| Re: estoy siendo atacado por, virus, help nuevamente gracias por la ayuda, y les dejo mi report
ComboFix 08-03-06.2 - omega 2008-03-08 18:04:33.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.34.3082.18.139 [GMT -6:00]
Se ejecuta desde: C:\Documents and Settings\omega\Escritorio\ComboFix.exe
* Creado un nuevo punto de restauración ADVERTENCIA - ESTE EQUIPO NO TIENE INSTALADA LA CONSOLA DE RECUPERACION!
.
(((((((((((((((((((((((((((((((((((( Otras eliminaciones )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\BMab846ba2.xml
C:\WINDOWS\cookies.ini
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\amvo.exe
C:\WINDOWS\system32\amvo0.dll
C:\WINDOWS\system32\awvvv.dll
C:\WINDOWS\system32\aydthwyp.dll
C:\WINDOWS\system32\fkuyebcj.dll
C:\WINDOWS\system32\khffghh.dll
C:\WINDOWS\system32\pchycufo.dll
C:\WINDOWS\system32\pqtufqmx.ini
C:\WINDOWS\system32\qgnbxera.dll
C:\WINDOWS\system32\rbeyhsgo.ini
C:\WINDOWS\system32\vdtnbgui.dll
C:\WINDOWS\system32\wbgjhcbo.dll
C:\WINDOWS\system32\wmjpmosr.ini
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\LEGACY_MHB28
(((((((((((((((((( Archivos creados desde 2008-02-09 - 2008-03-09 )))))))))))))))))))))))))))))))))
.
2008-03-07 19:10 . 2008-03-07 19:10 289,280 --a------ C:\WINDOWS\system32\C419.tmp
2008-03-07 16:37 . 2008-03-07 16:37 <DIR> d-------- C:\Documents and Settings\omega\Datos de programa\Malwarebytes
2008-03-07 16:37 . 2008-03-07 16:37 <DIR> d-------- C:\Documents and Settings\All Users\Datos de programa\Malwarebytes
2008-03-07 16:36 . 2008-03-07 16:37 <DIR> d-------- C:\Archivos de programa\Malwarebytes' Anti-Malware
2008-03-07 16:13 . 2008-03-07 16:13 <DIR> d-------- C:\Archivos de programa\CCleaner
2008-03-07 12:46 . 2008-03-07 12:46 289,280 --a------ C:\WINDOWS\system32\30D7.tmp
2008-03-06 18:19 . 2008-03-06 18:19 289,280 --a------ C:\WINDOWS\system32\9D0.tmp
2008-03-06 14:41 . 2008-03-06 14:41 29 --a------ C:\WINDOWS\system32\twqfgsai.tmp
2008-03-06 14:40 . 2008-03-06 14:40 167,936 --a------ C:\WINDOWS\system32\drivers\Mhb28.sys
2008-03-05 12:52 . 2008-03-05 12:52 <DIR> d-------- C:\Archivos de programa\Trend Micro
2008-03-04 20:21 . 2008-03-05 02:35 76,288 -r-hs---- C:\WINDOWS\system32\ieupdate.exe
2008-03-03 13:24 . 2008-03-03 13:42 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2008-03-03 13:24 . 2008-03-03 13:30 30,590 --a------ C:\WINDOWS\system32\pavas.ico
2008-03-03 13:24 . 2008-03-03 13:30 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico
2008-03-03 13:24 . 2008-03-03 13:30 1,406 --a------ C:\WINDOWS\system32\Help.ico
2008-03-03 12:37 . 2008-03-04 14:02 1,304,758 ---hs---- C:\WINDOWS\system32\ncycnyen.ini
2008-02-28 18:29 . 2007-11-27 22:27 96,715 -r-hs---- C:\WINDOWS\system32\avpo.exe
2008-02-24 11:00 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2008-02-24 11:00 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll
2008-02-24 11:00 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-02-23 16:17 . 2008-02-23 16:25 <DIR> d--hsc--- C:\Archivos de programa\Archivos comunes\WindowsLiveInstaller
