Unknown & Undetectable Malware executing windows & programs multiple times till laptop hangs

drec · March 14, 2010

Greetings,I'm drec.

There is an unknown malware hiding in my laptop which auto executes IE,WMP, Windows Explorer most of the time.(I have reformatted about 3 times but the malware s still hiding somewhere.I only formatted C Drive for the installation of the W7.It was already on my previous OS,Vista.)

it also executes programs which i use most frequently such as Firefox & so on.It keeps opening up multiple firefox windows till my laptop slows down.It also diabled several keys from my keyboard.most of the numbers can't be typed.it also changed the the keyboard in such a way that when i press certain letters,windows minimize,my laptop gets locked,shows desktop n so on.whenever the cursor is on a typeable 'box'it types out by itself.usually''7890' or '77777777777777777777777' continously.

I used various online virus scanners n spyware detectors but all failed to detect the malware.

malwarebytes full scan can't detect it either.I have attached 'attach' n 'ark' .

DDS file output is as follows

DDS (Ver_09-12-01.01) - NTFSx86

Run by DharmaMayaChandrahas at 12:49:59.84 on Sun 03/14/2010

Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_18

Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.2038.936 [GMT 8:00]

============== Running Processes ===============

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\aestsrv.exe

C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

C:\Program Files\Sandboxie\SbieSvc.exe

C:\Program Files\Spyware Doctor\pctsAuxs.exe

C:\Windows\system32\STacSV.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files\ThreatFire\TFService.exe

C:\Program Files\Live Mesh\Remote Desktop\wlcrasvc.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files\COMODO\COMODO Internet Security\cfp.exe

C:\Program Files\ThreatFire\TFTray.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\Users\DharmaMayaChandrahas\AppData\Local\Microsoft\Live Mesh\Bin\Servicing\0.9.4014.7\MoeMonitor.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Windows\System32\spool\drivers\w32x86\3\E_FATICAP.EXE

C:\Users\DharmaMayaChandrahas\AppData\Local\Microsoft\Live Mesh\GacBase\Moe.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files\Windows Live\Contacts\wlcomm.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Windows\System32\svchost.exe -k secsvcs

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Program Files\Internet Explorer\IELowutil.exe

C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FAMTCAP.EXE

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

C:\Windows\system32\igfxsrvc.exe

C:\Program Files\PeerBlock\peerblock.exe

C:\Program Files\COMODO\COMODO livePCsupport\CLPSLS.exe

C:\Users\DharmaMayaChandrahas\Downloads\dds.scr

C:\Windows\system32\conhost.exe

C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uWindow Title = Dharma-Maya Chandrahas

BHO: Octh Class: {000123b4-9b42-4900-b3f7-f4b073efc214} - c:\program files\orbitdownloader\orbitcth.dll

BHO: PC Tools Browser Guard BHO: {2a0f3d1b-0909-4ff4-b272-609cce6054e7} - c:\program files\spyware doctor\bdt\PCTBrowserDefender.dll

BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File

BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~4\office14\GROOVEEX.DLL

BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - c:\progra~1\micros~4\office14\URLREDIR.DLL

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

TB: Grab Pro: {c55bbcd6-41ad-48ad-9953-3609c48eacc7} - c:\program files\orbitdownloader\GrabPro.dll

TB: PC Tools Browser Guard: {472734ea-242a-422b-adf8-83d1e48cc825} - c:\program files\spyware doctor\bdt\PCTBrowserDefender.dll

uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background

uRun: [MoeMonitor.exe] "c:\users\dharmamayachandrahas\appdata\local\microsoft\live mesh\bin\servicing\0.9.4014.7\MoeMonitor.exe"

uRun: [PeerBlock] c:\program files\peerblock\peerblock.exe

uRun: [sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun

uRun: [EPSON Stylus CX5500 Series] c:\windows\system32\spool\drivers\w32x86\3\e_faticap.exe /fu "c:\windows\temp\E_S75D3.tmp" /EF "HKCU"

