Help Help Help ! my Computer is ill

[contrex]

also how many updates are needed?  i do understsand that things are being updated all the time but w/updates seems to be downloading updates all the timeis this normal?

Microsoft issues patches, updates and security fixes on the first Tuesday (I think) of each month. SP2 came out in August 2004 so I daresay Windows Update will decide that there is a bit of catching up to do. I expect that some of the updates will duplicate or replace earlier ones so Windows Update won't make you download absolutely everything, but it is quite common, after applying SP2 to a new install, to have a fair amount to download. I suggest you don't skip this step.

Internet Explorer 7 is likely to be one of the updates. Did you choose to let Microsoft choose your updates, or are you selecting from a list?

[simshi993052]

Hi I am letting W/Updates do all  work as i do not know much.
As I said before i would post the log files from Ad-aware/Hijack after i had finished installing all my stuff back on so here  they are

Hijack This:-
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\SiteAdvisor\6009\SiteAdv.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\WINDOWS\system32\BtUsrBdg.exe
C:\WINDOWS\system32\BTSetBootKey.exe
C:\Program Files\3M\PSNLite\PsnLite.exe
C:\PROGRA~1\3M\PSNLite\PSNGive.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\SiteAdvisor\6009\SAService.exe
C:\PROGRA~1\McAfee\MSC\mcregist.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\LimeWire\LimeWire.exe
C:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe
C:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe
C:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe
C:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe
C:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe
C:\WINDOWS\System32\msiexec.exe
C:\Documents and Settings\Simshi\My Documents\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6009\SiteAdv.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\program files\mcafee\virusscan\scriptcl.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6009\SiteAdv.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6009\SiteAdv.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [BTUSRBDG] BtUsrBdg.exe
O4 - HKLM\..\Run: [BTSETBOOTKEY] BTSetBootKey.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Post-it® Software Notes Lite.lnk = C:\Program Files\3M\PSNLite\PsnLite.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6009\SiteAdv.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: SiteAdvisor Service - McAfee, Inc. - C:\Program Files\SiteAdvisor\6009\SAService.exe




Let me know if you spot anything Dodgy.

Many thaks once again for all your help i'm glad i'm all ok now
all the best cheers guys
matt

[simshi993052]

Heres the Ad-aware one as it would not fit in the other post
Cheers
Matt
Ad-aware:-
Ad-Aware SE Build 1.06r1
Logfile Created on:21 May 2007 23:41:39
Created with Ad-Aware SE Personal, free for private use.
Using definitions file:SE1R171 21.05.2007
References detected during the scan:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
MRU List(TAC index:0):14 total references
Tracking Cookie(TAC index:3):8 total references
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Ad-Aware SE Settings

Set : Search for negligible risk entries
Set : Safe mode (always request confirmation)
Set : Scan active processes
Set : Scan registry
Set : Deep-scan registry
Set : Scan my IE Favorites for banned URLs
Set : Scan my Hosts file

Extended Ad-Aware SE Settings

Set : Unload recognized processes & modules during scan
Set : Scan registry for all users instead of current user only
Set : Always try to unload modules before deletion
Set : During removal, unload Explorer and IE if necessary
Set : Let Windows remove files in use at next reboot
Set : Delete quarantined objects after restoring
Set : Include basic Ad-Aware settings in log file
Set : Include additional Ad-Aware settings in log file
Set : Include reference summary in log file
Set : Include alternate data stream details in log file
Set : Play sound at scan completion if scan locates critical objects


21-05-2007 23:41:39 - Scan started. (Smart mode)

