Virus Damage - 3 Main Problems

[Az Flux]

Right, my laptop was recently infested with some Win32 virus that spread via my flash drive ... heh, and some other malware that I can't remember. And while I do believe I've removed all malicious programs, my computer has been having problems ever since. The problems warrant a reformat, really, but the wonderful people at Sony gave me no software with my Laptop. So I've got no drivers for anything, and only luckily have an XP CD from another computer. So yes, I'm hoping it can be fixed without a reformat.
--

First error - The disk drive no longer recognizes blank CDs. It will read CDs and DVDs that have stuff on them but if I try to burn one it keeps telling me to insert a blank CD or DVD. I've tried it numerous times and I know the CDs work because I've since written to them from another computer.

I haven't been able to test it on a blank DVD but I believe the problem is with Windows, not with the Disk Drive, so I would like to try it with Roxio.

My Drive is: Matshita DVD-RAM UJ-850S
---

Second error - The computer runs really slow after startup, even though CPU usage and Commit Charge are low.

I know computer will run slow when starting up, but my laptop is doing it slower then it ever has ... and only since the viruses. Also, with the CPU under 10% and commit charge under half, I don't see why it should be so slow. It takes about 5 minutes before everything will start running smoothly.

It also takes some time to shutdown. I suppose it goes through all the processes quick enough, but when it gets to the end they'll just be a black screen with the mouse icon for about 30 seconds before it finally turns off. Perhaps a simple black screen I could understand, but with use of the mouse, and an external USB one at that, it seems strange.
---

Third error - The log-on Windows Welcome Screen at refuses to show and I'm stuck with the old dialog box. It is set in the Control panel to show, as well as in the registry - the Winlogon value set to 1.

The other problem relating to PcAnywhere and Awgina.dll replacing msgina.dll - I do not have PcAnywhere installed and never have. I also don't have Awgina.dll anywhere on the computer. However, I downloaded a fix anyway but it simply that told me everything was working fine. Never-the-less, I replaced the dll with one from a working computer but with still no luck.

I also had problems with winlogon.exe continually wanting to connect to the net and a strange IP address. I fixed this by replacing the file with the one from a clean computer, but it may have caused some sort of problem before that.
---

Heh, right, those problems I would love to have to fixed, so any help would be greatly appreciated. Below is my HiJackThis log, I've gone through it many times but a second opinion always helps. To make it easier, I haven't start anything other then Firefox and HiJackThis ... so anything else there has run on startup.

Thank you.
---

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 12:13:27 AM, on 11/13/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\LckFldService.exe
C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe
C:\Program Files\Sony\VAIO Update 3\VAIOUpdt.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe
C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe
C:\Program Files\Sony\ISB Utility\ISBMgr.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Trend Micro\Internet Security 2007\TMAS_OE\TMAS_OEMon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Documents and Settings\Sea\Desktop\Security\HiJackThis (v2).exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://vaio-online.sony.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: EWPBrowseObject Class - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [VAIOCameraUtility] "C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe"
O4 - HKLM\..\Run: [VAIO Update 3] "C:\Program Files\Sony\VAIO Update 3\VAIOUpdt.exe" /Stationary
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [Switcher.exe] C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [SonyPowerCfg] "C:\Program Files\Sony\VAIO Power Management\SPMgr.exe"
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe"
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [ISBMgr.exe] C:\Program Files\Sony\ISB Utility\ISBMgr.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [OE] "C:\Program Files\Trend Micro\Internet Security 2007\TMAS_OE\TMAS_OEMon.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - S-1-5-18 Startup: E-Flyer.lnk = C:\Program Files\Sony\E-Flyer\E-Flyer.exe (User 'SYSTEM')
O4 - S-1-5-18 Startup: VAIO Launcher.lnk = C:\Program Files\Sony\VAIO Launcher\Launcher.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: E-Flyer.lnk = C:\Program Files\Sony\E-Flyer\E-Flyer.exe (User 'Default user')
O4 - .DEFAULT Startup: VAIO Launcher.lnk = C:\Program Files\Sony\VAIO Launcher\Launcher.exe (User 'Default user')
O4 - .DEFAULT User Startup: E-Flyer.lnk = C:\Program Files\Sony\E-Flyer\E-Flyer.exe (User 'Default user')
O4 - .DEFAULT User Startup: VAIO Launcher.lnk = C:\Program Files\Sony\VAIO Launcher\Launcher.exe (User 'Default user')
O4 - Global Startup: Bluetooth Manager.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O14 - IERESET.INF: START_PAGE_URL=http://vaio-online.sony.com/
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 2228694875
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program Files\Sony\Image Converter 2\IcVzMon.exe
O23 - Service: LckFldService - Unknown owner - C:\WINDOWS\system32\LckFldService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Trend Micro Protection Against Spyware (PcScnSrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SonicStage Back-End Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SsBeSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
O23 - Service: VAIO Entertainment Aggregation and Control Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe
O23 - Service: VAIO Entertainment Task Scheduler - Sony Corporation - C:\Program Files\Sony\VAIO Entertainment\VzTaskScheduler.exe
O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe
O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

[Gecko]

Hi Az Flux,

To fix the burner problem:
Start > Run type regedit and press enter.

