Pop ups+ virus's+slow running HELP!!
Discussion
My best mate at uni has a laptop that has recently started throwing up endless pop ups and running slower. I had a quick look and his antivirus (norton) is now out of date and therefore pathetic. So I installed AVG (which works brilliantly on my comp) and decided to attack the pop ups with Ad-aware/ spy bot afterwards.
Doing all of the above in safe mode + normal mode results in fewer problems found in adaware/ non in spybot and nothing too scary. However, it will not allow me to do a complete system scan in AVG - yet even scanning half reveals 8 virus found on half of the computer alone. I cannot use AVG to delete or even quarantine these.
There seems to be no way that I can get it to function properly enough to run effectively, and the pop ups just keep coming. The laptop is otherwise a relatively good one (just over a year old) and quite a high spec?
Any ideas are most appreciated.
Its doing his head in!
Doing all of the above in safe mode + normal mode results in fewer problems found in adaware/ non in spybot and nothing too scary. However, it will not allow me to do a complete system scan in AVG - yet even scanning half reveals 8 virus found on half of the computer alone. I cannot use AVG to delete or even quarantine these.
There seems to be no way that I can get it to function properly enough to run effectively, and the pop ups just keep coming. The laptop is otherwise a relatively good one (just over a year old) and quite a high spec?
Any ideas are most appreciated.
Its doing his head in!
from orbit, it's the only way to be sure. (In otherwords, reformat and reinstall the OS.)
Download Spysweeper start the PC in safe mode and install Spysweeper then run it and I bet it will pick up a ton of stuff.
It really is the daddy of these type of problems.
It is important you run spysweeper in safe mode the first time and then reboot the PC in normal mode and run it again as it can't pick everything up in safe mode but it should make the PC useable in its normal mode.
It really is the daddy of these type of problems.
It is important you run spysweeper in safe mode the first time and then reboot the PC in normal mode and run it again as it can't pick everything up in safe mode but it should make the PC useable in its normal mode.
Here you go (im on his laptop now) - this is the result of hijack this... looks a little busier than any other computer I have taken a log file of. Any ideas??
Logfile of HijackThis v1.99.1
Scan saved at 11:54:01, on 30/09/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSSystem32Ati2evxx.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32LEXBCES.EXE
C:WINDOWSsystem32LEXPPS.EXE
C:WINDOWSsystem32spoolsv.exe
C:PROGRA~1GrisoftAVGFRE~1avgamsvr.exe
C:PROGRA~1GrisoftAVGFRE~1avgupsvc.exe
C:Program FilesCommon FilesSymantec SharedccSetMgr.exe
C:WINDOWSsystem32 oneLabsvsmon.exe
C:Program FilesCommon FilesSymantec SharedccEvtMgr.exe
C:Program FilesCommon FilesSymantec SharedSecurity CenterSymWSC.exe
C:WINDOWSsystem32 undll32.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSExplorer.EXE
C:Program FilesApointApoint.exe
C:Program FilesATI TechnologiesATI Control Panelatiptaxx.exe
C:WINDOWSSystem32ezSP_Px.exe
C:WINDOWSsystem32ICO.EXE
C:Program FilesCommon FilesSymantec SharedccApp.exe
C:Program FilesSonyHotKey UtilityHKserv.exe
C:Program Filessonyvaio update 2VAIOUpdt.exe
C:Program Filessonyvaio power managementSPMgr.exe
C:Program Filesdrag'n drop cd+dvdBinFilesDragDrop.exe
C:Program FilesQuickTimeqttask.exe
C:Program FilesCommon FilesRealUpdate_OB ealsched.exe
C:Program FilesiTunesiTunesHelper.exe
C:PROGRA~1GrisoftAVGFRE~1avgcc.exe
C:PROGRA~1GrisoftAVGFRE~1avgemc.exe
C:Program Files one Labs oneAlarmzlclient.exe
C:Program FilesMSN MessengerMsnMsgr.Exe
C:Program FilesSpybot - Search & DestroyTeaTimer.exe
C:Program FilesiPod iniPodService.exe
C:Program FilesAdobeAcrobat 6.0Distillracrotray.exe
C:Program FilesSony CorporationPicture PackagePicture Package MenuSonyTray.exe
C:Program FilesSony CorporationPicture PackagePicture Package ApplicationsResidence.exe
C:Program FilesApointApntex.exe
C:Program FilesSonyHotKey UtilityHKWnd.exe
C:Program FilesLavasoftAd-Aware SE PersonalAd-Aware.exe
C:Program FilesGrisoftAVG Freeavgwb.dat
C:Program FilesInternet Exploreriexplore.exe
C:WINDOWSsystem32wuauclt.exe
C:DOCUME~1jaredLOCALS~1TempTemporary Directory 1 for hijackthis.zipHijackThis.exe
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://g.msn.co.uk/0SEENGB/SAOS01
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = www.cnn.com/
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = www.club-vaio.sony-europe.com/
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:Program FilesCommon FilesSymantec SharedAdBlockingNISShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:program filesgooglegoogletoolbar2.dll
O3 - Toolbar: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - (no file)
O4 - HKLM..Run: [Apoint] C:Program FilesApointApoint.exe
O4 - HKLM..Run: [ATIPTA] C:Program FilesATI TechnologiesATI Control Panelatiptaxx.exe
O4 - HKLM..Run: [ezShieldProtector for Px] C:WINDOWSSystem32ezSP_Px.exe
O4 - HKLM..Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM..Run: [ccApp] "C:Program FilesCommon FilesSymantec SharedccApp.exe"
