Member Panel

Whats with those 017 entries anyway? Are they not just for my ISP?

017 entries- If the domain is not from your ISP or company network then it it is normally a browser hijacker.

Well I don't know if it's from my ISP or not. Just wondering as I was asked to remove them.

Those 017 are Russian host servers.Run Wareout again and then remove these from the log..

O17 - HKLM\System\CCS\Services\Tcpip\..\{2957BB99-4352-4499-AFCE-3C59908DA77A}: NameServer = 85.255.114.54 85.255.112.26
O17 - HKLM\System\CS1\Services\Tcpip\..\{2957BB99-4352-4499-AFCE-3C59908DA77A}: NameServer = 85.255.114.54 85.255.112.26

Ok I did that again. But like I said, those entries are not there when Im offline so I have to connect to remove them and they just keep coming back everytime I go online again.

Can you post a new HJT log...I dont understand why they come and go like that...will you also try this and then see if you can remove them from the log...

1. Click Start, right-click My Computer, and then click Properties.
2. Click the System Restore tab.
3. Select the Turn off System Restore check box (or the Turn off System Restore on all drives check box), and then click OK.
4. Click Yes when you receive the prompt to the turn off System Restore.
Turn on System Restore
To turn on System Restore, follow these steps: 1. Click Start, right-click My Computer, and then click Properties.
2. Click the System Restore tab.
3. Clear the Turn off System Restore check box (or the Turn off System Restore on all drives check box), and then click OK.

System restore was already off. Has been for a while.
Here's the new log.