Listing running processes


#:1 [smss.exe]
    FilePath           : \SystemRoot\System32\
    ProcessID          : 600
    ThreadCreationTime : 21-05-2007 21:57:16
    BasePriority       : Normal
#:2 [csrss.exe]
    FilePath           : \??\C:\WINDOWS\system32\
    ProcessID          : 656
    ThreadCreationTime : 21-05-2007 21:57:23
    BasePriority       : Normal
#:3 [winlogon.exe]
    FilePath           : \??\C:\WINDOWS\system32\
    ProcessID          : 680
    ThreadCreationTime : 21-05-2007 21:57:23
    BasePriority       : High
#:4 [services.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 724
    ThreadCreationTime : 21-05-2007 21:57:24
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Services and Controller app
    InternalName       : services.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : services.exe
#:5 [lsass.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 736
    ThreadCreationTime : 21-05-2007 21:57:24
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : LSA Shell (Export Version)
    InternalName       : lsass.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : lsass.exe
#:6 [svchost.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 908
    ThreadCreationTime : 21-05-2007 21:57:24
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Generic Host Process for Win32 Services
    InternalName       : svchost.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : svchost.exe
#:7 [svchost.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 976
    ThreadCreationTime : 21-05-2007 21:57:24
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Generic Host Process for Win32 Services
    InternalName       : svchost.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : svchost.exe
#:8 [svchost.exe]
    FilePath           : C:\WINDOWS\System32\
    ProcessID          : 1072
    ThreadCreationTime : 21-05-2007 21:57:25
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Generic Host Process for Win32 Services
    InternalName       : svchost.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : svchost.exe
#:9 [svchost.exe]
    FilePath           : C:\WINDOWS\System32\
    ProcessID          : 1192
    ThreadCreationTime : 21-05-2007 21:57:25
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Generic Host Process for Win32 Services
    InternalName       : svchost.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : svchost.exe

i will post the second half in a min.

[simshi993052]

#:10 [svchost.exe]
    FilePath           : C:\WINDOWS\System32\
    ProcessID          : 1236
    ThreadCreationTime : 21-05-2007 21:57:25
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Generic Host Process for Win32 Services
    InternalName       : svchost.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : svchost.exe
#:11 [spoolsv.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 1464
    ThreadCreationTime : 21-05-2007 21:57:25
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Spooler SubSystem App
    InternalName       : spoolsv.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : spoolsv.exe
#:12 [explorer.exe]
    FilePath           : C:\WINDOWS\
    ProcessID          : 1680
    ThreadCreationTime : 21-05-2007 21:57:26
    BasePriority       : Normal
    FileVersion        : 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 6.00.2900.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Windows Explorer
    InternalName       : explorer
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : EXPLORER.EXE
#:13 [rundll32.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 1800
    ThreadCreationTime : 21-05-2007 21:57:28
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Run a DLL as an App
    InternalName       : rundll
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : RUNDLL.EXE
#:14 [siteadv.exe]
    FilePath           : C:\Program Files\SiteAdvisor\6009\
    ProcessID          : 1808
    ThreadCreationTime : 21-05-2007 21:57:28
    BasePriority       : Normal
    FileVersion        : 2.3.0
    ProductVersion     : 2.3.0
    ProductName        : SiteAdvisor
    CompanyName        : McAfee, Inc.
    FileDescription    : SiteAdvisor
    InternalName       : SiteAdv
    LegalCopyright     : Copyright McAfee, Inc. All rights reserved.
    OriginalFilename   : SiteAdv
#:15 [jusched.exe]
    FilePath           : C:\Program Files\Java\jre1.5.0_09\bin\
    ProcessID          : 1828
    ThreadCreationTime : 21-05-2007 21:57:28
    BasePriority       : Normal
#:16 [btusrbdg.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 1848
    ThreadCreationTime : 21-05-2007 21:57:28
    BasePriority       : Normal
    FileVersion        : 1, 0, 1, 0
    ProductVersion     : 1, 0, 0, 0
    CompanyName        : Extended Systems, Inc.
    FileDescription    : btusrbdg.exe
    InternalName       : BTUSRBDG
    LegalCopyright     : Copyright (C) 2001 Extended Systems, Inc.
    OriginalFilename   : btusrbdg.exe
#:17 [btsetbootkey.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 1856
    ThreadCreationTime : 21-05-2007 21:57:28
    BasePriority       : Normal
#:18 [psnlite.exe]
    FilePath           : C:\Program Files\3M\PSNLite\
    ProcessID          : 1876
    ThreadCreationTime : 21-05-2007 21:57:28
    BasePriority       : Normal
    FileVersion        : 3, 1, 1, 1073
    ProductVersion     : 3, 1, 1, 1073
    ProductName        : Post-it(R) Software Notes Lite
    CompanyName        : 3M
    FileDescription    : Post-it(R) Software Notes: System
    InternalName       : PSN
    LegalCopyright     : © 1995-2004 3M Company. All Rights Reserved.
    LegalTrademarks    : "Post-it" and canary yellow are a registered trademarks of 3M.
    OriginalFilename   : PSN2VIEW.EXE
#:19 [psngive.exe]
    FilePath           : C:\PROGRA~1\3M\PSNLite\
    ProcessID          : 1904
    ThreadCreationTime : 21-05-2007 21:57:30
    BasePriority       : Normal
    FileVersion        : 3, 1, 2, 2073
    ProductVersion     : 3, 1, 2, 2073
    ProductName        : Post-it(R) Software Notes
    CompanyName        : 3M
    FileDescription    : Post-it(R) Software Notes: GiveNote
    InternalName       : PSN
    LegalCopyright     : © 1995-2004 3M Company. All Rights Reserved.
    LegalTrademarks    : "Post-it" and canary yellow are a registered trademarks of 3M.
    OriginalFilename   : PSN.EXE
#:20 [svchost.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 2028
    ThreadCreationTime : 21-05-2007 21:57:33
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Generic Host Process for Win32 Services
    InternalName       : svchost.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : svchost.exe

