wintems sysrosa etc... Antivirus não arranca

[porjma]

Boas pessoal,
a semana passada descobri que estava infectado com o wintems que corria na minha lista de processo...
dei por ele porque tinha sempre o processador a consumir 60% dos recursos da máquina,fique sem placa de som, a net não abria, etc etc etc..
O CAOS!!!!
entretanto , depois de tentar milhoes de hipoteses (bit defender, windows defender, elibagle,etc...)aparentemente consegui remover com o combofix e a situação ja nao se verifica.
De qualquer modo o meu antivirus (symantec) nao arranca, nem consigo fazer updates ao windows...
Alguem me pode dar sugestoes? È o portatil do trabalho e a minha vida depende de que tudo fique a funcionar ok. Senao todo o meu trabalho vai à vida...Nao posso andar com ele sem antivirus a correr. HELP MEEEE!!!!
o log do hijackthis é este:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:13, on 2008-05-15
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
D:\ThirdParty\Apache Group\Apache2\bin\Apache.exe
D:\THIRDP~1\Weblogic\WEBLOG~1\server\bin\beasvc.exe
D:\THIRDP~1\Weblogic\WEBLOG~1\server\bin\beasvc.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
D:\SAS\DataFlux\DFPOWE~1\7.1\bin\DFBATC~1.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
D:\ThirdParty\Apache Group\Apache2\bin\Apache.exe
D:\SAS\SAS913\sas.exe
C:\Support\Sasset2\sasset_app.exs
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\RealVNC\WinVNC\WinVNC.exe
D:\SAS\SAS913\spawner.exe
D:\SAS\SAS913\objspawn.exe
D:\SAS\SAS913\sas.exe
D:\SAS\SAS913\core\sasext\jproxy.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\porjma\Local Settings\Temporary Internet Files\Content.IE5\S1GD8XUZ\HiJackThis[1].exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.por.sas.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://securityresponse.symantec.com/av ... 4294906298
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Sasset] C:\Support\Sasset2\sassetint_app.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-21-1275210071-1383384898-725345543-1011\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'lsfadmin')
O4 - HKUS\S-1-5-21-1275210071-1383384898-725345543-1011\..\RunOnce: [NeroHomeFirstStart] C:\Program Files\Common Files\Ahead\Lib\NeroScoutOptions.exe (User 'lsfadmin')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/ms ... b31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resourc ... oscan8.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b31267.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} (JuniperSetupSP1 Control) - https://wbi.sas.com/dana-cached/setup/J ... tupSP1.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = emea.sas.com
O17 - HKLM\Software\..\Telephony: DomainName = emea.sas.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = emea.sas.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = por.sas.com,emea.sas.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = emea.sas.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = por.sas.com,emea.sas.com
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = emea.sas.com
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: SearchList = por.sas.com,emea.sas.com
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = por.sas.com,emea.sas.com
O23 - Service: Apache2 - Apache Software Foundation - D:\ThirdParty\Apache Group\Apache2\bin\Apache.exe
O23 - Service: BEA WebLogic Platform 8.1 NodeManager - BEA Systems, Inc. - D:\THIRDP~1\Weblogic\WEBLOG~1\server\bin\beasvc.exe
O23 - Service: beasvc SASSolutions_Admin - BEA Systems, Inc. - D:\THIRDP~1\Weblogic\WEBLOG~1\server\bin\beasvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: DataFlux Batch Scheduler (DFBatchSvc) - DataFlux - D:\SAS\DataFlux\DFPOWE~1\7.1\bin\DFBATC~1.EXE
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPBPRO.EXE
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPBOID.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LSF sas_cluster LIM (LIM-sas_cluster) - Unknown owner - C:\LSF_6.0\etc\lim.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Process Manager - Unknown owner - C:\Program Files\Platform Computing\Platform Process Manager\3.0\etc\jfd.exe
O23 - Service: LSF sas_cluster RES (RES-sas_cluster) - Unknown owner - C:\LSF_6.0\etc\res.exe
O23 - Service: SAS Lev1 CS - BIArchitec - Unknown owner - D:\SAS\SAS913\spawner.exe
O23 - Service: SAS Lev1 MS - BIArchitec - Unknown owner - D:\SAS\SAS913\sas.exe
O23 - Service: SAS Lev1 OB - BIArchitec - Unknown owner - D:\SAS\SAS913\objspawn.exe
O23 - Service: SAS Lev1 OL - BIArchitec - Unknown owner - D:\SAS\SAS913\sas.exe
O23 - Service: SASset Management 2 (Workstation) (Sasset2) - SAS Institute (ISD) - C:\Support\Sasset2\sasset_app.exs
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: LSF sas_cluster SBD (SBD-sas_cluster) - Unknown owner - C:\LSF_6.0\etc\sbatchd.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: VNC Server (winvnc) - RealVNC Ltd. - C:\Program Files\RealVNC\WinVNC\WinVNC.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

--
End of file - 9081 bytes

[speed200]

Tenta fazer um scan ao PC utilizando isto: http://www.eset.eu/online-scanner

[porjma]

boas,
acabei agora de fazer o scan e não encontrou nada.
aparentemente nenhuma aplicação encontra mais virus na minha máquina.
continuo é sem antivirus...
qnd tento fazer 'enable auto-protect' ele desliga-se sozinho passado uns segundos.
obrigado pela ajuda. Mais alguma ideia?