ComboFix 13-02-03.03 - JaXoDee 04.02.2013 17:54:33.4.2 - x86
Systém Microsoft Windows XP Home Edition 5.1.2600.3.1250.421.1033.18.3583.2998 [GMT 1:00]
Running from: c:\documents and settings\JaXoDee\Desktop\ComboFix.exe
AV: ESET Smart Security 6.0 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET personal firewall *Disabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
.
.
((((((((((((((((((((((((( Files Created from 2013-01-04 to 2013-02-04 )))))))))))))))))))))))))))))))
.
.
2013-02-03 21:53 . 2013-02-03 21:53 -------- d-----w- C:\rsit
2013-01-09 17:35 . 2013-01-09 17:35 -------- d-----w- C:\NVIDIA
2013-01-09 17:01 . 2013-02-04 12:30 -------- d-----r- C:\Program Files
2013-01-09 17:00 . 2013-01-31 15:05 -------- d-----w- C:\Documents and Settings
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-12-16 12:23 . 2006-02-28 12:00 290560 ----a-w- c:\windows\system32\atmfd.dll
2012-11-13 01:25 . 2006-02-28 12:00 1866368 ----a-w- c:\windows\system32\win32k.sys
2013-01-16 20:10 . 2013-01-09 17:13 262552 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SetDefaultMIDI"="MIDIDef.exe" [2008-03-20 31232]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTHelper"="CTHELPER.EXE" [2008-03-20 23040]
"CTxfiHlp"="CTXFIHLP.EXE" [2008-03-20 23552]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2012-11-26 5074384]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2012-09-23 15512424]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2012-09-23 108392]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [8.10.2012 8:21 121216]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [26.11.2012 13:34 1329304]
R3 COMMONFX.SYS;COMMONFX.SYS;c:\windows\system32\drivers\COMMONFX.sys [20.3.2008 17:23 98328]
R3 CTEDSPIO.SYS;CTEDSPIO.SYS;c:\windows\system32\drivers\CTEDSPIO.sys [20.3.2008 17:38 134168]
R3 CTEDSPSY.SYS;CTEDSPSY.SYS;c:\windows\system32\drivers\CTEDSPSY.sys [20.3.2008 17:37 309784]
R3 L1c;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\drivers\l1c51x86.sys [9.1.2013 18:08 65136]
S0 d347bus;d347bus;c:\windows\system32\DRIVERS\d347bus.sys --> c:\windows\system32\DRIVERS\d347bus.sys [?]
S0 d347prt;d347prt;c:\windows\system32\Drivers\d347prt.sys --> c:\windows\system32\Drivers\d347prt.sys [?]
S2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [9.11.2012 11:21 160944]
S3 COMMONFX;COMMONFX;c:\windows\system32\drivers\COMMONFX.sys [20.3.2008 17:23 98328]
S3 CT20XUT.SYS;CT20XUT.SYS;c:\windows\system32\drivers\CT20XUT.sys [20.3.2008 17:36 171032]
S3 CT20XUT;CT20XUT;c:\windows\system32\drivers\CT20XUT.sys [20.3.2008 17:36 171032]
S3 CTAUDFX.SYS;CTAUDFX.SYS;c:\windows\system32\drivers\CTAUDFX.sys [20.3.2008 17:23 528920]
S3 CTAUDFX;CTAUDFX;c:\windows\system32\drivers\CTAUDFX.sys [20.3.2008 17:23 528920]
S3 CTEAPSFX.SYS;CTEAPSFX.SYS;c:\windows\system32\drivers\CTEAPSFX.sys [20.3.2008 17:26 163352]
S3 CTEAPSFX;CTEAPSFX;c:\windows\system32\drivers\CTEAPSFX.sys [20.3.2008 17:26 163352]
S3 CTEDSPFX.SYS;CTEDSPFX.SYS;c:\windows\system32\drivers\CTEDSPFX.sys [20.3.2008 17:32 259096]
S3 CTEDSPFX;CTEDSPFX;c:\windows\system32\drivers\CTEDSPFX.sys [20.3.2008 17:32 259096]
S3 CTEDSPIO;CTEDSPIO;c:\windows\system32\drivers\CTEDSPIO.sys [20.3.2008 17:38 134168]
S3 CTEDSPSY;CTEDSPSY;c:\windows\system32\drivers\CTEDSPSY.sys [20.3.2008 17:37 309784]
S3 CTERFXFX.SYS;CTERFXFX.SYS;c:\windows\system32\drivers\CTERFXFX.sys [20.3.2008 17:36 99352]
S3 CTERFXFX;CTERFXFX;c:\windows\system32\drivers\CTERFXFX.sys [20.3.2008 17:36 99352]
S3 CTEXFIFX.SYS;CTEXFIFX.SYS;c:\windows\system32\drivers\CTEXFIFX.sys [20.3.2008 17:40 1324056]
S3 CTEXFIFX;CTEXFIFX;c:\windows\system32\drivers\CTEXFIFX.sys [20.3.2008 17:40 1324056]
S3 CTHWIUT.SYS;CTHWIUT.SYS;c:\windows\system32\drivers\CTHWIUT.sys [20.3.2008 17:37 72728]
S3 CTHWIUT;CTHWIUT;c:\windows\system32\drivers\CTHWIUT.sys [20.3.2008 17:37 72728]
S3 CTSBLFX.SYS;CTSBLFX.SYS;c:\windows\system32\drivers\CTSBLFX.sys [20.3.2008 17:25 534040]
S3 CTSBLFX;CTSBLFX;c:\windows\system32\drivers\CTSBLFX.sys [20.3.2008 17:25 534040]
.
.
------- Supplementary Scan -------
.
TCP: DhcpNameServer = 194.145.207.73 194.145.207.73
TCP: Interfaces\{E32CFC50-B5F4-4B40-8298-9E60C28B3EF4}: NameServer = 194.145.207.73 194.145.207.73
FF - ProfilePath - c:\documents and settings\JaXoDee\Application Data\Mozilla\Firefox\Profiles\dmamtv1m.default\
FF - prefs.js: browser.startup.homepage -
www.pokec.sk
FF - ExtSQL: 2013-01-09 19:00; {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}; c:\documents and settings\JaXoDee\Application Data\Mozilla\Firefox\Profiles\dmamtv1m.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF - ExtSQL: 2013-01-09 19:01; {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}; c:\documents and settings\JaXoDee\Application Data\Mozilla\Firefox\Profiles\dmamtv1m.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
FF - ExtSQL: 2013-01-09 19:02;
netvideohunter@netvideohunter.com; c:\documents and settings\JaXoDee\Application Data\Mozilla\Firefox\Profiles\dmamtv1m.default\extensions\
netvideohunter@netvideohunter.com
FF - ExtSQL: 2013-01-13 18:37; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - ExtSQL: 2013-01-27 21:53; jid0-YxzrUsJ0WOiOaU89TngAzLcIs18@jetpack; c:\documents and settings\JaXoDee\Application Data\Mozilla\Firefox\Profiles\dmamtv1m.default\extensions\jid0-YxzrUsJ0WOiOaU89TngAzLcIs18@jetpack
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2013-02-04 17:58
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
Completion time: 2013-02-04 17:59:43
ComboFix-quarantined-files.txt 2013-02-04 16:59
.
Pre-Run: 57 947 754 496 bytes free
Post-Run: 57 903 988 736 bytes free
.
- - End Of File - - 07C07AF0FC9E3A20A86689D939FDB4E2