 |
| |||||||
| Foro Oficial de HijackThis en español Analizamos tu log de HijackThis para eliminar Hijackers, Spyware, Adware, ToolBars, Virus, Troyanos y Malwares en gral. Antes lea las Políticas del Foro de HijackThis. |
 |
| | Herramientas |
 | 
05/03/08, 21:20:10
|  |
| |||
| estoy siendo atacado por, virus, help Hola, chicos de este foro soy nuevo en el mismo, por que me lo han recomendado que es muy bueno y debo de decir que así es, pues miren creo que mi oc, esat siendo atacada por todo lo maligno de la red es por eso que les voya dejar mi log, espero que si mi pc, tiene algo me lo ayuden a repararlo y bueno me eh dado cuenta que handa mal, por que aveces cierra completamente toda la barra de mi pc, y aveces abre anuncios publicitarios sin que se lo ordene..gracis por la ayuda. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 08:19:49 p.m., on 05/03/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Archivos de programa\Panda Software\Panda Internet Security 2007\pavsrv51.exe C:\Archivos de programa\Panda Software\Panda Internet Security 2007\AVENGINE.EXE C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE c:\archivos de programa\panda software\panda internet security 2007\firewall\PNMSRV.EXE C:\WINDOWS\system32\spoolsv.exe C:\Archivos de programa\Panda Software\Panda Internet Security 2007\PavFnSvr.exe C:\Archivos de programa\Archivos comunes\Panda Software\PavShld\pavprsrv.exe C:\Archivos de programa\Panda Software\Panda Internet Security 2007\AntiSpam\pskmssvc.exe C:\Archivos de programa\Panda Software\Panda Internet Security 2007\PsImSvc.exe C:\Archivos de programa\Panda Software\Panda Internet Security 2007\APVXDWIN.EXE C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\ieupdate.exe C:\WINDOWS\system32\ctfmon.exe C:\Archivos de programa\Windows Live\Messenger\MsnMsgr.Exe C:\Archivos de programa\Messenger\msmsgs.exe C:\Archivos de programa\nvcoi\nvcoi.exe C:\Archivos de programa\Panda Software\Panda Internet Security 2007\SRVLOAD.EXE c:\archivos de programa\panda software\panda internet security 2007\WebProxy.exe C:\ARCHIV~1\Yahoo!\MESSEN~1\ymsgr_tray.exe C:\Archivos de programa\Windows Live\Messenger\usnsvc.exe C:\Archivos de programa\Internet Explorer\iexplore.exe C:\Archivos de programa\Archivos comunes\Ahead\Lib\NMIndexingService.exe C:\Archivos de programa\Archivos comunes\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Archivos de programa\Internet Explorer\iexplore.exe C:\Archivos de programa\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://es.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://es.search.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://es.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://es.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://es.search.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://es.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://es.search.yahoo.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://es.yahoo.com R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://es.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://es.search.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\ARCHIV~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: (no name) - {6A11553E-7737-4DA8-8FFD-B6842B415702} - C:\WINDOWS\system32\khffghh.dll O2 - BHO: {c3caead6-f836-b89a-29a4-7cdb705426c6} - {6c624507-bdc7-4a92-a98b-638f6daeac3c} - C:\WINDOWS\system32\qgnbxera.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\ARCHIV~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Archivos de programa\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Aplicación auxiliar de inicio de sesión - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\archivos de programa\google\googletoolbar3.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Archivos de programa\Google\GoogleToolbarNotifier\2.0.301.7164 \swg.dll O2 - BHO: (no name) - {E3439C08-1E37-445B-B556-CF985B186C15} - C:\WINDOWS\system32\awvvv.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\ARCHIV~1\MEGAUP~1\MEGAUP~1.DLL O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\archivos de programa\google\googletoolbar3.dll O4 - HKLM\..\Run: [APVXDWIN] "C:\Archivos de programa\Panda Software\Panda Internet Security 2007\APVXDWIN.EXE" /s O4 - HKLM\..