2008-02-23 16:16 . 2008-02-23 16:16 <DIR> d-------- C:\Documents and Settings\All Users\Datos de programa\WLInstaller
2008-02-23 16:16 . 2008-02-23 16:26 <DIR> d-------- C:\Archivos de programa\Windows Live
2008-02-22 15:36 . 2008-02-22 15:36 <DIR> d-------- C:\tmp
2008-02-21 17:56 . 2008-02-21 17:56 244 --ah----- C:\sqmnoopt11.sqm
2008-02-21 17:56 . 2008-02-21 17:56 232 --ah----- C:\sqmdata11.sqm
2008-02-21 11:18 . 2008-02-21 11:18 268 --ah----- C:\sqmdata10.sqm
2008-02-21 11:18 . 2008-02-21 11:18 244 --ah----- C:\sqmnoopt10.sqm
2008-02-20 16:43 . 2006-09-25 13:59 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-02-20 16:43 . 2006-09-25 13:59 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2008-02-20 15:53 . 2008-02-28 15:50 <DIR> d-------- C:\tmpDownload
2008-02-20 15:53 . 2008-02-20 16:59 5 --a------ C:\WINDOWS\youtubex.dll
2008-02-20 15:52 . 2008-02-20 16:08 <DIR> d-------- C:\Archivos de programa\YoutubeGet
2008-02-20 12:41 . 2008-02-20 12:41 268 --ah----- C:\sqmdata09.sqm
2008-02-20 12:41 . 2008-02-20 12:41 244 --ah----- C:\sqmnoopt09.sqm
2008-02-19 20:19 . 2008-02-19 20:19 244 --ah----- C:\sqmnoopt08.sqm
2008-02-19 20:19 . 2008-02-19 20:19 232 --ah----- C:\sqmdata08.sqm
2008-02-19 18:24 . 2008-02-19 18:24 244 --ah----- C:\sqmnoopt07.sqm
2008-02-19 18:24 . 2008-02-19 18:24 232 --ah----- C:\sqmdata07.sqm
2008-02-19 17:36 . 2008-02-19 17:36 244 --ah----- C:\sqmnoopt06.sqm
2008-02-19 17:36 . 2008-02-19 17:36 232 --ah----- C:\sqmdata06.sqm
2008-02-16 17:11 . 2008-02-17 12:59 <DIR> d-------- C:\Archivos de programa\Ares
.
(((((((((((((((((((((((((((((((((((((( Reporte Find3M )))))))))))))))))))))))))))))))))))))))))))))))))) )
.
2008-03-08 23:59 232,248 ----a-w C:\WINDOWS\system32\drivers\APPFCONT.DAT
2008-03-08 23:59 1,132 ----a-w C:\WINDOWS\system32\drivers\APPFLTR.CFG
2008-03-06 19:10 --------- d-----w C:\Documents and Settings\All Users\Datos de programa\Microsoft Help
2008-02-23 23:59 --------- d-----w C:\Archivos de programa\Freecorder
2008-02-23 22:37 --------- d-----w C:\Archivos de programa\MSN Messenger
2008-02-17 19:46 --------- d-----w C:\Archivos de programa\Replay Media Catcher
2008-02-03 20:20 --------- d-----w C:\Documents and Settings\omega\Datos de programa\Ahead
2008-02-03 20:20 --------- d-----w C:\Documents and Settings\All Users\Datos de programa\Ahead
2008-01-27 07:05 --------- d-----w C:\Documents and Settings\All Users\Datos de programa\Bluetooth
2008-01-27 07:00 --------- d-----w C:\Archivos de programa\IVT Corporation
2008-01-25 10:12 --------- d-----w C:\Documents and Settings\omega\Datos de programa\MegauploadToolbar
2008-01-22 14:07 --------- d-----w C:\Documents and Settings\omega\Datos de programa\GetRightToGo
2008-01-20 09:12 --------- d-----w C:\Archivos de programa\MP3 Player Utilities 3.68
2008-01-18 08:41 --------- d-----w C:\Documents and Settings\All Users\Datos de programa\Yahoo!
