TechSpot

Something downloading in background - I don't feel safe!!

By ywain
Feb 17, 2005
  1. Helo there, could someone have a look at my Hijack This log file and tell me what to fix - got loads of things which bug me on the computer..... worst thing is that something seems to be downloading in the background and it might be Windows Update but that always shows '0% complete'!!!

    Please Help
     
  2. RealBlackStuff

    RealBlackStuff TS Rookie Posts: 6,503

  3. ywain

    ywain TS Rookie Topic Starter

    KeyboardBAD

    followed
    How to remove Begin2Search/CoolwebSearch/HomeSearch Assistant computer Keyboard
    has broked
    Key
    press
    freeses
    computer
    .
     

    Attached Files:

  4. RealBlackStuff

    RealBlackStuff TS Rookie Posts: 6,503

    Boot in safe mode.
    Switch System Restore off.
    Press ctrl/alt/del and in Taskmanager try to STOP:

    mcrt32.exe
    lsass2k.exe
    MDNZ.exe
    smtp32.exe
    p6.exe
    wuacti.exe
    mssupdate.exe

    Next, run HJT on its own and let it 'fix' if still there:
    C:\WINDOWS\System32\mcrt32.exe
    C:\WINDOWS\System32\lsass2k.exe
    C:\WINDOWS\System32\MDNZ.exe
    C:\WINDOWS\System32\smtp32.exe
    C:\WINDOWS\System32\p6.exe

    O4 - HKLM\..\Run: [Start Upping] mcrt32.exe
    O4 - HKLM\..\Run: [lsass2k Update] lsass2k.exe
    O4 - HKLM\..\Run: [MDN] MDNZ.exe
    O4 - HKLM\..\Run: [SMTP32 Mailing Protocol] smtp32.exe
    O4 - HKLM\..\RunServices: [Start Upping] mcrt32.exe
    O4 - HKLM\..\RunServices: [lsass2k Update] lsass2k.exe
    O4 - HKLM\..\RunServices: [MDN] MDNZ.exe
    O4 - HKLM\..\RunServices: [SMTP32 Mailing Protocol] smtp32.exe
    O4 - HKCU\..\Run: [Windows Auto Update] wuacti.exe (do a search for it)
    O4 - HKCU\..\Run: [MDN] MDNZ.exe
    O4 - HKCU\..\Run: [Start Upping] mcrt32.exe
    O4 - HKCU\..\Run: [SMTP32 Mailing Protocol] smtp32.exe
    O4 - HKCU\..\Run: [lsass2k Update] lsass2k.exe
    O4 - HKCU\..\RunServices: [Start Uppings] mssupdate.exe (do a search for it)

    Unless the IP-numbers are from your ISP, also fix:
    O17 - HKLM\System\CCS\Services\Tcpip\..\{F55AC4C9-8A2B-4EB2-884F-432BF6A4D66A}: NameServer = 80.225.253.50 80.225.253.58

    When done, delete the bold files.
    Boot normal. If all OK, put System Restore back on.
     
  5. ywain

    ywain TS Rookie Topic Starter

    Thank you Blackstuff

    First of all may I say that I love Guiness as well and especially love it now that my computer seems to be behaving - nothing is downloading constantly, my keyboard works, download rate has doubled and I feel Safe!!!

    It's all thanks to you - forever in your debt!

    Ywain
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...