?Cat=
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204