Something downloading in background - I don't feel safe!!

[ywain]

Helo there, could someone have a look at my Hijack This log file and tell me what to fix - got loads of things which bug me on the computer..... worst thing is that something seems to be downloading in the background and it might be Windows Update but that always shows '0% complete'!!!

Please Help

 

[RealBlackStuff]

Go to this post here first, and follow the instructions EXACTLY.
How to remove Begin2Search/Coolwebsearch and Other Nasties
Then post a fresh Hijackthis log-file.

 

[ywain]

KeyboardBAD

followed
How to remove Begin2Search/CoolwebSearch/HomeSearch Assistant computer Keyboard
has broked
Key
press
freeses
computer
.

 

[RealBlackStuff]

Boot in safe mode.
Switch System Restore off.
Press ctrl/alt/del and in Taskmanager try to STOP:
mcrt32.exe
lsass2k.exe
MDNZ.exe
smtp32.exe
p6.exe
wuacti.exe
mssupdate.exe

Next, run HJT on its own and let it 'fix' if still there:
C:\WINDOWS\System32\mcrt32.exe
C:\WINDOWS\System32\lsass2k.exe
C:\WINDOWS\System32\MDNZ.exe
C:\WINDOWS\System32\smtp32.exe
C:\WINDOWS\System32\p6.exe

O4 - HKLM\..\Run: [Start Upping] mcrt32.exe
O4 - HKLM\..\Run: [lsass2k Update] lsass2k.exe
O4 - HKLM\..\Run: [MDN] MDNZ.exe
O4 - HKLM\..\Run: [SMTP32 Mailing Protocol] smtp32.exe
O4 - HKLM\..\RunServices: [Start Upping] mcrt32.exe
O4 - HKLM\..\RunServices: [lsass2k Update] lsass2k.exe
O4 - HKLM\..\RunServices: [MDN] MDNZ.exe
O4 - HKLM\..\RunServices: [SMTP32 Mailing Protocol] smtp32.exe
O4 - HKCU\..\Run: [Windows Auto Update] wuacti.exe (do a search for it)
O4 - HKCU\..\Run: [MDN] MDNZ.exe
O4 - HKCU\..\Run: [Start Upping] mcrt32.exe
O4 - HKCU\..\Run: [SMTP32 Mailing Protocol] smtp32.exe
O4 - HKCU\..\Run: [lsass2k Update] lsass2k.exe
O4 - HKCU\..\RunServices: [Start Uppings] mssupdate.exe (do a search for it)

Unless the IP-numbers are from your ISP, also fix:
O17 - HKLM\System\CCS\Services\Tcpip\..\{F55AC4C9-8A2B-4EB2-884F-432BF6A4D66A}: NameServer = 80.225.253.50 80.225.253.58

When done, delete the bold files.
Boot normal. If all OK, put System Restore back on.

 

[ywain]

Thank you Blackstuff

First of all may I say that I love Guiness as well and especially love it now that my computer seems to be behaving - nothing is downloading constantly, my keyboard works, download rate has doubled and I feel Safe!!!

It's all thanks to you - forever in your debt!

Ywain