#:21 [hwapi.exe]
    FilePath           : C:\Program Files\Common Files\McAfee\HackerWatch\
    ProcessID          : 204
    ThreadCreationTime : 21-05-2007 21:57:33
    BasePriority       : Normal
    FileVersion        : 8.2.104.0
    ProductVersion     : 8.2.104.0
    ProductName        : McAfee HackerWatch Service
    CompanyName        : McAfee, Inc.
    FileDescription    : McAfee HackerWatch Service
    LegalCopyright     : (c) McAfee, Inc.  All rights reserved.
    OriginalFilename   : HWAPI.exe
#:22 [mcmscsvc.exe]
    FilePath           : C:\PROGRA~1\McAfee\MSC\
    ProcessID          : 260
    ThreadCreationTime : 21-05-2007 21:57:33
    BasePriority       : Normal
    FileVersion        : 7,2,142,0
    ProductVersion     : 7,2,0,0
    ProductName        : McAfee SecurityCenter
    CompanyName        : McAfee, Inc.
    FileDescription    : MISP User Manager
    InternalName       : McMSCSvc
    LegalCopyright     : Copyright © 2006 McAfee, Inc.
    OriginalFilename   : McMSCSvc.exe
#:23 [mcnasvc.exe]
    FilePath           : c:\program files\common files\mcafee\mna\
    ProcessID          : 364
    ThreadCreationTime : 21-05-2007 21:57:36
    BasePriority       : Normal
    FileVersion        : 1,2,106,0
    ProductVersion     : 1,2,0,0
    ProductName        : McAfee Integrated Security Platform
    CompanyName        : McAfee, Inc.
    FileDescription    : McAfee Network Agent
    InternalName       : McNASvc
    LegalCopyright     : Copyright © 2006 McAfee, Inc.
    OriginalFilename   : McNASvc.exe
#:24 [mcods.exe]
    FilePath           : C:\PROGRA~1\McAfee\VIRUSS~1\
    ProcessID          : 424
    ThreadCreationTime : 21-05-2007 21:57:36
    BasePriority       : Normal
    FileVersion        : 11,2,121,0
    ProductVersion     : 11,2,0,0
    ProductName        : McAfee VirusScan
    CompanyName        : McAfee, Inc.
    FileDescription    : McAfee VirusScan - On Demand Scan
    InternalName       : mcods.exe
    LegalCopyright     : Copyright © 2006 McAfee, Inc.
    OriginalFilename   : mcods.exe

[simshi993052]