\Run: [SCANINICIO] "C:\Archivos de programa\Panda Software\Panda Internet Security 2007\Inicio.exe" O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [a8b7583e] rundll32.exe "C:\WINDOWS\system32\swbwsumr.dll",b O4 - HKLM\..\Run: [Microsoft Internet Explorer Update] ieupdate.exe O4 - HKLM\..\RunOnce: [Panda_cleaner_2904193] C:\Archivos de programa\Panda Software\Panda Internet Security 2007\pavdr.exe 2904193 O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Archivos de programa\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [MSMSGS] "C:\Archivos de programa\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [amva] C:\WINDOWS\system32\amvo.exe O4 - HKCU\..\Run: [avpa] C:\WINDOWS\system32\avpo.exe O4 - HKCU\..\Run: [nvcoi] C:\Archivos de programa\nvcoi\nvcoi.exe O4 - HKCU\..\Run: [Yahoo! Pager] "C:\ARCHIV~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICIO LOCAL') O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_01] cmd.exe /c md "%USERPROFILE%\Configuración local\Temp" (User 'SERVICIO LOCAL') O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_03] rundll32 advpack.dll,LaunchINFSection nlite.inf,S (User 'SERVICIO LOCAL') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Servicio de red') O4 - HKUS\S-1-5-20\..\RunOnce: [nlpo_01] cmd.exe /c md "%USERPROFILE%\Configuración local\Temp" (User 'Servicio de red') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [nlpo_01] cmd.exe /c md "%USERPROFILE%\Configuración local\Temp" (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [nlpo_01] cmd.exe /c md "%USERPROFILE%\Configuración local\Temp" (User 'Default user') O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Enviar a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARCHIV~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: &Enviar a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARCHIV~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARCHIV~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Archivos de programa\Yahoo!\Common\yinsthelper.dll O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\ARCHIV~1\MICROS~2\Office12\GR99D3~1.DLL O20 - Winlogon Notify: khffghh - C:\WINDOWS\SYSTEM32\khffghh.dll O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Archivos de programa\Ares\chatServer.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Archivos de programa\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: NBService - Nero AG - C:\Archivos de programa\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Archivos de programa\Archivos comunes\Ahead\Lib\NMIndexingService.exe O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - C:\Archivos de programa\Panda Software\Panda Internet Security 2007\PavFnSvr.exe O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Archivos de programa\Archivos comunes\Panda Software\PavShld\pavprsrv.exe O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Archivos de programa\Panda Software\Panda Internet Security 2007\pavsrv51.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Panda Antispam Engine (pmshellsrv) - Panda Software International - C:\Archivos de programa\Panda Software\Panda Internet Security 2007\AntiSpam\pskmssvc.exe O23 - Service: Panda Network Manager (PNMSRV) - Panda Software International - c:\archivos de programa\panda software\panda internet security 2007\firewall\PNMSRV.EXE O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software - C:\Archivos de programa\Panda Software\Panda Internet Security 2007\PsImSvc.exe -- End of file - 9616 bytes       |
|
06/03/08, 21:12:36
| |
| ||||
 Re: estoy siendo atacado por, virus, help Hola omegas tienes varias infecciones en el PC. Por favor realiza los siguientes pasos en modo normal: Paso 1 Descargue, instale y/o actualice los siguientes programas (pero no los ejecute aun).
Paso 2
O2 - BHO: (no name) - {6A11553E-7737-4DA8-8FFD-B6842B415702} - C:\WINDOWS\system32\khffghh.dll O2 - BHO: {c3caead6-f836-b89a-29a4-7cdb705426c6} - {6c624507-bdc7-4a92-a98b-638f6daeac3c} - C:\WINDOWS\system32\qgnbxera.dll O2 - BHO: (no name) - {E3439C08-1E37-445B-B556-CF985B186C15} - C:\WINDOWS\system32\awvvv.dll O4 - HKLM\..\Run: [a8b7583e] rundll32.exe "C:\WINDOWS\system32\swbwsumr.dll",b O4 - HKLM\..\Run: [Microsoft Internet Explorer Update] ieupdate.exe O4 - HKCU\..\Run: [amva] C:\WINDOWS\system32\amvo.exe O4 - HKCU\..\Run: [avpa] C:\WINDOWS\system32\avpo.exe O20 - Winlogon Notify: khffghh - C:\WINDOWS\SYSTEM32\khffghh.dll Paso 3 Ejecuta estos programas (de a uno).