mRun: [egui] "c:\program files\eset\eset nod32 antivirus\egui.exe" /hide /waitservice

mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray

mRun: [COMODO Internet Security] "c:\program files\comodo\comodo internet security\cfp.exe" -h

mRun: [ThreatFire] c:\program files\threatfire\TFTray.exe

mRun: [ProcessLassoManagementConsole] c:\program files\process lasso\processlasso.exe

mRun: [ProcessGovernor] c:\program files\process lasso\processgovernor.exe

dRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background

uPolicies-system: NoDispSettingsPage = 1 (0x1)

mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

IE: &Download by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/201

IE: &Grab video by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/204

IE: Do&wnload selected by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/203

IE: Down&load all by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/202

IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office14\EXCEL.EXE/3000

IE: Se&nd to OneNote - c:\progra~1\micros~4\office14\ONBttnIE.dll/105

IE: Send image to &Bluetooth Device... - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm

IE: Send page to &Bluetooth Device... - c:\program files\widcomm\bluetooth software\btsendto_ie.htm

IE: {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe

IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office14\ONBttnIE.dll

IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office\office14\ONBttnIELinkedNotes.dll

DPF: {22492231-AEF0-49FC-9180-CE8969AB1273} - hxxp://download.sp.f-secure.com/ols/f-secure-rtm/resources/fslauncher.cab

DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} - hxxp://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab

DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab

DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} - hxxp://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} - hxxp://ax.emsisoft.com/asquared.cab

DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} - hxxp://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,5890/mcfscan.cab

Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL

Notify: igfxcui - igfxdev.dll

AppInit_DLLs: c:\windows\system32\guard32.dll

SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~4\office14\GROOVEEX.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\users\dharma~1\appdata\roaming\mozilla\firefox\profiles\t48y4nd2.default\

FF - component: c:\users\dharmamayachandrahas\appdata\roaming\mozilla\firefox\profiles\t48y4nd2.default\extensions\glasser@sixxgate.com\components\dwmxpcom.dll

FF - component: c:\users\dharmamayachandrahas\appdata\roaming\mozilla\firefox\profiles\t48y4nd2.default\extensions\support@lastpass.com\platform\winnt_x86-msvc\components\lpxpcom.dll

FF - plugin: c:\progra~1\micros~4\office14\NPAUTHZ.DLL

FF - plugin: c:\progra~1\micros~4\office14\NPSPWRAP.DLL

FF - plugin: c:\program files\mozilla firefox\plugins\npFoxitReaderPlugin.dll

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----

c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);

c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);

c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);

c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");

c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2010-2-8 28552]

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2010-2-13 207792]

R0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [2010-2-15 51984]

R0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [2010-2-15 59664]

R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdguard.sys [2010-2-13 130960]

R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [2010-2-13 29520]

R1 SBRE;SBRE;c:\windows\system32\drivers\SBREDrv.sys [2010-2-16 95024]

R2 AESTFilters;Andrea ST Filters Service;c:\windows\system32\AEstSrv.exe [2010-1-29 73728]

R2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\spyware doctor\bdt\BDTUpdateService.exe [2010-2-13 112592]

R2 CLPSLS;COMODO livePCsupport Service;c:\program files\comodo\comodo livepcsupport\CLPSLS.exe [2010-2-19 148744]

R2 ekrn;ESET Service;c:\program files\eset\eset nod32 antivirus\ekrn.exe [2009-11-16 735960]

R2 epfwwfpr;epfwwfpr;c:\windows\system32\drivers\epfwwfpr.sys [2009-12-18 95896]

R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2010-1-28 236368]

R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsAuxs.exe [2010-2-13 359624]

R2 ThreatFire;ThreatFire;c:\program files\threatfire\tfservice.exe service --> c:\program files\threatfire\TFService.exe service [?]

