not sure

[koolkid12349]

what it is, but a cmd just opened for a split second that i have no idea what it did, any ideas?

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:19, on 2008-05-12
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32Info.exe
C:\Program Files\Trend Micro\HijackThis\scanner.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dogpile.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell.com/remote
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 5732 bytes

 

[koolkid12349]

ComboFix 08-05-01.3 - Owner 2008-05-12 19:23:27.22 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.670 [GMT -4:00]
Running from: C:\Documents and Settings\Owner\Desktop\Combofix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\esvipqve.ini
C:\WINDOWS\system32\fgxcekpu.ini
C:\WINDOWS\system32\irkyuakn.ini
C:\WINDOWS\system32\vewhmcbu.ini

.
((((((((((((((((((((((((( Files Created from 2008-04-12 to 2008-05-12 )))))))))))))))))))))))))))))))
.

2008-05-08 22:50 . 2008-05-10 00:43 <DIR> d-------- C:\Documents and Settings\Nick\Application Data\AVG7
2008-05-07 23:22 . 2008-05-07 23:23 36 --a------ C:\New Text Document.bat
2008-05-04 22:09 . 2008-05-04 22:09 420,268 --a------ C:\picture050.jpg
2008-05-04 22:06 . 2008-05-04 22:06 414,481 --a------ C:\picture049.jpg
2008-05-01 22:53 . 2008-05-01 22:53 514,077 --a------ C:\picture048.jpg
2008-05-01 21:29 . 2008-05-01 21:29 471,764 --a------ C:\picture047.jpg
2008-05-01 20:48 . 2008-05-01 20:48 417,940 --a------ C:\picture046.jpg
2008-05-01 20:39 . 2008-05-01 20:39 339,992 --a------ C:\picture045.jpg
2008-04-29 19:54 . 2008-04-29 19:54 498,685 --a------ C:\picture044.jpg
2008-04-28 18:28 . 2008-04-28 18:28 487,498 --a------ C:\picture043.jpg
2008-04-28 12:48 . 2008-04-28 12:49 145,294 --a------ C:\picture042.jpg
2008-04-28 12:46 . 2008-04-28 12:46 637,426 --a------ C:\picture041.jpg
2008-04-26 15:28 . 2008-04-26 15:29 113,547 --a------ C:\picture040.jpg
2008-04-26 12:50 . 2008-05-05 18:00 <DIR> d-------- C:\Mah B folder
2008-04-25 17:41 . 2008-04-29 00:29 112,047 --a------ C:\hitsugaya.jpg
2008-04-25 17:40 . 2008-04-25 17:40 27,685 --a------ C:\ichigo.jpg
2008-04-25 17:16 . 2008-04-25 17:16 <DIR> d-------- C:\Program Files\Viewpoint
2008-04-25 17:16 . 2008-04-25 17:16 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-04-25 17:15 . 2008-04-25 18:44 <DIR> d-------- C:\Program Files\Common Files\AOL
2008-04-25 17:15 . 2008-04-25 17:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\AOL OCP
2008-04-25 17:15 . 2008-04-25 17:15 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\AOL
2008-04-25 17:14 . 2008-04-25 17:16 460 --ah----- C:\IPH.PH
2008-04-25 17:09 . 2004-08-04 02:07 59,264 --a------ C:\WINDOWS\system32\drivers\USBAUDIO.sys
2008-04-25 17:09 . 2004-08-04 02:07 59,264 --a--c--- C:\WINDOWS\system32\dllcache\usbaudio.sys
2008-04-24 21:03 . 2008-04-24 21:03 466,852 --a------ C:\picture039.jpg
2008-04-24 20:06 . 2008-04-24 20:06 432,134 --a------ C:\picture038.jpg
2008-04-24 13:55 . 2008-04-24 13:55 433,694 --a------ C:\picture037.jpg
2008-04-24 12:12 . 2008-04-24 12:12 457,887 --a------ C:\picture035.jpg
2008-04-24 12:12 . 2008-04-24 12:12 406,375 --a------ C:\picture036.jpg
2008-04-22 18:39 . 2008-04-22 18:39 477,655 --a------ C:\picture034.jpg
2008-04-20 03:26 . 2008-04-20 03:26 47,921 --a------ C:\edit.jpg
2008-04-19 12:50 . 2008-04-19 12:50 462,420 --a------ C:\picture033.jpg
2008-04-19 12:50 . 2008-04-19 12:50 460,586 --a------ C:\picture032.jpg
2008-04-19 11:09 . 2008-04-19 11:09 394,666 --a------ C:\picture031.jpg
2008-04-19 01:21 . 2008-04-19 01:21 409,883 --a------ C:\picture030.jpg
2008-04-19 00:35 . 2008-04-19 00:35 425,515 --a------ C:\picture029.jpg
2008-04-17 20:55 . 2008-04-17 20:55 505,654 --a------ C:\picture028.jpg
2008-04-14 00:11 . 2008-04-14 00:23 <DIR> d-------- C:\Program Files\Yahoo!
2008-04-14 00:11 . 2008-04-14 00:11 <DIR> d-------- C:\Program Files\CCleaner
2008-04-13 23:38 . 2008-04-13 23:38 18,760 --a------ C:\Baddest Niggah.png
2008-04-13 22:16 . 2008-04-13 22:18 134,538 --a------ C:\picture027.jpg
2008-04-13 22:12 . 2008-04-13 22:12 335,867 --a------ C:\picture026.jpg
2008-04-13 16:02 . 2008-04-13 16:02 463,040 --a------ C:\picture025.jpg
2008-04-12 00:19 . 2008-04-12 00:48 <DIR> d-------- C:\WINDOWS\system32\Adobe
2008-04-12 00:07 . 2008-04-12 00:07 239,793 --a------ C:\picture024.jpg

