Solved System Security issue

[meezy]

Hi I am new to this forum i have found that it is one of the best sources for help in all things windows 7 so i registered for so help with security issues with my pc... i have a dell inspiron N7101 running windows 7 home premium x64...

Now i believe i have a few infections yet i have scanned and scanned with Kaspersky Internet Security 2012 with setting set to max... but i still feel that though Kaspersky say there is no threats found, that i am infected... I have also used TDSSkiller...
can someone give me incite on the hijack this log....

so here is the hijack this log results:

Running processes:
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe
C:\Program Files (x86)\Unlocker\UnlockerAssistant.exe
C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\Opera\opera.exe
C:\Users\arshlock\Desktop\Programs\PC\Apps\HijackThis.exe
C:\Windows\SysWOW64\DllHost.exe
 
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\ievkbd.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\klwtbbho.dll
O4 - HKLM\..\Run: [AVP] "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe"
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files (x86)\Unlocker\UnlockerAssistant.exe"
O4 - HKCU\..\Run: [PeerBlock] C:\Program Files\PeerBlock\peerblock.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe" /MINIMIZED
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: hello.vbs
O4 - Global Startup: Bluetooth.lnk = ?
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\ie_banner_deny.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~3\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: &Virtual Keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\ievkbd.dll
O9 - Extra button: Send To Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: Send to &Bluetooth Device... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: URLs c&heck - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\klwtbbho.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{D3E9183B-9A75-40AE-9A2B-3D47FFDA85DE}: NameServer = 192.168.1.1,192.168.1.2
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Autodesk Content Service - Unknown owner - C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe
O23 - Service: Kaspersky Anti-Virus Service (AVP) - Kaspersky Lab ZAO - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service 64 - Flexera Software, Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Protected Storage (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies, Inc. - C:\Program Files (x86)\WinPcap\rpcapd.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: SNMP Trap (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: Print Spooler (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Intel(R) Management & Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
 
--
End of file - 9144 bytes

also forgot to mention that on my network monitor i have noticed something that resolves as view.atdmt.com as a destination called from my pc...
Please Help

 

[Petey7]

Why do you think you are infected, and why do you think you have multiple infections? Knowing the symptoms will give us a lot of insight. Have you tried scanning with Malwarebytes? Which is in my opinion it is the best on-demand scanner available.

I'll look at the hijack log some more but at first glace the only things that jump out at me are all the things that say "file missing" and the Unlocker program. What exactly have you used unlocker for, if you don't mind sharing?

 

[meezy]

i use the unlocker program to unlock locked Handles on processes that become unresponsive... and the file is missing is the big reason i believe i have become infected... and the only symptoms i have is that almost all my programs have been unresponsive, and it takes an absurdly long time to kill them with the task manager... like 10-20 min. for them to close... also one instance of svchost.exe uses over 240mb of memory... not to mention that when my network is idle i some times see absurd amounts of data transfered like 25-50gb when the network is idle... also i recently underwent a major syn flood on my network... though i was able to stop it... it did some significant damage to my net... but what i have noticed most and give me the impression that there is some sorta infection(s) is that every so often my cursor moves the text cursor to odd points of a paragraph... if that makes since... normally i am able to deal with these things on my own... but my gut tells me there is something serious here....

 

[codekiddy]

Why don't you just reinstall windows?

time involved into scanning and finding viruses in your comp is usualy 100 times more then reinstalling everything.
furthermore you can't be 100% shore to clean your comp completly.

saving comp from viruses is done in real time, not when comp is already compromised(to late).

 

[meezy]

i cant afford to reinstall... trust me if i could i would... would cost me close to $600-$700 for me to that...

 

[C-11]

Then run full scans with MBAM & SuperAntiSpyware in my sig for starters.

 

[Petey7]

i use the unlocker program to unlock locked Handles on processes that become unresponsive... and the file is missing is the big reason i believe i have become infected...

Could be a current or past virus, or the files could have just become corrupt. You could try running the system file checker.

http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

and the only symptoms i have is that almost all my programs have been unresponsive, and it takes an absurdly long time to kill them with the task manager... like 10-20 min. for them to close... also one instance of svchost.exe uses over 240mb of memory...

The large size of the svchost is not all that weird. svchost contain several windows services. Your computer being slow can be caused by any number of things but a virus is a fair guess.

not to mention that when my network is idle i some times see absurd amounts of data transfered like 25-50gb when the network is idle... also i recently underwent a major syn flood on my network... though i was able to stop it... it did some significant damage to my net...

Networking is not my forte.

but what i have noticed most and give me the impression that there is some sorta infection(s) is that every so often my cursor moves the text cursor to odd points of a paragraph... if that makes since... normally i am able to deal with these things on my own... but my gut tells me there is something serious here....

The cursor moving is actually a common thing that I am not aware of being an indication of an actual problem and am not aware of a fix.