O4 - HKLM..Run: [HKSERV.EXE] C:Program FilesSonyHotKey UtilityHKserv.exe
O4 - HKLM..Run: [VAIO Update 2] "C:Program Filessonyvaio update 2VAIOUpdt.exe" /Stationary
O4 - HKLM..Run: [SonyPowerCfg] C:Program Filessonyvaio power managementSPMgr.exe
O4 - HKLM..Run: [Drag'n Drop CD+DVD] C:Program Filesdrag'n drop cd+dvdBinFilesDragDrop.exe /StartUp
O4 - HKLM..Run: [QuickTime Task] "C:Program FilesQuickTimeqttask.exe" -atboottime
O4 - HKLM..Run: [TkBellExe] "C:Program FilesCommon FilesRealUpdate_OB ealsched.exe" -osboot
O4 - HKLM..Run: [Symantec NetDriver Monitor] C:PROGRA~1SYMNET~1SNDMon.exe
O4 - HKLM..Run: [Synchronization loader lokd] h2m6w5s.exe
O4 - HKLM..Run: [Installs SP2] c:windowssystem32qpalsp epcale.exe c:windowssystem32qpalsppalsp.exe
O4 - HKLM..Run: [iTunesHelper] "C:Program FilesiTunesiTunesHelper.exe"
O4 - HKLM..Run: [AVG7_CC] C:PROGRA~1GrisoftAVGFRE~1avgcc.exe /STARTUP
O4 - HKLM..Run: [AVG7_EMC] C:PROGRA~1GrisoftAVGFRE~1avgemc.exe
O4 - HKLM..Run: [Zone Labs Client] C:Program Files one Labs oneAlarmzlclient.exe
O4 - HKLM..Run: [URLLSTCK.exe] C:Program FilesNorton Internet SecurityUrlLstCk.exe
O4 - HKLM..Run: [UserFaultCheck] %systemroot%system32dumprep 0 -u
O4 - HKLM..RunServices: [Synchronization loader lokd] h2m6w5s.exe
O4 - HKLM..RunServices: [Installs SP2] c:windowssystem32qpalsp epcale.exe c:windowssystem32qpalsppalsp.exe
O4 - HKCU..Run: [Synchronization loader lokd] h2m6w5s.exe
O4 - HKCU..Run: [MsnMsgr] "C:Program FilesMSN MessengerMsnMsgr.Exe" /background
O4 - HKCU..Run: [SpybotSD TeaTimer] C:Program FilesSpybot - Search & DestroyTeaTimer.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:Program FilesAdobeAcrobat 6.0Distillracrotray.exe
O4 - Global Startup: Microsoft Office.lnk = C:Program FilesMicrosoft OfficeOfficeOSA9.EXE
O4 - Global Startup: Picture Package Menu.lnk = ?
O4 - Global Startup: Picture Package VCD Maker.lnk = ?
O8 - Extra context menu item: &Google Search - res://c:program filesgoogleGoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:program filesgoogleGoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:program filesgoogleGoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:program filesgoogleGoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:program filesgoogleGoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavaj2re1.4.2_03 in pjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavaj2re1.4.2_03 in pjpi142_03.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=www.club-vaio.sony-europe.com/
O15 - Trusted Zone: *.sony-europe.com
O15 - Trusted Zone: *.sonystyle-europe.com
O15 - Trusted Zone: *.vaio-link.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/WebsiteAccess/ie/bridge-c10.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/17e21b430a54c959d917/netzip/RdxIE601.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {C36112BF-2FA3-4694-8603-3B510EA3B465} (Lycos File Upload Component) - http://f007.mail.lycos.co.uk/app/uploader/FileUploader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:PROGRA~1MSNMES~1msgrapp.dll" (file missing)
O20 - Winlogon Notify: MS-DOS Emulation - C:WINDOWSsystem32k8js0i17e8.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:WINDOWSSystem32Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:PROGRA~1GrisoftAVGFRE~1avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:PROGRA~1GrisoftAVGFRE~1avgupsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:Program FilesCommon FilesSymantec SharedccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:Program FilesCommon FilesSymantec SharedccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:Program FilesCommon FilesSymantec SharedccSetMgr.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:Program FilesiPod iniPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:WINDOWSsystem32LEXBCES.EXE
O23 - Service: PACSPTISVR - Unknown owner - C:Program FilesCommon FilesSony SharedAVLibPacsptisvr.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:Program FilesCommon FilesSymantec SharedSNDSrvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:Program FilesCommon FilesSony SharedAVLibSptisrv.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:Program FilesCommon FilesSymantec SharedSecurity CenterSymWSC.exe
O23 - Service: VAIO Media Music Server (VAIOMediaPlatform-MusicServer-AppServer) - Unknown owner - C:Program Filessonyvaio media music serverSSSvr.exe" /Service=VAIOMediaPlatform-MusicServer-AppServer /DisplayName="VAIO Media Music Server (file missing)
O23 - Service: VAIO Media Music Server (HTTP) (VAIOMediaPlatform-MusicServer-HTTP) - Unknown owner - C:Program FilesCommon FilesSony Sharedvaio media platformsv_httpd.exe" /Service=VAIOMediaPlatform-MusicServer-HTTP /RegRoot="SoftwareSony CorporationVAIO Media Platform2.0" /RegExt="ApplicationsMusicServerHTTP (file missing)
O23 - Service: VAIO Media Music Server (UPnP) (VAIOMediaPlatform-MusicServer-UPnP) - Sony Corporation - C:Program FilesCommon FilesSony Sharedvaio media platformUPnPFramework.exe
O23 - Service: VAIO Media Photo Server (VAIOMediaPlatform-PhotoServer-AppServer) - Sony Corporation - C:Program Filessonyphoto serverappsrvPhotoAppSrv.exe
