Thread: Hijacklog
View Single Post
Old 08-04-2008, 09:51 AM   #2 (permalink)
koolkid12349
Bronze Member
 
Join Date: Oct 2007
Posts: 95
Default
ComboFix 08-08-03.03 - Owner 2008-08-04 3:44:11.28 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.659 [GMT -4:00]
Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Owner\Application Data\macromedia\Flash Player\#SharedObjects\VMD23ZLN\interclick.com
C:\Documents and Settings\Owner\Application Data\macromedia\Flash Player\#SharedObjects\VMD23ZLN\interclick.com\ud.s ol
C:\Documents and Settings\Owner\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#int erclick.com
C:\Documents and Settings\Owner\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#int erclick.com\settings.sol

.
((((((((((((((((((((((((( Files Created from 2008-07-04 to 2008-08-04 )))))))))))))))))))))))))))))))
.

2008-08-02 00:46 . 2008-08-02 00:46 <DIR> d--h----- C:\WINDOWS\PIF
2008-07-26 20:41 . 2008-07-26 20:41 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\acccore
2008-07-26 19:12 . 2008-07-26 19:12 <DIR> d-------- C:\Program Files\Viewpoint
2008-07-26 19:12 . 2008-07-26 19:12 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\acccore
2008-07-26 19:10 . 2008-07-26 19:12 <DIR> d-------- C:\Program Files\AIM6
2008-07-26 14:25 . 2001-08-17 13:48 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys
2008-07-26 14:25 . 2001-08-17 13:48 12,160 --a--c--- C:\WINDOWS\system32\dllcache\mouhid.sys
2008-07-26 14:25 . 2001-08-17 14:02 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys
2008-07-26 14:25 . 2001-08-17 14:02 9,600 --a--c--- C:\WINDOWS\system32\dllcache\hidusb.sys
2008-07-21 03:36 . 2008-07-21 03:36 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\skypePM
2008-07-21 03:36 . 2008-07-21 03:36 56 --ah----- C:\WINDOWS\system32\ezsidmv.dat
2008-07-21 03:31 . 2008-08-01 04:26 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Skype
2008-07-21 03:29 . 2008-07-21 03:29 <DIR> d-------- C:\Program Files\Skype
2008-07-21 03:29 . 2008-07-21 03:29 <DIR> d-------- C:\Program Files\Common Files\Skype
2008-07-21 03:29 . 2008-07-21 03:29 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Skype
2008-07-20 01:24 . 2008-07-20 01:24 <DIR> d-------- C:\Program Files\Zone Labs
2008-07-19 20:28 . 2008-07-19 20:28 1,374 --a------ C:\WINDOWS\imsins.BAK
2008-07-19 02:25 . 2008-07-19 02:25 0 --a------ C:\WINDOWS\system32\drivers\dump_wmimmc(5).sys
2008-07-17 21:03 . 2008-07-17 21:03 0 --a------ C:\WINDOWS\system32\drivers\dump_wmimmc(6).sys
2008-07-17 13:21 . 2008-07-17 13:21 0 --a------ C:\WINDOWS\system32\drivers\dump_wmimmc(7).sys
2008-07-16 19:03 . 2008-07-16 19:03 0 --a------ C:\WINDOWS\system32\drivers\dump_wmimmc(8).sys
2008-07-16 15:20 . 2008-07-20 01:34 <DIR> d-------- C:\Program Files\Linksys EasyLink Advisor
2008-07-16 15:20 . 2008-07-16 15:24 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\GTek
2008-07-16 12:19 . 2008-07-16 12:19 0 --a------ C:\WINDOWS\system32\drivers\dump_wmimmc(9).sys
2008-07-16 03:31 . 2008-07-16 03:31 0 --a------ C:\WINDOWS\system32\drivers\dump_wmimmc(10).sys
2008-07-15 12:36 . 2008-07-15 12:36 0 --a------ C:\WINDOWS\system32\drivers\dump_wmimmc(11).sys
2008-07-14 17:09 . 2008-07-14 17:09 434,819 --a------ C:\picture157.jpg
2008-07-14 12:20 . 2008-07-14 12:20 0 --a------ C:\WINDOWS\system32\drivers\dump_wmimmc(12).sys