#:25 [mcpromgr.exe]
    FilePath           : C:\PROGRA~1\McAfee\MSC\
    ProcessID          : 448
    ThreadCreationTime : 21-05-2007 21:57:36
    BasePriority       : Normal
    FileVersion        : 7,2,142,0
    ProductVersion     : 7,2,0,0
    ProductName        : McAfee SecurityCenter
    CompanyName        : McAfee, Inc.
    FileDescription    : McAfee Integrated Security Platform
    InternalName       : McProMgr
    LegalCopyright     : Copyright © 2006 McAfee, Inc.
    OriginalFilename   : McProMgr.exe
#:26 [redirsvc.exe]
    FilePath           : c:\PROGRA~1\COMMON~1\mcafee\redirsvc\
    ProcessID          : 504
    ThreadCreationTime : 21-05-2007 21:57:36
    BasePriority       : Normal
    FileVersion        : 1,2,112,0
    ProductVersion     : 1,2,0,0
    ProductName        : McAfee Redirector
    CompanyName        : McAfee, Inc.
    FileDescription    : McAfee Redirector Service Module
    InternalName       : McRedirector
    LegalCopyright     : Copyright © 2006 McAfee, Inc.
    OriginalFilename   : RedirSvc.exe
    Comments           : McAfee Redirector Service
#:27 [mcshield.exe]
    FilePath           : C:\PROGRA~1\McAfee\VIRUSS~1\
    ProcessID          : 552
    ThreadCreationTime : 21-05-2007 21:57:36
    BasePriority       : High
#:28 [mcsysmon.exe]
    FilePath           : C:\PROGRA~1\McAfee\VIRUSS~1\
    ProcessID          : 628
    ThreadCreationTime : 21-05-2007 21:57:36
    BasePriority       : Normal
    FileVersion        : 11,2,130,0
    ProductVersion     : 11,2,0,0
    ProductName        : McAfee VirusScan API
    CompanyName        : McAfee, Inc.
    FileDescription    : McAfee SystemGuards Service
    InternalName       : sysmon
    LegalCopyright     : Copyright © 2006 McAfee, Inc.
    OriginalFilename   : sysmon.exe
#:29 [mpfsrv.exe]
    FilePath           : C:\Program Files\McAfee\MPF\
    ProcessID          : 808
    ThreadCreationTime : 21-05-2007 21:57:37
    BasePriority       : Normal
    FileVersion        : 8.2.115.0
    ProductVersion     : 8.2.115.0
    ProductName        : McAfee Personal Firewall
    CompanyName        : McAfee, Inc.
    FileDescription    : McAfee Personal Firewall Service
    InternalName       : MPFService
    LegalCopyright     : Copyright © 2005 McAfee, Inc. All Rights Reserved.
    OriginalFilename   : MpfService.exe
    Comments           : McAfee Personal Firewall Service
#:30 [saservice.exe]
    FilePath           : C:\Program Files\SiteAdvisor\6009\
    ProcessID          : 1180
    ThreadCreationTime : 21-05-2007 21:57:37
    BasePriority       : Normal
    FileVersion        : 1, 0, 0, 1
    ProductVersion     : 1, 0, 0, 1
    ProductName        :  SAService Application
    CompanyName        : McAfee, Inc.
    FileDescription    : SAService Application
    InternalName       : SAService
    LegalCopyright     : Copyright McAfee, Inc. 2006
    OriginalFilename   : SAService.exe

