Suspicious, unremovable Hijack This entry

Hi:

The relevant portion of the Hijack this log:

O17 - HKLM\System\CCS\Services\Tcpip\..\{6866e193-efa5-4018-999e-c7b0dbd6ae87}: NameServer = 219.76.98.90 218.102.32.172
O17 - HKLM\System\CS1\Services\Tcpip\..\{6866e193-efa5-4018-999e-c7b0dbd6ae87}: NameServer = 219.76.98.90 218.102.32.172

Those IP addresses happen to be owned by my ISP.

Hijack this won't remove it. They simply re-appear at start up, as if some underlying application is generating them.

Any thoughts would be appreciated.

I fail to understand your problem. You state that these IP addresses belong to your ISP. If that is the case, they are legitimate entries and you shouldn't be trying to remove them. The following quoted instructions for O17 entries are taken from a HijackThis tutorial:

If you see entries for this and do not recognize the domain as belonging to your ISP or company, and the DNS servers do not belong to your ISP or company, then you should have HijackThis fix it.

As you recognize these entries as belonging to your ISP, they should NOT be removed.

If you are experiencing other issues that cause you to feel your system is infected with malware, then please start a new topic after familiarizing yourself with the forum rules and instructions for posting DDS logs: >Forum Posting Rules - Please Read<

As this issue does not involve malware and therefore falls outside the scope of this forum, this topic is now closed.

You can help support this site from this link :
Donations For Malware Removal