2008-07-14 00:48 . 2008-07-14 00:48 0 --a------ C:\WINDOWS\system32\drivers\dump_wmimmc(13).sys
2008-07-13 22:19 . 2008-07-13 22:19 268 --ah----- C:\sqmdata19.sqm
2008-07-13 22:19 . 2008-07-13 22:19 244 --ah----- C:\sqmnoopt19.sqm
2008-07-13 18:30 . 2008-07-13 18:30 269,035 --a------ C:\picture156.jpg
2008-07-13 12:36 . 2008-07-13 12:36 0 --a------ C:\WINDOWS\system32\drivers\dump_wmimmc.sys
2008-07-13 03:09 . 2008-07-13 03:09 <DIR> d-------- C:\Nexon
2008-07-13 02:56 . 2008-07-13 02:56 268 --ah----- C:\sqmdata18.sqm
2008-07-13 02:56 . 2008-07-13 02:56 244 --ah----- C:\sqmnoopt18.sqm
2008-07-12 20:53 . 2008-07-12 20:53 <DIR> d-------- C:\WINDOWS\system32\CatRoot_bak
2008-07-12 20:49 . 2008-07-12 20:49 268 --ah----- C:\sqmdata17.sqm
2008-07-12 20:49 . 2008-07-12 20:49 244 --ah----- C:\sqmnoopt17.sqm
2008-07-12 20:41 . 2008-07-12 20:41 268 --ah----- C:\sqmdata16.sqm
2008-07-12 20:41 . 2008-07-12 20:41 244 --ah----- C:\sqmnoopt16.sqm
2008-07-12 13:55 . 2008-07-12 13:55 0 --a------ C:\WINDOWS\system32\drivers\dump_wmimmc(2).sys
2008-07-12 01:41 . 2008-07-12 01:41 0 --a------ C:\WINDOWS\system32\drivers\dump_wmimmc(3).sys
2008-07-12 01:37 . 2008-07-12 01:37 268 --ah----- C:\sqmdata15.sqm
2008-07-12 01:37 . 2008-07-12 01:37 244 --ah----- C:\sqmnoopt15.sqm
2008-07-11 23:57 . 2008-07-11 23:57 0 --a------ C:\WINDOWS\system32\drivers\dump_wmimmc(4).sys
2008-07-11 23:54 . 2008-07-23 19:56 268 --ah----- C:\sqmdata14.sqm
2008-07-11 23:54 . 2008-07-23 19:56 244 --ah----- C:\sqmnoopt14.sqm
2008-07-11 00:55 . 2008-07-20 13:28 268 --ah----- C:\sqmdata13.sqm
2008-07-11 00:55 . 2008-07-20 13:28 244 --ah----- C:\sqmnoopt13.sqm
2008-07-10 01:56 . 2008-07-10 01:56 70,177 --a------ C:\watermellons.jpg
2008-07-09 16:25 . 2008-07-20 01:55 268 --ah----- C:\sqmdata12.sqm
2008-07-09 16:25 . 2008-07-20 01:55 244 --ah----- C:\sqmnoopt12.sqm
2008-07-09 16:13 . 2008-07-20 01:05 268 --ah----- C:\sqmdata11.sqm
2008-07-09 16:13 . 2008-07-20 01:05 244 --ah----- C:\sqmnoopt11.sqm
2008-07-09 13:55 . 2008-07-20 00:59 268 --ah----- C:\sqmdata10.sqm
2008-07-09 13:55 . 2008-07-20 00:59 244 --ah----- C:\sqmnoopt10.sqm
2008-07-09 13:43 . 2008-07-09 13:43 <DIR> d-------- C:\WINDOWS\system32\scripting
2008-07-09 13:43 . 2008-07-09 13:43 <DIR> d-------- C:\WINDOWS\l2schemas
2008-07-09 13:14 . 2006-12-28 15:01 19,569 --a------ C:\WINDOWS\005344_.tmp
2008-07-08 02:11 . 2008-07-20 00:53 268 --ah----- C:\sqmdata09.sqm
2008-07-08 02:11 . 2008-07-20 00:53 244 --ah----- C:\sqmnoopt09.sqm
2008-07-07 23:36 . 2008-07-07 23:36 301,986 --a------ C:\ninja.jpg
2008-07-07 22:19 . 2008-07-07 23:40 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Hamachi
2008-07-07 22:18 . 2008-07-07 22:19 <DIR> d-------- C:\Program Files\Hamachi
2008-07-07 22:18 . 2008-07-07 22:18 25,280 --a------ C:\WINDOWS\system32\drivers\hamachi.sys
2008-07-07 16:51 . 2008-07-08 13:05 <DIR> d-------- C:\Program Files\Jnes 0.6
2008-07-07 11:54 . 2008-07-07 11:54 318,998 --a------ C:\picture155.jpg
2008-07-05 13:53 . 2008-07-20 00:19 268 --ah----- C:\sqmdata08.sqm
2008-07-05 13:53 . 2008-07-20 00:19 244 --ah----- C:\sqmnoopt08.sqm
2008-07-05 00:21 . 2008-07-19 23:45 268 --ah----- C:\sqmdata07.sqm
2008-07-05 00:21 . 2008-07-19 23:45 244 --ah----- C:\sqmnoopt07.sqm
2008-07-04 23:26 . 2008-07-19 21:21 268 --ah----- C:\sqmdata06.sqm
2008-07-04 23:26 . 2008-07-19 21:21 244 --ah----- C:\sqmnoopt06.sqm