Locate the following registry subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E965-E325-11CE-BFC1-08002BE10318}
In the right pane of Registry Editor, right-click the UpperFilters value (if it is present), and then click Delete. Click Yes on the Confirm Value Delete message .

Right-click the LowerFilters value (if it is present), and then click Delete. Click Yes on the "Confirm Value Delete" message.
Exit regedit.


Slow starup problem:

You gave two anti virus programs installed, Trend and Norton remove one of them completly.


Winlogon window problem:

I believe that this may be a result of replacing the winlogon.exe file from a different system.

Did you rename or overwrite the old winlogon.exe file?


Your Hijackthis log is clean

[Az Flux]

You mean there's still traces of Norton on there? Man, what does it take to get rid of it. When I first bought my Laptop, it was on there but I replaced it straight away with Pc-Cillin. I removed it through it's uninstall feature but it left a lot of things behind. I removed them as I found them and thought I got rid of it all, but obviously not. I can't see the traces on there, so can you tell me what to do get rid of them?

I'm still getting problems with the disc drive. I uninstalled the driver, and let Windows re-install it but it's still not working, so I'm thinking it may be a problem with the XP writing wizard. The exact message I get is:
There is no disc in the drive. Please insert a writable CD into drive F:\

And Winlogon, I was getting the problem before I replaced it. Replacing was about the last thing I did, hoping it would fix the error, but it didn't. It did fix the spyware-ish problem though, where Winlogon.exe was trying to connect to some strange IP addess on the net.

When the problem first started, I checked the control panel and it was disabled and though re-enabling it there did nothing, perhaps it's not really an error and something is intentionally disabling it.

But yes, I still have the original Winlogon in a safe place on my computer but I don't quite want to put it back because of the spyware thing.

[Gecko]

Az Flux,
To completely remove Norton download Norton's
The Norton Removal Tool uninstalls all Norton 2008/2007/2006/2005/2004/2003 products and Norton 360 from your computer.
If you use ACT! or WinFAX, back up those databases before you proceed.

Did you actually use Regedit and remove the upper and lower filters?
Just uninstalling the drivers will not remove the upper and lower filters from the registry.


I believe we should fix the other 2 issues before we tackle the Winlogon problem.

[Az Flux]

Ah, thank you. Norton is now completely gone and my computer is running much faster. The strange shutdown is still happening though.

Yes, I removed those filters from the registry first but when it didn't work I searched the net again and found I could uninstall/reinstall the driver without any extra software, just the OS.

And yeah, the Winlogon is the least of the problems so last works.

[Gecko]

Az Flux,

I'm glad your system is running better, one down two to go.

What software are you using to burn your CDs?

What is the brand name of the blank CDs you are trying to burn?

[Az Flux]

[Gecko]

[Az Flux]

I downloaded and tried ImgBurn and it wrote to the CDs perfectly. That should make it a software problem with the XP Writing Wizard, right? And it's not overly important to have it fixed now, since ImgBurn works great but never-the-less I would prefer it fixed. Heh, I like everything working on my computer.

Yes, I do have a Windows XP CD - That gold one you use to install Windows.

And the only repair offered is System Restore, but the earliest I can go back is the 6th and I had the viruses before that.

If it helps, is what came off my Flash drive. Heh, it's an info site, not the actual file. I can't give anymore information (except that it used an autorun.inf to install) but I know there was more then just that on my computer.

[Gecko]

Az Flux,

Ok lets try running windows system file checker.

Put your Windows XP CD in your CD/DVD drive.
Click start > Run and type CMD and press enter.
In the command box type SFC /scannow and press enter (note space between c and /)

This will take some time to finish once it is finished reboot the system.

[Az Flux]

Ok, scanned and restart and the drive still doesn't work with the writing wizard, however I do get a different message.

"The disc in the drive is not a writable CD or it is full.

Please insert a blank, writable CD into drive F:\, or insert a disc with enough free space to hold all the files you have selected for writing to CD."

So, it now recognizes that there is actually a disc in there, just not that it's writable. Heh, well some success I say.

[Gecko]

Az Flux,

Did you check to see if the upper and lower filter are not in the registry?

[Az Flux]

Well, they were there again but upon deleting them, the old message has returned.

"There is no disc in the drive. Please insert a writable CD into drive F:\ "

[Gecko]

Az Flux,

I think we are at a crossroad here; it's obvious that your burner works based on ImgBurn's success and you can login to windows.
Running the System file checker did not resolve the problem with Windows burn or Winlogon.
So what ever happened with the virus at this point does not drastically affect you using the system.

So I think that the only way to resolve these two problems would to be to do an in-place upgrade.
Basically you would reinstall windows on top of itself without loosing any of your installed programs, email and such.
But you would loose all of Windows updates and Automatic Updates will be disabled.

Complete instructions for doing an in-place upgrade can be found

[Az Flux]

Thanks, I'll look into that. Just a couple of questions.

Does it remove any registry keys, or modify them? So, I won't loose installed programs but would the install effect them?

And are you able to turn automatics back on?


Oh, and on another note, I had to restore the upper and lower filters back into the registry. While they were gone, my flash drive wouldn't work.