O23 - Service: VAIO Media Photo Server (HTTP) (VAIOMediaPlatform-PhotoServer-HTTP) - Unknown owner - C:Program FilesCommon Filessony sharedvaio media platformSV_Httpd.exe" /Service=VAIOMediaPlatform-PhotoServer-HTTP /RegRoot="SoftwareSony CorporationVAIO Media Platform2.0" /RegExt="ApplicationsPhotoServerHTTP (file missing)
O23 - Service: VAIO Media Photo Server (UPnP) (VAIOMediaPlatform-PhotoServer-UPnP) - Sony Corporation - C:Program FilesCommon Filessony sharedvaio media platformUPnPFramework.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:WINDOWSsystem32 oneLabsvsmon.exe
All help is much appreciated thanks,
Ben CA
Logfile of HijackThis v1.99.1
Scan saved at 11:54:01, on 30/09/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSSystem32Ati2evxx.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32LEXBCES.EXE
C:WINDOWSsystem32LEXPPS.EXE
C:WINDOWSsystem32spoolsv.exe
C:PROGRA~1GrisoftAVGFRE~1avgamsvr.exe
C:PROGRA~1GrisoftAVGFRE~1avgupsvc.exe
C:Program FilesCommon FilesSymantec SharedccSetMgr.exe
C:WINDOWSsystem32 oneLabsvsmon.exe
C:Program FilesCommon FilesSymantec SharedccEvtMgr.exe
C:Program FilesCommon FilesSymantec SharedSecurity CenterSymWSC.exe
C:WINDOWSsystem32 undll32.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSExplorer.EXE
C:Program FilesApointApoint.exe
C:Program FilesATI TechnologiesATI Control Panelatiptaxx.exe
C:WINDOWSSystem32ezSP_Px.exe
C:WINDOWSsystem32ICO.EXE
C:Program FilesCommon FilesSymantec SharedccApp.exe
C:Program FilesSonyHotKey UtilityHKserv.exe
C:Program Filessonyvaio update 2VAIOUpdt.exe
C:Program Filessonyvaio power managementSPMgr.exe
C:Program Filesdrag'n drop cd+dvdBinFilesDragDrop.exe
C:Program FilesQuickTimeqttask.exe
C:Program FilesCommon FilesRealUpdate_OB ealsched.exe
C:Program FilesiTunesiTunesHelper.exe
C:PROGRA~1GrisoftAVGFRE~1avgcc.exe
C:PROGRA~1GrisoftAVGFRE~1avgemc.exe
C:Program Files one Labs oneAlarmzlclient.exe
C:Program FilesMSN MessengerMsnMsgr.Exe
C:Program FilesSpybot - Search & DestroyTeaTimer.exe
C:Program FilesiPod iniPodService.exe
C:Program FilesAdobeAcrobat 6.0Distillracrotray.exe
C:Program FilesSony CorporationPicture PackagePicture Package MenuSonyTray.exe
C:Program FilesSony CorporationPicture PackagePicture Package ApplicationsResidence.exe
C:Program FilesApointApntex.exe
C:Program FilesSonyHotKey UtilityHKWnd.exe
C:Program FilesLavasoftAd-Aware SE PersonalAd-Aware.exe
C:Program FilesGrisoftAVG Freeavgwb.dat
C:Program FilesInternet Exploreriexplore.exe
C:WINDOWSsystem32wuauclt.exe
C:DOCUME~1jaredLOCALS~1TempTemporary Directory 1 for hijackthis.zipHijackThis.exe
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://g.msn.co.uk/0SEENGB/SAOS01
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = www.cnn.com/
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = www.club-vaio.sony-europe.com/
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:Program FilesCommon FilesSymantec SharedAdBlockingNISShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:program filesgooglegoogletoolbar2.dll
O3 - Toolbar: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - (no file)
O4 - HKLM..Run: [Apoint] C:Program FilesApointApoint.exe
O4 - HKLM..Run: [ATIPTA] C:Program FilesATI TechnologiesATI Control Panelatiptaxx.exe
O4 - HKLM..Run: [ezShieldProtector for Px] C:WINDOWSSystem32ezSP_Px.exe
O4 - HKLM..Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM..Run: [ccApp] "C:Program FilesCommon FilesSymantec SharedccApp.exe"
O4 - HKLM..Run: [HKSERV.EXE] C:Program FilesSonyHotKey UtilityHKserv.exe
O4 - HKLM..Run: [VAIO Update 2] "C:Program Filessonyvaio update 2VAIOUpdt.exe" /Stationary
O4 - HKLM..Run: [SonyPowerCfg] C:Program Filessonyvaio power managementSPMgr.exe
O4 - HKLM..Run: [Drag'n Drop CD+DVD] C:Program Filesdrag'n drop cd+dvdBinFilesDragDrop.exe /StartUp
O4 - HKLM..Run: [QuickTime Task] "C:Program FilesQuickTimeqttask.exe" -atboottime
O4 - HKLM..Run: [TkBellExe] "C:Program FilesCommon FilesRealUpdate_OB ealsched.exe" -osboot
O4 - HKLM..Run: [Symantec NetDriver Monitor] C:PROGRA~1SYMNET~1SNDMon.exe
O4 - HKLM..Run: [Synchronization loader lokd] h2m6w5s.exe
O4 - HKLM..Run: [Installs SP2] c:windowssystem32qpalsp epcale.exe c:windowssystem32qpalsppalsp.exe
O4 - HKLM..Run: [iTunesHelper] "C:Program FilesiTunesiTunesHelper.exe"
O4 - HKLM..Run: [AVG7_CC] C:PROGRA~1GrisoftAVGFRE~1avgcc.exe /STARTUP
O4 - HKLM..Run: [AVG7_EMC] C:PROGRA~1GrisoftAVGFRE~1avgemc.exe
O4 - HKLM..Run: [Zone Labs Client] C:Program Files one Labs oneAlarmzlclient.exe
O4 - HKLM..Run: [URLLSTCK.exe] C:Program FilesNorton Internet SecurityUrlLstCk.exe
O4 - HKLM..Run: [UserFaultCheck] %systemroot%system32dumprep 0 -u
O4 - HKLM..RunServices: [Synchronization loader lokd] h2m6w5s.exe
O4 - HKLM..RunServices: [Installs SP2] c:windowssystem32qpalsp epcale.exe c:windowssystem32qpalsppalsp.exe
O4 - HKCU..Run: [Synchronization loader lokd] h2m6w5s.exe
O4 - HKCU..Run: [MsnMsgr] "C:Program FilesMSN MessengerMsnMsgr.Exe" /background
O4 - HKCU..Run: [SpybotSD TeaTimer] C:Program FilesSpybot - Search & DestroyTeaTimer.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:Program FilesAdobeAcrobat 6.0Distillracrotray.exe
O4 - Global Startup: Microsoft Office.lnk = C:Program FilesMicrosoft OfficeOfficeOSA9.EXE
O4 - Global Startup: Picture Package Menu.lnk = ?