Paso 4
Reinicia y nos dejas los reportes. Novedades del Foro | Antivirus Online | Eliminar Malwares | Políticas del Foro | Blog * Ayúdanos haciendo una DONACIÓN para poder seguir Ayudando. * Para evitar Virus y Spywares al navegar por internet, USE FIREFOX !! * No se resuelven dudas por Privados ni por E-mail, ya que para eso esta el foro. |
a las siguientes entradas: |
08/03/08, 19:31:19
| |
| |||
| Re: estoy siendo atacado por, virus, help nuevamente gracias por la ayuda, y les dejo mi report ComboFix 08-03-06.2 - omega 2008-03-08 18:04:33.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.34.3082.18.139 [GMT -6:00] Se ejecuta desde: C:\Documents and Settings\omega\Escritorio\ComboFix.exe * Creado un nuevo punto de restauración ADVERTENCIA - ESTE EQUIPO NO TIENE INSTALADA LA CONSOLA DE RECUPERACION! . (((((((((((((((((((((((((((((((((((( Otras eliminaciones ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\BMab846ba2.xml C:\WINDOWS\cookies.ini C:\WINDOWS\pskt.ini C:\WINDOWS\system32\amvo.exe C:\WINDOWS\system32\amvo0.dll C:\WINDOWS\system32\awvvv.dll C:\WINDOWS\system32\aydthwyp.dll C:\WINDOWS\system32\fkuyebcj.dll C:\WINDOWS\system32\khffghh.dll C:\WINDOWS\system32\pchycufo.dll C:\WINDOWS\system32\pqtufqmx.ini C:\WINDOWS\system32\qgnbxera.dll C:\WINDOWS\system32\rbeyhsgo.ini C:\WINDOWS\system32\vdtnbgui.dll C:\WINDOWS\system32\wbgjhcbo.dll C:\WINDOWS\system32\wmjpmosr.ini . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\LEGACY_MHB28 (((((((((((((((((( Archivos creados desde 2008-02-09 - 2008-03-09 ))))))))))))))))))))))))))))))))) . 2008-03-07 19:10 . 2008-03-07 19:10 289,280 --a------ C:\WINDOWS\system32\C419.tmp 2008-03-07 16:37 . 2008-03-07 16:37 <DIR> d-------- C:\Documents and Settings\omega\Datos de programa\Malwarebytes 2008-03-07 16:37 . 2008-03-07 16:37 <DIR> d-------- C:\Documents and Settings\All Users\Datos de programa\Malwarebytes 2008-03-07 16:36 . 2008-03-07 16:37 <DIR> d-------- C:\Archivos de programa\Malwarebytes' Anti-Malware 2008-03-07 16:13 . 2008-03-07 16:13 <DIR> d-------- C:\Archivos de programa\CCleaner 2008-03-07 12:46 . 2008-03-07 12:46 289,280 --a------ C:\WINDOWS\system32\30D7.tmp 2008-03-06 18:19 . 2008-03-06 18:19 289,280 --a------ C:\WINDOWS\system32\9D0.tmp 2008-03-06 14:41 . 2008-03-06 14:41 29 --a------ C:\WINDOWS\system32\twqfgsai.tmp 2008-03-06 14:40 . 2008-03-06 14:40 167,936 --a------ C:\WINDOWS\system32\drivers\Mhb28.sys 2008-03-05 12:52 . 2008-03-05 12:52 <DIR> d-------- C:\Archivos de programa\Trend Micro 2008-03-04 20:21 . 2008-03-05 02:35 76,288 -r-hs---- C:\WINDOWS\system32\ieupdate.exe 2008-03-03 13:24 . 2008-03-03 13:42 <DIR> d-------- C:\WINDOWS\system32\ActiveScan 2008-03-03 13:24 . 2008-03-03 13:30 30,590 --a------ C:\WINDOWS\system32\pavas.ico 2008-03-03 13:24 . 2008-03-03 13:30 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico 2008-03-03 13:24 . 2008-03-03 13:30 1,406 --a------ C:\WINDOWS\system32\Help.ico 2008-03-03 12:37 . 2008-03-04 14:02 1,304,758 ---hs---- C:\WINDOWS\system32\ncycnyen.ini 2008-02-28 18:29 . 