Solved Possible rootkit infection

[Resolved] Possible rootkit infection

Hello all,

looks like i got a nasty rootkit infection...

Symptoms:

- Computer freezes while on internet, especially if watching video (flash based, didnt try with divx)
- Computer won't complete shutdown (stuck at "shutting the computer down screen ")
- Reinstalling Windows XP from recovery kit DID NOT solve the problem.
- Windows update won't work
- Cant install certain software (like Intel Wifi updates, HJT is fine)


DDS


DDS (Ver_10-03-17.01) - NTFSx86
Run by rodrigo at 11:02:38.03 on 27/03/2010
Internet Explorer: 6.0.2900.2180
Microsoft Windows XP Professional 5.1.2600.2.1252.44.1033.18.2046.1353 [GMT 1:00]

AV: Norton Internet Security 2006 *On-access scanning enabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}
FW: Norton Internet Security 2006 *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
C:\WINDOWS\System32\GEARSec.exe
C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe
C:\Program Files\Norton Ghost\Agent\VProSvc.exe
C:\WINDOWS\system32\nvsvc32.exe
svchost.exe
C:\Program Files\SigmaTel\C-Major Audio\WDM\StacSV.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\system32\ICO.EXE
C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe
C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Sony\ISB Utility\ISBMgr.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Sony\AppMonUtil\AppMonUtility.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\rodrigo\My Documents\Downloads\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.club-vaio.com/en/
uInternet Connection Wizard,ShellNext = hxxp://www.club-vaio.com/en/
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.5.0_06\bin\ssv.dll
BHO: CNisExtBho Class: {9ecb9560-04f9-4bbc-943d-298ddf1699e1} - c:\program files\common files\symantec shared\adblocking\NISShExt.dll
BHO: CNavExtBho Class: {a8f38d8d-e480-4d52-b7a2-731bb6995fdd} - c:\program files\norton internet security\norton antivirus\NavShExt.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar1.dll
BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\progra~1\google~1\BAE.dll
TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar1.dll
TB: Norton Internet Security 2006: {0b53eac3-8d69-4b9e-9b19-a37c9a5676a7} - c:\program files\common files\symantec shared\adblocking\NISShExt.dll
TB: Norton AntiVirus: {c4069e3a-68f1-403e-b40e-20066696354b} - c:\program files\norton internet security\norton antivirus\NavShExt.dll
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [Apoint] c:\program files\apoint\Apoint.exe
mRun: [ehTray] c:\windows\ehome\ehtray.exe
mRun: [Mouse Suite 98 Daemon] ICO.EXE
mRun: [VAIOCameraUtility] "c:\program files\sony\vaio camera utility\VCUServe.exe "
mRun: [SonyPowerCfg] "c:\program files\sony\vaio power management\SPMgr.exe "
mRun: [ISBMgr.exe] c:\program files\sony\isb utility\ISBMgr.exe
mRun: [Switcher.exe] c:\program files\sony\wireless switch setting utility\Switcher.exe
mRun: [VAIO Update 2] "c:\program files\sony\vaio update 2\VAIOUpdt.exe" /Stationary
mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe "
mRun: [URLLSTCK.exe] c:\program files\norton internet security\UrlLstCk.exe
mRun: [AppMon Utility] "c:\program files\sony\appmonutil\AppMonUtility.exe" @@@Start
mRun: [Acrobat Assistant 7.0] "c:\program files\adobe\acrobat 7.0\distillr\Acrotray.exe "
mRun: [Norton Ghost 10.0] "c:\program files\norton ghost\agent\GhostTray.exe "
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
IE: &Google Search - c:\program files\google\GoogleToolbar1.dll/cmsearch.html
IE: &Translate English Word - c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
IE: Add RSS Support Site to VAIO Information FLOW - c:\program files\sony\vaio information flow\aiesc.html
IE: Backward Links - c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
IE: Cached Snapshot of Page - c:\program files\google\GoogleToolbar1.dll/cmcache.html
IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office11\EXCEL.EXE/3000
IE: Similar Pages - c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
IE: Translate Page into English - c:\program files\google\GoogleToolbar1.dll/cmtrans.html
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC} - c:\program files\java\jre1.5.0_06\bin\ssv.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office11\REFIEBAR.DLL
Trusted Zone: sony-europe.com
Trusted Zone: sonystyle-europe.com
Trusted Zone: vaio-link.com
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1269639370593
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
Notify: VESWinlogon - VESWinlogon.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\rodrigo\applic~1\mozilla\firefox\profiles\q40wq3du.default\
FF - plugin: c:\program files\java\jre1.5.0_06\bin\NPJava11.dll
FF - plugin: c:\program files\java\jre1.5.0_06\bin\NPJava12.dll
FF - plugin: c:\program files\java\jre1.5.0_06\bin\NPJava13.dll
FF - plugin: c:\program files\java\jre1.5.0_06\bin\NPJava14.dll
FF - plugin: c:\program files\java\jre1.5.0_06\bin\NPJava32.dll
FF - plugin: c:\program files\java\jre1.5.0_06\bin\NPJPI150_06.dll
FF - plugin: c:\program files\java\jre1.5.0_06\bin\NPOJI610.dll

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl3.rsa_seed_sha ", true);

============= SERVICES / DRIVERS ===============

R1 SAVRTPEL;SAVRTPEL;c:\program files\norton internet security\norton antivirus\Savrtpel.sys [2006-1-25 53896]
R2 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\ccEvtMgr.exe [2006-1-25 192112]
R2 ccProxy;Symantec Network Proxy;c:\program files\common files\symantec shared\ccProxy.exe [2006-1-25 202352]
R2 ccSetMgr;Symantec Settings Manager;c:\program files\common files\symantec shared\ccSetMgr.exe [2006-1-25 169584]
R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]
R2 MSSQL$VAIO_VEDB;MSSQL$VAIO_VEDB;c:\program files\microsoft sql server\mssql$vaio_vedb\binn\sqlservr.exe -svaio_vedb --> c:\program files\microsoft sql server\mssql$vaio_vedb\binn\sqlservr.exe -sVAIO_VEDB [?]
R2 navapsvc;Norton AntiVirus Auto-Protect Service;c:\program files\norton internet security\norton antivirus\NAVAPSVC.EXE [2006-1-25 139888]
R2 Symantec Core LC;Symantec Core LC;c:\program files\common files\symantec shared\ccpd-lc\symlcsvc.exe [2006-7-31 1251720]
R3 5U870CAP_VID_1262&PID_25FD;Sony Visual Communication Camera VGP-VCC2 ;c:\windows\system32\drivers\5U870CAP.sys [2006-7-28 75264]
R3 AVerM115S;AVerM115S service;c:\windows\system32\drivers\AVerM115S.sys [2006-7-28 754688]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2010-3-26 102448]
R3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20100326.019\NAVENG.Sys [2010-3-27 84912]
R3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20100326.019\NavEx15.Sys [2010-3-27 1324720]
R3 SAVRT;SAVRT;c:\program files\norton internet security\norton antivirus\savrt.sys [2006-1-25 334984]
R3 SonyImgF;Sony Image Conversion Filter Driver;c:\windows\system32\drivers\SonyImgF.sys [2006-7-28 30080]
R3 ti21sony;ti21sony;c:\windows\system32\drivers\ti21sony.sys [2006-7-28 226304]
S3 ccPwdSvc;Symantec Password Validation;c:\program files\common files\symantec shared\ccPwdSvc.exe [2004-12-13 79472]
S3 SAVScan;Symantec AVScan;c:\program files\norton internet security\norton antivirus\SAVScan.exe [2006-1-25 198368]
S3 SQLAgent$VAIO_VEDB;SQLAgent$VAIO_VEDB;c:\program files\microsoft sql server\mssql$vaio_vedb\binn\sqlagent.exe -i vaio_vedb --> c:\program files\microsoft sql server\mssql$vaio_vedb\binn\sqlagent.EXE -i VAIO_VEDB [?]

=============== Created Last 30 ================

2010-03-27 02:04:55 0 d-----w- c:\windows\ServicePackFiles
2010-03-27 02:02:56 0 d-----w- c:\program files\MSXML 4.0
2010-03-27 01:58:23 0 d-sha-r- C:\cmdcons
2010-03-27 01:56:54 98816 ----a-w- c:\windows\sed.exe
2010-03-27 01:56:54 77312 ----a-w- c:\windows\MBR.exe
2010-03-27 01:56:54 261632 ----a-w- c:\windows\PEV.exe
2010-03-27 01:56:54 161792 ----a-w- c:\windows\SWREG.exe
2010-03-27 01:53:50 0 d-----w- c:\program files\TrendMicro
2010-03-27 01:47:22 0 d-----w- c:\windows\system32\drivers\NSS
2010-03-27 01:47:22 0 d-----w- c:\program files\Norton Security Scan
2010-03-27 01:47:22 0 d-----w- c:\docume~1\alluse~1\applic~1\Norton
2010-03-27 01:47:17 0 d-----w- c:\program files\NortonInstaller
2010-03-27 01:47:17 0 d-----w- c:\docume~1\alluse~1\applic~1\NortonInstaller
2010-03-27 00:32:31 0 d-----w- c:\program files\Karen's Power Tools
2010-03-27 00:32:18 0 d-----w- c:\docume~1\alluse~1\applic~1\Karen's Power Tools
2010-03-26 23:39:32 65776 ----a-w- c:\windows\UnDeploy.exe
2010-03-26 23:39:32 0 d-----w- c:\program files\LookInMyPC
2010-03-26 23:24:20 0 d-----w- c:\windows\system32\CatRoot_bak
2010-03-26 23:23:08 352640 -c----w- c:\windows\system32\dllcache\srv.sys
2010-03-26 23:22:53 82432 -c----w- c:\windows\system32\dllcache\fontsub.dll
2010-03-26 23:22:51 3555328 -c----w- c:\windows\system32\dllcache\moviemk.exe
2010-03-26 23:22:18 453760 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2010-03-26 23:21:19 470528 -c----w- c:\windows\system32\dllcache\aclayers.dll
2010-03-26 23:20:27 153088 -c----w- c:\windows\system32\dllcache\triedit.dll
2010-03-26 23:18:03 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll
2010-03-26 23:17:55 655872 -c----w- c:\windows\system32\dllcache\mstscax.dll
2010-03-26 23:17:47 128512 -c----w- c:\windows\system32\dllcache\dhtmled.ocx
2010-03-26 23:14:38 1172480 -c----w- c:\windows\system32\dllcache\msxml3.dll
2010-03-26 23:14:31 332800 -c----w- c:\windows\system32\dllcache\netapi32.dll
2010-03-26 23:14:26 331776 -c----w- c:\windows\system32\dllcache\msadce.dll
2010-03-26 23:13:57 683520 -c----w- c:\windows\system32\dllcache\inetcomm.dll
2010-03-26 23:13:29 272128 -c----w- c:\windows\system32\dllcache\bthport.sys
2010-03-26 23:13:29 272128 ------w- c:\windows\system32\drivers\bthport.sys
2010-03-26 23:13:24 202752 -c----w- c:\windows\system32\dllcache\rmcast.sys
2010-03-26 22:59:56 0 d-----w- c:\docume~1\rodrigo\applic~1\Digital Support
2010-03-26 22:59:29 0 d-----w- c:\program files\Digital Support
2010-03-26 22:12:16 0 d-----w- c:\docume~1\rodrigo\applic~1\Intel
2010-03-26 22:06:39 663552 ----a-w- c:\windows\system32\NETw5c32.dll
2010-03-26 22:06:39 4221952 ----a-w- c:\windows\system32\drivers\NETw5x32.sys
2010-03-26 22:06:39 2756608 ----a-w- c:\windows\system32\NETw5r32.dll
2010-03-26 22:06:23 0 d-----w- c:\program files\common files\Intel
2010-03-26 21:54:20 294912 -c----w- c:\windows\system32\dllcache\msctf.dll
2010-03-26 21:40:40 0 d-----w- c:\windows\system32\PreInstall
2010-03-26 21:37:16 21728 ----a-w- c:\windows\system32\wucltui.dll.mui
2010-03-26 21:37:16 17632 ----a-w- c:\windows\system32\wuaueng.dll.mui
2010-03-26 21:37:16 15072 ----a-w- c:\windows\system32\wuaucpl.cpl.mui
2010-03-26 21:37:15 15064 ----a-w- c:\windows\system32\wuapi.dll.mui
2010-03-26 21:37:15 0 d-----w- c:\windows\system32\SoftwareDistribution
2010-03-26 21:35:49 0 d-s---w- c:\documents and settings\rodrigo\UserData
2010-03-26 21:22:47 0 d-----w- c:\program files\VS Revo Group
2010-03-26 19:46:24 0 d-----w- c:\windows\system32\LogFiles
2010-03-26 19:26:58 0 d-----w- c:\docume~1\rodrigo\applic~1\Avira
2010-03-26 18:18:50 0 d-----w- c:\docume~1\rodrigo\applic~1\Malwarebytes
2010-03-26 18:18:41 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-26 18:18:37 0 d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
2010-03-26 18:18:36 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-03-26 18:18:35 0 d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-03-26 01:03:57 60936 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2010-03-26 01:03:55 0 d-----w- c:\docume~1\alluse~1\applic~1\Avira
2010-03-26 00:40:27 0 ----a-w- c:\windows\tosOBEX.INI
2010-03-26 00:36:41 0 d-----w- c:\program files\Norton Ghost
2010-03-26 00:34:08 376 ----a-w- c:\windows\ODBC.INI
2010-03-26 00:33:59 17920 ----a-w- c:\windows\system32\mdimon.dll
2010-03-26 00:33:24 0 d-----w- c:\program files\Microsoft ActiveSync
2010-03-26 00:33:05 0 d-----w- c:\windows\SHELLNEW
2010-03-26 00:26:58 33340 ------w- c:\windows\system32\dbmsqlgc.dll
2010-03-26 00:26:58 24576 ------w- c:\windows\system32\dbmsgnet.dll
2010-03-26 00:26:54 306688 ----a-w- c:\windows\IsUninst.exe
2010-03-26 00:26:42 0 d-----w- c:\program files\Microsoft SQL Server
2010-03-26 00:25:57 2981888 ----a-w- c:\windows\system32\iplw7.dll
2010-03-26 00:25:56 53248 ----a-w- c:\windows\system32\ipl.dll
2010-03-26 00:25:56 2973696 ----a-w- c:\windows\system32\ipla6.dll
2010-03-26 00:25:56 2785280 ----a-w- c:\windows\system32\iplm6.dll
2010-03-26 00:25:56 2686976 ----a-w- c:\windows\system32\iplm5.dll
2010-03-26 00:25:56 2531328 ----a-w- c:\windows\system32\iplp6.dll
2010-03-26 00:25:56 2502656 ----a-w- c:\windows\system32\iplpx.dll
2010-03-26 00:25:56 19968 ----a-w- c:\windows\system32\Cpuinf32.dll
2010-03-26 00:25:28 0 d-----w- c:\docume~1\alluse~1\applic~1\VAIO Media Platform
2010-03-26 00:24:58 49152 ----a-w- c:\windows\system32\VAIOIF.scr
2010-03-26 00:24:39 0 d-----w- c:\documents and settings\all users\DSD Direct
2010-03-26 00:24:09 91648 ----a-w- c:\windows\system32\SonyAIds.dll
2010-03-26 00:24:09 75776 ----a-w- c:\windows\system32\SonyAIwo.dll
2010-03-26 00:24:09 38400 ----a-w- c:\windows\system32\SonyAIwd.dll
2010-03-26 00:23:54 0 d-----w- c:\documents and settings\all users\SonicStage Mastering Studio
2010-03-26 00:23:18 770048 ----a-w- c:\windows\system32\CDDBUISony.dll
2010-03-26 00:23:18 520192 ----a-w- c:\windows\system32\CddbPlaylist2Sony.dll
2010-03-26 00:23:17 73728 ----a-w- c:\windows\system32\CddbLinkSony.dll
2010-03-26 00:23:17 643072 ----a-w- c:\windows\system32\CDDBControlSony.dll
2010-03-26 00:23:17 585728 ----a-w- c:\windows\system32\CddbMusicIDSony.dll
2010-03-26 00:22:44 0 d-----w- c:\program files\Skype
2010-03-26 00:21:37 58 ----a-w- c:\windows\WININIT.INI
2010-03-26 00:20:51 0 d-----w- c:\program files\Roxio
2010-03-26 00:20:48 0 d-----w- c:\program files\common files\Sonic Shared
2010-03-26 00:20:18 0 d-----w- c:\program files\ISP
2010-03-26 00:20:00 0 d-----w- c:\documents and settings\all users\ImageConverter2
2010-03-26 00:18:34 0 d-----w- c:\program files\Toshiba
2010-03-26 00:17:20 0 d-----w- c:\docume~1\rodrigo\applic~1\Symantec
2010-03-26 00:15:37 0 ---ha-r- c:\windows\system32\drivers\Sony_VGN-AR21M.mrk
2010-03-26 00:15:30 0 d-----w- c:\program files\Program Shortcuts
2010-03-26 00:12:00 8704 ----a-w- c:\windows\system32\kbdjpn.dll
2010-03-26 00:11:57 6144 ----a-w- c:\windows\system32\kbd106.dll
2010-03-26 00:11:54 14848 ----a-w- c:\windows\system32\drivers\kbdhid.sys
2010-03-26 00:11:53 21504 ----a-w- c:\windows\system32\hidserv.dll