O4 - Global Startup: Picture Package VCD Maker.lnk = ?
O8 - Extra context menu item: &Google Search - res://c:program filesgoogleGoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:program filesgoogleGoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:program filesgoogleGoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:program filesgoogleGoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:program filesgoogleGoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavaj2re1.4.2_03 in pjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavaj2re1.4.2_03 in pjpi142_03.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=www.club-vaio.sony-europe.com/
O15 - Trusted Zone: *.sony-europe.com
O15 - Trusted Zone: *.sonystyle-europe.com
O15 - Trusted Zone: *.vaio-link.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/WebsiteAccess/ie/bridge-c10.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/17e21b430a54c959d917/netzip/RdxIE601.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {C36112BF-2FA3-4694-8603-3B510EA3B465} (Lycos File Upload Component) - http://f007.mail.lycos.co.uk/app/uploader/FileUploader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:PROGRA~1MSNMES~1msgrapp.dll" (file missing)
O20 - Winlogon Notify: MS-DOS Emulation - C:WINDOWSsystem32k8js0i17e8.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:WINDOWSSystem32Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:PROGRA~1GrisoftAVGFRE~1avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:PROGRA~1GrisoftAVGFRE~1avgupsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:Program FilesCommon FilesSymantec SharedccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:Program FilesCommon FilesSymantec SharedccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:Program FilesCommon FilesSymantec SharedccSetMgr.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:Program FilesiPod iniPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:WINDOWSsystem32LEXBCES.EXE
O23 - Service: PACSPTISVR - Unknown owner - C:Program FilesCommon FilesSony SharedAVLibPacsptisvr.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:Program FilesCommon FilesSymantec SharedSNDSrvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:Program FilesCommon FilesSony SharedAVLibSptisrv.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:Program FilesCommon FilesSymantec SharedSecurity CenterSymWSC.exe
O23 - Service: VAIO Media Music Server (VAIOMediaPlatform-MusicServer-AppServer) - Unknown owner - C:Program Filessonyvaio media music serverSSSvr.exe" /Service=VAIOMediaPlatform-MusicServer-AppServer /DisplayName="VAIO Media Music Server (file missing)
O23 - Service: VAIO Media Music Server (HTTP) (VAIOMediaPlatform-MusicServer-HTTP) - Unknown owner - C:Program FilesCommon FilesSony Sharedvaio media platformsv_httpd.exe" /Service=VAIOMediaPlatform-MusicServer-HTTP /RegRoot="SoftwareSony CorporationVAIO Media Platform2.0" /RegExt="ApplicationsMusicServerHTTP (file missing)
O23 - Service: VAIO Media Music Server (UPnP) (VAIOMediaPlatform-MusicServer-UPnP) - Sony Corporation - C:Program FilesCommon FilesSony Sharedvaio media platformUPnPFramework.exe
O23 - Service: VAIO Media Photo Server (VAIOMediaPlatform-PhotoServer-AppServer) - Sony Corporation - C:Program Filessonyphoto serverappsrvPhotoAppSrv.exe
O23 - Service: VAIO Media Photo Server (HTTP) (VAIOMediaPlatform-PhotoServer-HTTP) - Unknown owner - C:Program FilesCommon Filessony sharedvaio media platformSV_Httpd.exe" /Service=VAIOMediaPlatform-PhotoServer-HTTP /RegRoot="SoftwareSony CorporationVAIO Media Platform2.0" /RegExt="ApplicationsPhotoServerHTTP (file missing)
O23 - Service: VAIO Media Photo Server (UPnP) (VAIOMediaPlatform-PhotoServer-UPnP) - Sony Corporation - C:Program FilesCommon Filessony sharedvaio media platformUPnPFramework.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:WINDOWSsystem32 oneLabsvsmon.exe
All help is much appreciated thanks,
Ben CA
Fix these first in safe mode.
O3 - Toolbar: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - (no file)
O4 - HKLM..Run: [Synchronization loader lokd] h2m6w5s.exe
O4 - HKLM..Run: [Installs SP2] c:windowssystem32qpalsp epcale.exe c:windowssystem32qpalsppalsp.exe
O4 - HKLM..Run: [UserFaultCheck] %systemroot%system32dumprep 0 -u
O4 - HKLM..RunServices: [Synchronization loader lokd] h2m6w5s.exe
O4 - HKLM..RunServices: [Installs SP2] c:windowssystem32qpalsp epcale.exe c:windowssystem32qpalsppalsp.exe
O4 - HKCU..Run: [Synchronization loader lokd] h2m6w5s.exe
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:PROGRA~1MSNMES~1msgrapp.dll" (file missing)
O20 - Winlogon Notify: MS-DOS Emulation - C:WINDOWSsystem32k8js0i17e8.dll
O23 - Service: VAIO Media Music Server (VAIOMediaPlatform-MusicServer-AppServer) - Unknown owner - C:Program Filessonyvaio media music serverSSSvr.exe" /Service=VAIOMediaPlatform-MusicServer-AppServer /DisplayName="VAIO Media Music Server (file missing)
O23 - Service: VAIO Media Photo Server (HTTP) (VAIOMediaPlatform-PhotoServer-HTTP) - Unknown owner - C:Program FilesCommon Filessony sharedvaio media platformSV_Httpd.exe" /Service=VAIOMediaPlatform-PhotoServer-HTTP /RegRoot="SoftwareSony CorporationVAIO Media Platform2.0" /RegExt="ApplicationsPhotoServerHTTP (file missing)
(Looks like there was some Sony software that's not correctly installed, might as well lose the incorrect entries)
Stay in safe mode and delete the following files:
h2m6w5s.exe
qpalsppalsp.exe
qpalsp epcale.exe
k8js0i17e8.dll
You might have to view all files and hidden and system files to find them!