2007-11-27 22:27 96,715 -r-hs---- C:\WINDOWS\system32\avpo.exe 2008-02-24 11:00 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll 2008-02-24 11:00 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll 2008-02-24 11:00 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui 2008-02-23 16:17 . 2008-02-23 16:25 <DIR> d--hsc--- C:\Archivos de programa\Archivos comunes\WindowsLiveInstaller 2008-02-23 16:16 . 2008-02-23 16:16 <DIR> d-------- C:\Documents and Settings\All Users\Datos de programa\WLInstaller 2008-02-23 16:16 . 2008-02-23 16:26 <DIR> d-------- C:\Archivos de programa\Windows Live 2008-02-22 15:36 . 2008-02-22 15:36 <DIR> d-------- C:\tmp 2008-02-21 17:56 . 2008-02-21 17:56 244 --ah----- C:\sqmnoopt11.sqm 2008-02-21 17:56 . 2008-02-21 17:56 232 --ah----- C:\sqmdata11.sqm 2008-02-21 11:18 . 2008-02-21 11:18 268 --ah----- C:\sqmdata10.sqm 2008-02-21 11:18 . 2008-02-21 11:18 244 --ah----- C:\sqmnoopt10.sqm 2008-02-20 16:43 . 2006-09-25 13:59 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2008-02-20 16:43 . 2006-09-25 13:59 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys 2008-02-20 15:53 . 2008-02-28 15:50 <DIR> d-------- C:\tmpDownload 2008-02-20 15:53 . 2008-02-20 16:59 5 --a------ C:\WINDOWS\youtubex.dll 2008-02-20 15:52 . 2008-02-20 16:08 <DIR> d-------- C:\Archivos de programa\YoutubeGet 2008-02-20 12:41 . 2008-02-20 12:41 268 --ah----- C:\sqmdata09.sqm 2008-02-20 12:41 . 2008-02-20 12:41 244 --ah----- C:\sqmnoopt09.sqm 2008-02-19 20:19 . 2008-02-19 20:19 244 --ah----- C:\sqmnoopt08.sqm 2008-02-19 20:19 . 2008-02-19 20:19 232 --ah----- C:\sqmdata08.sqm 2008-02-19 18:24 . 2008-02-19 18:24 244 --ah----- C:\sqmnoopt07.sqm 2008-02-19 18:24 . 2008-02-19 18:24 232 --ah----- C:\sqmdata07.sqm 2008-02-19 17:36 . 2008-02-19 17:36 244 --ah----- C:\sqmnoopt06.sqm 2008-02-19 17:36 . 2008-02-19 17:36 232 --ah----- C:\sqmdata06.sqm 2008-02-16 17:11 . 2008-02-17 12:59 <DIR> d-------- C:\Archivos de programa\Ares . (((((((((((((((((((((((((((((((((((((( Reporte Find3M )))))))))))))))))))))))))))))))))))))))))))))))))) ) . 2008-03-08 23:59 232,248 ----a-w C:\WINDOWS\system32\drivers\APPFCONT.DAT 2008-03-08 23:59 1,132 ----a-w C:\WINDOWS\system32\drivers\APPFLTR.CFG 2008-03-06 19:10 --------- d-----w C:\Documents and Settings\All Users\Datos de programa\Microsoft Help 2008-02-23 23:59 --------- d-----w C:\Archivos de programa\Freecorder 2008-02-23 22:37 --------- d-----w C:\Archivos de programa\MSN Messenger 2008-02-17 19:46 --------- d-----w C:\Archivos de programa\Replay Media Catcher 2008-02-03 20:20 --------- d-----w C:\Documents and Settings\omega\Datos de programa\Ahead 2008-02-03 20:20 --------- d-----w C:\Documents and Settings\All Users\Datos de programa\Ahead 2008-01-27 07:05 --------- d-----w C:\Documents and Settings\All Users\Datos de programa\Bluetooth 2008-01-27 07:00 --------- d-----w C:\Archivos de programa\IVT Corporation 2008-01-25 10:12 --------- d-----w C:\Documents and Settings\omega\Datos de programa\MegauploadToolbar 2008-01-22 14:07 --------- d-----w C:\Documents and Settings\omega\Datos de programa\GetRightToGo 2008-01-20 09:12 --------- d-----w C:\Archivos de programa\MP3 Player Utilities 3.68 2008-01-18 08:41 --------- d-----w C:\Documents and Settings\All Users\Datos de programa\Yahoo! 