Foolestroupe -

If you run HijackThis and make a new log, it uses the same default filename for the log so it overwrites the previous one. But if you change the name on a log - e.g. by putting the date on the front of the filename (050225_hijackthis.log) - you have a reference copy. HijackThis should just make a new one with the default name the next time you run it. Just let your ref copy sit there until you need it. Comparing a new log to one you saved when the machine was clean should make it quite simple to at least know what's been changed. You may still want some expert advice on what can be "fixed" safely; but you'll be way ahead at the start.

With older Win versions you could do something similar with regedit, to save a "clean version" just for comparison when something comes up; but WinXP makes such frequent changes to registry that it's hardly worth it now.

John