Empty the temp directories and clear out the temporary internet files. It should be healthier by then. It may need a couple of attacks, bear in mind this software is intentionally difficult to locate!
Once it's fixed, get Firefox
O3 - Toolbar: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - (no file)
O4 - HKLM..Run: [Synchronization loader lokd] h2m6w5s.exe
O4 - HKLM..Run: [Installs SP2] c:windowssystem32qpalsp epcale.exe c:windowssystem32qpalsppalsp.exe
O4 - HKLM..Run: [UserFaultCheck] %systemroot%system32dumprep 0 -u
O4 - HKLM..RunServices: [Synchronization loader lokd] h2m6w5s.exe
O4 - HKLM..RunServices: [Installs SP2] c:windowssystem32qpalsp epcale.exe c:windowssystem32qpalsppalsp.exe
O4 - HKCU..Run: [Synchronization loader lokd] h2m6w5s.exe
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:PROGRA~1MSNMES~1msgrapp.dll" (file missing)
O20 - Winlogon Notify: MS-DOS Emulation - C:WINDOWSsystem32k8js0i17e8.dll
O23 - Service: VAIO Media Music Server (VAIOMediaPlatform-MusicServer-AppServer) - Unknown owner - C:Program Filessonyvaio media music serverSSSvr.exe" /Service=VAIOMediaPlatform-MusicServer-AppServer /DisplayName="VAIO Media Music Server (file missing)
O23 - Service: VAIO Media Photo Server (HTTP) (VAIOMediaPlatform-PhotoServer-HTTP) - Unknown owner - C:Program FilesCommon Filessony sharedvaio media platformSV_Httpd.exe" /Service=VAIOMediaPlatform-PhotoServer-HTTP /RegRoot="SoftwareSony CorporationVAIO Media Platform2.0" /RegExt="ApplicationsPhotoServerHTTP (file missing)
(Looks like there was some Sony software that's not correctly installed, might as well lose the incorrect entries)
Stay in safe mode and delete the following files:
h2m6w5s.exe
qpalsppalsp.exe
qpalsp epcale.exe
k8js0i17e8.dll
You might have to view all files and hidden and system files to find them!
Empty the temp directories and clear out the temporary internet files. It should be healthier by then. It may need a couple of attacks, bear in mind this software is intentionally difficult to locate!
Once it's fixed, get Firefox
Thanks, have "fixed" all that you have listed (just restarting to double check)
Im not sure where to look for the files that you list though?? Im really not very technically minded (in the computer sense anyway) so if you can just point me in the right direction a little I would really appreciate it!!
Oh, also - his recycle bin *always* has 50 items in it and they cannot be emptied (or seen for that matter) - any ideas??
its a right mess!!!
Thanks again,
BCA
Im not sure where to look for the files that you list though?? Im really not very technically minded (in the computer sense anyway) so if you can just point me in the right direction a little I would really appreciate it!!
Oh, also - his recycle bin *always* has 50 items in it and they cannot be emptied (or seen for that matter) - any ideas??
its a right mess!!! Thanks again,
BCA
Still cant find them??? Im really sorry im rubbish with computers, is there something im not quite understanding?? I have looked in system32 + searched files (+extended the search for hidden files etc etc) and still nothing.
He is still unable to do a complete virus scan + even the incomplete version comes up with a few virus's??
Thanks for your continued help BlairOut, sorry about my inability to deal with computers!!
He is still unable to do a complete virus scan + even the incomplete version comes up with a few virus's??
Thanks for your continued help BlairOut, sorry about my inability to deal with computers!!
OK, so where are we? Popups should have gone by now.
So, right click on the C drive, properties, tools, scan for errors (Automatically fix file system errors)..... It'll probably ask you to schedule it for the next boot up.
Make sure that's done first and coming up clean, and then try an anti-virus scan again.
Make sure no other AV software is installed on the PC before scanning.
So, right click on the C drive, properties, tools, scan for errors (Automatically fix file system errors)..... It'll probably ask you to schedule it for the next boot up.
Make sure that's done first and coming up clean, and then try an anti-virus scan again.
Make sure no other AV software is installed on the PC before scanning.
Little update: Pop ups return whenever it is connected to the uni network. AVG still doesnt work properly (it doesnt do a full scan and still picks up 8 virus's but cannot "heal" them. They do not go in his virus vault either.
Adaware/ spybot/ ccleaner etc etc have all been used and its still not 100% I have done as you suggested with the system check which went fine, but had no real effect/ results.
its not looking too hopeful atm
+our work has just started so he could do with his computer running perfectly once more.
Any further help is desperately needed and much appreciated,
Thanks again,
Ben CA
Adaware/ spybot/ ccleaner etc etc have all been used and its still not 100% I have done as you suggested with the system check which went fine, but had no real effect/ results.
its not looking too hopeful atm +our work has just started so he could do with his computer running perfectly once more.
Any further help is desperately needed and much appreciated,
Thanks again,
Ben CA
BliarOut said:
Turn off system restore and then post another hijack this log.... It does take persistence to cure them all 
Did you run a full scandisk?
How do I turn off system restore? / I did a full system check, not sure about scan disk - is that not the thing that runs when you dont turn it off properly??
So sorry about my technical ignorance, just explain it to me as you would to a 6 year old and I'll know what to do
Thanks again BlairOut, I owe you a
at the next PF!Heres the HijackThis log. Norton is still very much present and it seems like everything I do has no real effect. AVG still cannot do a full scan, and although the computer is running much better, the pop ups are still here - and we know there are atleast 4 virus's present. HELP!!!!!