2008-01-18 08:40 --------- d-----w C:\Archivos de programa\Yahoo! 2007-11-28 04:27 96,715 --sh--r C:\WINDOWS\system32\avpo.exe . ((((((((((((((((((((((((((((((((( Cargando Puntos Reg )))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Nota* entradas vacías & entradas legítimas predeterminadas no son mostradas [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 01:42 15360] "MsnMsgr"="C:\Archivos de programa\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184] "MSMSGS"="C:\Archivos de programa\Messenger\msmsgs.exe" [2006-09-25 13:59 1694208] "Yahoo! Pager"="C:\ARCHIV~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [2007-08-30 17:43 4670704] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run] "APVXDWIN"="C:\Archivos de programa\Panda Software\Panda Internet Security 2007\APVXDWIN.exe" [2006-10-11 12:09 364544] "SCANINICIO"="C:\Archivos de programa\Panda Software\Panda Internet Security 2007\Inicio.exe" [2006-02-01 18:13 22528] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 01:42 15360] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\RunOnce] "nlpo_01"="cmd.exe" [2004-08-19 01:42 402944 C:\WINDOWS\system32\cmd.exe] "nlpo_02"="advpack.dll" [2004-08-19 01:41 101376 C:\WINDOWS\system32\advpack.dll] "nlpo_03"="advpack.dll" [2004-08-19 01:41 101376 C:\WINDOWS\system32\advpack.dll] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr] avldr.dll 2005-09-27 12:13 45056 C:\WINDOWS\system32\avldr.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\contro l\securityproviders] SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menú Inicio^Programas^Inicio^BlueSoleil.lnk] path=C:\Documents and Settings\All Users\Menú Inicio\Programas\Inicio\BlueSoleil.lnk backup=C:\WINDOWS\pss\BlueSoleil.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\amva] C:\WINDOWS\system32\amvo.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] --a------ 2007-03-12 13:49 153136 C:\Archivos de programa\Archivos comunes\Ahead\Lib\NMBgMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor] --a------ 2006-10-27 00:47 31016 C:\Archivos de programa\Microsoft Office\Office12\GrooveMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] --a------ 2004-01-07 13:02 49152 C:\Archivos de programa\Hewlett-Packard\HP Software Update\HPWuSchd2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\JavaCore] C:\Archivos de programa\JavaCore\JavaCore.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MapEDC] C:\Archivos de programa\MapEDC\MapEDC.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2007-03-09 18:53 153136 C:\Archivos de programa\Archivos comunes\Ahead\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NoDNS] C:\Archivos de programa\\NoDNS\\NoDNS.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan] --a------ 2006-01-11 15:08 577536 C:\WINDOWS\soundman.