==================== Find3M ====================

2010-03-26 00:36:55 10344 ----a-w- c:\windows\system32\drivers\symlcbrd.sys

============= FINISH: 11:03:13.06 ===============


ATTACH


UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-03-17.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume2
Install Date: 26/03/2010 01:16:15
System Uptime: 27/03/2010 10:32:23 (1 hours ago)

Motherboard: Sony Corporation | | VAIO
Processor: Intel(R) Core(TM)2 CPU T5600 @ 1.83GHz | N/A | 1828/167mhz
Processor: Intel(R) Core(TM)2 CPU T5600 @ 1.83GHz | N/A | 1828/167mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 75 GiB total, 59.387 GiB free.
D: is FIXED (NTFS) - 67 GiB total, 0.575 GiB free.
E: is Removable
F: is Removable
G: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP21: 26/03/2010 01:26:39 - Installed OpenMG Secure Module
RP22: 26/03/2010 02:03:55 - Avira AntiVir Personal - 26/03/2010 02:03
RP23: 26/03/2010 18:58:13 - Norton Antivirus post configuration restore point
RP24: 26/03/2010 22:23:24 - Revo Uninstaller's restore point - Avira AntiVir Personal - Free Antivirus
RP25: 26/03/2010 22:39:59 - Software Distribution Service 3.0
RP26: 26/03/2010 22:52:36 - Software Distribution Service 3.0
RP27: 26/03/2010 23:05:03 - Removed mXML
RP28: 26/03/2010 23:05:08 - Removed mMHouse
RP29: 26/03/2010 23:05:46 - Removed mCore
RP30: 26/03/2010 23:06:12 - Removed mPfMgr
RP31: 27/03/2010 02:53:42 - Installed Intel(R) PROSet/Wireless WiFi Software.
RP32: 27/03/2010 02:53:46 - Installed HiJackThis
RP33: 27/03/2010 03:00:41 - Software Distribution Service 3.0

==== Installed Programs ======================

Adobe Acrobat 7.0 Elements
Adobe Common File Installer
Adobe Flash Player 10 Plugin
Adobe Help Center 2.0
Adobe Photoshop Elements 4.0
Adobe Premiere Elements 2.0
Adobe Reader 7.0
Adobe Reader 7.0.5
AppMon Utility
AV Mode Button Utility
Bluetooth Stack for Windows by Toshiba
Browser Address Error Redirector
CC_ccProxyExt
ccCommon
ccPxyCore
Click to DVD 2.0.03 Menu Data
Click to DVD 2.5.30
DSD Direct
DSD Playback Plug-in 1.0
DVgate Plus
Google Earth
Google Toolbar for Internet Explorer
HDAUDIO SoftV92 Data Fax Modem with SmartCP
High Definition Audio Driver Package - KB835221
HiJackThis
Hotfix for Windows Media Player 10 (KB903157)
Hotfix for Windows XP (KB888795)
Hotfix for Windows XP (KB891593)
Hotfix for Windows XP (KB893357)
Hotfix for Windows XP (KB895961)
Hotfix for Windows XP (KB896256)
Hotfix for Windows XP (KB899337)
Hotfix for Windows XP (KB899510)
Hotfix for Windows XP (KB900466)
Hotfix for Windows XP (KB902841)
Hotfix for Windows XP (KB909667)
Hotfix for Windows XP (KB910728)
Hotfix for Windows XP (KB918114)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB979306)
Image Converter 2 Plus
Intel(R) PRO Network Connections Drivers
Intel(R) PROSet/Wireless Software
InterVideo WinDVD for VAIO
J2SE Runtime Environment 5.0 Update 6
Karen's Computer Profiler
LAN Setting Utility
LiveReg (Symantec Corporation)
LiveUpdate 2.7 (Symantec Corporation)
LookInMyPC
Macromedia Flash Player 8
Malwarebytes' Anti-Malware
mDriver
Memory Stick Formatter
Microsoft .NET Framework 1.0 Hotfix (KB887998)
Microsoft .NET Framework 1.0 Hotfix (KB953295)
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB953297)
Microsoft Office Standard Edition 2003
Microsoft SQL Server Desktop Engine (VAIO_VEDB)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Works
Mozilla Firefox (3.5.8)
mProSafe
MSRedist
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
mWlsSafe
My Club VAIO MCE 1.0.0
Norton AntiSpam
Norton AntiVirus 2006
Norton Ghost 10.0
Norton Internet Security
Norton Internet Security 2006 (Symantec Corporation)
Norton Protection Center
Norton Security Scan
Norton WMI Update
NVIDIA Drivers
Office 2003 Trial Assistant
OpenMG AAC Add-on Module 1.0.00
OpenMG Limited Patch 4.5-06-05-12-01
OpenMG Secure Module 4.5.01
PC Fixer
Picasa 2
Revo Uninstaller 1.85
Roxio DigitalMedia Audio
Roxio DigitalMedia Copy
Roxio DigitalMedia Data
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896422)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899589)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB908531)
Security Update for Windows XP (KB911280)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB916281)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB944338-v2)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB958470)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB971032)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165-v2)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978706)
Setting Utility Series
SigmaTel Audio
Skype 2.0
SonicStage 4.0
SonicStage Mastering Studio 2.2
SonicStage Mastering Studio Audio Filter
SonicStage Mastering Studio Audio Filter Custom Preset
SonicStage Mastering Studio Plugins
Sony MP4 Shared Library
Sony USB Mouse
Sony Utilities DLL
Sony Video Shared Library
SPBBC
SymNet
Update for Windows Media Player 10 (KB910393)
Update for Windows Media Player 10 (KB913800)
Update for Windows Media Player 10 (KB926251)
Update for Windows XP (KB894391)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB910437)
Update for Windows XP (KB912945)
Update for Windows XP (KB932823-v3)
Update for Windows XP (KB955759)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
Update for Windows XP (KB978207)
Update Rollup 2 for Windows XP Media Center Edition 2005
VAIO Camera Utility
VAIO Control Center
VAIO Edit Components 6.0
VAIO Entertainment Platform
VAIO Event Service
VAIO Hardware Diagnostics
VAIO Information FLOW
VAIO Media 5.0
VAIO Media AC3 Decoder 1.0
VAIO Media Integrated Server 5.0
VAIO Media Redistribution 5.0
VAIO Media Registration Tool 5.0
VAIO Online Registration (English)
VAIO Original Screen Saver
VAIO Original Screen Saver VAIO Cozy Screen SD Wide Contents
VAIO Power Management
VAIO Product Survey
VAIO Sea Wallpaper
VAIO Starfish Wallpaper
VAIO Update 2
VOR
VPS
WebFldrs XP
Windows Genuine Advantage Validation Tool (KB892130)
Windows Installer 3.1 (KB893803)
Windows Media Format Runtime
Windows XP Hotfix - KB307154
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB884018
Windows XP Hotfix - KB884575
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888239
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB888321
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
Windows XP Hotfix - KB893056
Windows XP Media Center Edition 2005 KB914548
Windows XP Media Center Edition 2005 KB973768
Wireless LAN Starter
Wireless Switch Setting Utility

==== Event Viewer Messages From Past Week ========

27/03/2010 10:33:49, error: Service Control Manager [7000] - The Intel(R) PROSet/Wireless Registry Service service failed to start due to the following error: The system cannot find the file specified.
27/03/2010 02:59:06, error: Service Control Manager [7034] - The Adobe Active File Monitor V4 service terminated unexpectedly. It has done this 1 time(s).
27/03/2010 01:59:39, error: Service Control Manager [7000] - The IMAPI CD-Burning COM Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
27/03/2010 01:59:38, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the IMAPI CD-Burning COM Service service to connect.
26/03/2010 22:15:52, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Avira AntiVir Guard service to connect.
26/03/2010 22:15:52, error: Service Control Manager [7000] - The Avira AntiVir Guard service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
26/03/2010 22:15:41, error: Service Control Manager [7031] - The Avira AntiVir Guard service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
26/03/2010 20:50:15, error: Service Control Manager [7034] - The Avira AntiVir Guard service terminated unexpectedly. It has done this 3 time(s).
26/03/2010 20:49:31, error: Service Control Manager [7031] - The Avira AntiVir Guard service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
26/03/2010 02:03:05, error: SideBySide [59] - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. .
26/03/2010 02:03:05, error: SideBySide [59] - Generate Activation Context failed for C:\DOCUME~1\rodrigo\LOCALS~1\Temp\RarSFX0\redist.dll. Reference error message: The operation completed successfully. .
26/03/2010 02:03:05, error: SideBySide [32] - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system.
26/03/2010 01:26:39, error: sr [1] - The System Restore filter encountered the unexpected error '0xC000000D' while processing the file 'MSIe30b.tmp' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume.
26/03/2010 01:25:59, error: sr [1] - The System Restore filter encountered the unexpected error '0xC000000D' while processing the file 'MSIe305.tmp' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume.
26/03/2010 01:22:31, error: sr [1] - The System Restore filter encountered the unexpected error '0xC000000D' while processing the file 'MSI51c5e.tmp' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume.
26/03/2010 01:22:14, error: sr [1] - The System Restore filter encountered the unexpected error '0xC000000D' while processing the file 'MSI49607.tmp' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume.
26/03/2010 01:21:45, error: sr [1] - The System Restore filter encountered the unexpected error '0xC000000D' while processing the file 'MSIe2f1.tmp' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume.
26/03/2010 01:20:46, error: sr [1] - The System Restore filter encountered the unexpected error '0xC000000D' while processing the file 'MSIe1c4.tmp' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume.
26/03/2010 01:18:30, error: sr [1] - The System Restore filter encountered the unexpected error '0xC000000D' while processing the file 'MSIe19e.tmp' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume.

==== End Of File ===========================

 

Done! Sorry about that.

 

my computer presented the exactly same symptoms after a clean install. i was surprised as well.

then i saw on some other thread one of you guys (maybe it was you, not sure) telling an user to run a software called combofix, which i did. and for my surprise it accused a possible rootkit infection.

right at the end of the log i noticed a line telling to use the command "mbr -f" and i did it. (i shouldn't go on about doing stuff i don't really understand but hey, thats me!)

after which i restarted the machine and ran combofix another time. this time it didn't accuse an infection so i thought "im in the clear now, great! "

one more restart and for my suprise it crashed even before the loading screen. (something about user log interface missing)

another clean install and now it seems im ok. did all the updates and downloaded lots of security programs (recommend here).

but just for my peace of mind here are the logs from a fresh run of DDS. I noticed a few error messages at the end of the attach log which im hoping are not infection related. but if you could at least take a look at them and see if everything is ok i would be very grateful.