Logfile of HijackThis v1.99.1
Scan saved at 13:23:37, on 05/10/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSSystem32Ati2evxx.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32LEXBCES.EXE
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSsystem32LEXPPS.EXE
C:PROGRA~1GrisoftAVGFRE~1avgamsvr.exe
C:PROGRA~1GrisoftAVGFRE~1avgupsvc.exe
C:Program FilesCommon FilesSymantec SharedccSetMgr.exe
C:WINDOWSsystem32 oneLabsvsmon.exe
C:Program FilesCommon FilesSymantec SharedccEvtMgr.exe
C:Program FilesCommon FilesSymantec SharedSecurity CenterSymWSC.exe
C:WINDOWSsystem32 undll32.exe
C:WINDOWSExplorer.EXE
C:Program FilesApointApoint.exe
C:Program FilesATI TechnologiesATI Control Panelatiptaxx.exe
C:WINDOWSSystem32ezSP_Px.exe
C:WINDOWSsystem32ICO.EXE
C:Program FilesCommon FilesSymantec SharedccApp.exe
C:Program FilesSonyHotKey UtilityHKserv.exe
C:Program Filessonyvaio update 2VAIOUpdt.exe
C:Program Filessonyvaio power managementSPMgr.exe
C:Program Filesdrag'n drop cd+dvdBinFilesDragDrop.exe
C:Program FilesQuickTimeqttask.exe
C:Program FilesCommon FilesRealUpdate_OB ealsched.exe
C:Program FilesiTunesiTunesHelper.exe
C:Program Files one Labs oneAlarmzlclient.exe
C:PROGRA~1GrisoftAVGFRE~1avgcc.exe
C:PROGRA~1GrisoftAVGFRE~1avgemc.exe
C:Program FilesMSN MessengerMsnMsgr.Exe
C:Program FilesSpybot - Search & DestroyTeaTimer.exe
C:Program FilesAdobeAcrobat 6.0Distillracrotray.exe
C:Program FilesSony CorporationPicture PackagePicture Package MenuSonyTray.exe
C:Program FilesSony CorporationPicture PackagePicture Package ApplicationsResidence.exe
C:Program FilesiPod iniPodService.exe
C:Program FilesApointApntex.exe
C:Program FilesSonyHotKey UtilityHKWnd.exe
C:WINDOWSsystem32wuauclt.exe
C:DOCUME~1jaredLOCALS~1TempTemporary Directory 1 for hijackthis.zipHijackThis.exe
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://g.msn.co.uk/0SEENGB/SAOS01
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = www.cnn.com/
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = www.club-vaio.sony-europe.com/
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:Program FilesCommon FilesSymantec SharedAdBlockingNISShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:program filesgooglegoogletoolbar2.dll
O4 - HKLM..Run: [Apoint] C:Program FilesApointApoint.exe
O4 - HKLM..Run: [ATIPTA] C:Program FilesATI TechnologiesATI Control Panelatiptaxx.exe
O4 - HKLM..Run: [ezShieldProtector for Px] C:WINDOWSSystem32ezSP_Px.exe
O4 - HKLM..Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM..Run: [ccApp] "C:Program FilesCommon FilesSymantec SharedccApp.exe"
O4 - HKLM..Run: [HKSERV.EXE] C:Program FilesSonyHotKey UtilityHKserv.exe
O4 - HKLM..Run: [VAIO Update 2] "C:Program Filessonyvaio update 2VAIOUpdt.exe" /Stationary
O4 - HKLM..Run: [SonyPowerCfg] C:Program Filessonyvaio power managementSPMgr.exe
O4 - HKLM..Run: [Drag'n Drop CD+DVD] C:Program Filesdrag'n drop cd+dvdBinFilesDragDrop.exe /StartUp
O4 - HKLM..Run: [QuickTime Task] "C:Program FilesQuickTimeqttask.exe" -atboottime
O4 - HKLM..Run: [TkBellExe] "C:Program FilesCommon FilesRealUpdate_OB ealsched.exe" -osboot
O4 - HKLM..Run: [Symantec NetDriver Monitor] C:PROGRA~1SYMNET~1SNDMon.exe
O4 - HKLM..Run: [iTunesHelper] "C:Program FilesiTunesiTunesHelper.exe"
O4 - HKLM..Run: [Zone Labs Client] C:Program Files one Labs oneAlarmzlclient.exe
O4 - HKLM..Run: [URLLSTCK.exe] C:Program FilesNorton Internet SecurityUrlLstCk.exe
O4 - HKLM..Run: [UserFaultCheck] %systemroot%system32dumprep 0 -u
O4 - HKLM..Run: [AVG7_CC] C:PROGRA~1GrisoftAVGFRE~1avgcc.exe /STARTUP
O4 - HKLM..Run: [AVG7_EMC] C:PROGRA~1GrisoftAVGFRE~1avgemc.exe
O4 - HKCU..Run: [MsnMsgr] "C:Program FilesMSN MessengerMsnMsgr.Exe" /background
O4 - HKCU..Run: [SpybotSD TeaTimer] C:Program FilesSpybot - Search & DestroyTeaTimer.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:Program FilesAdobeAcrobat 6.0Distillracrotray.exe
O4 - Global Startup: Microsoft Office.lnk = C:Program FilesMicrosoft OfficeOfficeOSA9.EXE
O4 - Global Startup: Picture Package Menu.lnk = ?
O4 - Global Startup: Picture Package VCD Maker.lnk = ?