#:31 [mcregist.exe]
    FilePath           : C:\PROGRA~1\McAfee\MSC\
    ProcessID          : 2752
    ThreadCreationTime : 21-05-2007 21:57:51
    BasePriority       : Normal
    FileVersion        : 5,3,106,0
    ProductVersion     : 5,3,0,0
    ProductName        : McAfee Registration Wizard
    CompanyName        : McAfee, Inc.
    FileDescription    : Registration Wizard
    InternalName       : mcregist
    LegalCopyright     : Copyright © 2006 McAfee, Inc.
    OriginalFilename   : mcregist.exe
#:32 [mcagent.exe]
    FilePath           : c:\PROGRA~1\mcafee.com\agent\
    ProcessID          : 2964
    ThreadCreationTime : 21-05-2007 21:57:52
    BasePriority       : Normal
    FileVersion        : 7,2,142,0
    ProductVersion     : 7,2,0,0
    ProductName        : McAfee SecurityCenter
    CompanyName        : McAfee, Inc.
    FileDescription    : McAfee Integrated Security Platform
    InternalName       : McAgent
    LegalCopyright     : Copyright © 2006 McAfee, Inc.
    OriginalFilename   : McAgent.exe
#:33 [alg.exe]
    FilePath           : C:\WINDOWS\System32\
    ProcessID          : 3140
    ThreadCreationTime : 21-05-2007 21:57:52
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Application Layer Gateway Service
    InternalName       : ALG.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : ALG.exe
#:34 [svchost.exe]
    FilePath           : C:\WINDOWS\System32\
    ProcessID          : 2444
    ThreadCreationTime : 21-05-2007 22:10:15
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Generic Host Process for Win32 Services
    InternalName       : svchost.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : svchost.exe
#:35 [limewire.exe]
    FilePath           : C:\Program Files\LimeWire\
    ProcessID          : 2984
    ThreadCreationTime : 21-05-2007 22:14:19
    BasePriority       : Normal
    FileVersion        : 1, 0, 0, 2
    ProductVersion     : 1, 0, 0, 2
    ProductName        :  LimeWire
    CompanyName        : Lime Wire, LLC
    FileDescription    : LimeWire
    InternalName       : LimeWire
    LegalCopyright     : Copyright (C) 2004
    OriginalFilename   : LimeWire.exe
    Comments           : The most advanced file sharing program on the planet.
#:36 [yahoowidgetengine.exe]
    FilePath           : C:\Program Files\Yahoo!\Yahoo! Widget Engine\
    ProcessID          : 1212
    ThreadCreationTime : 21-05-2007 22:16:46
    BasePriority       : Normal
    FileVersion        : 3.1.4
    ProductVersion     : 3.1.4
    ProductName        : Yahoo! Widget Engine
    CompanyName        : Yahoo! Inc.
    FileDescription    : Yahoo! Widget Engine
    InternalName       : Yahoo! Widget Engine
    LegalCopyright     : Copyright (C) 2004-2006 Yahoo! Inc.
    OriginalFilename   : YahooWidgetEngine.exe
#:37 [yahoowidgetengine.exe]
    FilePath           : C:\Program Files\Yahoo!\Yahoo! Widget Engine\
    ProcessID          : 2720
    ThreadCreationTime : 21-05-2007 22:16:55
    BasePriority       : Normal
    FileVersion        : 3.1.4
    ProductVersion     : 3.1.4
    ProductName        : Yahoo! Widget Engine
    CompanyName        : Yahoo! Inc.
    FileDescription    : Yahoo! Widget Engine
    InternalName       : Yahoo! Widget Engine
    LegalCopyright     : Copyright (C) 2004-2006 Yahoo! Inc.
    OriginalFilename   : YahooWidgetEngine.exe
#:38 [yahoowidgetengine.exe]
    FilePath           : C:\Program Files\Yahoo!\Yahoo! Widget Engine\
    ProcessID          : 3108
    ThreadCreationTime : 21-05-2007 22:16:56
    BasePriority       : Normal
    FileVersion        : 3.1.4
    ProductVersion     : 3.1.4
    ProductName        : Yahoo! Widget Engine
    CompanyName        : Yahoo! Inc.
    FileDescription    : Yahoo! Widget Engine
    InternalName       : Yahoo! Widget Engine
    LegalCopyright     : Copyright (C) 2004-2006 Yahoo! Inc.
    OriginalFilename   : YahooWidgetEngine.exe
#:39 [yahoowidgetengine.exe]
    FilePath           : C:\Program Files\Yahoo!\Yahoo! Widget Engine\
    ProcessID          : 220
    ThreadCreationTime : 21-05-2007 22:17:59
    BasePriority       : Normal
    FileVersion        : 3.1.4
    ProductVersion     : 3.1.4
    ProductName        : Yahoo! Widget Engine
    CompanyName        : Yahoo! Inc.
    FileDescription    : Yahoo! Widget Engine
    InternalName       : Yahoo! Widget Engine
    LegalCopyright     : Copyright (C) 2004-2006 Yahoo! Inc.
    OriginalFilename   : YahooWidgetEngine.exe
#:40 [yahoowidgetengine.exe]
    FilePath           : C:\Program Files\Yahoo!\Yahoo! Widget Engine\
    ProcessID          : 652
    ThreadCreationTime : 21-05-2007 22:18:16
    BasePriority       : Normal
    FileVersion        : 3.1.4
    ProductVersion     : 3.1.4
    ProductName        : Yahoo! Widget Engine
    CompanyName        : Yahoo! Inc.
    FileDescription    : Yahoo! Widget Engine
    InternalName       : Yahoo! Widget Engine
    LegalCopyright     : Copyright (C) 2004-2006 Yahoo! Inc.
    OriginalFilename   : YahooWidgetEngine.exe
#:41 [msiexec.exe]
    FilePath           : C:\WINDOWS\System32\
    ProcessID          : 1120
    ThreadCreationTime : 21-05-2007 22:39:17
    BasePriority       : Normal