R2 wlcrasvc;Live Mesh Remote Desktop;c:\program files\live mesh\remote desktop\wlcrasvc.exe [2010-2-2 44880]

R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-14 229888]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2010-1-28 19160]

R3 netw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\drivers\netw5v32.sys [2009-6-11 4231168]

R3 osppsvc;Office Software Protection Platform;c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\OSPPSVC.EXE [2009-9-26 4639136]

R3 pbfilter;pbfilter;c:\program files\peerblock\pbfilter.sys [2010-2-19 16472]

R3 RDPDISPM;RDPDISPM;c:\windows\system32\drivers\rdpdispm.sys [2010-2-2 9040]

R3 SbieDrv;SbieDrv;c:\program files\sandboxie\SbieDrv.sys [2009-12-1 119296]

R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\drivers\VSTAZL3.SYS [2009-7-14 207360]

R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\drivers\VSTDPV3.SYS [2009-7-14 980992]

R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\drivers\VSTCNXT3.SYS [2009-7-14 661504]

R3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [2010-2-15 33552]

S0 EnumProcessesDriver;EnumProcessesDriver;c:\windows\system32\drivers\EnumProcessesDriver.sys [2010-3-14 17664]

S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\microsoft office\office14\GROOVE.EXE [2009-10-29 30603640]

S3 qcusbser;Mobile Connector USB Device for Legacy Serial Communication;c:\windows\system32\drivers\qcusbser.sys [2010-1-30 103552]

S3 sdCoreService;PC Tools Security Service;c:\program files\spyware doctor\pctsSvc.exe [2010-2-13 1141712]

S3 SUNXUBZMU;SUNXUBZMU;c:\users\dharma~1\appdata\local\temp\sunxubzmu.exe --> c:\users\dharma~1\appdata\local\temp\SUNXUBZMU.exe [?]

S3 UVNDTNIFBYK;UVNDTNIFBYK;c:\users\dharma~1\appdata\local\temp\uvndtnifbyk.exe --> c:\users\dharma~1\appdata\local\temp\UVNDTNIFBYK.exe [?]

=============== Created Last 30 ================

2010-03-14 04:46:10 0 ----a-w- c:\users\dharmamayachandrahas\defogger_reenable

2010-03-14 04:33:20 17664 ----a-w- c:\windows\system32\drivers\EnumProcessesDriver.sys

2010-03-13 03:14:58 49152 ----a-w- c:\windows\system32\E_DCINST.DLL

2010-03-13 03:14:57 86528 ----a-w- c:\windows\system32\E_FLBCAP.DLL

2010-03-13 03:14:55 78848 ----a-w- c:\windows\system32\E_FD4BCAP.DLL

2010-03-13 02:21:25 0 d-----w- c:\programdata\EPSON

2010-03-13 02:18:01 0 d-----w- c:\program files\epson

2010-03-13 02:17:58 66560 ----a-w- c:\windows\system32\eswia7e.dll

2010-03-13 02:17:58 3584 ----a-w- c:\windows\system32\eswiaml.dll

2010-03-13 02:17:58 208896 ----a-w- c:\windows\system32\esint7e.dll

2010-03-05 14:11:23 0 d-----w- c:\users\dharma~1\appdata\roaming\ProcessLasso

2010-03-05 14:11:23 0 d-----w- c:\program files\Process Lasso

2010-03-01 12:23:56 641536 ----a-w- c:\windows\system32\CPFilters.dll

2010-03-01 12:23:56 465408 ----a-w- c:\windows\system32\psisdecd.dll

2010-03-01 12:23:56 417792 ----a-w- c:\windows\system32\msdri.dll

2010-03-01 12:23:56 204288 ----a-w- c:\windows\system32\MSNP.ax

2010-03-01 12:23:50 2048 ----a-w- c:\windows\system32\tzres.dll

2010-02-25 10:57:11 0 d-----w- c:\program files\Anti Trojan Elite

2010-02-20 05:32:27 0 d-----w- c:\program files\VirusTotalUploader2

2010-02-19 12:21:01 0 d-----w- c:\program files\PeerBlock

2010-02-19 10:48:35 65536 --sha-w- c:\users\dharmamayachandrahas\ntuser.dat{97c105c1-1d43-11df-bbff-001aa0ff77d3}.TM.blf