2008-01-18 08:40 --------- d-----w C:\Archivos de programa\Yahoo!
2007-11-28 04:27 96,715 --sh--r C:\WINDOWS\system32\avpo.exe
.
((((((((((((((((((((((((((((((((( Cargando Puntos Reg ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* entradas vacías & entradas legítimas predeterminadas no son mostradas
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 01:42 15360]
"MsnMsgr"="C:\Archivos de programa\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]
"MSMSGS"="C:\Archivos de programa\Messenger\msmsgs.exe" [2006-09-25 13:59 1694208]
"Yahoo! Pager"="C:\ARCHIV~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [2007-08-30 17:43 4670704]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"APVXDWIN"="C:\Archivos de programa\Panda Software\Panda Internet Security 2007\APVXDWIN.exe" [2006-10-11 12:09 364544]
"SCANINICIO"="C:\Archivos de programa\Panda Software\Panda Internet Security 2007\Inicio.exe" [2006-02-01 18:13 22528]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 01:42 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\RunOnce]
"nlpo_01"="cmd.exe" [2004-08-19 01:42 402944 C:\WINDOWS\system32\cmd.exe]
"nlpo_02"="advpack.dll" [2004-08-19 01:41 101376 C:\WINDOWS\system32\advpack.dll]
"nlpo_03"="advpack.dll" [2004-08-19 01:41 101376 C:\WINDOWS\system32\advpack.dll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr]
avldr.dll 2005-09-27 12:13 45056 C:\WINDOWS\system32\avldr.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\contro l\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menú Inicio^Programas^Inicio^BlueSoleil.lnk]
path=C:\Documents and Settings\All Users\Menú Inicio\Programas\Inicio\BlueSoleil.lnk
backup=C:\WINDOWS\pss\BlueSoleil.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\amva]
C:\WINDOWS\system32\amvo.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2007-03-12 13:49 153136 C:\Archivos de programa\Archivos comunes\Ahead\Lib\NMBgMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
--a------ 2006-10-27 00:47 31016 C:\Archivos de programa\Microsoft Office\Office12\GrooveMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2004-01-07 13:02 49152 C:\Archivos de programa\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\JavaCore]
C:\Archivos de programa\JavaCore\JavaCore.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MapEDC]
C:\Archivos de programa\MapEDC\MapEDC.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2007-03-09 18:53 153136 C:\Archivos de programa\Archivos comunes\Ahead\Lib\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NoDNS]
C:\Archivos de programa\\NoDNS\\NoDNS.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
--a------ 2006-01-11 15:08 577536 C:\WINDOWS\soundman.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StatusClient 2.6]
--a------ 2004-02-27 11:29 61440 C:\Archivos de programa\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-09-25 01:11 132496 C:\Archivos de programa\Java\jre1.6.0_03\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
--a------ 2007-11-29 18:19 68856 C:\Archivos de programa\Google\GoogleToolbarNotifier\GoogleToolba rNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomcatStartup 2.5]
--a------ 2004-05-20 10:40 188416 C:\Archivos de programa\Hewlett-Packard\Toolbox\hpbpsttp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Zero Setup]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
--a------ 2007-08-30 17:43 4670704 C:\Archivos de programa\Yahoo!\Messenger\YahooMessenger.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\PandaAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\PandaFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Archivos de programa\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Archivos de programa\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Archivos de programa\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\Archivos de programa\\Messenger\\msmsgs.exe"=