[simshi993052]

#:42 [ad-aware.exe]
    FilePath           : C:\Program Files\Lavasoft\Ad-Aware SE Personal\
    ProcessID          : 1144
    ThreadCreationTime : 21-05-2007 22:40:52
    BasePriority       : Normal
    FileVersion        : 6.2.0.236
    ProductVersion     : SE 106
    ProductName        : Lavasoft Ad-Aware SE
    CompanyName        : Lavasoft Sweden
    FileDescription    : Ad-Aware SE Core application
    InternalName       : Ad-Aware.exe
    LegalCopyright     : Copyright © Lavasoft AB Sweden
    OriginalFilename   : Ad-Aware.exe
    Comments           : All Rights Reserved
Memory scan result:
New critical objects: 0
Objects found so far: 0

Started registry scan

Registry Scan result:

New critical objects: 0
Objects found so far: 0

Started deep registry scan

Deep registry scan result:

New critical objects: 0
Objects found so far: 0

Started Tracking Cookie scan

 Tracking Cookie Object Recognized!
    Type               : IECache Entry
    Data               : simshi@doubleclick[1].txt
    TAC Rating         : 3
    Category           : Data Miner
    Comment            : Hits:6
    Value              : Cookie:[email protected]/
    Expires            : 20-05-2010 23:21:34
    LastSync           : Hits:6
    UseCount           : 0
    Hits               : 6
 Tracking Cookie Object Recognized!
    Type               : IECache Entry
    Data               : simshi@com[1].txt
    TAC Rating         : 3
    Category           : Data Miner
    Comment            : Hits:1
    Value              : Cookie:[email protected]/
    Expires            : 20-05-2017 23:37:52
    LastSync           : Hits:1
    UseCount           : 0
    Hits               : 1
 Tracking Cookie Object Recognized!
    Type               : IECache Entry
    Data               : simshi@mediaplex[1].txt
    TAC Rating         : 3
    Category           : Data Miner
    Comment            : Hits:2
    Value              : Cookie:[email protected]/
    Expires            : 22-06-2009 01:00:00
    LastSync           : Hits:2
    UseCount           : 0
    Hits               : 2
 Tracking Cookie Object Recognized!
    Type               : IECache Entry
    Data               : simshi@zedo[1].txt
    TAC Rating         : 3
    Category           : Data Miner
    Comment            : Hits:11
    Value              : Cookie:[email protected]/
    Expires            : 18-05-2017 23:37:46
    LastSync           : Hits:11
    UseCount           : 0
    Hits               : 11
 Tracking Cookie Object Recognized!
    Type               : IECache Entry
    Data               : simshi@revsci[2].txt
    TAC Rating         : 3
    Category           : Data Miner
    Comment            : Hits:2
    Value              : Cookie:[email protected]/
    Expires            : 16-05-2027 23:37:50
    LastSync           : Hits:2
    UseCount           : 0
    Hits               : 2
 Tracking Cookie Object Recognized!
    Type               : IECache Entry
    Data               : simshi@atdmt[2].txt
    TAC Rating         : 3
    Category           : Data Miner
    Comment            : Hits:3
    Value              : Cookie:[email protected]/
    Expires            : 19-05-2012 01:00:00
    LastSync           : Hits:3
    UseCount           : 0
    Hits               : 3
 Tracking Cookie Object Recognized!
    Type               : IECache Entry
    Data               : simshi@2o7[1].txt
    TAC Rating         : 3
    Category           : Data Miner
    Comment            : Hits:9
    Value              : Cookie:[email protected]/
    Expires            : 19-05-2012 23:39:12
    LastSync           : Hits:9
    UseCount           : 0
    Hits               : 9
 Tracking Cookie Object Recognized!
    Type               : IECache Entry
    Data               : simshi@advertising[2].txt
    TAC Rating         : 3
    Category           : Data Miner
    Comment            : Hits:28
    Value              : Cookie:[email protected]/
    Expires            : 19-05-2012 23:31:38
    LastSync           : Hits:28
    UseCount           : 0
    Hits               : 28
Tracking cookie scan result:

New critical objects: 8
Objects found so far: 8

Deep scanning and examining files...