2010-02-19 10:48:35 524288 --sha-w- c:\users\dharmamayachandrahas\ntuser.dat{97c105c1-1d43-11df-bbff-001aa0ff77d3}.TMContainer00000000000000000002.regtrans-ms

2010-02-19 10:48:35 524288 --sha-w- c:\users\dharmamayachandrahas\ntuser.dat{97c105c1-1d43-11df-bbff-001aa0ff77d3}.TMContainer00000000000000000001.regtrans-ms

2010-02-17 18:52:39 0 d-----w- c:\program files\PeerGuardian2

2010-02-16 13:59:08 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys

2010-02-16 13:47:59 0 d-----w- c:\programdata\Lavasoft

2010-02-15 12:33:02 0 d-----w- C:\Wormguard

2010-02-15 10:29:44 0 d-----w- c:\users\dharma~1\appdata\roaming\TrojanHunter

2010-02-15 08:43:01 0 d-----w- c:\program files\TrojanHunter 5.2

2010-02-15 07:33:48 77312 ----a-w- c:\windows\system32\ztvunace26.dll

2010-02-15 07:33:48 75264 ----a-w- c:\windows\system32\unacev2.dll

2010-02-15 07:33:48 69632 ----a-w- c:\windows\system32\ztvcabinet.dll

2010-02-15 07:33:48 162304 ----a-w- c:\windows\system32\ztvunrar36.dll

2010-02-15 07:33:48 153088 ----a-w- c:\windows\system32\UNRAR3.dll

2010-02-15 07:32:47 0 d-----w- c:\program files\Trojan Remover

2010-02-14 16:31:59 59664 ----a-w- c:\windows\system32\drivers\TfSysMon.sys

2010-02-14 16:31:31 33552 ----a-w- c:\windows\system32\drivers\TfNetMon.sys

2010-02-14 16:31:30 51984 ----a-w- c:\windows\system32\drivers\TfFsMon.sys

2010-02-14 16:23:10 0 d-----w- c:\program files\ThreatFire

2010-02-14 13:19:44 15944 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys

2010-02-14 13:18:34 0 d-----w- c:\programdata\Hitman Pro

2010-02-14 13:17:02 0 d-----w- c:\program files\Hitman Pro 3.5

2010-02-14 12:18:49 0 d-----w- c:\programdata\Sun

2010-02-14 12:17:54 411368 ----a-w- c:\windows\system32\deploytk.dll

2010-02-13 14:57:41 767952 ----a-w- c:\windows\BDTSupport.dll.old

2010-02-13 14:57:41 767952 ----a-w- c:\windows\BDTSupport.dll

2010-02-13 14:57:40 882 ----a-w- c:\windows\RegSDImport.xml

2010-02-13 14:57:40 879 ----a-w- c:\windows\RegISSImport.xml

2010-02-13 14:57:40 149456 ----a-w- c:\windows\SGDetectionTool.dll

2010-02-13 14:57:40 131 ----a-w- c:\windows\IDB.zip

2010-02-13 14:57:39 165840 ----a-w- c:\windows\PCTBDRes.dll

2010-02-13 14:57:39 1652688 ----a-w- c:\windows\PCTBDCore.dll

2010-02-13 14:57:39 1640400 ----a-w- c:\windows\PCTBDCore.dll.old

2010-02-13 14:57:39 1152444 ----a-w- c:\windows\UDB.zip

2010-02-13 14:41:54 98600 ----a-w- c:\windows\system32\drivers\pctwfpfilter.sys

2010-02-13 14:41:54 7387 ----a-w- c:\windows\system32\drivers\pctgntdi.cat

2010-02-13 14:41:54 233136 ----a-w- c:\windows\system32\drivers\pctgntdi.sys

2010-02-13 14:41:46 7383 ----a-w- c:\windows\system32\drivers\pctcore.cat

2010-02-13 14:41:45 87784 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys

2010-02-13 14:41:45 7412 ----a-w- c:\windows\system32\drivers\PCTAppEvent.cat

2010-02-13 14:41:45 207792 ----a-w- c:\windows\system32\drivers\PCTCore.sys

2010-02-13 14:41:27 7383 ----a-w- c:\windows\system32\drivers\pctplsg.cat

2010-02-13 14:41:27 70408 ----a-w- c:\windows\system32\drivers\pctplsg.sys

2010-02-13 14:41:04 0 d-----w- c:\program files\common files\PC Tools

2010-02-13 14:41:03 0 d-----w- c:\users\dharma~1\appdata\roaming\PC Tools

2010-02-13 14:41:03 0 d-----w- c:\programdata\PC Tools

2010-02-13 14:41:03 0 d-----w- c:\program files\Spyware Doctor

2010-02-13 11:04:19 0 d-----w- c:\windows\McAfee.com

2010-02-13 09:34:44 0 d-----w- c:\programdata\Comodo

2010-02-13 09:34:38 29520 ----a-w- c:\windows\system32\drivers\cmdhlp.sys

2010-02-13 09:34:38 171552 ----a-w- c:\windows\system32\guard32.dll

2010-02-13 09:34:38 130960 ----a-w- c:\windows\system32\drivers\cmdguard.sys

2010-02-12 16:47:03 0 d-----w- c:\users\dharma~1\appdata\roaming\.anki

2010-02-12 16:40:38 0 d-----w- c:\program files\Anki

2010-02-12 13:55:22 0 d-----w- c:\windows\system32\appmgmt

==================== Find3M ====================

2010-02-24 01:16:06 181632 ------w- c:\windows\system32\MpSigStub.exe

2010-02-02 09:47:37 9040 ----a-w- c:\windows\system32\drivers\rdpdispm.sys

2010-02-02 09:47:37 118736 ----a-w- c:\windows\system32\rdpdispd.dll

2010-01-28 15:16:33 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_09_00.Wdf