DDS (Ver_10-03-17.01) - NTFSx86
Run by Rodrigo at 10:54:13.35 on 28/03/2010
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_18
Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.2046.1147 [GMT 2:00]

AV: Norton Internet Security 2006 *On-access scanning enabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}
FW: Norton Internet Security 2006 *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program Files\Intel\WiFi\bin\S24EvMon.exe
svchost.exe
svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Intel\WiFi\bin\EvtEng.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
svchost.exe
C:\Program Files\SigmaTel\C-Major Audio\WDM\StacSV.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
C:\Program Files\Intel\WiFi\bin\WLKeeper.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\system32\ICO.EXE
C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe
C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
C:\Program Files\Sony\ISB Utility\ISBMgr.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Sony\AppMonUtil\AppMonUtility.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\Intel\WiFi\bin\ZCfgSvc.exe
C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Rodrigo\My Documents\Downloads\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.club-vaio.com/en/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = hxxp://www.club-vaio.com/en/
uInternet Settings,ProxyOverride = local
mSearchAssistant = hxxp://www.google.com/ie
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: SpywareGuardDLBLOCK.CBrowserHelper: {4a368e80-174f-4872-96b5-0b27ddd11db2} - c:\program files\spywareguard\dlprotect.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
BHO: CNisExtBho Class: {9ecb9560-04f9-4bbc-943d-298ddf1699e1} - c:\program files\common files\symantec shared\adblocking\NISShExt.dll
BHO: CNavExtBho Class: {a8f38d8d-e480-4d52-b7a2-731bb6995fdd} - c:\program files\norton internet security\norton antivirus\NavShExt.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar1.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar1.dll
TB: Norton Internet Security 2006: {0b53eac3-8d69-4b9e-9b19-a37c9a5676a7} - c:\program files\common files\symantec shared\adblocking\NISShExt.dll
TB: Norton AntiVirus: {c4069e3a-68f1-403e-b40e-20066696354b} - c:\program files\norton internet security\norton antivirus\NavShExt.dll
uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [Apoint] c:\program files\apoint\Apoint.exe
mRun: [ehTray] c:\windows\ehome\ehtray.exe
mRun: [Mouse Suite 98 Daemon] ICO.EXE
mRun: [VAIOCameraUtility] "c:\program files\sony\vaio camera utility\VCUServe.exe "
mRun: [SonyPowerCfg] "c:\program files\sony\vaio power management\SPMgr.exe "
mRun: [ISBMgr.exe] c:\program files\sony\isb utility\ISBMgr.exe
mRun: [Switcher.exe] c:\program files\sony\wireless switch setting utility\Switcher.exe
mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe "
mRun: [URLLSTCK.exe] c:\program files\norton internet security\UrlLstCk.exe
mRun: [AppMon Utility] "c:\program files\sony\appmonutil\AppMonUtility.exe" @@@Start
mRun: [Acrobat Assistant 7.0] "c:\program files\adobe\acrobat 7.0\distillr\Acrotray.exe "
mRun: [<NO NAME>]
mRun: [IntelZeroConfig] "c:\program files\intel\wifi\bin\ZCfgSvc.exe "
mRun: [IntelWireless] "c:\program files\common files\intel\wirelesscommon\iFrmewrk.exe" /tf Intel Wireless Tray
mRun: [VAIO Update 5] "c:\program files\sony\vaio update 5\VAIOUpdt.exe" /Stationary
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe "
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
StartupFolder: c:\docume~1\rodrigo\startm~1\programs\startup\spywar~1.lnk - c:\program files\spywareguard\sgmain.exe
IE: &Google Search - c:\program files\google\GoogleToolbar1.dll/cmsearch.html
IE: &Translate English Word - c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
IE: Add RSS Support Site to VAIO Information FLOW - c:\program files\sony\vaio information flow\aiesc.html
IE: Backward Links - c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
IE: Cached Snapshot of Page - c:\program files\google\GoogleToolbar1.dll/cmcache.html
IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office11\EXCEL.EXE/3000
IE: Similar Pages - c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
IE: Translate Page into English - c:\program files\google\GoogleToolbar1.dll/cmtrans.html
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office11\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
Trusted Zone: sony-europe.com
Trusted Zone: sonystyle-europe.com
Trusted Zone: vaio-link.com
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} - hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.1.66.0.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: VESWinlogon - VESWinlogon.dll
SEH: SpywareGuard.Handler: {81559c35-8464-49f7-bb0e-07a383bef910} - c:\program files\spywareguard\spywareguard.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\rodrigo\applic~1\mozilla\firefox\profiles\6nnxd13u.default\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl3.rsa_seed_sha ", true);

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2010-3-27 64288]
R1 SAVRTPEL;SAVRTPEL;c:\program files\norton internet security\norton antivirus\Savrtpel.sys [2006-1-25 53896]
R2 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\ccEvtMgr.exe [2006-1-25 192112]
R2 ccProxy;Symantec Network Proxy;c:\program files\common files\symantec shared\ccProxy.exe [2006-1-25 202352]
R2 ccSetMgr;Symantec Settings Manager;c:\program files\common files\symantec shared\ccSetMgr.exe [2006-1-25 169584]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2010-2-4 1263728]
R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]
R2 MSSQL$VAIO_VEDB;MSSQL$VAIO_VEDB;c:\program files\microsoft sql server\mssql$vaio_vedb\binn\sqlservr.exe -svaio_vedb --> c:\program files\microsoft sql server\mssql$vaio_vedb\binn\sqlservr.exe -sVAIO_VEDB [?]
R2 navapsvc;Norton AntiVirus Auto-Protect Service;c:\program files\norton internet security\norton antivirus\NAVAPSVC.EXE [2006-1-25 139888]
R2 Symantec Core LC;Symantec Core LC;c:\program files\common files\symantec shared\ccpd-lc\symlcsvc.exe [2006-7-31 1251720]
R3 5U870CAP_VID_1262&PID_25FD;Sony Visual Communication Camera VGP-VCC2 ;c:\windows\system32\drivers\5U870CAP.sys [2006-7-28 75264]
R3 AVerM115S;AVerM115S service;c:\windows\system32\drivers\AVerM115S.sys [2006-7-28 754688]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2010-3-27 102448]
R3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20100327.003\NAVENG.Sys [2010-3-28 84912]
R3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20100327.003\NavEx15.Sys [2010-3-28 1324720]
R3 SAVRT;SAVRT;c:\program files\norton internet security\norton antivirus\savrt.sys [2006-1-25 334984]
R3 SonyImgF;Sony Image Conversion Filter Driver;c:\windows\system32\drivers\SonyImgF.sys [2006-7-28 30080]
R3 ti21sony;ti21sony;c:\windows\system32\drivers\ti21sony.sys [2006-7-28 812544]
S3 cpudrv;cpudrv;c:\program files\systemrequirementslab\cpudrv.sys [2009-12-18 11336]
S3 rspSanity;rspSanity;c:\windows\system32\drivers\rspSanity32.sys [2010-3-27 27192]
S3 SAVScan;Symantec AVScan;c:\program files\norton internet security\norton antivirus\SAVScan.exe [2006-1-25 198368]
S3 SQLAgent$VAIO_VEDB;SQLAgent$VAIO_VEDB;c:\program files\microsoft sql server\mssql$vaio_vedb\binn\sqlagent.exe -i vaio_vedb --> c:\program files\microsoft sql server\mssql$vaio_vedb\binn\sqlagent.EXE -i VAIO_VEDB [?]
S3 VUAgent;VUAgent;c:\program files\sony\vaio update 5\VUAgent.exe [2010-3-27 673136]

=============== Created Last 30 ================

2010-03-28 08:46:48 0 d-----w- c:\windows\system32\appmgmt
2010-03-27 20:47:43 600 ----a-w- c:\documents and settings\rodrigo\PUTTY.RND
2010-03-27 19:26:31 0 d-----w- c:\program files\SpywareGuard
2010-03-27 19:19:10 0 d-----w- c:\program files\SpywareBlaster
2010-03-27 18:49:42 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys
2010-03-27 18:49:36 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-03-27 18:46:49 0 dc-h--w- c:\docume~1\alluse~1\applic~1\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}
2010-03-27 18:46:37 0 d-----w- c:\program files\Lavasoft
2010-03-27 18:13:39 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2010-03-27 17:59:56 0 d-----w- c:\program files\Spybot - Search & Destroy
2010-03-27 17:59:56 0 d-----w- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2010-03-27 17:52:08 0 d-----w- c:\docume~1\rodrigo\applic~1\Malwarebytes
2010-03-27 17:52:04 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-27 17:52:02 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-03-27 17:52:02 0 d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-03-27 17:52:02 0 d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
2010-03-27 17:48:26 0 d-----r- c:\program files\Skype
2010-03-27 17:44:29 0 d-----w- c:\program files\common files\DivX Shared
2010-03-27 17:43:03 0 d-----w- c:\program files\DivX
2010-03-27 17:40:01 73728 ----a-w- c:\windows\system32\javacpl.cpl
2010-03-27 17:40:01 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-03-27 16:47:49 215144 ----a-r- c:\windows\patchw32.dll
2010-03-27 16:46:54 215144 ----a-r- c:\windows\pw32a.dll
2010-03-27 15:49:20 0 d-----w- c:\windows\system32\scripting
2010-03-27 15:49:20 0 d-----w- c:\windows\l2schemas
2010-03-27 15:49:19 0 d-----w- c:\windows\system32\en
2010-03-27 15:49:19 0 d-----w- c:\windows\system32\bits
2010-03-27 15:08:19 0 d-----w- c:\windows\system32\GroupPolicy
2010-03-27 15:08:19 0 d-----w- c:\program files\Windows Desktop Search
2010-03-27 15:07:51 98304 -c----w- c:\windows\system32\dllcache\nlhtml.dll
2010-03-27 15:07:51 29696 -c----w- c:\windows\system32\dllcache\mimefilt.dll
2010-03-27 15:07:50 192000 -c----w- c:\windows\system32\dllcache\offfilt.dll
2010-03-27 15:06:45 0 d-----w- c:\program files\MSXML 6.0
2010-03-27 14:51:58 129045 ------w- c:\windows\system32\drivers\cxthsfs2.cty
2010-03-27 14:41:31 991232 -c----w- c:\windows\system32\dllcache\ieframe.dll.mui
2010-03-27 14:41:31 6067200 -c----w- c:\windows\system32\dllcache\ieframe.dll
2010-03-27 14:41:31 52224 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
2010-03-27 14:41:31 459264 -c----w- c:\windows\system32\dllcache\msfeeds.dll
2010-03-27 14:41:31 380928 -c----w- c:\windows\system32\dllcache\ieapfltr.dll
2010-03-27 14:41:31 268288 -c----w- c:\windows\system32\dllcache\iertutil.dll
2010-03-27 14:41:31 2452872 -c----w- c:\windows\system32\dllcache\ieapfltr.dat
2010-03-27 14:41:31 13824 -c----w- c:\windows\system32\dllcache\ieudinit.exe
2010-03-27 14:41:30 63488 -c----w- c:\windows\system32\dllcache\icardie.dll
2010-03-27 14:35:50 0 d-----w- c:\windows\network diagnostic
2010-03-27 14:34:54 33792 -c--a-w- c:\windows\system32\dllcache\custsat.dll
2010-03-27 14:03:42 0 d-----w- c:\program files\MSXML 4.0
2010-03-27 13:58:01 0 d-----w- c:\windows\ServicePackFiles
2010-03-27 13:49:12 3558912 -c----w- c:\windows\system32\dllcache\moviemk.exe
2010-03-27 13:48:30 293376 ------w- c:\windows\system32\browserchoice.exe
2010-03-27 13:48:05 353792 -c----w- c:\windows\system32\dllcache\srv.sys
2010-03-27 13:47:19 455424 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2010-03-27 13:46:29 81920 -c----w- c:\windows\system32\dllcache\fontsub.dll
2010-03-27 13:46:29 119808 -c----w- c:\windows\system32\dllcache\t2embed.dll
2010-03-27 13:46:09 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll
2010-03-27 13:42:51 153088 -c----w- c:\windows\system32\dllcache\triedit.dll
2010-03-27 13:41:41 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll
2010-03-27 13:41:33 128512 -c----w- c:\windows\system32\dllcache\dhtmled.ocx
2010-03-27 13:39:54 2560 ------w- c:\windows\system32\xpsp4res.dll
2010-03-27 13:39:53 215552 -c----w- c:\windows\system32\dllcache\wordpad.exe
2010-03-27 13:39:53 1206508 -c----w- c:\windows\system32\dllcache\sysmain.sdb
2010-03-27 13:39:13 1172480 -c----w- c:\windows\system32\dllcache\msxml3.dll
2010-03-27 13:39:10 337408 -c----w- c:\windows\system32\dllcache\netapi32.dll
2010-03-27 13:38:51 691712 -c----w- c:\windows\system32\dllcache\inetcomm.dll
2010-03-27 13:38:47 512000 -c--a-w- c:\windows\system32\dllcache\jscript.dll
2010-03-27 13:38:35 272128 -c----w- c:\windows\system32\dllcache\bthport.sys
2010-03-27 13:38:34 272128 ------w- c:\windows\system32\drivers\bthport.sys
2010-03-27 13:38:30 203136 -c----w- c:\windows\system32\dllcache\rmcast.sys
2010-03-27 13:31:56 0 d-----w- c:\windows\system32\PreInstall
2010-03-27 13:30:23 0 d-sh--w- c:\documents and settings\rodrigo\UserData
2010-03-27 13:26:13 35704 ----a-w- c:\windows\system32\NicInst.dll
2010-03-27 13:26:13 28536 ----a-w- c:\windows\system32\NicCo.dll
2010-03-27 13:21:01 80896 -c----w- c:\windows\system32\dllcache\tlntsess.exe
2010-03-27 13:21:00 76288 -c----w- c:\windows\system32\dllcache\telnet.exe
2010-03-27 13:20:51 0 d-----w- C:\Update
2010-03-27 13:15:58 0 d-----w- c:\docume~1\rodrigo\applic~1\Intel
2010-03-27 13:15:40 663552 ----a-w- c:\windows\system32\NETw5c32.dll
2010-03-27 13:15:40 4221952 ----a-w- c:\windows\system32\drivers\NETw5x32.sys
2010-03-27 13:15:40 2756608 ----a-w- c:\windows\system32\NETw5r32.dll
2010-03-27 13:15:24 0 d-----w- c:\program files\common files\Intel
2010-03-27 13:11:30 0 d-----w- c:\program files\SystemRequirementsLab
2010-03-27 13:08:24 331776 -c----w- c:\windows\system32\dllcache\msadce.dll
2010-03-27 13:08:20 655872 -c----w- c:\windows\system32\dllcache\mstscax.dll
2010-03-27 13:04:49 0 ----a-w- c:\windows\tosOBEX.INI
2010-03-27 13:03:52 27192 ----a-w- c:\windows\system32\drivers\rspSanity32.sys
2010-03-27 13:03:52 0 d-----w- c:\program files\SanityCheck
2010-03-27 12:45:04 0 d-----w- c:\windows\system32\LogFiles
2010-03-27 12:41:45 0 d-----w- c:\windows\system32\SoftwareDistribution
2010-03-27 12:34:36 376 ----a-w- c:\windows\ODBC.INI
2010-03-27 12:34:26 17920 ----a-w- c:\windows\system32\mdimon.dll
2010-03-27 12:33:53 0 d-----w- c:\program files\Microsoft ActiveSync
2010-03-27 12:33:34 0 d-----w- c:\windows\SHELLNEW
2010-03-27 12:27:31 33340 ------w- c:\windows\system32\dbmsqlgc.dll
2010-03-27 12:27:31 24576 ------w- c:\windows\system32\dbmsgnet.dll
2010-03-27 12:27:26 306688 ----a-w- c:\windows\IsUninst.exe
2010-03-27 12:27:15 0 d-----w- c:\program files\Microsoft SQL Server
2010-03-27 12:26:31 2981888 ----a-w- c:\windows\system32\iplw7.dll
2010-03-27 12:26:30 53248 ----a-w- c:\windows\system32\ipl.dll
2010-03-27 12:26:30 2973696 ----a-w- c:\windows\system32\ipla6.dll
2010-03-27 12:26:30 2785280 ----a-w- c:\windows\system32\iplm6.dll
2010-03-27 12:26:30 2686976 ----a-w- c:\windows\system32\iplm5.dll
2010-03-27 12:26:30 2531328 ----a-w- c:\windows\system32\iplp6.dll
2010-03-27 12:26:30 2502656 ----a-w- c:\windows\system32\iplpx.dll
2010-03-27 12:26:30 19968 ----a-w- c:\windows\system32\Cpuinf32.dll
2010-03-27 12:26:01 0 d-----w- c:\docume~1\alluse~1\applic~1\VAIO Media Platform
2010-03-27 12:25:32 49152 ----a-w- c:\windows\system32\VAIOIF.scr
2010-03-27 12:25:10 0 d-----w- c:\documents and settings\all users\DSD Direct
2010-03-27 12:24:46 91648 ----a-w- c:\windows\system32\SonyAIds.dll
2010-03-27 12:24:46 75776 ----a-w- c:\windows\system32\SonyAIwo.dll
2010-03-27 12:24:46 38400 ----a-w- c:\windows\system32\SonyAIwd.dll
2010-03-27 12:24:29 0 d-----w- c:\documents and settings\all users\SonicStage Mastering Studio
2010-03-27 12:23:53 770048 ----a-w- c:\windows\system32\CDDBUISony.dll
2010-03-27 12:23:53 73728 ----a-w- c:\windows\system32\CddbLinkSony.dll
2010-03-27 12:23:53 643072 ----a-w- c:\windows\system32\CDDBControlSony.dll
2010-03-27 12:23:53 585728 ----a-w- c:\windows\system32\CddbMusicIDSony.dll
2010-03-27 12:23:53 520192 ----a-w- c:\windows\system32\CddbPlaylist2Sony.dll
2010-03-27 12:22:16 58 ----a-w- c:\windows\WININIT.INI
2010-03-27 12:21:31 0 d-----w- c:\program files\Roxio
2010-03-27 12:21:29 0 d-----w- c:\program files\common files\Sonic Shared
2010-03-27 12:20:41 0 d-----w- c:\documents and settings\all users\ImageConverter2
2010-03-27 12:19:12 0 d-----w- c:\program files\Toshiba
2010-03-27 12:17:56 0 d-----w- c:\docume~1\rodrigo\applic~1\Symantec
2010-03-27 12:16:13 0 ---ha-r- c:\windows\system32\drivers\Sony_VGN-AR21M.mrk
2010-03-27 12:16:07 0 d-----w- c:\program files\Program Shortcuts
2010-03-27 12:12:43 8704 ----a-w- c:\windows\system32\kbdjpn.dll
2010-03-27 12:12:41 6144 ----a-w- c:\windows\system32\kbd106.dll
2010-03-27 12:12:38 14592 ----a-w- c:\windows\system32\drivers\kbdhid.sys
2010-03-27 12:12:37 21504 ----a-w- c:\windows\system32\hidserv.dll