Disk Scan Result for C:\WINDOWS

New critical objects: 0
Objects found so far: 8

Disk Scan Result for C:\WINDOWS\system32

New critical objects: 0
Objects found so far: 8

Disk Scan Result for C:\DOCUME~1\Simshi\LOCALS~1\Temp\

New critical objects: 0
Objects found so far: 8


Scanning Hosts file......
Hosts file location:"C:\WINDOWS\system32\drivers\etc\hosts".

Hosts file scan result:

1 entries scanned.
New critical objects:0
Objects found so far: 8

 MRU List Object Recognized!
    Location:          : C:\Documents and Settings\Simshi\recent
    Description        : list of recently opened documents

 MRU List Object Recognized!
    Location:          : S-1-5-21-1343024091-776561741-725345543-1003\software\microsoft\direct3d\mostrecentapplication
    Description        : most recent application to use microsoft direct3d

 MRU List Object Recognized!
    Location:          : S-1-5-21-1343024091-776561741-725345543-1003\software\microsoft\direct3d\mostrecentapplication
    Description        : most recent application to use microsoft direct X

 MRU List Object Recognized!
    Location:          : software\microsoft\directdraw\mostrecentapplication
    Description        : most recent application to use microsoft directdraw

 MRU List Object Recognized!
    Location:          : S-1-5-21-1343024091-776561741-725345543-1003\software\microsoft\internet explorer
    Description        : last download directory used in microsoft internet explorer

 MRU List Object Recognized!
    Location:          : S-1-5-21-1343024091-776561741-725345543-1003\software\microsoft\internet explorer\typedurls
    Description        : list of recently entered addresses in microsoft internet explorer

 MRU List Object Recognized!
    Location:          : S-1-5-21-1343024091-776561741-725345543-1003\software\microsoft\microsoft management console\recent file list
    Description        : list of recent snap-ins used in the microsoft management console

 MRU List Object Recognized!
    Location:          : S-1-5-21-1343024091-776561741-725345543-1003\software\microsoft\windows\currentversion\explorer\comdlg32\lastvisitedmru
    Description        : list of recent programs opened

 MRU List Object Recognized!
    Location:          : S-1-5-21-1343024091-776561741-725345543-1003\software\microsoft\windows\currentversion\explorer\comdlg32\opensavemru
    Description        : list of recently saved files, stored according to file extension

 MRU List Object Recognized!
    Location:          : S-1-5-21-1343024091-776561741-725345543-1003\software\microsoft\windows\currentversion\explorer\recentdocs
    Description        : list of recent documents opened

 MRU List Object Recognized!
    Location:          : S-1-5-21-1343024091-776561741-725345543-1003\software\microsoft\windows\currentversion\explorer\runmru
    Description        : mru list for items opened in start | run

 MRU List Object Recognized!
    Location:          : .DEFAULT\software\microsoft\windows media\wmsdk\general
    Description        : windows media sdk

 MRU List Object Recognized!
    Location:          : S-1-5-18\software\microsoft\windows media\wmsdk\general
    Description        : windows media sdk


 MRU List Object Recognized!
    Location:          : S-1-5-21-1343024091-776561741-725345543-1003\software\microsoft\windows media\wmsdk\general
    Description        : windows media sdk

Performing conditional scans...

Conditional scan result:

New critical objects: 0
Objects found so far: 22

23:43:17 Scan Complete

Summary Of This Scan

Total scanning time:00:01:37.734
Objects scanned:93357
Objects identified:8
Objects ignored:0
New critical objects:8

sorry about the long post didn't know what else to do
cheers

[helper]

you have limewire, and i think your java is out of date, apart from that, I dont see anything

[simshi993052]

A yet i have not used it and fully intend to scan anythig downloaded
as soon as i can find something to scan with any suggestions?

if i have a seperate hard drive to store stuff downloaded with lime wire will that help

cheers
matt

[helper]

are you asking for a reccomendation as a scanner to use?
if so then i'd use AVG Free, also even if you use a diff hard disk if its hooked up to your computer, if the file is infectted, it CAN (depending on the virus) spread to any hooked up media (floppy disk, hard disk, usb drive,ect)

[patio]

helper where is your Hijack Log training from ? ? ?

[helper]

well, wikipedia, why? is it good?

[GX1_Man]

It is suspect at best.