O8 - Extra context menu item: &Google Search - res://c:program filesgoogleGoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:program filesgoogleGoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:program filesgoogleGoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:program filesgoogleGoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:program filesgoogleGoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavaj2re1.4.2_03 in pjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavaj2re1.4.2_03 in pjpi142_03.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=www.club-vaio.sony-europe.com/
O15 - Trusted Zone: *.sony-europe.com
O15 - Trusted Zone: *.sonystyle-europe.com
O15 - Trusted Zone: *.vaio-link.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/WebsiteAccess/ie/bridge-c10.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/17e21b430a54c959d917/netzip/RdxIE601.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {C36112BF-2FA3-4694-8603-3B510EA3B465} (Lycos File Upload Component) - http://f007.mail.lycos.co.uk/app/uploader/FileUploader.cab
O20 - Winlogon Notify: RunOnce - C:WINDOWSsystem32lvr2099oe.dll
O20 - Winlogon Notify: ShellCompatibility - C:WINDOWSsystem32j84o0ih3e84.dll (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:WINDOWSSystem32Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:PROGRA~1GrisoftAVGFRE~1avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:PROGRA~1GrisoftAVGFRE~1avgupsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:Program FilesCommon FilesSymantec SharedccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:Program FilesCommon FilesSymantec SharedccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:Program FilesCommon FilesSymantec SharedccSetMgr.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:Program FilesiPod iniPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:WINDOWSsystem32LEXBCES.EXE
O23 - Service: PACSPTISVR - Unknown owner - C:Program FilesCommon FilesSony SharedAVLibPacsptisvr.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:Program FilesCommon FilesSymantec SharedSNDSrvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:Program FilesCommon FilesSony SharedAVLibSptisrv.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:Program FilesCommon FilesSymantec SharedSecurity CenterSymWSC.exe
O23 - Service: VAIO Media Music Server (VAIOMediaPlatform-MusicServer-AppServer) - Unknown owner - C:Program Filessonyvaio media music serverSSSvr.exe" /Service=VAIOMediaPlatform-MusicServer-AppServer /DisplayName="VAIO Media Music Server (file missing)
O23 - Service: VAIO Media Music Server (HTTP) (VAIOMediaPlatform-MusicServer-HTTP) - Unknown owner - C:Program FilesCommon FilesSony Sharedvaio media platformsv_httpd.exe" /Service=VAIOMediaPlatform-MusicServer-HTTP /RegRoot="SoftwareSony CorporationVAIO Media Platform2.0" /RegExt="ApplicationsMusicServerHTTP (file missing)
O23 - Service: VAIO Media Music Server (UPnP) (VAIOMediaPlatform-MusicServer-UPnP) - Sony Corporation - C:Program FilesCommon FilesSony Sharedvaio media platformUPnPFramework.exe
O23 - Service: VAIO Media Photo Server (VAIOMediaPlatform-PhotoServer-AppServer) - Sony Corporation - C:Program Filessonyphoto serverappsrvPhotoAppSrv.exe
O23 - Service: VAIO Media Photo Server (HTTP) (VAIOMediaPlatform-PhotoServer-HTTP) - Unknown owner - C:Program FilesCommon Filessony sharedvaio media platformSV_Httpd.exe" /Service=VAIOMediaPlatform-PhotoServer-HTTP /RegRoot="SoftwareSony CorporationVAIO Media Platform2.0" /RegExt="ApplicationsPhotoServerHTTP (file missing)
O23 - Service: VAIO Media Photo Server (UPnP) (VAIOMediaPlatform-PhotoServer-UPnP) - Sony Corporation - C:Program FilesCommon Filessony sharedvaio media platformUPnPFramework.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:WINDOWSsystem32 oneLabsvsmon.exe
Norton is still very much present and it seems like everything I do has no real effect. AVG still cannot do a full scan, and although the computer is running much better, the pop ups are still here - and we know there are atleast 4 virus's present. HELP!!!!! Logfile of HijackThis v1.99.1
Scan saved at 13:23:37, on 05/10/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSSystem32Ati2evxx.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32LEXBCES.EXE
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSsystem32LEXPPS.EXE
C:PROGRA~1GrisoftAVGFRE~1avgamsvr.exe
C:PROGRA~1GrisoftAVGFRE~1avgupsvc.exe
C:Program FilesCommon FilesSymantec SharedccSetMgr.exe
C:WINDOWSsystem32 oneLabsvsmon.exe
C:Program FilesCommon FilesSymantec SharedccEvtMgr.exe
C:Program FilesCommon FilesSymantec SharedSecurity CenterSymWSC.exe
C:WINDOWSsystem32 undll32.exe
C:WINDOWSExplorer.EXE
C:Program FilesApointApoint.exe
C:Program FilesATI TechnologiesATI Control Panelatiptaxx.exe
C:WINDOWSSystem32ezSP_Px.exe
C:WINDOWSsystem32ICO.EXE
C:Program FilesCommon FilesSymantec SharedccApp.exe
C:Program FilesSonyHotKey UtilityHKserv.exe
C:Program Filessonyvaio update 2VAIOUpdt.exe
C:Program Filessonyvaio power managementSPMgr.exe
C:Program Filesdrag'n drop cd+dvdBinFilesDragDrop.exe
C:Program FilesQuickTimeqttask.exe
C:Program FilesCommon FilesRealUpdate_OB ealsched.exe
C:Program FilesiTunesiTunesHelper.exe
C:Program Files one Labs oneAlarmzlclient.exe
C:PROGRA~1GrisoftAVGFRE~1avgcc.exe
C:PROGRA~1GrisoftAVGFRE~1avgemc.exe
C:Program FilesMSN MessengerMsnMsgr.Exe
C:Program FilesSpybot - Search & DestroyTeaTimer.exe
C:Program FilesAdobeAcrobat 6.0Distillracrotray.exe
C:Program FilesSony CorporationPicture PackagePicture Package MenuSonyTray.exe
C:Program FilesSony CorporationPicture PackagePicture Package ApplicationsResidence.exe
C:Program FilesiPod iniPodService.exe
C:Program FilesApointApntex.exe
C:Program FilesSonyHotKey UtilityHKWnd.exe
C:WINDOWSsystem32wuauclt.exe
C:DOCUME~1jaredLOCALS~1TempTemporary Directory 1 for hijackthis.zipHijackThis.exe
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://g.msn.co.uk/0SEENGB/SAOS01
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = www.cnn.com/