==================== Find3M ====================

2010-03-27 12:37:21 10344 ----a-w- c:\windows\system32\drivers\symlcbrd.sys
2010-01-05 10:00:29 832512 ----a-w- c:\windows\system32\wininet.dll
2010-01-05 10:00:21 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-01-05 10:00:20 17408 ------w- c:\windows\system32\corpol.dll

============= FINISH: 10:55:04.65 ===============


ATTACH


UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-03-17.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume2
Install Date: 3/27/2010 1:16:53 PM
System Uptime: 3/28/2010 10:47:39 AM (0 hours ago)

Motherboard: Sony Corporation | | VAIO
Processor: Intel(R) Core(TM)2 CPU T5600 @ 1.83GHz | N/A | 1828/167mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 75 GiB total, 57.098 GiB free.
D: is FIXED (NTFS) - 67 GiB total, 0.575 GiB free.
E: is Removable
F: is Removable
G: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP21: 3/27/2010 1:27:12 PM - Installed OpenMG Secure Module
RP22: 3/27/2010 1:42:33 PM - Norton Antivirus post configuration restore point
RP23: 3/27/2010 2:14:07 PM - Removed mXML
RP24: 3/27/2010 2:14:12 PM - Removed mMHouse
RP25: 3/27/2010 2:14:48 PM - Removed mCore
RP26: 3/27/2010 2:15:13 PM - Removed mPfMgr
RP27: 3/27/2010 2:15:17 PM - Installed Intel(R) PROSet/Wireless WiFi Software.
RP28: 3/27/2010 2:21:15 PM - Removed VAIO Update 2
RP29: 3/27/2010 2:21:57 PM - Removed VAIO Update 2
RP30: 3/27/2010 2:22:01 PM - Installed VAIO Update 4
RP31: 3/27/2010 2:23:10 PM - Removed VAIO Update 4
RP32: 3/27/2010 2:23:14 PM - Installed VAIO Update 5
RP33: 3/27/2010 2:25:37 PM - Installed DSD Direct 1.0.03 Update program
RP34: 3/27/2010 2:31:11 PM - Software Distribution Service 3.0
RP35: 3/27/2010 2:49:17 PM - Software Distribution Service 3.0
RP36: 3/27/2010 3:23:27 PM - Software Distribution Service 3.0
RP37: 3/27/2010 3:33:37 PM - Software Distribution Service 3.0
RP38: 3/27/2010 3:54:58 PM - Software Distribution Service 3.0
RP39: 3/27/2010 4:05:26 PM - Software Distribution Service 3.0
RP40: 3/27/2010 4:28:57 PM - Software Distribution Service 3.0
RP41: 3/27/2010 4:35:32 PM - Software Distribution Service 3.0
RP42: 3/27/2010 6:39:36 PM - Installed Java(TM) 6 Update 18
RP43: 3/28/2010 10:46:22 AM - Removed Norton Ghost 10.0

==== Installed Programs ======================

Ad-Aware
Ad-Aware Email Scanner for Outlook
Adobe Acrobat 7.0 Elements
Adobe Common File Installer
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Help Center 2.0
Adobe Photoshop Elements 4.0
Adobe Premiere Elements 2.0
Adobe Reader 7.0
Adobe Reader 7.0.5
AppMon Utility
AutoUpdate
AV Mode Button Utility
Bluetooth Stack for Windows by Toshiba
Browser Address Error Redirector
CC_ccProxyExt
ccCommon
ccPxyCore
Click to DVD 2.0.03 Menu Data
Click to DVD 2.5.30
DivX
DivX Player
DivX Web Player
DSD Direct
DSD Playback Plug-in 1.0
DVgate Plus
Google Earth
Google Toolbar for Internet Explorer
HDAUDIO SoftV92 Data Fax Modem with SmartCP
High Definition Audio Driver Package - KB835221
Hotfix for Windows Media Player 10 (KB903157)
Hotfix for Windows XP (KB915800-v4)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB976002-v5)
Hotfix for Windows XP (KB979306)
Image Converter 2 Plus
Intel PROSet Wireless
Intel(R) PRO Network Connections Drivers
Intel(R) PROSet/Wireless WiFi Software
InterVideo WinDVD for VAIO
J2SE Runtime Environment 5.0 Update 6
Java Auto Updater
Java(TM) 6 Update 18
LAN Setting Utility
LiveUpdate 2.7 (Symantec Corporation)
Malwarebytes' Anti-Malware
Memory Stick Formatter
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB953297)
Microsoft Base Smart Card Cryptographic Service Provider Package
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Standard Edition 2003
Microsoft SQL Server Desktop Engine (VAIO_VEDB)
Microsoft Works
Mozilla Firefox (3.5.8)
mProSafe
MSRedist
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 6 Service Pack 2 (KB973686)
mWlsSafe
My Club VAIO MCE 1.0.0
Norton AntiSpam
Norton AntiVirus 2006
Norton Internet Security
Norton Internet Security 2006 (Symantec Corporation)
Norton Protection Center
Norton WMI Update
NVIDIA Drivers
Office 2003 Trial Assistant
OpenMG AAC Add-on Module 1.0.00
OpenMG Limited Patch 4.5-06-05-12-01
OpenMG Secure Module 4.5.01
Picasa 2
Roxio DigitalMedia Audio
Roxio DigitalMedia Copy
Roxio DigitalMedia Data
SanityCheck 2.00
Security Update for Windows Internet Explorer 7 (KB938127-v2)
Security Update for Windows Internet Explorer 7 (KB978207)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165-v2)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978706)
Setting Utility Series
SigmaTel Audio
Skypeâ„¢ 4.2
SonicStage 4.0
SonicStage Mastering Studio 2.2
SonicStage Mastering Studio Audio Filter
SonicStage Mastering Studio Audio Filter Custom Preset
SonicStage Mastering Studio Plugins
Sony MP4 Shared Library
Sony USB Mouse
Sony Utilities DLL
Sony Video Shared Library
SPBBC
Spybot - Search & Destroy
SpywareBlaster 4.2
SpywareGuard v2.2
SymNet
System Requirements Lab for Intel
Update for Windows Media Player 10 (KB910393)
Update for Windows Media Player 10 (KB913800)
Update for Windows Media Player 10 (KB926251)
Update for Windows XP (KB955759)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
Update for Windows XP (KB978207)
Update Rollup 2 for Windows XP Media Center Edition 2005
VAIO Camera Utility
VAIO Control Center
VAIO Edit Components 6.0
VAIO Entertainment Platform
VAIO Event Service
VAIO Hardware Diagnostics
VAIO Information FLOW
VAIO Media 5.0
VAIO Media AC3 Decoder 1.0
VAIO Media Integrated Server 5.0
VAIO Media Redistribution 5.0
VAIO Media Registration Tool 5.0
VAIO Online Registration (English)
VAIO Original Screen Saver
VAIO Original Screen Saver VAIO Cozy Screen SD Wide Contents
VAIO Power Management
VAIO Product Survey
VAIO Sea Wallpaper
VAIO Starfish Wallpaper
VAIO Update 5
VC80CRTRedist - 8.0.50727.762
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
VOR
VPS
WebFldrs XP
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 7
Windows Media Format Runtime
Windows XP Media Center Edition 2005 KB925766
Windows XP Media Center Edition 2005 KB973768
Windows XP Service Pack 3
Wireless LAN Starter
Wireless Switch Setting Utility

==== Event Viewer Messages From Past Week ========

3/27/2010 7:54:28 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the COM+ System Application service to connect.
3/27/2010 7:54:28 PM, error: Service Control Manager [7000] - The COM+ System Application service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
3/27/2010 7:54:27 PM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service COMSysApp with arguments " " in order to run the server: {ECABAFBC-7F19-11D2-978E-0000F8757E2A}
3/27/2010 7:52:59 PM, error: Service Control Manager [7034] - The NVIDIA Display Driver Service service terminated unexpectedly. It has done this 1 time(s).
3/27/2010 4:15:55 PM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service WSearch with arguments " " in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
3/27/2010 3:29:40 PM, error: DCOM [10016] - The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID {A4199E55-EBB9-49E5-AF1A-7A5408B2E206} to the user NT AUTHORITY\NETWORK SERVICE SID (S-1-5-20). This security permission can be modified using the Component Services administrative tool.
3/27/2010 3:24:38 PM, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Internet Explorer 8 for Windows XP.
3/27/2010 3:03:05 PM, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Microsoft .NET Framework 1.1 Service Pack 1 Security Update for Windows 2000, Windows XP, Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2 (KB953297).
3/27/2010 2:52:45 PM, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0x8024200d: Security Update for Windows XP (KB920213).
3/27/2010 1:27:12 PM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC000000D' while processing the file 'MSIe647.tmp' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume.
3/27/2010 1:26:33 PM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC000000D' while processing the file 'MSIe641.tmp' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume.
3/27/2010 1:23:09 PM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC000000D' while processing the file 'MSI51c4e.tmp' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume.
3/27/2010 1:22:52 PM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC000000D' while processing the file 'MSI49f00.tmp' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume.
3/27/2010 1:22:24 PM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC000000D' while processing the file 'MSIe62d.tmp' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume.
3/27/2010 1:21:27 PM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC000000D' while processing the file 'MSIe500.tmp' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume.
3/27/2010 1:19:08 PM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC000000D' while processing the file 'MSIe4da.tmp' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume.

==== End Of File ===========================

 

Mbam log

Malwarebytes' Anti-Malware 1.44
Database version: 3927
Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

29/03/2010 19:00:50
mbam-log-2010-03-29 (19-00-39).txt

Scan type: Quick Scan
Objects scanned: 132791
Time elapsed: 6 minute(s), 33 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

 

Gmer log

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-03-29 21:32:56
Windows 5.1.2600 Service Pack 3
Running: 04qejhfp.exe; Driver: C:\DOCUME~1\Rodrigo\LOCALS~1\Temp\kxdoykog.sys


---- System - GMER 1.0.15 ----

SSDT 89981518 ZwAlertResumeThread
SSDT 89B4E518 ZwAlertThread
SSDT 89C22148 ZwAllocateVirtualMemory
SSDT 89DF56D8 ZwConnectPort
SSDT Lbd.sys (Boot Driver/Lavasoft AB) ZwCreateKey [0xBA91887E]
SSDT 89C1C148 ZwCreateThread
SSDT \??\C:\Program Files\Symantec\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwDeleteValueKey [0xA92E2DC0]
SSDT 89D8DB10 ZwFreeVirtualMemory
SSDT 89D010B8 ZwImpersonateAnonymousToken
SSDT 89A900B0 ZwImpersonateThread
SSDT 89CBDFB0 ZwMapViewOfSection
SSDT 89B49518 ZwOpenProcessToken
SSDT 88269D28 ZwOpenThreadToken
SSDT 89C5A248 ZwResumeThread
SSDT 89AF34B0 ZwSetContextThread
SSDT 89ADA0F0 ZwSetInformationProcess
SSDT 89A4BF00 ZwSetInformationThread
SSDT \??\C:\Program Files\Symantec\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwSetValueKey [0xA92E3020]
SSDT 89CF7078 ZwSuspendProcess
SSDT 899A74B0 ZwSuspendThread
SSDT 89B6E518 ZwTerminateProcess
SSDT 881EFAF0 ZwTerminateThread
SSDT 89C8EAA0 ZwUnmapViewOfSection
SSDT 89A236D0 ZwWriteVirtualMemory

---- Kernel code sections - GMER 1.0.15 ----

.text ntkrnlpa.exe!ZwCallbackReturn + 2FFC 80504898 4 Bytes JMP B24889C8
.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xB8E9F360, 0x22117D, 0xE8000020]