If you have no real training and a LOT of experience it is dangerous to suggest things to users already in a crisis, even something as trivial as "everything looks OK" can take someone down the wrong path.

Wikipedia training is not the course requirement for Hijack Log Analysis. I'm sure Oddjob can advise you further on this.

[CBMatt]

Looks clean to me.  For future reference, please don't omit anything from the log, including the header that lists your OS and MSIE.  I don't think it'll be an issue here, but remember to include it anytime you post a log.

I'm curious...did you run the Ad-Aware scan before HijackThis?  HijackThis shows that you have the latest version of Java, but Ad-Aware doesn't.

As far as Limewire goes...I can't tell you to stop using it.  I am obligated, however, to tell you that you need to be very careful with what you download.  Music is usually safe (not always, but usually), but many programs downloaded with Limewire tend to be infected.  I've caught a few particularly nasty infections myself in the past.  So, just be careful.  I don't want to see you coming back here because of infections from filesharing.

Now, with that said, let's talk about protection...I'm not sure how many people would agree, but I think McAfee is a pretty decent firewall.  It might not be the best, but I like it.  Its anti-virus, however, leaves a little to be desired.  So, you should consider having AVG Free as a backup.  Just be sure to disable the active scanning so it won't conflict with McAfee.  I suggest scanning with AVG in Safe Mode at least once a week.  For spyware, I'd suggest getting Spybot Search & Destroy, AVG Anti-Spyware, and SUPERAntiSpyware.  With these, you should have a pretty good arsenal.

well, wikipedia, why? is it good?

helper, it's admirable that you want to help, but please refrain from doing so until you get some formal training.  I know it seems simple enough, but there are a lot of special cases out there that you have to look out for.  If you want to help, I suggest you find a "school" to train at.  I can help point you in the right direction if you'd like.

Your log looks clean.  Installing the rest of your software shouldn't change this.  Unless, of course, some of this software was obtained illegally, which can sometimes infect your system.

Let's get one thing straight: It is not the legal status of software which causes systems to become infected, it is the fact that sometimes (not always) viruses are added to pirate copies or to keygens etc. This may be an unpalatable fact for some, but the plain fact is that there are many millions of people running "illegal" (poor choice of words for non-DMCA countries, ie the rest of the world) software including operating systems and major application suites.

I understand that the legal status of software isn't what infects a system.  It's just common knowledge that many warez tend to carry malware.  Many of us have probably witnessed this first-hand, I'm sure.  The same thing can happen with legal software too, of course, but it's more common among software of dubious nature.

Now, I have to ask...did you just reinstall XP or did you actually reformat?  I've never had to reinstall an OS, but I don't think you normally have to reinstall your programs... Anyone care to either confirm this or correct me?

Correcting you, I am afraid. You definitely do have to reinstall your programs after a reinstall. A reinstall wipes out everything in the system partition. Now there's a funny thing. I thought, given your decided opinions about "illegal" software and infections, that you would be a very experienced veteran with much knowledge under your belt?

Like I said, I have never reinstalled an OS, so I obviously don't know what all it entails.  That's probably why I asked.  And so you know, I haven't stated any opinions about illegal software here.  I merely stated a fact: downloading warez can and often will get you infected.  I'm not riding on some high horse and telling the guy that it's bad to use illegal software (I don't even know for sure if he actually does use it).  Personally, I really don't care.  He can use all of the illegal software he wants (I myself am not innocent in this regard).  It's only fair of me to send out a warning.  That aside, thank you for answering my question.

[oddjob]

well, wikipedia, why? is it good?

helper, it's admirable that you want to help, but please refrain from doing so until you get some formal training.  I know it seems simple enough, but there are a lot of special cases out there that you have to look out for.  If you want to help, I suggest you find a "school" to train at.  I can help point you in the right direction if you'd like.

I have been asked to add my backing to this advice. It is sound.

Helper ... I agree with CBMatt ... it is always good that more people want to help in the fight against malware but you would indeed be well advised to listen to what he says.

If you want to get more expertise in working on HJT logs the (free) online training schools CBMatt refers to are an excellent starting point.

Here is a thread on the issue from earlier this year ...

http://www.computerhope.com/forum/index.php/topic,31800.msg190919.html#msg190919


OJ

[unlovedwarrior]

im in the Malware University right now

simshi993052 have a look at my Signature protection ideas