"C:\\Archivos de programa\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Archivos de programa\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Archivos de programa\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"C:\\Archivos de programa\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Archivos de programa\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Archivos de programa\\Ares\\Ares.exe"=
"C:\\WINDOWS\\system32\\spoolsv.exe"=
R0 netflt;Panda Net Driver [NDIS Layer];C:\WINDOWS\system32\Drivers\NETFLT.SYS [2006-10-10 16:02]
R1 APPFLT;App Filter Plugin;C:\WINDOWS\system32\Drivers\APPFLT.SYS [2006-08-03 16:37]
R1 BIOS;BIOS;C:\WINDOWS\system32\drivers\BIOS.sys [2005-03-16 00:23]
R1 DSAFLT;DSA Filter Plugin;C:\WINDOWS\system32\Drivers\DSAFLT.SYS [2006-08-02 14:08]
R1 FNETMON;NetMon Filter Plugin;C:\WINDOWS\system32\Drivers\fnetmon.SYS [2006-06-29 22:50]
R1 IDSFLT;Ids Filter Plugin;C:\WINDOWS\system32\Drivers\IDSFLT.SYS [2006-08-02 14:10]
R1 NETFLTDI;Panda Net Driver [TDI Layer];C:\WINDOWS\system32\Drivers\NETFLTDI.SYS [2006-05-11 22:26]
R1 ShldDrv;Panda File Shield Driver;C:\WINDOWS\system32\drivers\ShldDrv.sys [2005-08-29 07:23]
R1 SMSFLT;SMS Filter Plugin;C:\WINDOWS\system32\Drivers\SMSFLT.SYS [2006-08-02 14:15]
R1 WNMFLT;Wifi Monitor Filter Plugin;C:\WINDOWS\system32\Drivers\WNMFLT.SYS [2006-09-28 15:58]
R2 cpoint;Panda CPoint Driver;C:\WINDOWS\system32\Drivers\cpoint.sys [2005-08-12 14:36]
R2 PavProc;Panda Process Protection Driver;C:\WINDOWS\system32\DRIVERS\PavProc.sys [2006-04-25 10:02]
R3 ComFiltr;Panda Anti-Dialer;C:\WINDOWS\system32\DRIVERS\COMFiltr.sys []
S3 se59bus;Sony Ericsson Device 089 driver (WDM);C:\WINDOWS\system32\DRIVERS\se59bus.sys [2006-09-05 12:07]
[HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{0286d6ae-d809-11dc-9af8-0016ec8e0572}]
\shell\Auto\command - MSOCache\doWTP_RESTORE_0.exe -autorun
\shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL MSOCache\doWTP_RESTORE_0.exe -autorun
[HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{04b10d37-e63f-11dc-9b18-0016ec8e0572}]
\Shell\AutoRun\command - F:\ntde1ect.com
\Shell\explore\Command - F:\ntde1ect.com
\Shell\open\Command - F:\ntde1ect.com
[HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{265b617a-c8c6-11dc-9adb-0016ec8e0572}]
\Shell\AutoRun\command - ntde1ect.com
\Shell\explore\Command - ntde1ect.com
\Shell\open\Command - ntde1ect.com
[HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{33c80c28-c98c-11dc-9adc-0016ec8e0572}]
\Shell\AutoRun\command - F:\xn1i9x.com
\Shell\explore\Command - F:\xn1i9x.com
\Shell\open\Command - F:\xn1i9x.com
[HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{33c80c2b-c98c-11dc-9adc-0016ec8e0572}]
\Shell\auto\command - Knight.exe open
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Knight.exe open
\Shell\explore\command - Knight.exe open
\Shell\find\command - Knight.exe open
\Shell\install\command - Knight.exe open
\Shell\open\command - Knight.exe open
[HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{3d5ce84e-a1ec-11dc-a86e-0016ec8e0572}]
\Shell\AutoRun\command - ntde1ect.com
\Shell\explore\Command - ntde1ect.com
\Shell\open\Command - ntde1ect.com
[HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{3f5a55fa-9c69-11dc-a85e-0016ec8e0572}]
\Shell\AutoRun\command - F:\x6.bat
\Shell\explore\Command - F:\x6.bat
\Shell\open\Command - F:\x6.bat
[HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{580985e4-e895-11dc-9b27-0016ec8e0572}]
\Shell\AutoRun\command - F:\ntde1ect.com