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2008-08-04 07:31 --------- d-----w C:\Program Files\mIRC
2008-08-04 03:30 23 ----a-w C:\Documents and Settings\Owner\jagex_runescape_preferences.dat
2008-07-29 18:45 --------- d-----w C:\Documents and Settings\Owner\Application Data\teamspeak2
2008-07-26 23:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-07-26 23:11 --------- d-----w C:\Program Files\Common Files\AOL
2008-07-16 19:23 --------- d-----w C:\Documents and Settings\Owner\Application Data\GTek
2008-07-13 00:52 --------- d-----w C:\Program Files\MSN Messenger
2008-07-04 16:55 76,040 ----a-w C:\WINDOWS\system32\drivers\avgtdix.sys
2008-07-04 16:50 96,520 ----a-w C:\WINDOWS\system32\drivers\avgldx86.sys
2008-07-04 16:50 10,520 ----a-w C:\WINDOWS\system32\avgrsstx.dll
2008-06-30 01:58 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avg8
2008-06-30 01:57 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-06-30 01:57 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-20 06:43 --------- d-----w C:\Documents and Settings\All Users\Application Data\scar5
2008-06-20 06:42 --------- d-----w C:\Program Files\scar5
2008-06-20 06:42 --------- d-----w C:\Documents and Settings\Owner\Application Data\scar5
2008-06-19 16:02 --------- d-----w C:\Program Files\AVG
2008-06-19 16:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
2008-06-13 13:10 272,128 ----a-w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-04 01:02 --------- d-----w C:\Documents and Settings\Nick\Application Data\teamspeak2
2008-05-08 03:23 36 ----a-w C:\New Text Document.bat
2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
2007-09-03 23:03 1,217,264 ----a-w C:\Program Files\Win32OpenSSL_Light-0_9_8e.exe
2007-08-13 23:16 1,008,360 ----a-w C:\Program Files\MzBot no patcher.rar
2007-08-11 03:21 27,728 ----a-w C:\Program Files\file1.jpg
2007-08-09 15:26 664,572,433 ----a-w C:\Program Files\MSSetup.exe
2007-08-01 21:22 5,914,648 ----a-w C:\Program Files\SUPERAntiSpyware.exe
2007-08-01 20:28 212,849 ----a-w C:\Program Files\scanner.exe.zip
2007-08-01 07:45 921,654 ----a-w C:\Program Files\file.BMP
2007-08-01 07:44 28,272 ----a-w C:\Program Files\file.bin
2007-07-31 19:56 50,375 ----a-w C:\Program Files\SAtrainerFinalv3.zip
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 17:43 4670704]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 12:54 5674352]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2003-01-13 13:53 114688]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-28 23:37 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-07-04 12:56 1232152]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-11 23:23:26 282624]

[hkey_local_machine\software\microsoft\windows\curr entversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2006-12-20 14:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2007-04-19 14:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List]
"C:\\Nexon\\MapleStory\\MapleStory.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"C:\\Program Files\\mIRC\\mirc.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"C:\\Program Files\\AIM6\\aim6.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-07-04 12:50]
R2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-07-04 12:52]
R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-07-04 12:50]
R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-07-04 12:55]
R2 Viewpoint Manager Service;Viewpoint Manager Service;C:\Program Files\Viewpoint\Common\ViewpointService.exe [2007-01-04 17:38]
S3 MzBot;MzBot;C:\MzBot.sys []

[HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{31eb884b-c43b-11dc-9a32-000874c39918}]
\Shell\AutoRun\command - E:\LaunchU3.exe -a
.
Contents of the 'Scheduled Tasks' folder

2008-07-28 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 15:57]
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-Aim6 - (no file)


.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\haf3bgo8.default\


************************************************** ************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-04 03:46:23
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

************************************************** ************************
.
Completion time: 2008-08-04 3:48:28
ComboFix-quarantined-files.txt 2008-08-04 07:48:23
ComboFix2.txt 2008-07-20 05:15:50
ComboFix3.txt 2008-07-13 07:23:12
ComboFix4.txt 2008-06-29 17:22:58
ComboFix5.txt 2008-08-04 07:43:23

Pre-Run: 35,293,593,600 bytes free
Post-Run: 35,335,512,064 bytes free

205 --- E O F --- 2008-07-23 23:59:31
theres the combofix

hjt was preformed before combofix
koolkid12349 is offline   Reply With Quote