Vaio laptop spyware/virus/malware

garcia

Thanks browntoa,
I've used hijackthis to get rid of that item.

Unfortunately the problem is still persisting - inordinately long start-up/load time, crackly audio due to sytem slow down, and mouse pointer freezing due to system slow down.

Should I try rootkits next?
Many thanks

Browntoa

go for it

I take it that the entry has not reappeared on a reboot ??

garcia

No it seems to have permanently gone. Thanks.

garcia

albertross wrote:

is your hard disk light continually flashing when it goes slow? You can also see in task manager whether it is running out of ram, which causes swapping, hard disk trashing, and resulting slowness..

Good question albertross - actually you are right. Its difficult to see/hear on a laptop but I just noticed that all the slow downs coincide with disk activity.

Any clues?

Thanks.

albertross_2

It might not be swapping, zonealarm writes to it's log every couple of seconds, but the light shouldn't be on constantly

If you go into task manager, performance, how much physical memory is available?

These might help identify the cause.

http://www.sysinternals.com/Utilities/ProcessExplorer.html

http://www.sysinternals.com/Utilities/Filemon.html

http://www.sysinternals.com/Utilities/Regmon.html

http://www.sysinternals.com/Utilities/TcpView.html

garcia

Thanks albertross. It doesn't have zonealarm installed (though did at one stage).

In task manager there is 206Mb free out of 514Mb total.

albertross_2

It's probably not swapping then, try filemon.. it tells you what is happening on the PC.

Are you sure you uninstalled zonealarm properly?

O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

What firewall are you using?

garcia

Are you sure you uninstalled zonealarm properly?

O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

What firewall are you using?

You are right, sorry. I had installed zone alarm originally, but since it didn't show up on the taskbar I assumed it had been uninstalled. It was there all along. Having said that, looking at the log, zone alarm hasn't been active since May 27th!!!

garcia

Incidentally the blacklight rootkit scan came back clear.

The RootkitRevealer one gave the following:

HKLM\SOFTWARE\Microsoft\Cryptography\RNG\Seed 04/07/2006 15:11 80 bytes Data mismatch between Windows API and raw hive data.


I don't know if thats an issue or how to fix it.

Browntoa

Data mismatch between Windows API and raw hive data.

This discrepancy will occur if a Registry value is updated while the Registry scan is in progress. Values that change frequently include timestamps such as the Microsoft SQL Server uptime value, shown below, and virus scanner "last scan" values. You should investigate any reported value to ensure that its a valid application or system Registry value.
HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\RECOVERYMANAGER\MSSQLServer\uptime_time_utc
3/1/2005 4:33 PM