\Shell\explore\Command - F:\ntde1ect.com
\Shell\open\Command - F:\ntde1ect.com
[HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{59e8b61c-bc55-11dc-9ac5-0016ec8e0572}]
\Shell\AutoRun\command - F:\u.bat
\Shell\explore\Command - F:\u.bat
\Shell\open\Command - F:\u.bat
[HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{6caedd23-e30e-11dc-9b0f-0016ec8e0572}]
\Shell\AutoRun\command - F:\oufddh.exe
\Shell\explore\Command - F:\oufddh.exe
\Shell\open\Command - F:\oufddh.exe
[HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{6caedd24-e30e-11dc-9b0f-0016ec8e0572}]
\Shell\AutoRun\command - G:\oufddh.exe
\Shell\explore\Command - G:\oufddh.exe
\Shell\open\Command - G:\oufddh.exe
[HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{72b8e728-d7ff-11dc-9af7-0016ec8e0572}]
\Shell\AutoRun\command - tio8x6.cmd
\Shell\explore\Command - tio8x6.cmd
\Shell\open\Command - tio8x6.cmd
[HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{9369dc4c-c734-11dc-9ad8-0016ec8e0572}]
\Shell\AutoRun\command - F:\3wcxx91.cmd
\Shell\explore\Command - F:\3wcxx91.cmd
\Shell\open\Command - F:\3wcxx91.cmd
[HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{b85170b2-dfe3-11dc-9b07-0016ec8e0572}]
\Shell\AutoRun\command - tio8x6.cmd
\Shell\explore\Command - tio8x6.cmd
\Shell\open\Command - tio8x6.cmd
[HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{cfa27dc1-dc1c-11dc-9aff-0016ec8e0572}]
\Shell\AutoRun\command - F:\d6fagcs8.cmd
\Shell\explore\Command - F:\d6fagcs8.cmd
\Shell\open\Command - F:\d6fagcs8.cmd
[HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{d87171bc-c688-11dc-9ad7-0016ec8e0572}]
\Shell\Auto\command - fasfeaepm.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL fasfeaepm.exe
[HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{d87171be-c688-11dc-9ad7-0016ec8e0572}]
\Shell\AutoRun\command - ntde1ect.com
\Shell\explore\Command - ntde1ect.com
\Shell\open\Command - ntde1ect.com
[HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{e890341d-e7bb-11dc-9b1e-0016ec8e0572}]
\Shell\AutoRun\command - G:\ntde1ect.com
\Shell\explore\Command - G:\ntde1ect.com
\Shell\open\Command - G:\ntde1ect.com
.
************************************************** ************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-08 18:11:45
Windows 5.1.2600 Service Pack 2 NTFS
escaneando procesos ocultos ...
escaneando entradas ocultas de autostart ...
escaneando archivos ocultos ...
el escaneo se completo con exito
archivos ocultos: 0
************************************************** ************************
.
------------------------ Other Running Processes ------------------------
.
C:\Archivos de programa\Panda Software\Panda Internet Security 2007\pavsrv51.exe
C:\Archivos de programa\Panda Software\Panda Internet Security 2007\AVENGINE.EXE
c:\archivos de programa\panda software\panda internet security 2007\firewall\PNMSRV.EXE
C:\Archivos de programa\Panda Software\Panda Internet Security 2007\PavFnSvr.exe
C:\Archivos de programa\Archivos comunes\Panda Software\PavShld\pavprsrv.exe
C:\Archivos de programa\Panda Software\Panda Internet Security 2007\AntiSpam\pskmssvc.exe
C:\Archivos de programa\Panda Software\Panda Internet Security 2007\PsImSvc.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Archivos de programa\Panda Software\Panda Internet Security 2007\SRVLOAD.EXE
c:\archivos de programa\panda software\panda internet security 2007\WebProxy.exe
C:\ARCHIV~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
.
************************************************** ************************
.
Tiempo completado: 2008-03-08 18:20:32 - machine was rebooted
ComboFix-quarantined-files.txt 2008-03-09 00:20:26
.
2008-02-14 03:32:36 --- E O F --- |