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-12 23:26 868,384 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-05-12 17:45 10,652 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-05-12 00:58 --------- d-----w C:\Documents and Settings\Owner\Application Data\teamspeak2
2008-05-10 04:58 --------- d-----w C:\Program Files\mIRC
2008-05-10 04:53 --------- d-----w C:\Program Files\Howies Quick Screen Capture
2008-05-10 04:45 --------- d-----w C:\Documents and Settings\Nick\Application Data\teamspeak2
2008-05-08 21:10 --------- d-----w C:\Documents and Settings\Owner\Application Data\AVG7
2008-05-06 23:30 --------- d-----w C:\Program Files\SwiftSwitch
2008-04-25 01:09 --------- d-----w C:\Program Files\SwiftKit
2008-04-15 16:52 --------- d-----w C:\Program Files\SUPERAntiSpyware
2008-04-14 17:51 1,813,886 ----a-w C:\WINDOWS\Internet Logs\tvDebug.zip
2008-04-03 20:25 --------- d-----w C:\Program Files\iTunes
2008-04-03 20:24 --------- d-----w C:\Program Files\iPod
2008-04-03 20:23 --------- d-----w C:\Program Files\QuickTime
2008-03-19 22:07 --------- d-----w C:\Program Files\Java
2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-17 21:46 --------- d-----w C:\Program Files\HyCam2
2008-03-15 04:36 --------- d-----w C:\Program Files\Coupons
2008-03-14 03:11 75,248 ----a-w C:\WINDOWS\zllsputility.exe
2008-03-14 03:11 1,086,952 ----a-w C:\WINDOWS\system32\zpeng24.dll
2008-03-07 18:05 136,192 ----a-w C:\WINDOWS\Internet Logs\xDB1.tmp
2008-03-07 18:05 1,353,216 ----a-w C:\WINDOWS\Internet Logs\xDB2.tmp
2008-03-04 04:44 1,974 ----a-w C:\WINDOWS\system32\tmp.reg
2008-03-02 04:12 86,016 ----a-w C:\WINDOWS\system32\VACFix.exe
2008-03-01 13:06 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-03-01 04:48 82,432 ----a-w C:\WINDOWS\system32\IEDFix.exe
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 05:32 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2008-02-16 22:40 149,774 ----a-w C:\SwiftKit(Install).exe
2007-09-03 23:03 1,217,264 ----a-w C:\Program Files\Win32OpenSSL_Light-0_9_8e.exe
2007-08-13 23:16 1,008,360 ----a-w C:\Program Files\MzBot no patcher.rar
2007-08-11 03:21 27,728 ----a-w C:\Program Files\file1.jpg
2007-08-09 15:26 664,572,433 ----a-w C:\Program Files\MSSetup.exe
2007-08-01 21:22 5,914,648 ----a-w C:\Program Files\SUPERAntiSpyware.exe
2007-08-01 20:28 212,849 ----a-w C:\Program Files\scanner.exe.zip
2007-08-01 07:45 921,654 ----a-w C:\Program Files\file.BMP
2007-08-01 07:44 28,272 ----a-w C:\Program Files\file.bin
2007-07-31 19:56 50,375 ----a-w C:\Program Files\SAtrainerFinalv3.zip
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA}]
2008-03-03 23:51 262144 --a------ C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}"= "C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL" [2008-03-03 23:51 262144]

[HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}"= C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL [2008-03-03 23:51 262144]

[HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2003-01-13 13:53 114688]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-04-16 08:21 579584]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-28 23:37 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-03-13 23:11 919016]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-02-02 17:29 219136]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-11 23:23:26 282624]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 14:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 14:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Nexon\\MapleStory\\MapleStory.exe"=
"C:\\Program Files\\SwiftSwitch\\SwiftSwitch.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=

S4 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" [2007-01-04 17:38]

.
Contents of the 'Scheduled Tasks' folder
"2008-04-28 18:54:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-12 19:25:51
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-05-12 19:27:41
ComboFix-quarantined-files.txt 2008-05-12 23:27:37
ComboFix2.txt 2008-04-26 05:45:32
ComboFix3.txt 2008-04-14 03:58:09
ComboFix4.txt 2008-04-02 18:29:46
ComboFix5.txt 2008-03-20 22:17:27

Pre-Run: 40,923,365,376 bytes free
Post-Run: 40,899,395,584 bytes free

168 --- E O F --- 2008-04-10 04:04:40