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Ip SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Ip Lbd.sys (Boot Driver/Lavasoft AB)
AttachedDevice \Driver\Tcpip \Device\Tcp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Tcp Lbd.sys (Boot Driver/Lavasoft AB)
AttachedDevice \Driver\Tcpip \Device\Udp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Udp Lbd.sys (Boot Driver/Lavasoft AB)
AttachedDevice \Driver\Tcpip \Device\RawIp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)

---- EOF - GMER 1.0.15 ----

 

Hijackthis log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:52:16, on 29/03/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16981)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\WiFi\bin\S24EvMon.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Intel\WiFi\bin\EvtEng.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
C:\Program Files\SigmaTel\C-Major Audio\WDM\StacSV.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
C:\Program Files\Intel\WiFi\bin\WLKeeper.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\system32\ICO.EXE
C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe
C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
C:\Program Files\Sony\ISB Utility\ISBMgr.exe
C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Sony\AppMonUtil\AppMonUtility.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Intel\WiFi\bin\ZCfgSvc.exe
C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.club-vaio.com/en/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.club-vaio.com/en/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [VAIOCameraUtility] "C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe "
O4 - HKLM\..\Run: [SonyPowerCfg] "C:\Program Files\Sony\VAIO Power Management\SPMgr.exe "
O4 - HKLM\..\Run: [ISBMgr.exe] C:\Program Files\Sony\ISB Utility\ISBMgr.exe
O4 - HKLM\..\Run: [Switcher.exe] C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe "
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [AppMon Utility] "C:\Program Files\Sony\AppMonUtil\AppMonUtility.exe" @@@Start
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe "
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\WiFi\bin\ZCfgSvc.exe "
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" /tf Intel Wireless Tray
O4 - HKLM\..\Run: [VAIO Update 5] "C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe" /Stationary
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe "
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe "
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe "
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Add RSS Support Site to VAIO Information FLOW - C:\Program Files\Sony\VAIO Information FLOW\aiesc.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.club-vaio.com/en/
O15 - Trusted Zone: *.sony-europe.com
O15 - Trusted Zone: *.sonystyle-europe.com
O15 - Trusted Zone: *.vaio-link.com
O16 - DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} (SysInfo Class) - http://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.1.66.0.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program Files\Sony\Image Converter 2\IcVzMon.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless WiFi Service (S24EventMonitor) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\S24EvMon.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Program Files\SigmaTel\C-Major Audio\WDM\StacSV.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe
O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
O23 - Service: VUAgent - Sony Corporation - C:\Program Files\Sony\VAIO Update 5\VUAgent.exe
O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\WLKeeper.exe

--
End of file - 15087 bytes

 

combofix log

ComboFix 10-03-29.04 - Rodrigo 30/03/2010 18:37:20.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.2046.1297 [GMT 2:00]
Running from: c:\documents and settings\Rodrigo\My Documents\Downloads\ComboFix.exe
AV: Norton Internet Security 2006 *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security 2006 *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\recycler\S-1-5-21-219947256-894474488-273542942-500
c:\windows\patchw32.dll
c:\windows\pw32a.dll

.
((((((((((((((((((((((((( Files Created from 2010-02-28 to 2010-03-30 )))))))))))))))))))))))))))))))
.

2010-03-29 20:35 . 2010-03-29 22:39 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-03-29 20:16 . 2010-03-30 16:33 -------- d-----w- C:\Cache
2010-03-29 19:51 . 2010-03-29 19:51 -------- d-----w- c:\program files\Trend Micro
2010-03-28 15:54 . 2010-03-28 15:54 -------- d-----w- c:\documents and settings\Rodrigo\Local Settings\Application Data\Sony Corporation
2010-03-28 14:27 . 2010-03-28 14:27 -------- d-----w- c:\documents and settings\Rodrigo\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2010-03-28 13:41 . 2010-02-01 01:45 38784 ----a-w- c:\documents and settings\Rodrigo\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-03-28 13:41 . 2010-03-28 13:41 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-03-28 13:40 . 2010-03-28 13:40 86016 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\arh.exe
2010-03-28 13:38 . 2010-03-28 13:38 -------- d-----w- c:\documents and settings\Rodrigo\Application Data\AdobeUM
2010-03-28 06:29 . 2010-03-28 06:29 -------- d-----w- c:\windows\Sun
2010-03-27 20:52 . 2010-03-27 20:52 1956808 ----a-w- c:\documents and settings\Rodrigo\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe
2010-03-27 19:26 . 2010-03-28 13:43 -------- d-----w- c:\program files\SpywareGuard
2010-03-27 19:19 . 2010-03-27 19:19 -------- d-----w- c:\documents and settings\All Users\Application Data\TEMP
2010-03-27 19:19 . 2010-03-27 19:19 -------- d-----w- c:\program files\SpywareBlaster
2010-03-27 18:46 . 2010-03-27 18:46 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}
2010-03-27 18:46 . 2010-02-04 15:53 2954656 -c--a-w- c:\documents and settings\All Users\Application Data\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}\Ad-AwareInstaller.exe
2010-03-27 18:46 . 2010-03-27 18:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2010-03-27 18:46 . 2010-03-27 18:46 -------- d-----w- c:\program files\Lavasoft
2010-03-27 18:13 . 2010-03-27 18:13 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2010-03-27 18:13 . 2010-03-27 18:13 -------- d-----w- c:\documents and settings\Rodrigo\Application Data\skypePM
2010-03-27 17:59 . 2010-03-27 18:03 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-03-27 17:59 . 2010-03-27 18:02 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-03-27 17:52 . 2010-03-27 17:52 -------- d-----w- c:\documents and settings\Rodrigo\Application Data\Malwarebytes
2010-03-27 17:52 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-27 17:52 . 2010-03-27 17:52 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-03-27 17:52 . 2010-03-27 17:52 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-03-27 17:52 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-03-27 17:48 . 2010-03-27 17:48 -------- d-----w- c:\program files\Common Files\Skype
2010-03-27 17:48 . 2010-03-27 17:48 -------- d-----r- c:\program files\Skype
2010-03-27 17:46 . 2010-03-27 18:40 -------- d-----w- c:\documents and settings\Rodrigo\Application Data\Skype
2010-03-27 17:46 . 2010-03-27 17:48 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2010-03-27 17:44 . 2010-03-27 17:44 -------- d-----w- c:\program files\Common Files\DivX Shared
2010-03-27 17:43 . 2010-03-27 17:44 -------- d-----w- c:\program files\DivX
2010-03-27 17:40 . 2010-03-27 17:40 348160 ----a-w- c:\documents and settings\Rodrigo\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-1e7af390-n\msvcr71.dll
2010-03-27 17:40 . 2010-03-27 17:40 503808 ----a-w- c:\documents and settings\Rodrigo\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-1e7af390-n\msvcp71.dll
2010-03-27 17:40 . 2010-03-27 17:40 499712 ----a-w- c:\documents and settings\Rodrigo\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-1e7af390-n\jmc.dll
2010-03-27 17:40 . 2010-03-27 17:40 61440 ----a-w- c:\documents and settings\Rodrigo\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-6f237e72-n\decora-sse.dll
2010-03-27 17:40 . 2010-03-27 17:40 12800 ----a-w- c:\documents and settings\Rodrigo\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-6f237e72-n\decora-d3d.dll
2010-03-27 17:40 . 2010-03-27 17:39 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-03-27 17:36 . 2010-03-27 17:37 1924976 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\install_flash_player.exe
2010-03-27 17:36 . 2010-03-28 15:08 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2010-03-27 15:49 . 2010-03-27 15:49 -------- d-----w- c:\windows\system32\scripting
2010-03-27 15:49 . 2010-03-27 15:49 -------- d-----w- c:\windows\l2schemas
2010-03-27 15:49 . 2010-03-27 15:49 -------- d-----w- c:\windows\system32\en
2010-03-27 15:49 . 2010-03-27 15:49 -------- d-----w- c:\windows\system32\bits
2010-03-27 15:08 . 2010-03-27 15:08 -------- d-----w- c:\documents and settings\Rodrigo\Local Settings\Application Data\Identities
2010-03-27 15:08 . 2010-03-27 15:16 -------- d-----w- c:\program files\Windows Desktop Search
2010-03-27 15:08 . 2010-03-27 15:08 -------- d-----w- c:\windows\system32\GroupPolicy
2010-03-27 15:07 . 2008-03-07 17:02 98304 -c----w- c:\windows\system32\dllcache\nlhtml.dll
2010-03-27 15:07 . 2008-03-07 17:02 29696 -c----w- c:\windows\system32\dllcache\mimefilt.dll
2010-03-27 15:07 . 2008-03-07 17:02 192000 -c----w- c:\windows\system32\dllcache\offfilt.dll
2010-03-27 15:06 . 2010-03-27 15:06 -------- d-----w- c:\program files\MSXML 6.0
2010-03-27 14:51 . 2008-04-14 00:11 12800 ------w- c:\windows\system32\credssp.dll
2010-03-27 14:41 . 2010-01-05 10:00 52224 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
2010-03-27 14:41 . 2010-01-05 10:00 459264 -c----w- c:\windows\system32\dllcache\msfeeds.dll
2010-03-27 14:41 . 2010-01-05 10:00 268288 -c----w- c:\windows\system32\dllcache\iertutil.dll
2010-03-27 14:41 . 2010-01-05 10:00 6067200 -c----w- c:\windows\system32\dllcache\ieframe.dll
2010-03-27 14:41 . 2010-01-05 10:00 380928 -c----w- c:\windows\system32\dllcache\ieapfltr.dll
2010-03-27 14:41 . 2009-12-31 15:33 13824 -c----w- c:\windows\system32\dllcache\ieudinit.exe
2010-03-27 14:41 . 2009-06-29 08:33 2452872 -c----w- c:\windows\system32\dllcache\ieapfltr.dat
2010-03-27 14:41 . 2010-01-05 10:00 63488 -c----w- c:\windows\system32\dllcache\icardie.dll
2010-03-27 14:34 . 2007-08-13 17:54 33792 -c--a-w- c:\windows\system32\dllcache\custsat.dll
2010-03-27 14:03 . 2010-03-27 14:03 -------- d-----w- c:\program files\MSXML 4.0
2010-03-27 13:58 . 2010-03-27 15:47 -------- d-----w- c:\windows\ServicePackFiles
2010-03-27 13:49 . 2009-10-23 15:28 3558912 -c----w- c:\windows\system32\dllcache\moviemk.exe
2010-03-27 13:48 . 2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe
2010-03-27 13:48 . 2009-12-31 16:50 353792 -c----w- c:\windows\system32\dllcache\srv.sys
2010-03-27 13:47 . 2009-12-04 18:22 455424 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2010-03-27 13:46 . 2009-10-15 16:28 81920 -c----w- c:\windows\system32\dllcache\fontsub.dll
2010-03-27 13:46 . 2009-10-15 16:28 119808 -c----w- c:\windows\system32\dllcache\t2embed.dll
2010-03-27 13:46 . 2009-11-21 15:51 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll
2010-03-27 13:42 . 2009-06-21 21:44 153088 -c----w- c:\windows\system32\dllcache\triedit.dll
2010-03-27 13:41 . 2009-07-10 13:27 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll
2010-03-27 13:39 . 2008-05-03 11:55 2560 ------w- c:\windows\system32\xpsp4res.dll
2010-03-27 13:39 . 2008-04-21 12:08 215552 -c----w- c:\windows\system32\dllcache\wordpad.exe
2010-03-27 13:39 . 2009-07-31 04:35 1172480 -c----w- c:\windows\system32\dllcache\msxml3.dll
2010-03-27 13:39 . 2008-10-15 16:34 337408 -c----w- c:\windows\system32\dllcache\netapi32.dll
2010-03-27 13:38 . 2008-04-11 19:04 691712 -c----w- c:\windows\system32\dllcache\inetcomm.dll
2010-03-27 13:38 . 2009-08-13 15:16 512000 -c--a-w- c:\windows\system32\dllcache\jscript.dll
2010-03-27 13:38 . 2008-06-13 11:05 272128 -c----w- c:\windows\system32\dllcache\bthport.sys
2010-03-27 13:38 . 2008-06-13 11:05 272128 ------w- c:\windows\system32\drivers\bthport.sys
2010-03-27 13:38 . 2008-05-08 14:02 203136 -c----w- c:\windows\system32\dllcache\rmcast.sys
2010-03-27 13:30 . 2010-03-27 13:30 -------- d-sh--w- c:\documents and settings\Rodrigo\UserData
2010-03-27 13:26 . 2006-11-28 13:15 35704 ----a-w- c:\windows\system32\NicInst.dll
2010-03-27 13:26 . 2006-11-28 13:15 28536 ----a-w- c:\windows\system32\NicCo.dll
2010-03-27 13:25 . 2010-03-27 13:25 -------- d-----w- c:\documents and settings\Rodrigo\Application Data\InstallShield
2010-03-27 13:21 . 2009-06-12 12:31 80896 -c----w- c:\windows\system32\dllcache\tlntsess.exe
2010-03-27 13:21 . 2009-06-12 12:31 76288 -c----w- c:\windows\system32\dllcache\telnet.exe
2010-03-27 13:20 . 2010-03-27 13:29 -------- d-----w- C:\Update
2010-03-27 13:15 . 2010-03-27 13:15 -------- d-----w- c:\documents and settings\Rodrigo\Application Data\Intel
2010-03-27 13:15 . 2010-03-27 13:15 -------- d-----w- c:\documents and settings\NetworkService\Application Data\Intel
2010-03-27 13:15 . 2010-03-27 13:15 -------- d-----w- c:\documents and settings\LocalService\Application Data\Intel
2010-03-27 13:15 . 2010-03-27 13:15 -------- d-----w- c:\documents and settings\Administrator\Application Data\Intel
2010-03-27 13:15 . 2009-10-26 04:47 4221952 ----a-w- c:\windows\system32\drivers\NETw5x32.sys
2010-03-27 13:15 . 2008-06-20 08:33 2756608 ----a-w- c:\windows\system32\NETw5r32.dll
2010-03-27 13:15 . 2008-06-20 08:32 663552 ----a-w- c:\windows\system32\NETw5c32.dll
2010-03-27 13:15 . 2010-03-27 13:15 -------- d-----w- c:\program files\Common Files\Intel
2010-03-27 13:15 . 2010-03-27 13:15 -------- d-----w- c:\documents and settings\All Users\Application Data\Intel
2010-03-27 13:11 . 2010-03-27 13:11 -------- d-----w- c:\program files\SystemRequirementsLab
2010-03-27 13:08 . 2008-05-01 14:33 331776 -c----w- c:\windows\system32\dllcache\msadce.dll
2010-03-27 13:08 . 2009-06-10 07:19 2066432 -c----w- c:\windows\system32\dllcache\mstscax.dll
2010-03-27 13:03 . 2010-03-27 13:03 -------- d-----w- c:\program files\SanityCheck
2010-03-27 13:03 . 2009-11-12 09:11 27192 ----a-w- c:\windows\system32\drivers\rspSanity32.sys
2010-03-27 12:54 . 2010-03-27 12:54 0 ----a-w- c:\windows\nsreg.dat
2010-03-27 12:54 . 2010-03-27 12:54 -------- d-----w- c:\documents and settings\Rodrigo\Local Settings\Application Data\Mozilla
2010-03-27 12:45 . 2010-03-27 12:45 -------- d-----w- c:\windows\system32\LogFiles
2010-03-27 12:40 . 2010-03-27 12:40 -------- d-----w- c:\documents and settings\Rodrigo\Local Settings\Application Data\Toshiba
2010-03-27 12:34 . 2006-04-26 10:47 117200 ----a-w- c:\documents and settings\All Users\Application Data\Sony Corporation\Click to DVD\2.0\HDDisc\SonyMpeg2tsSplitterInst\setup.exe
2010-03-27 12:34 . 2003-06-18 16:31 18944 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\mdippr.dll
2010-03-27 12:34 . 2003-06-18 16:31 17920 ----a-w- c:\windows\system32\mdimon.dll
2010-03-27 12:33 . 2010-03-27 12:33 -------- d-----w- c:\program files\Microsoft ActiveSync
2010-03-27 12:33 . 2010-03-27 12:33 -------- d-----w- c:\windows\SHELLNEW
2010-03-27 12:33 . 2010-03-27 12:33 -------- d-----w- c:\program files\Microsoft.NET
2010-03-27 12:33 . 2010-03-27 12:33 -------- d-----r- C:\MSOCache
2010-03-27 12:31 . 2010-03-27 12:32 -------- d-----w- c:\program files\Microsoft Works
2010-03-27 12:30 . 2010-03-28 13:45 -------- d-----w- c:\documents and settings\Rodrigo\Local Settings\Application Data\Adobe
2010-03-27 12:27 . 2002-12-17 15:23 33340 ------w- c:\windows\system32\dbmsqlgc.dll
2010-03-27 12:27 . 2002-10-20 13:05 24576 ------w- c:\windows\system32\dbmsgnet.dll
2010-03-27 12:27 . 1998-10-29 14:45 306688 ----a-w- c:\windows\IsUninst.exe
2010-03-27 12:27 . 2010-03-27 12:27 -------- d-----w- c:\program files\Microsoft SQL Server
2010-03-27 12:26 . 2005-11-11 15:00 2981888 ----a-w- c:\windows\system32\iplw7.dll
2010-03-27 12:26 . 2005-11-11 15:00 2785280 ----a-w- c:\windows\system32\iplm6.dll
2010-03-27 12:26 . 2005-11-11 15:00 2686976 ----a-w- c:\windows\system32\iplm5.dll
2010-03-27 12:26 . 2005-11-11 15:00 2531328 ----a-w- c:\windows\system32\iplp6.dll
2010-03-27 12:26 . 2005-11-11 15:00 2502656 ----a-w- c:\windows\system32\iplpx.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-30 16:27 . 2006-07-31 12:00 -------- d-----w- c:\program files\Norton Internet Security
2010-03-30 16:27 . 2006-07-31 11:58 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-03-28 13:43 . 2006-07-31 11:48 -------- d-----w- c:\program files\Common Files\Adobe
2010-03-27 17:40 . 2006-07-31 11:45 -------- d-----w- c:\program files\Common Files\Java
2010-03-27 17:39 . 2006-07-31 11:45 -------- d-----w- c:\program files\Java
2010-03-27 16:57 . 2006-07-31 11:56 -------- d-----w- c:\program files\Google BAE
2010-03-27 16:34 . 2006-07-31 11:58 -------- d-----w- c:\program files\Symantec
2010-03-27 15:52 . 2006-07-28 15:10 86811 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-03-27 13:28 . 2006-07-31 11:46 -------- d-----w- c:\program files\Sony
2010-03-27 13:28 . 2006-07-28 16:08 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-03-27 13:15 . 2006-07-28 16:03 -------- d-----w- c:\program files\Intel
2010-03-27 12:40 . 2006-07-31 11:58 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec
2010-03-27 12:37 . 2006-07-31 12:00 10344 ----a-w- c:\windows\system32\drivers\symlcbrd.sys
2010-03-27 12:28 . 2006-07-31 12:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Sony Corporation
2010-03-27 12:28 . 2006-07-31 11:43 -------- d-----w- c:\program files\Common Files\Sony Shared
2010-03-27 12:22 . 2010-03-27 12:17 -------- d-----w- c:\documents and settings\Rodrigo\Application Data\Sony Corporation
2010-03-27 12:16 . 2010-03-27 12:16 0 ---ha-r- c:\windows\system32\drivers\Sony_VGN-AR21M.mrk
2010-03-04 13:01 . 2006-07-31 11:46 503808 ----a-w- c:\windows\system32\MSVCP71.DLL
2010-03-04 13:01 . 2006-07-31 11:46 348160 ----a-w- c:\windows\system32\MSVCR71.DLL
2010-03-04 13:01 . 2006-01-25 08:21 1060864 ----a-w- c:\windows\system32\MFC71.DLL
2010-02-04 15:53 . 2010-03-27 18:49 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys
2010-01-05 10:00 . 2006-07-28 06:55 832512 ----a-w- c:\windows\system32\wininet.dll
2010-01-05 10:00 . 2006-07-28 06:55 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-01-05 10:00 . 2006-07-28 06:55 17408 ------w- c:\windows\system32\corpol.dll
2009-12-31 16:50 . 2006-07-28 06:55 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer "= "c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter "= "c:\windows\system32\NvMcTray.dll" [2006-07-06 86016]
"NvCplDaemon "= "c:\windows\system32\NvCpl.dll" [2006-07-06 7561216]
"Apoint "= "c:\program files\Apoint\Apoint.exe" [2004-11-17 118784]
"ehTray "= "c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
"Mouse Suite 98 Daemon "= "ICO.EXE" [2002-03-14 45056]
"VAIOCameraUtility "= "c:\program files\Sony\VAIO Camera Utility\VCUServe.exe" [2005-12-27 69632]
"SonyPowerCfg "= "c:\program files\Sony\VAIO Power Management\SPMgr.exe" [2006-06-27 217088]
"ISBMgr.exe "= "c:\program files\Sony\ISB Utility\ISBMgr.exe" [2004-02-20 32768]
"Switcher.exe "= "c:\program files\Sony\Wireless Switch Setting Utility\Switcher.exe" [2006-02-14 176128]
"ccApp "= "c:\program files\Common Files\Symantec Shared\ccApp.exe" [2006-01-25 52848]
"URLLSTCK.exe "= "c:\program files\Norton Internet Security\UrlLstCk.exe" [2007-01-16 23168]
"AppMon Utility "= "c:\program files\Sony\AppMonUtil\AppMonUtility.exe" [2006-06-22 29696]
"Acrobat Assistant 7.0 "= "c:\program files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2005-03-03 483328]
"IntelZeroConfig "= "c:\program files\Intel\WiFi\bin\ZCfgSvc.exe" [2009-11-03 1372160]
"IntelWireless "= "c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2009-11-03 1202448]
"VAIO Update 5 "= "c:\program files\Sony\VAIO Update 5\VAIOUpdt.exe" [2009-12-08 1324400]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-21 35760]
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE "= "c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Rodrigo\Start Menu\Programs\Startup\
SpywareGuard.lnk - c:\program files\SpywareGuard\sgmain.exe [2003-8-29 360448]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
2006-03-09 13:51 73728 ----a-w- c:\windows\system32\VESWinlogon.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@= "Service "

