Hijack this please

[Julie]

Good morning everyone! As I mentioned over the past week, I am using a new (to me) computer which still shows my brother's account in C Drive. Can I safely remove it? He was the only person to use the computer so, even though I changed the name from his to mine in the Administrator account, will it be unwise to just delete it? Hope I'm making sense!
Also, I'd be grateful if someone could have a look at this log for me as there seems to be loads going on even though the computer has only been used for gaming and not connected to the internet until yesterday. I want to pare evrything down as far as possible and make this machine mine!

Many thanks, Julie.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:04:05, on 18/02/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Sony\vaio media music server\SSSvr.exe
C:\Program Files\sony\photo server 20\appsrv\PicAppSrv.exe
C:\Program Files\Sony\giga pocket\GPVSvr.exe
C:\Program Files\Common Files\Sony Shared\vaio media platform\sv_httpd.exe
C:\Program Files\Common Files\sony shared\vaio media platform\SV_Httpd.exe
C:\Program Files\Common Files\sony shared\vaio media platform\SV_Httpd.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\System32\ezSP_Px.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Sony\giga pocket\USBsircs.exe
C:\Program Files\MSN\MSNCoreFiles\MSN6.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = my.msn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.club-vaio.sony-europe.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: Giga Pocket Remocon Driver.lnk = C:\Program Files\Sony\giga pocket\USBsircs.exe
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.club-vaio.sony-europe.com/
O15 - Trusted Zone: *.sony-europe.com
O15 - Trusted Zone: *.sonystyle-europe.com
O15 - Trusted Zone: *.vaio-link.com
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} (get_atlcom Class) - platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe
O23 - Service: VAIO Media Music Server (Application) (VAIOMediaPlatform-MusicServer-AppServer) - Sony Corporation - C:\Program Files\Sony\vaio media music server\SSSvr.exe
O23 - Service: VAIO Media Music Server (HTTP) (VAIOMediaPlatform-MusicServer-HTTP) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\vaio media platform\sv_httpd.exe
O23 - Service: VAIO Media Music Server (UPnP) (VAIOMediaPlatform-MusicServer-UPnP) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\vaio media platform\UPnPFramework.exe
O23 - Service: VAIO Media Photo Server (Application) (VAIOMediaPlatform-PhotoServer-AppServer) - Unknown owner - C:\Program Files\sony\photo server 20\appsrv\PicAppSrv.exe
O23 - Service: VAIO Media Photo Server (HTTP) (VAIOMediaPlatform-PhotoServer-HTTP) - Sony Corporation - C:\Program Files\Common Files\sony shared\vaio media platform\SV_Httpd.exe
O23 - Service: VAIO Media Photo Server (UPnP) (VAIOMediaPlatform-PhotoServer-UPnP) - Sony Corporation - C:\Program Files\Common Files\sony shared\vaio media platform\UPnPFramework.exe
O23 - Service: VAIO Media Video Server (Application) (VAIOMediaPlatform-VideoServer-AppServer) - Sony Corporation - C:\Program Files\Sony\giga pocket\GPVSvr.exe
O23 - Service: VAIO Media Video Server (HTTP) (VAIOMediaPlatform-VideoServer-HTTP) - Sony Corporation - C:\Program Files\Common Files\sony shared\vaio media platform\SV_Httpd.exe
O23 - Service: VAIO Media Video Server (UPnP) (VAIOMediaPlatform-VideoServer-UPnP) - Sony Corporation - C:\Program Files\Common Files\sony shared\vaio media platform\UPnPFramework.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 6750 bytes

[Julie]

Wow! Sorry that log is so long ... didn't realise or preview it! Just to add that, when I did try to delete my brother's account in Documents and Settings, I got the message " .... is a Windows system folder and is required for Windows to run properly"

[ken]

If you just changed the name on your brothers account, thats why you cant delete it Julie. You have to have an Admin account. If you opened another account for yourself first and made yourself Admin, then you could probably delete his.

You can take out the entries with Java on them and Adobe Reader. I will let Mikk sort out the rest, he's better at it than me.

[Julie]

Thank you Ken ... I will make a start. It's taking longer than I thought to get this the way I want it! Will go and have a look at my account now too. Julie.

[mikkh]

Yes horrible list

The 04 run entries - it would be quicker for me to say what to keep, rather than what to delete

I don't like Zone Alarm, it's a big resource hog on a lot of PC's and I would advise you to uninstall that first and replace it with Comodo firewall

This is the only one to keep IMO - 'fix' all the other 04 entries

O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui

These are a bit cheeky and I don't rate Sony to be any more trusted than other sites myself

O14 - IERESET.INF: START_PAGE_URL=http://www.club-vaio.sony-europe.com/
O15 - Trusted Zone: *.sony-europe.com
O15 - Trusted Zone: *.sonystyle-europe.com
O15 - Trusted Zone: *.vaio-link.com

Get rid of them too

A lot of the other vaio bloat is not showing in that log, so it's probably hiding in start/programs/startup

delete anything that is in there

The CTFMON stuff I've explained before in other logs, but I'll repeat it again - turn off advanced text services to purge it properly

it.cas.psu.edu/Training/HowTo/ENComputers/turnoffadvtextservices.htm

Ideally a fresh install would be best, but that lot removed will make it feel a lot faster

[Julie]

Thank you SO much Mikkh ... I can't tell you how it feels to have you sort that for me! I will get to it in the morning. How do I get rid of them? Through HJT somehow? I've not done myself before ... someone else has always been around to help in the past but it's down to me this time.

Thanks again for taking the time! Julie.

[Julie]

Please ignore the "how do I?" bit in my last reply ... of course I know how to! I'm just tired that's all! Bye for now, Julie.