2010-01-18 23:29:31 85504 ----a-w- c:\windows\system32\secproc_ssp_isv.dll

2010-01-18 23:29:31 85504 ----a-w- c:\windows\system32\secproc_ssp.dll

2010-01-18 23:29:31 365568 ----a-w- c:\windows\system32\secproc_isv.dll

2010-01-18 23:29:30 369152 ----a-w- c:\windows\system32\secproc.dll

2010-01-18 23:28:33 324608 ----a-w- c:\windows\system32\RMActivate_isv.exe

2010-01-18 23:28:33 277504 ----a-w- c:\windows\system32\RMActivate_ssp_isv.exe

2010-01-18 23:28:30 320512 ----a-w- c:\windows\system32\RMActivate.exe

2010-01-18 23:28:30 280064 ----a-w- c:\windows\system32\RMActivate_ssp.exe

2009-12-19 09:02:55 977920 ----a-w- c:\windows\system32\wininet.dll

2009-12-19 09:02:52 12288 ----a-w- c:\windows\system32\tsbyuv.dll

2009-12-19 09:02:48 1328640 ----a-w- c:\windows\system32\quartz.dll

2009-12-19 09:02:46 22016 ----a-w- c:\windows\system32\msyuv.dll

2009-12-19 09:02:45 31744 ----a-w- c:\windows\system32\msvidc32.dll

2009-12-19 09:02:45 13312 ----a-w- c:\windows\system32\msrle32.dll

2009-12-19 09:02:40 84480 ----a-w- c:\windows\system32\mciavi32.dll

2009-12-19 09:02:39 50176 ----a-w- c:\windows\system32\iyuv_32.dll

2009-12-19 09:02:01 91648 ----a-w- c:\windows\system32\avifil32.dll

2009-07-14 04:56:42 31548 ----a-w- c:\windows\inf\perflib\0409\perfd.dat

2009-07-14 04:56:42 31548 ----a-w- c:\windows\inf\perflib\0409\perfc.dat

2009-07-14 04:56:42 291294 ----a-w- c:\windows\inf\perflib\0409\perfi.dat

2009-07-14 04:56:42 291294 ----a-w- c:\windows\inf\perflib\0409\perfh.dat

2009-07-14 04:41:57 174 --sha-w- c:\program files\desktop.ini

2009-07-14 00:34:40 291294 ----a-w- c:\windows\inf\perflib\0000\perfi.dat

2009-07-14 00:34:40 291294 ----a-w- c:\windows\inf\perflib\0000\perfh.dat

2009-07-14 00:34:38 31548 ----a-w- c:\windows\inf\perflib\0000\perfd.dat

2009-07-14 00:34:38 31548 ----a-w- c:\windows\inf\perflib\0000\perfc.dat

2009-06-10 21:26:35 9633792 --sha-r- c:\windows\fonts\StaticCache.dat

2009-07-14 01:14:45 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe

============= FINISH: 12:56:16.54 ===============

Attach.zip

ark.txt

screen317 · March 18, 2010

Hi and welcome to Malwarebytes.

Do you still need help?

drec · March 18, 2010

Hi and welcome to Malwarebytes.
Do you still need help?

Hi! Yes,I still do need your help.Thank you.

Regards,

drec.

screen317 · March 19, 2010

Hi,

Please run DDS again and post its log.

After you post it, please visit this webpage for instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

When the tool is finished, it will produce a report for you.
Please post the C:\ComboFix.txt along with a new HijackThis log so we may continue cleaning the system.

-screen317

drec · March 21, 2010

Hi,
Please run DDS again and post its log.
After you post it, please visit this webpage for instructions for running ComboFix:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
When the tool is finished, it will produce a report for you.
Please post the C:\ComboFix.txt along with a new HijackThis log so we may continue cleaning the system.
-screen317

Hi,

I have posted dds here.I have also attached 'attach'zip.

DDS (Ver_09-12-01.01) - NTFSx86

Run by DharmaMayaChandrahas at 21:50:37.91 on Fri 03/19/2010

Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_18

Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.2038.843 [GMT 8:00]

============== Running Processes ===============

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Program Files\COMODO\COMODO livePCsupport\CLPSLS.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\aestsrv.exe

C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

C:\Program Files\Sandboxie\SbieSvc.exe

C:\Program Files\Spyware Doctor\pctsAuxs.exe

C:\Windows\system32\STacSV.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files\ThreatFire\TFService.exe

C:\Program Files\Live Mesh\Remote Desktop\wlcrasvc.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\system32\Dwm.exe

C:\Windows\system32\taskhost.exe

C:\Windows\Explorer.EXE

C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files\COMODO\COMODO Internet Security\cfp.exe

C:\Program Files\ThreatFire\TFTray.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\Users\DharmaMayaChandrahas\AppData\Local\Microsoft\Live Mesh\Bin\Servicing\0.9.4014.7\MoeMonitor.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Users\DharmaMayaChandrahas\AppData\Local\Microsoft\Live Mesh\GacBase\Moe.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\Windows Live\Contacts\wlcomm.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Windows\System32\svchost.exe -k secsvcs

C:\Windows\system32\wuauclt.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\Program Files\Skype\Plugin Manager\skypePM.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Skype\Toolbars\Shared\SkypeNames2.exe

C:\Program Files\Process Lasso\ProcessLasso.exe

C:\Program Files\Process Lasso\processgovernor.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\taskeng.exe

C:\Program Files\TrojanHunter 5.2\Tools\LiveUpdate\LiveUpdate.exe

C:\Program Files\COMODO\COMODO System-Cleaner\UpdateApplications.exe