Try running the system file checker as I mentioned above and Malwarebytes. Also, did some reading up on Unlocker and have read several reports that is installs several toolbars without informing you, unless you read through the entire EULA that it is going to and even one claim that it installs malware.

would cost me close to $600-$700 for me to that

I doubt that is true. You live in the US where you could obtain a new copy of Windows 7 for a couple hundred dollars, which you don't even need to do. You can get a disc from anybody and use the product key that came with your computer to reinstall windows.

 

[meezy]

in the process of such scans...
you know come to think about it all this started happening after a feud with a script kiddy on wow...

 

[meezy]

I doubt that is true. You live in the US where you could obtain a new copy of Windows 7 for a couple hundred dollars, which you don't even need to do. You can get a disc from anybody and use the product key that came with your computer to reinstall windows.

its not the reinstall of windows that will cost me i have windows 7 installation disc and my PK... its the cost of all my other Product Keys that i cannot reuse for there are maxed out... i have a total of 24 pc's on my network and my commercial key for KIS is maxed... will cost 200+ to renew... my office 2010 is maxed.... my autocad is maxed.... the cost is to renew all my prog... Product keys.... and to think of it it would be more... if i have to get autocad again...

 

[Petey7]

Usually a phone call and explanation of having to reinstall Windows will get you around such problems but I'll agree that some companies 1) don't care, and 2) will actually be happy about you having to re-purchase their software.

 

[meezy]

and autocad 2012 is 3500+
i have tried calling before after a reinstall after something like this happened back in 09' and the only companies that worked with me was kaspersky and microsoft... i have to repay for everything else... though autocad isn't an need for me... it is for the wifey... same for office... but office can be explained to microsoft... the rest of my progs... there is only a slim-nill chance that their companies would re issue a new product key and license for me... and i cant take that chance... the wife is already on me for the amount of money that i do spend... and she would kill me if i have to spend more on something i have already bought....

 

[DavidE]

If you have 24 PC's don't you have some type of Backup/Restore utility installed?

If you have another PC like the one with issues, you might be able to clone that one and "copy" it to the problem PC.

 

[Petey7]

Definitely best to see if we can fix what the actual issue is before doing a reinstall in this case. Just fo the MBAM, SuperAntiSpyware, and SFC scans for now and tell us what happens.

 

[meezy]

all my others are XP this is the only one with 7... and even if the others had 7 they are all 32bit based and not 64bit based... plus this is a laptop... and its the only dell i own... the rest of my pc's are all custom builds... my 24 pc network is really a cluster... plus one server with windows server 2008... but the server has be dead for awhile... kid spilled coffee on it... also cloning has only worked for me when both pc's had almost matching hardware...

 

[Petey7]

Indeed, cloning would only work if the hardware setup was exactly the same.

 

[meezy]

plus a lot of software these days bind your product key to you hardware id's so cloning for the most part every thing would have to be the same even the hardware id's

 

[meezy]

Sfc scan shows no errors

what is DARKCOMET?

 

[gigagiggles]

First and foremost, HijackThis is not fully functional or effective for a 64bit OS. The "missing file" is standard response in a 64bit OS. The program has not been rewritten to access 64bit OS folders. So it is not a cause for concern.

Second, with Norton, it is advised not to run two active antivirus programs concurrently. If Kaspersky is similar, then TeaTimer may conflict with control and responsibility. Such conflict may affect OS responsiveness and show other effects. These symptoms may lead you to think you are infected.

Third, Sun Java just went to version 7. As a matter of course, the update usually plugs some security holes.

 

[pawprint]

Usually a phone call and explanation of having to reinstall Windows will get you around such problems but I'll agree that some companies 1) don't care, and 2) will actually be happy about you having to re-purchase their software.

Ouch, meezy, I feel your pain...

Petey, it really depends. In my experience dealing with various expensive CAD packages costing 4, 5, even 6 figures US$, that is the whole reason the software vendors want to sell you maintenance on expensive software licenses. That is where they make a good deal of their money as a licensed VAR. If your lic's are not under maintenance and you need to move them, or in some cases simply reinstall them on the same machine, you are up a creek. I have even had some software vendors charge me an additional fee of $1000+ to move licenses or reinstall them.

 

[meezy]

alright MalwareBytes scan found nothing... superantispyware found 20 tracking cookies... spybot bot found an additional tracking cookie... TDSSKill found a hidden rootkit attached to sptd file associated with alcohol 120%... SvchostAnalyzer found a hidden service origin unknown and no info... so i let a friend of mine check it out and he found a rat that had injected itself into explorer.exe, svchost.exe, and dwm.exe... a nasty little piece of work... but i was able to isolate and disinfect these files... and all scanners report no infections... and KIS finally found the root of the infection came from the network flood i recieved a few weeks ago... i even have a good idea who it was that did the attack...
Thank you all for your help... very much appreciated