[Julie]

All done! Comodo installed first after removing Zonealarm. When I go to Start/All Programs/Startup the folder is completely empty ... where else would I find all the Vaio stuff you mentioned?

Aha! In All Users/Start Menu there's VAIO Media, VAIO Edit Components LE, VAIO System Information and then a Sony VAIO folder containing Sony Music, Club VAIO!!!, ISP Selector, Sony Style Imager, License, Online Registration, EverQuest and Promo Trailers.

Most of that sounds useless to me but what do I know? Will wait to hear from someone before I start pressing delete!

Goodnight all, Julie.

[ken]

Delete them all from the Start Menu Jullie. There might be a VAIO folder in Program Files, delete that as well. Once you finish clearing out all this garbage, reboot and then run C Cleaner. That will get rid of all the waifs and strays. As your running XP, you should download and run RegscrubXP, that will really tidy up the registry. Download it from here:

majorgeeks.com/download.php?det=2048

Run C Cleaner first, before running RegscrubXP.

[mikkh]

I also noticed at the top of your log, it says SP2 and IE6 which shows it's been offline quite a while.

If automatic updates are set, you'll be bombarded with literally dozens of updates very soon and though Ken probably won't agree, I think you should update to SP3 ASAP to make most of the impending updates null and void (they're all contained in SP3)

www.softwarepatch.com/windows/windows-xp-service-pack-3.html

Best to get it all over with in one go. There will still be some updates to do even after that, but it will cut down the numbers drastically

[ken]

Too right I dont agree, I wouldn't waste my time putting on any update after SP2.

[Julie]

Good morning! Thank you both for your replies during the night. I am up and on it already ha ha! Have downoaded RegscrubXP and will do as you say Ken. Mikkh, you are right about the updates ... there are loads waiting to be installed and I never could decide if I need them or not I have always only downloaded the critical ones. I am sure things are faster this morning by the way! Trying to decide about SP3 ... this machine has never been online until this week.

Thanks to you both again for your help, Julie.

[nike]

Pardon me for butting in here, but I agree with Ken on updates, especially when it comes to SP3. Most of the updates are for large companies security, and don't reflect on the every day user, so, they are really not needed to my way of thinking. I had a PC running XP Pro SP2 for a few years, with no other updates installed, and it ran very well. I decided to install SP3 just to see what would happen, and it messed the thing up and caused it to run slower. That proved to me that SP3 wasn't necessary.

[Julie]

Hi! You're welcome to join in anytime ... I'm always interested to hear differing points of view. I really can't decide what to do so will read up a bit about SP3 before committing.

Thanks for your reply, Julie.

[mikkh]

While I respect both Kev and Kens opinions, neither use XP as a main OS any more (as far as I'm aware) and both are experienced users who take sensible precautions and wouldn't be fazed by a fresh install. All of which makes glibly dismissing SP3 a little bit suspect as general advice IMO.

I've installed it on dozens of PC's with no problems and can't see what harm it does to have all the latest patches installed for the average user.

Yes do research it a bit, you will find a few horror stories because that's human nature - everyone complains if something goes wrong, but for the vast majority who've had no bother, they say nothing.

It's not the big improvement SP2 was, but if it saves the hassle of installing a shed load of updates, that can't be a bad thing and there will be a time when some software requires SP3 before it will install. In fact it's already here thinking about it. Live messenger goes on a lot more smoothly if SP3 is detected

[Julie]

Well you've convinced me Mikkh and it's done! I did read more about it but, as you predicted, opinions are split just as they are in here and I am a relative novice with all this technical stuff. I really appreciate the help I've been given from Ken and Kev too but it was the fact that you implied it would be a simpler option for those who are not as confident in their IT skills that swayed me as I certainly fall into that category!

Anyway, I feel as though I've been a bit of a pest over the past couple of days ... gone for ages and then back with all guns blazing when I need help

My heartfelt thanks again to you all, Julie,

[ken]

About 98% of computer users, have a shop bought computer and religiously install all Windows updates. Their computers work and do what they want, so they are happy. The same 98% computer users, wouldn't know a fast computer if it jumped up and bit them on the bum. As long as they are happy, I cant fault them.

I still have an XP SP2 x 64 system on a hard drive, that I run from the docking station and I use it for running older simulation games that wont run on Win7.

Sure I can reinstall my computer with a new system complete with drivers and programs in about 20 minutes. I sometimes do this to get rid of all the crap that Windows insists on keeping and no amount of running cleaners will get rid of. I rarely do it because of anything nasty has got past my security. I say rarely as I do get nasties, nothing is 100% secure and its sometimes quicker to put another image on the hard drive than to try and clean up the OS. In the case of a boot sector virus, the hard drive has to be fully formatted before reinstalling anyway. This can be done using the Paragon 9 disk and I can be up and running again in about half hour.

I admit I run my OS's light, but I seem to get less trouble than people who use Updates. I don't have to worry about an update screwing my drivers and having to wait for Micro$oft releasing a patch to patch the patch. I think about 60% of the patches are for patches. The system grows in size by 80%, to gain an extra 10% of unnecessary security. If you have top class 3rd party security, what more do you need?? I even have Defender turned off on Win7, as I run SAS Pro which works in the background. I know which one I trust to work best and I don't need Defender upsetting the apple cart.

[Julie]

My plan is not to accept any more updates unless I know I need them ... in the past I have let them install automatically. I don't ever know whether I'm doing the right thing but I will see how things go. Thanks for taking the time to give me your point of view Ken ... I really do appreciate it. Julie.

[elvisuk]

"My plan is not to accept any more updates unless I know I need them" KC or Mikkh will always help you with updates, which you need or which you don't need or anybody on CIT will help if they can.

[Julie]

Thank you! I know this is a great site to be part of ... everyone is so generous with their time and expertise!
Julie.