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = www.club-vaio.sony-europe.com/
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:Program FilesCommon FilesSymantec SharedAdBlockingNISShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:program filesgooglegoogletoolbar2.dll
O4 - HKLM..Run: [Apoint] C:Program FilesApointApoint.exe
O4 - HKLM..Run: [ATIPTA] C:Program FilesATI TechnologiesATI Control Panelatiptaxx.exe
O4 - HKLM..Run: [ezShieldProtector for Px] C:WINDOWSSystem32ezSP_Px.exe
O4 - HKLM..Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM..Run: [ccApp] "C:Program FilesCommon FilesSymantec SharedccApp.exe"
O4 - HKLM..Run: [HKSERV.EXE] C:Program FilesSonyHotKey UtilityHKserv.exe
O4 - HKLM..Run: [VAIO Update 2] "C:Program Filessonyvaio update 2VAIOUpdt.exe" /Stationary
O4 - HKLM..Run: [SonyPowerCfg] C:Program Filessonyvaio power managementSPMgr.exe
O4 - HKLM..Run: [Drag'n Drop CD+DVD] C:Program Filesdrag'n drop cd+dvdBinFilesDragDrop.exe /StartUp
O4 - HKLM..Run: [QuickTime Task] "C:Program FilesQuickTimeqttask.exe" -atboottime
O4 - HKLM..Run: [TkBellExe] "C:Program FilesCommon FilesRealUpdate_OB ealsched.exe" -osboot
O4 - HKLM..Run: [Symantec NetDriver Monitor] C:PROGRA~1SYMNET~1SNDMon.exe
O4 - HKLM..Run: [iTunesHelper] "C:Program FilesiTunesiTunesHelper.exe"
O4 - HKLM..Run: [Zone Labs Client] C:Program Files one Labs oneAlarmzlclient.exe
O4 - HKLM..Run: [URLLSTCK.exe] C:Program FilesNorton Internet SecurityUrlLstCk.exe
O4 - HKLM..Run: [UserFaultCheck] %systemroot%system32dumprep 0 -u
O4 - HKLM..Run: [AVG7_CC] C:PROGRA~1GrisoftAVGFRE~1avgcc.exe /STARTUP
O4 - HKLM..Run: [AVG7_EMC] C:PROGRA~1GrisoftAVGFRE~1avgemc.exe
O4 - HKCU..Run: [MsnMsgr] "C:Program FilesMSN MessengerMsnMsgr.Exe" /background
O4 - HKCU..Run: [SpybotSD TeaTimer] C:Program FilesSpybot - Search & DestroyTeaTimer.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:Program FilesAdobeAcrobat 6.0Distillracrotray.exe
O4 - Global Startup: Microsoft Office.lnk = C:Program FilesMicrosoft OfficeOfficeOSA9.EXE
O4 - Global Startup: Picture Package Menu.lnk = ?
O4 - Global Startup: Picture Package VCD Maker.lnk = ?
O8 - Extra context menu item: &Google Search - res://c:program filesgoogleGoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:program filesgoogleGoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:program filesgoogleGoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:program filesgoogleGoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:program filesgoogleGoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavaj2re1.4.2_03 in pjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavaj2re1.4.2_03 in pjpi142_03.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=www.club-vaio.sony-europe.com/
O15 - Trusted Zone: *.sony-europe.com
O15 - Trusted Zone: *.sonystyle-europe.com
O15 - Trusted Zone: *.vaio-link.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/WebsiteAccess/ie/bridge-c10.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/17e21b430a54c959d917/netzip/RdxIE601.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {C36112BF-2FA3-4694-8603-3B510EA3B465} (Lycos File Upload Component) - http://f007.mail.lycos.co.uk/app/uploader/FileUploader.cab
O20 - Winlogon Notify: RunOnce - C:WINDOWSsystem32lvr2099oe.dll
O20 - Winlogon Notify: ShellCompatibility - C:WINDOWSsystem32j84o0ih3e84.dll (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:WINDOWSSystem32Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:PROGRA~1GrisoftAVGFRE~1avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:PROGRA~1GrisoftAVGFRE~1avgupsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:Program FilesCommon FilesSymantec SharedccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:Program FilesCommon FilesSymantec SharedccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:Program FilesCommon FilesSymantec SharedccSetMgr.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:Program FilesiPod iniPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:WINDOWSsystem32LEXBCES.EXE
O23 - Service: PACSPTISVR - Unknown owner - C:Program FilesCommon FilesSony SharedAVLibPacsptisvr.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:Program FilesCommon FilesSymantec SharedSNDSrvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:Program FilesCommon FilesSony SharedAVLibSptisrv.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:Program FilesCommon FilesSymantec SharedSecurity CenterSymWSC.exe
O23 - Service: VAIO Media Music Server (VAIOMediaPlatform-MusicServer-AppServer) - Unknown owner - C:Program Filessonyvaio media music serverSSSvr.exe" /Service=VAIOMediaPlatform-MusicServer-AppServer /DisplayName="VAIO Media Music Server (file missing)
O23 - Service: VAIO Media Music Server (HTTP) (VAIOMediaPlatform-MusicServer-HTTP) - Unknown owner - C:Program FilesCommon FilesSony Sharedvaio media platformsv_httpd.exe" /Service=VAIOMediaPlatform-MusicServer-HTTP /RegRoot="SoftwareSony CorporationVAIO Media Platform2.0" /RegExt="ApplicationsMusicServerHTTP (file missing)
O23 - Service: VAIO Media Music Server (UPnP) (VAIOMediaPlatform-MusicServer-UPnP) - Sony Corporation - C:Program FilesCommon FilesSony Sharedvaio media platformUPnPFramework.exe
O23 - Service: VAIO Media Photo Server (VAIOMediaPlatform-PhotoServer-AppServer) - Sony Corporation - C:Program Filessonyphoto serverappsrvPhotoAppSrv.exe
O23 - Service: VAIO Media Photo Server (HTTP) (VAIOMediaPlatform-PhotoServer-HTTP) - Unknown owner - C:Program FilesCommon Filessony sharedvaio media platformSV_Httpd.exe" /Service=VAIOMediaPlatform-PhotoServer-HTTP /RegRoot="SoftwareSony CorporationVAIO Media Platform2.0" /RegExt="ApplicationsPhotoServerHTTP (file missing)
O23 - Service: VAIO Media Photo Server (UPnP) (VAIOMediaPlatform-PhotoServer-UPnP) - Sony Corporation - C:Program FilesCommon Filessony sharedvaio media platformUPnPFramework.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:WINDOWSsystem32 oneLabsvsmon.exe
Gassing Station | Computers, Gadgets & Stuff | Top of Page | What's New | My Stuff