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"c:\\Program Files\\Adobe\\Photoshop Elements 4.0\\AdobePhotoshopElementsMediaServer.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\Program Files\\Skype\\Phone\\Skype.exe "=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe "=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [27/03/2010 20:49 64288]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [04/02/2010 17:52 1263728]
R2 MSSQL$VAIO_VEDB;MSSQL$VAIO_VEDB;c:\program files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe -sVAIO_VEDB --> c:\program files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe -sVAIO_VEDB [?]
R3 5U870CAP_VID_1262&PID_25FD;Sony Visual Communication Camera VGP-VCC2 ;c:\windows\system32\drivers\5U870CAP.sys [28/07/2006 08:55 75264]
R3 AVerM115S;AVerM115S service;c:\windows\system32\drivers\AVerM115S.sys [28/07/2006 08:55 754688]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [27/03/2010 18:50 102448]
R3 SonyImgF;Sony Image Conversion Filter Driver;c:\windows\system32\drivers\SonyImgF.sys [28/07/2006 08:55 30080]
R3 ti21sony;ti21sony;c:\windows\system32\drivers\ti21sony.sys [28/07/2006 08:55 812544]
R3 VUAgent;VUAgent;c:\program files\Sony\VAIO Update 5\VUAgent.exe [27/03/2010 15:23 673136]
S3 cpudrv;cpudrv;c:\program files\SystemRequirementsLab\cpudrv.sys [18/12/2009 11:58 11336]
S3 rspSanity;rspSanity;c:\windows\system32\drivers\rspSanity32.sys [27/03/2010 15:03 27192]
S3 SQLAgent$VAIO_VEDB;SQLAgent$VAIO_VEDB;c:\program files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlagent.EXE -i VAIO_VEDB --> c:\program files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlagent.EXE -i VAIO_VEDB [?]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - COMHOST
.
Contents of the 'Scheduled Tasks' folder

2010-03-30 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-02-04 18:49]

2010-03-27 c:\windows\Tasks\Norton AntiVirus - Run Full System Scan - Rodrigo.job
- c:\progra~1\NORTON~1\NORTON~1\Navw32.exe [2006-01-25 11:13]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.club-vaio.com/en/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = hxxp://www.club-vaio.com/en/
uInternet Settings,ProxyOverride = local
IE: &Google Search - c:\program files\Google\GoogleToolbar1.dll/cmsearch.html
IE: &Translate English Word - c:\program files\Google\GoogleToolbar1.dll/cmwordtrans.html
IE: Add RSS Support Site to VAIO Information FLOW - c:\program files\Sony\VAIO Information FLOW\aiesc.html
IE: Backward Links - c:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html
IE: Cached Snapshot of Page - c:\program files\Google\GoogleToolbar1.dll/cmcache.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
IE: Similar Pages - c:\program files\Google\GoogleToolbar1.dll/cmsimilar.html
IE: Translate Page into English - c:\program files\Google\GoogleToolbar1.dll/cmtrans.html
Trusted Zone: sony-europe.com
Trusted Zone: sonystyle-europe.com
Trusted Zone: vaio-link.com
DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} - hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.1.66.0.cab
FF - ProfilePath - c:\documents and settings\Rodrigo\Application Data\Mozilla\Firefox\Profiles\6nnxd13u.default\
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-SunJavaUpdateSched - c:\program files\Java\jre6\bin\jusched.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-30 18:40
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(764)
c:\windows\system32\IWPDGINA.DLL
c:\program files\Intel\WiFi\bin\LangResources\ENU\SsoGnENU.dll
c:\windows\system32\VESWinlogon.dll
.
Completion time: 2010-03-30 18:42:34
ComboFix-quarantined-files.txt 2010-03-30 16:42

Pre-Run: 56,383,844,352 bytes free
Post-Run: 56,388,640,768 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT= "Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS= "Windows XP Media Center Edition" /noexecute=optin /fastdetect

- - End Of File - - A0E839DF3CF136318E8DD67CFF5A77A6

 

new hijackthis log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:44:27, on 30/03/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16981)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\WiFi\bin\S24EvMon.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Intel\WiFi\bin\EvtEng.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
C:\Program Files\SigmaTel\C-Major Audio\WDM\StacSV.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
C:\Program Files\Intel\WiFi\bin\WLKeeper.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\system32\ICO.EXE
C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe
C:\Program Files\Sony\ISB Utility\ISBMgr.exe
C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Intel\WiFi\bin\ZCfgSvc.exe
C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Sony\VAIO Update 5\VUAgent.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.club-vaio.com/en/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.club-vaio.com/en/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: SpywareGuardDLBLOCK.CBrowserHelper - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [VAIOCameraUtility] "C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe "
O4 - HKLM\..\Run: [SonyPowerCfg] "C:\Program Files\Sony\VAIO Power Management\SPMgr.exe "
O4 - HKLM\..\Run: [ISBMgr.exe] C:\Program Files\Sony\ISB Utility\ISBMgr.exe
O4 - HKLM\..\Run: [Switcher.exe] C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe "
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [AppMon Utility] "C:\Program Files\Sony\AppMonUtil\AppMonUtility.exe" @@@Start
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe "
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\WiFi\bin\ZCfgSvc.exe "
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" /tf Intel Wireless Tray
O4 - HKLM\..\Run: [VAIO Update 5] "C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe" /Stationary
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe "
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe "
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Add RSS Support Site to VAIO Information FLOW - C:\Program Files\Sony\VAIO Information FLOW\aiesc.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.club-vaio.com/en/
O15 - Trusted Zone: *.sony-europe.com
O15 - Trusted Zone: *.sonystyle-europe.com
O15 - Trusted Zone: *.vaio-link.com
O16 - DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} (SysInfo Class) - http://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.1.66.0.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program Files\Sony\Image Converter 2\IcVzMon.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless WiFi Service (S24EventMonitor) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\S24EvMon.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Program Files\SigmaTel\C-Major Audio\WDM\StacSV.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe
O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
O23 - Service: VUAgent - Sony Corporation - C:\Program Files\Sony\VAIO Update 5\VUAgent.exe
O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\WLKeeper.exe

--
End of file - 14580 bytes

 

latest combofix log

ComboFix 10-03-29.04 - Rodrigo 31/03/2010 22:08:43.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.2046.1121 [GMT 2:00]
Running from: c:\documents and settings\Rodrigo\My Documents\Downloads\ComboFix.exe
Command switches used :: c:\documents and settings\Rodrigo\My Documents\Downloads\CFScript.txt
AV: Norton Internet Security 2006 *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security 2006 *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}

FILE ::
"c:\windows\system32\ezsidmv.dat "
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\ezsidmv.dat

.
((((((((((((((((((((((((( Files Created from 2010-02-28 to 2010-03-31 )))))))))))))))))))))))))))))))
.

2010-03-31 16:53 . 2010-03-31 16:53 -------- d-----w- c:\windows\LastGood
2010-03-30 17:49 . 2010-03-30 17:49 516480 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\EmailScannerAddin.dll
2010-03-30 17:49 . 2010-03-30 17:49 17632 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\WSCUpdate.dll
2010-03-29 20:35 . 2010-03-31 18:44 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-03-29 20:16 . 2010-03-31 20:02 -------- d-----w- C:\Cache
2010-03-29 19:51 . 2010-03-29 19:51 -------- d-----w- c:\program files\Trend Micro
2010-03-28 15:54 . 2010-03-28 15:54 -------- d-----w- c:\documents and settings\Rodrigo\Local Settings\Application Data\Sony Corporation
2010-03-28 14:27 . 2010-03-28 14:27 -------- d-----w- c:\documents and settings\Rodrigo\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2010-03-28 13:41 . 2010-02-01 01:45 38784 ----a-w- c:\documents and settings\Rodrigo\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-03-28 13:41 . 2010-03-28 13:41 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-03-28 13:40 . 2010-03-28 13:40 86016 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\arh.exe
2010-03-28 13:38 . 2010-03-28 13:38 -------- d-----w- c:\documents and settings\Rodrigo\Application Data\AdobeUM
2010-03-28 06:29 . 2010-03-28 06:29 -------- d-----w- c:\windows\Sun
2010-03-27 20:52 . 2010-03-27 20:52 1956808 ----a-w- c:\documents and settings\Rodrigo\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe
2010-03-27 19:26 . 2010-03-28 13:43 -------- d-----w- c:\program files\SpywareGuard
2010-03-27 19:19 . 2010-03-30 18:53 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-03-27 19:19 . 2010-03-27 19:19 -------- d-----w- c:\program files\SpywareBlaster
2010-03-27 18:46 . 2010-03-27 18:46 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}
2010-03-27 18:46 . 2010-02-04 15:53 2954656 -c--a-w- c:\documents and settings\All Users\Application Data\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}\Ad-AwareInstaller.exe
2010-03-27 18:46 . 2010-03-27 18:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2010-03-27 18:46 . 2010-03-27 18:46 -------- d-----w- c:\program files\Lavasoft
2010-03-27 18:13 . 2010-03-27 18:13 -------- d-----w- c:\documents and settings\Rodrigo\Application Data\skypePM
2010-03-27 17:59 . 2010-03-27 18:03 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-03-27 17:59 . 2010-03-27 18:02 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-03-27 17:52 . 2010-03-27 17:52 -------- d-----w- c:\documents and settings\Rodrigo\Application Data\Malwarebytes
2010-03-27 17:52 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-27 17:52 . 2010-03-27 17:52 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-03-27 17:52 . 2010-03-27 17:52 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-03-27 17:52 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-03-27 17:48 . 2010-03-27 17:48 -------- d-----w- c:\program files\Common Files\Skype
2010-03-27 17:48 . 2010-03-27 17:48 -------- d-----r- c:\program files\Skype
2010-03-27 17:46 . 2010-03-27 18:40 -------- d-----w- c:\documents and settings\Rodrigo\Application Data\Skype
2010-03-27 17:46 . 2010-03-27 17:48 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2010-03-27 17:44 . 2010-03-27 17:44 -------- d-----w- c:\program files\Common Files\DivX Shared
2010-03-27 17:43 . 2010-03-27 17:44 -------- d-----w- c:\program files\DivX
2010-03-27 17:40 . 2010-03-27 17:40 348160 ----a-w- c:\documents and settings\Rodrigo\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-1e7af390-n\msvcr71.dll
2010-03-27 17:40 . 2010-03-27 17:40 503808 ----a-w- c:\documents and settings\Rodrigo\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-1e7af390-n\msvcp71.dll
2010-03-27 17:40 . 2010-03-27 17:40 499712 ----a-w- c:\documents and settings\Rodrigo\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-1e7af390-n\jmc.dll
2010-03-27 17:40 . 2010-03-27 17:40 61440 ----a-w- c:\documents and settings\Rodrigo\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-6f237e72-n\decora-sse.dll
2010-03-27 17:40 . 2010-03-27 17:40 12800 ----a-w- c:\documents and settings\Rodrigo\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-6f237e72-n\decora-d3d.dll
2010-03-27 17:40 . 2010-03-27 17:39 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-03-27 17:36 . 2010-03-27 17:37 1924976 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\install_flash_player.exe
2010-03-27 17:36 . 2010-03-28 15:08 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2010-03-27 15:49 . 2010-03-27 15:49 -------- d-----w- c:\windows\system32\scripting
2010-03-27 15:49 . 2010-03-27 15:49 -------- d-----w- c:\windows\l2schemas
2010-03-27 15:49 . 2010-03-27 15:49 -------- d-----w- c:\windows\system32\en
2010-03-27 15:49 . 2010-03-27 15:49 -------- d-----w- c:\windows\system32\bits
2010-03-27 15:08 . 2010-03-27 15:08 -------- d-----w- c:\documents and settings\Rodrigo\Local Settings\Application Data\Identities
2010-03-27 15:08 . 2010-03-27 15:16 -------- d-----w- c:\program files\Windows Desktop Search
2010-03-27 15:08 . 2010-03-27 15:08 -------- d-----w- c:\windows\system32\GroupPolicy
2010-03-27 15:07 . 2008-03-07 17:02 98304 -c----w- c:\windows\system32\dllcache\nlhtml.dll
2010-03-27 15:07 . 2008-03-07 17:02 29696 -c----w- c:\windows\system32\dllcache\mimefilt.dll
2010-03-27 15:07 . 2008-03-07 17:02 192000 -c----w- c:\windows\system32\dllcache\offfilt.dll
2010-03-27 15:06 . 2010-03-27 15:06 -------- d-----w- c:\program files\MSXML 6.0
2010-03-27 14:51 . 2008-04-14 00:11 12800 ------w- c:\windows\system32\credssp.dll
2010-03-27 14:41 . 2010-01-05 10:00 52224 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
2010-03-27 14:41 . 2010-01-05 10:00 459264 -c----w- c:\windows\system32\dllcache\msfeeds.dll
2010-03-27 14:41 . 2010-01-05 10:00 268288 -c----w- c:\windows\system32\dllcache\iertutil.dll
2010-03-27 14:41 . 2010-01-05 10:00 6067200 -c----w- c:\windows\system32\dllcache\ieframe.dll
2010-03-27 14:41 . 2010-01-05 10:00 380928 -c----w- c:\windows\system32\dllcache\ieapfltr.dll
2010-03-27 14:41 . 2009-12-31 15:33 13824 -c----w- c:\windows\system32\dllcache\ieudinit.exe
2010-03-27 14:41 . 2009-06-29 08:33 2452872 -c----w- c:\windows\system32\dllcache\ieapfltr.dat
2010-03-27 14:41 . 2010-01-05 10:00 63488 -c----w- c:\windows\system32\dllcache\icardie.dll
2010-03-27 14:34 . 2007-08-13 17:54 33792 -c--a-w- c:\windows\system32\dllcache\custsat.dll
2010-03-27 14:03 . 2010-03-27 14:03 -------- d-----w- c:\program files\MSXML 4.0
2010-03-27 13:58 . 2010-03-27 15:47 -------- d-----w- c:\windows\ServicePackFiles
2010-03-27 13:49 . 2009-10-23 15:28 3558912 -c----w- c:\windows\system32\dllcache\moviemk.exe
2010-03-27 13:48 . 2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe
2010-03-27 13:48 . 2009-12-31 16:50 353792 -c----w- c:\windows\system32\dllcache\srv.sys
2010-03-27 13:47 . 2009-12-04 18:22 455424 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2010-03-27 13:46 . 2009-10-15 16:28 81920 -c----w- c:\windows\system32\dllcache\fontsub.dll
2010-03-27 13:46 . 2009-10-15 16:28 119808 -c----w- c:\windows\system32\dllcache\t2embed.dll
2010-03-27 13:46 . 2009-11-21 15:51 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll
2010-03-27 13:42 . 2009-06-21 21:44 153088 -c----w- c:\windows\system32\dllcache\triedit.dll
2010-03-27 13:41 . 2009-07-10 13:27 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll
2010-03-27 13:39 . 2008-05-03 11:55 2560 ------w- c:\windows\system32\xpsp4res.dll
2010-03-27 13:39 . 2008-04-21 12:08 215552 -c----w- c:\windows\system32\dllcache\wordpad.exe
2010-03-27 13:39 . 2009-07-31 04:35 1172480 -c----w- c:\windows\system32\dllcache\msxml3.dll
2010-03-27 13:39 . 2008-10-15 16:34 337408 -c----w- c:\windows\system32\dllcache\netapi32.dll
2010-03-27 13:38 . 2008-04-11 19:04 691712 -c----w- c:\windows\system32\dllcache\inetcomm.dll
2010-03-27 13:38 . 2009-08-13 15:16 512000 -c--a-w- c:\windows\system32\dllcache\jscript.dll
2010-03-27 13:38 . 2008-06-13 11:05 272128 -c----w- c:\windows\system32\dllcache\bthport.sys
2010-03-27 13:38 . 2008-06-13 11:05 272128 ------w- c:\windows\system32\drivers\bthport.sys
2010-03-27 13:38 . 2008-05-08 14:02 203136 -c----w- c:\windows\system32\dllcache\rmcast.sys
2010-03-27 13:30 . 2010-03-27 13:30 -------- d-sh--w- c:\documents and settings\Rodrigo\UserData
2010-03-27 13:26 . 2006-11-28 13:15 35704 ----a-w- c:\windows\system32\NicInst.dll
2010-03-27 13:26 . 2006-11-28 13:15 28536 ----a-w- c:\windows\system32\NicCo.dll
2010-03-27 13:25 . 2010-03-27 13:25 -------- d-----w- c:\documents and settings\Rodrigo\Application Data\InstallShield
2010-03-27 13:21 . 2009-06-12 12:31 80896 -c----w- c:\windows\system32\dllcache\tlntsess.exe
2010-03-27 13:21 . 2009-06-12 12:31 76288 -c----w- c:\windows\system32\dllcache\telnet.exe
2010-03-27 13:20 . 2010-03-27 13:29 -------- d-----w- C:\Update
2010-03-27 13:15 . 2010-03-27 13:15 -------- d-----w- c:\documents and settings\Rodrigo\Application Data\Intel
2010-03-27 13:15 . 2010-03-27 13:15 -------- d-----w- c:\documents and settings\NetworkService\Application Data\Intel
2010-03-27 13:15 . 2010-03-27 13:15 -------- d-----w- c:\documents and settings\LocalService\Application Data\Intel
2010-03-27 13:15 . 2010-03-27 13:15 -------- d-----w- c:\documents and settings\Administrator\Application Data\Intel
2010-03-27 13:15 . 2009-10-26 04:47 4221952 ----a-w- c:\windows\system32\drivers\NETw5x32.sys
2010-03-27 13:15 . 2008-06-20 08:33 2756608 ----a-w- c:\windows\system32\NETw5r32.dll
2010-03-27 13:15 . 2008-06-20 08:32 663552 ----a-w- c:\windows\system32\NETw5c32.dll
2010-03-27 13:15 . 2010-03-27 13:15 -------- d-----w- c:\program files\Common Files\Intel
2010-03-27 13:15 . 2010-03-27 13:15 -------- d-----w- c:\documents and settings\All Users\Application Data\Intel
2010-03-27 13:11 . 2010-03-27 13:11 -------- d-----w- c:\program files\SystemRequirementsLab
2010-03-27 13:08 . 2008-05-01 14:33 331776 -c----w- c:\windows\system32\dllcache\msadce.dll
2010-03-27 13:08 . 2009-06-10 07:19 2066432 -c----w- c:\windows\system32\dllcache\mstscax.dll
2010-03-27 13:03 . 2010-03-27 13:03 -------- d-----w- c:\program files\SanityCheck
2010-03-27 13:03 . 2009-11-12 09:11 27192 ----a-w- c:\windows\system32\drivers\rspSanity32.sys
2010-03-27 12:54 . 2010-03-27 12:54 0 ----a-w- c:\windows\nsreg.dat
2010-03-27 12:54 . 2010-03-27 12:54 -------- d-----w- c:\documents and settings\Rodrigo\Local Settings\Application Data\Mozilla
2010-03-27 12:45 . 2010-03-27 12:45 -------- d-----w- c:\windows\system32\LogFiles
2010-03-27 12:40 . 2010-03-27 12:40 -------- d-----w- c:\documents and settings\Rodrigo\Local Settings\Application Data\Toshiba
2010-03-27 12:34 . 2006-04-26 10:47 117200 ----a-w- c:\documents and settings\All Users\Application Data\Sony Corporation\Click to DVD\2.0\HDDisc\SonyMpeg2tsSplitterInst\setup.exe
2010-03-27 12:34 . 2003-06-18 16:31 18944 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\mdippr.dll
2010-03-27 12:34 . 2003-06-18 16:31 17920 ----a-w- c:\windows\system32\mdimon.dll
2010-03-27 12:33 . 2010-03-27 12:33 -------- d-----w- c:\program files\Microsoft ActiveSync
2010-03-27 12:33 . 2010-03-27 12:33 -------- d-----w- c:\windows\SHELLNEW
2010-03-27 12:33 . 2010-03-27 12:33 -------- d-----w- c:\program files\Microsoft.NET
2010-03-27 12:33 . 2010-03-27 12:33 -------- d-----r- C:\MSOCache
2010-03-27 12:31 . 2010-03-27 12:32 -------- d-----w- c:\program files\Microsoft Works
2010-03-27 12:30 . 2010-03-30 19:45 -------- d-----w- c:\documents and settings\Rodrigo\Local Settings\Application Data\Adobe
2010-03-27 12:27 . 2002-12-17 15:23 33340 ------w- c:\windows\system32\dbmsqlgc.dll
2010-03-27 12:27 . 2002-10-20 13:05 24576 ------w- c:\windows\system32\dbmsgnet.dll
2010-03-27 12:27 . 1998-10-29 14:45 306688 ----a-w- c:\windows\IsUninst.exe
2010-03-27 12:27 . 2010-03-27 12:27 -------- d-----w- c:\program files\Microsoft SQL Server
2010-03-27 12:26 . 2005-11-11 15:00 2981888 ----a-w- c:\windows\system32\iplw7.dll
2010-03-27 12:26 . 2005-11-11 15:00 2785280 ----a-w- c:\windows\system32\iplm6.dll
2010-03-27 12:26 . 2005-11-11 15:00 2686976 ----a-w- c:\windows\system32\iplm5.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-31 20:07 . 2006-07-31 11:58 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-03-30 16:27 . 2006-07-31 12:00 -------- d-----w- c:\program files\Norton Internet Security
2010-03-28 13:43 . 2006-07-31 11:48 -------- d-----w- c:\program files\Common Files\Adobe
2010-03-27 18:49 . 2010-03-27 18:49 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-03-27 18:49 . 2010-03-27 18:49 95024 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Drivers\SBREDrv.sys
2010-03-27 18:49 . 2010-03-27 18:49 598368 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\EmailScanner.dll
2010-03-27 18:49 . 2010-03-27 18:49 566608 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\sbap.dll
2010-03-27 18:49 . 2010-03-27 18:49 15880 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lsdelete.exe
2010-03-27 18:49 . 2010-03-27 18:49 1230160 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\SBTE.dll
2010-03-27 18:49 . 2010-03-27 18:49 247120 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\SBRE.dll
2010-03-27 18:49 . 2010-03-27 18:49 6330848 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Resources.dll
2010-03-27 18:49 . 2010-03-27 18:49 17480 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\EmailScannerBridge.dll
2010-03-27 17:40 . 2006-07-31 11:45 -------- d-----w- c:\program files\Common Files\Java
2010-03-27 17:39 . 2006-07-31 11:45 -------- d-----w- c:\program files\Java
2010-03-27 16:57 . 2006-07-31 11:56 -------- d-----w- c:\program files\Google BAE
2010-03-27 16:34 . 2006-07-31 11:58 -------- d-----w- c:\program files\Symantec
2010-03-27 15:52 . 2006-07-28 15:10 86811 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-03-27 13:28 . 2006-07-31 11:46 -------- d-----w- c:\program files\Sony
2010-03-27 13:28 . 2006-07-28 16:08 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-03-27 13:15 . 2006-07-28 16:03 -------- d-----w- c:\program files\Intel
2010-03-27 12:40 . 2006-07-31 11:58 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec
2010-03-27 12:37 . 2006-07-31 12:00 10344 ----a-w- c:\windows\system32\drivers\symlcbrd.sys
2010-03-27 12:28 . 2006-07-31 12:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Sony Corporation
2010-03-27 12:28 . 2006-07-31 11:43 -------- d-----w- c:\program files\Common Files\Sony Shared
2010-03-27 12:22 . 2010-03-27 12:17 -------- d-----w- c:\documents and settings\Rodrigo\Application Data\Sony Corporation
2010-03-27 12:16 . 2010-03-27 12:16 0 ---ha-r- c:\windows\system32\drivers\Sony_VGN-AR21M.mrk
2010-03-04 13:01 . 2006-07-31 11:46 503808 ----a-w- c:\windows\system32\MSVCP71.DLL
2010-03-04 13:01 . 2006-07-31 11:46 348160 ----a-w- c:\windows\system32\MSVCR71.DLL
2010-03-04 13:01 . 2006-01-25 08:21 1060864 ----a-w- c:\windows\system32\MFC71.DLL
2010-02-04 15:53 . 2010-03-27 18:49 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys
2010-01-05 10:00 . 2006-07-28 06:55 832512 ------w- c:\windows\system32\wininet.dll
2010-01-05 10:00 . 2006-07-28 06:55 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-01-05 10:00 . 2006-07-28 06:55 17408 ------w- c:\windows\system32\corpol.dll
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.

((((((((((((((((((((((((((((( SnapShot@2010-03-30_16.40.54 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-03-30 23:37 . 2010-03-30 23:37 16384 c:\windows\Temp\Perflib_Perfdata_e0.dat
+ 2010-03-30 23:37 . 2010-03-30 23:37 16384 c:\windows\Temp\Perflib_Perfdata_16c.dat
+ 2006-07-28 15:13 . 2010-03-31 15:48 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2006-07-28 15:13 . 2010-03-27 16:22 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2006-07-28 15:13 . 2010-03-31 15:48 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2006-07-28 15:13 . 2010-03-27 16:22 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2010-03-30 23:47 . 2010-03-31 15:48 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2006-07-28 15:13 . 2010-03-27 16:22 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer "= "c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter "= "c:\windows\system32\NvMcTray.dll" [2006-07-06 86016]
"NvCplDaemon "= "c:\windows\system32\NvCpl.dll" [2006-07-06 7561216]
"Apoint "= "c:\program files\Apoint\Apoint.exe" [2004-11-17 118784]
"ehTray "= "c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
"Mouse Suite 98 Daemon "= "ICO.EXE" [2002-03-14 45056]
"VAIOCameraUtility "= "c:\program files\Sony\VAIO Camera Utility\VCUServe.exe" [2005-12-27 69632]
"SonyPowerCfg "= "c:\program files\Sony\VAIO Power Management\SPMgr.exe" [2006-06-27 217088]
"ISBMgr.exe "= "c:\program files\Sony\ISB Utility\ISBMgr.exe" [2004-02-20 32768]
"Switcher.exe "= "c:\program files\Sony\Wireless Switch Setting Utility\Switcher.exe" [2006-02-14 176128]
"ccApp "= "c:\program files\Common Files\Symantec Shared\ccApp.exe" [2006-01-25 52848]
"URLLSTCK.exe "= "c:\program files\Norton Internet Security\UrlLstCk.exe" [2007-01-16 23168]
"AppMon Utility "= "c:\program files\Sony\AppMonUtil\AppMonUtility.exe" [2006-06-22 29696]
"Acrobat Assistant 7.0 "= "c:\program files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2005-03-03 483328]
"IntelZeroConfig "= "c:\program files\Intel\WiFi\bin\ZCfgSvc.exe" [2009-11-03 1372160]
"IntelWireless "= "c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2009-11-03 1202448]
"VAIO Update 5 "= "c:\program files\Sony\VAIO Update 5\VAIOUpdt.exe" [2009-12-08 1324400]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-21 35760]
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE "= "c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Rodrigo\Start Menu\Programs\Startup\
SpywareGuard.lnk - c:\program files\SpywareGuard\sgmain.exe [2003-8-29 360448]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
2006-03-09 13:51 73728 ----a-w- c:\windows\system32\VESWinlogon.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@= "Service "

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"c:\\Program Files\\Adobe\\Photoshop Elements 4.0\\AdobePhotoshopElementsMediaServer.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\Program Files\\Skype\\Phone\\Skype.exe "=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe "=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [27/03/2010 20:49 64288]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [04/02/2010 17:52 1265264]
R2 MSSQL$VAIO_VEDB;MSSQL$VAIO_VEDB;c:\program files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe -sVAIO_VEDB --> c:\program files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe -sVAIO_VEDB [?]
R3 5U870CAP_VID_1262&PID_25FD;Sony Visual Communication Camera VGP-VCC2 ;c:\windows\system32\drivers\5U870CAP.sys [28/07/2006 08:55 75264]
R3 AVerM115S;AVerM115S service;c:\windows\system32\drivers\AVerM115S.sys [28/07/2006 08:55 754688]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [27/03/2010 18:50 102448]
R3 SonyImgF;Sony Image Conversion Filter Driver;c:\windows\system32\drivers\SonyImgF.sys [28/07/2006 08:55 30080]
R3 ti21sony;ti21sony;c:\windows\system32\drivers\ti21sony.sys [28/07/2006 08:55 812544]
R3 VUAgent;VUAgent;c:\program files\Sony\VAIO Update 5\VUAgent.exe [27/03/2010 15:23 673136]
S3 cpudrv;cpudrv;c:\program files\SystemRequirementsLab\cpudrv.sys [18/12/2009 11:58 11336]
S3 rspSanity;rspSanity;c:\windows\system32\drivers\rspSanity32.sys [27/03/2010 15:03 27192]
S3 SQLAgent$VAIO_VEDB;SQLAgent$VAIO_VEDB;c:\program files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlagent.EXE -i VAIO_VEDB --> c:\program files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlagent.EXE -i VAIO_VEDB [?]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - COMHOST
.
Contents of the 'Scheduled Tasks' folder

2010-03-30 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-02-04 17:49]

2010-03-27 c:\windows\Tasks\Norton AntiVirus - Run Full System Scan - Rodrigo.job
- c:\progra~1\NORTON~1\NORTON~1\Navw32.exe [2006-01-25 11:13]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.club-vaio.com/en/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = hxxp://www.club-vaio.com/en/
uInternet Settings,ProxyOverride = local
IE: &Google Search - c:\program files\Google\GoogleToolbar1.dll/cmsearch.html
IE: &Translate English Word - c:\program files\Google\GoogleToolbar1.dll/cmwordtrans.html
IE: Add RSS Support Site to VAIO Information FLOW - c:\program files\Sony\VAIO Information FLOW\aiesc.html
IE: Backward Links - c:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html
IE: Cached Snapshot of Page - c:\program files\Google\GoogleToolbar1.dll/cmcache.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
IE: Similar Pages - c:\program files\Google\GoogleToolbar1.dll/cmsimilar.html
IE: Translate Page into English - c:\program files\Google\GoogleToolbar1.dll/cmtrans.html
Trusted Zone: sony-europe.com
Trusted Zone: sonystyle-europe.com
Trusted Zone: vaio-link.com
DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} - hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.1.66.0.cab
FF - ProfilePath - c:\documents and settings\Rodrigo\Application Data\Mozilla\Firefox\Profiles\6nnxd13u.default\
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
.

**************************************************************************
scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files:

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(760)
c:\windows\system32\IWPDGINA.DLL
c:\program files\Intel\WiFi\bin\LangResources\ENU\SsoGnENU.dll
c:\windows\system32\VESWinlogon.dll
.
Completion time: 2010-03-31 22:14:46
ComboFix-quarantined-files.txt 2010-03-31 20:14
ComboFix2.txt 2010-03-30 16:42

Pre-Run: 55,950,237,696 bytes free
Post-Run: 55,911,755,776 bytes free

Current=3 Default=3 Failed=2 LastKnownGood=4 Sets=1,2,3,4
- - End Of File - - 2077DE3A029A96DB1F79F34621F405CF

 

latest hjt log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:16:58, on 31/03/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16981)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\WiFi\bin\S24EvMon.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Intel\WiFi\bin\EvtEng.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
C:\Program Files\SigmaTel\C-Major Audio\WDM\StacSV.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
C:\Program Files\Intel\WiFi\bin\WLKeeper.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\system32\ICO.EXE
C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe
C:\Program Files\Sony\ISB Utility\ISBMgr.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Intel\WiFi\bin\ZCfgSvc.exe
C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Sony\VAIO Update 5\VUAgent.exe
C:\WINDOWS\system32\wuauclt.exe
C:\ComboFix\CF3833.cfxxe
C:\ComboFix\mbr.cfxxe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.club-vaio.com/en/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.club-vaio.com/en/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [VAIOCameraUtility] "C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe "
O4 - HKLM\..\Run: [SonyPowerCfg] "C:\Program Files\Sony\VAIO Power Management\SPMgr.exe "
O4 - HKLM\..\Run: [ISBMgr.exe] C:\Program Files\Sony\ISB Utility\ISBMgr.exe
O4 - HKLM\..\Run: [Switcher.exe] C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe "
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [AppMon Utility] "C:\Program Files\Sony\AppMonUtil\AppMonUtility.exe" @@@Start
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe "
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\WiFi\bin\ZCfgSvc.exe "
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" /tf Intel Wireless Tray
O4 - HKLM\..\Run: [VAIO Update 5] "C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe" /Stationary
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe "
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe "
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Add RSS Support Site to VAIO Information FLOW - C:\Program Files\Sony\VAIO Information FLOW\aiesc.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.club-vaio.com/en/
O15 - Trusted Zone: *.sony-europe.com
O15 - Trusted Zone: *.sonystyle-europe.com
O15 - Trusted Zone: *.vaio-link.com
O16 - DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} (SysInfo Class) - http://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.1.66.0.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program Files\Sony\Image Converter 2\IcVzMon.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless WiFi Service (S24EventMonitor) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\S24EvMon.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Program Files\SigmaTel\C-Major Audio\WDM\StacSV.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe
O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
O23 - Service: VUAgent - Sony Corporation - C:\Program Files\Sony\VAIO Update 5\VUAgent.exe
O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\WLKeeper.exe

--
End of file - 14497 bytes

 

computer is doing just fine

no problems, no hiccups or anything.


--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0: scan report
Saturday, April 3, 2010
Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Saturday, April 03, 2010 16:25:37
Records in database: 3913895
--------------------------------------------------------------------------------

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\
F:\
G:\

Scan statistics:
Objects scanned: 81751
Threats found: 0
Infected objects found: 0
Suspicious objects found: 0
Scan duration: 01:36:16

No threats found. Scanned area is clean.

Selected area has been scanned.

 

latest hjt log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:48:17, on 03/04/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17023)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\WiFi\bin\S24EvMon.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Intel\WiFi\bin\EvtEng.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
C:\Program Files\SigmaTel\C-Major Audio\WDM\StacSV.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
C:\Program Files\Intel\WiFi\bin\WLKeeper.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\system32\ICO.EXE
C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe
C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
C:\Program Files\Sony\ISB Utility\ISBMgr.exe
C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Sony\AppMonUtil\AppMonUtility.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Intel\WiFi\bin\ZCfgSvc.exe
C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Java\jre6\bin\java.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.club-vaio.com/en/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.club-vaio.com/en/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [VAIOCameraUtility] "C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe "
O4 - HKLM\..\Run: [SonyPowerCfg] "C:\Program Files\Sony\VAIO Power Management\SPMgr.exe "
O4 - HKLM\..\Run: [ISBMgr.exe] C:\Program Files\Sony\ISB Utility\ISBMgr.exe
O4 - HKLM\..\Run: [Switcher.exe] C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe "
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [AppMon Utility] "C:\Program Files\Sony\AppMonUtil\AppMonUtility.exe" @@@Start
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe "
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\WiFi\bin\ZCfgSvc.exe "
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" /tf Intel Wireless Tray
O4 - HKLM\..\Run: [VAIO Update 5] "C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe" /Stationary
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe "
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe "
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Add RSS Support Site to VAIO Information FLOW - C:\Program Files\Sony\VAIO Information FLOW\aiesc.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.club-vaio.com/en/
O15 - Trusted Zone: *.sony-europe.com
O15 - Trusted Zone: *.sonystyle-europe.com
O15 - Trusted Zone: *.vaio-link.com
O16 - DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} (SysInfo Class) - http://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.1.66.0.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program Files\Sony\Image Converter 2\IcVzMon.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless WiFi Service (S24EventMonitor) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\S24EvMon.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Program Files\SigmaTel\C-Major Audio\WDM\StacSV.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe
O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
O23 - Service: VUAgent - Sony Corporation - C:\Program Files\Sony\VAIO Update 5\VUAgent.exe
O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\WLKeeper.exe

--
End of file - 14947 bytes