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StatusClient 2.6] --a------ 2004-02-27 11:29 61440 C:\Archivos de programa\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2007-09-25 01:11 132496 C:\Archivos de programa\Java\jre1.6.0_03\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] --a------ 2007-11-29 18:19 68856 C:\Archivos de programa\Google\GoogleToolbarNotifier\GoogleToolba rNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomcatStartup 2.5] --a------ 2004-05-20 10:40 188416 C:\Archivos de programa\Hewlett-Packard\Toolbox\hpbpsttp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Zero Setup] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager] --a------ 2007-08-30 17:43 4670704 C:\Archivos de programa\Yahoo!\Messenger\YahooMessenger.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\PandaAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\PandaFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Archivos de programa\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "C:\\Archivos de programa\\Microsoft Office\\Office12\\GROOVE.EXE"= "C:\\Archivos de programa\\Microsoft Office\\Office12\\ONENOTE.EXE"= "C:\\Archivos de programa\\Messenger\\msmsgs.exe"= "C:\\Archivos de programa\\Yahoo!\\Messenger\\YahooMessenger.exe"= "C:\\Archivos de programa\\Yahoo!\\Messenger\\YServer.exe"= "C:\\Archivos de programa\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"= "C:\\Archivos de programa\\Windows Live\\Messenger\\msnmsgr.exe"= "C:\\Archivos de programa\\Windows Live\\Messenger\\livecall.exe"= "C:\\Archivos de programa\\Ares\\Ares.exe"= "C:\\WINDOWS\\system32\\spoolsv.exe"= R0 netflt;Panda Net Driver [NDIS Layer];C:\WINDOWS\system32\Drivers\NETFLT.SYS [2006-10-10 16:02] R1 APPFLT;App Filter Plugin;C:\WINDOWS\system32\Drivers\APPFLT.SYS [2006-08-03 16:37] R1 BIOS;BIOS;C:\WINDOWS\system32\drivers\BIOS.sys [2005-03-16 00:23] R1 DSAFLT;DSA Filter Plugin;C:\WINDOWS\system32\Drivers\DSAFLT.SYS [2006-08-02 14:08] R1 FNETMON;NetMon Filter Plugin;C:\WINDOWS\system32\Drivers\fnetmon.SYS [2006-06-29 22:50] R1 IDSFLT;Ids Filter Plugin;C:\WINDOWS\system32\Drivers\IDSFLT.SYS [2006-08-02 14:10] R1 NETFLTDI;Panda Net Driver [TDI Layer];C:\WINDOWS\system32\Drivers\NETFLTDI.SYS [2006-05-11 22:26] R1 ShldDrv;Panda File Shield Driver;C:\WINDOWS\system32\drivers\ShldDrv.sys [2005-08-29 07:23] R1 SMSFLT;SMS Filter Plugin;C:\WINDOWS\system32\Drivers\SMSFLT.SYS [2006-08-02 14:15] R1 WNMFLT;Wifi Monitor Filter Plugin;C:\WINDOWS\system32\Drivers\WNMFLT.SYS [2006-09-28 15:58] R2 cpoint;Panda CPoint Driver;C:\WINDOWS\system32\Drivers\cpoint.sys [2005-08-12 14:36] R2 PavProc;Panda Process Protection Driver;C:\WINDOWS\system32\DRIVERS\PavProc.sys [2006-04-25 10:02] R3 ComFiltr;Panda Anti-Dialer;C:\WINDOWS\system32\DRIVERS\COMFiltr.sys [] S3 se59bus;Sony Ericsson Device 089 driver (WDM);C:\WINDOWS\system32\DRIVERS\se59bus.sys [2006-09-05 12:07] [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{0286d6ae-d809-11dc-9af8-0016ec8e0572}] \shell\Auto\command - MSOCache\doWTP_RESTORE_0.exe -autorun \shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL MSOCache\doWTP_RESTORE_0.exe -autorun [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{04b10d37-e63f-11dc-9b18-0016ec8e0572}] \Shell\AutoRun\command - F:\ntde1ect.com \Shell\explore\Command - F:\ntde1ect.com \Shell\open\Command - F:\ntde1ect.com [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{265b617a-c8c6-11dc-9adb-0016ec8e0572}] \Shell\AutoRun\command - ntde1ect.com \Shell\explore\Command - ntde1ect.com \Shell\open\Command - ntde1ect.com [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{33c80c28-c98c-11dc-9adc-0016ec8e0572}] \Shell\AutoRun\command - F:\xn1i9x.com \Shell\explore\Command - F:\xn1i9x.com \Shell\open\Command - F:\xn1i9x.com [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{33c80c2b-c98c-11dc-9adc-0016ec8e0572}] \Shell\auto\command - Knight.exe open \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Knight.exe open \Shell\explore\command - Knight.exe open \Shell\find\command - Knight.exe open \Shell\install\command - Knight.exe open \Shell\open\command - Knight.exe open [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{3d5ce84e-a1ec-11dc-a86e-0016ec8e0572}] \Shell\AutoRun\command - ntde1ect.com \Shell\explore\Command - ntde1ect.com \Shell\open\Command - ntde1ect.com [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{3f5a55fa-9c69-11dc-a85e-0016ec8e0572}] \Shell\AutoRun\command - F:\x6.bat \Shell\explore\Command - F:\x6.bat \Shell\open\Command - F:\x6.bat [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{580985e4-e895-11dc-9b27-0016ec8e0572}] \Shell\AutoRun\command - F:\ntde1ect.com \Shell\explore\Command - F:\ntde1ect.com \Shell\open\Command - F:\ntde1ect.com [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{59e8b61c-bc55-11dc-9ac5-0016ec8e0572}] \Shell\AutoRun\command - F:\u.bat \Shell\explore\Command - F:\u.bat \Shell\open\Command - F:\u.bat [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{6caedd23-e30e-11dc-9b0f-0016ec8e0572}] \Shell\AutoRun\command - F:\oufddh.exe \Shell\explore\Command - F:\oufddh.exe \Shell\open\Command - F:\oufddh.exe [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{6caedd24-e30e-11dc-9b0f-0016ec8e0572}] \Shell\AutoRun\command - G:\oufddh.exe \Shell\explore\Command - G:\oufddh.exe \Shell\open\Command - G:\oufddh.exe [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{72b8e728-d7ff-11dc-9af7-0016ec8e0572}] \Shell\AutoRun\command - tio8x6.cmd \Shell\explore\Command - tio8x6.cmd \Shell\open\Command - tio8x6.cmd [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{9369dc4c-c734-11dc-9ad8-0016ec8e0572}] \Shell\AutoRun\command - F:\3wcxx91.cmd \Shell\explore\Command - F:\3wcxx91.cmd \Shell\open\Command - F:\3wcxx91.cmd [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{b85170b2-dfe3-11dc-9b07-0016ec8e0572}] \Shell\AutoRun\command - tio8x6.cmd \Shell\explore\Command - tio8x6.cmd \Shell\open\Command - tio8x6.cmd [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{cfa27dc1-dc1c-11dc-9aff-0016ec8e0572}] \Shell\AutoRun\command - F:\d6fagcs8.cmd \Shell\explore\Command - F:\d6fagcs8.cmd \Shell\open\Command - F:\d6fagcs8.cmd [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{d87171bc-c688-11dc-9ad7-0016ec8e0572}] \Shell\Auto\command - fasfeaepm.exe \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL fasfeaepm.exe [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{d87171be-c688-11dc-9ad7-0016ec8e0572}] \Shell\AutoRun\command - ntde1ect.com \Shell\explore\Command - ntde1ect.com \Shell\open\Command - ntde1ect.com [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{e890341d-e7bb-11dc-9b1e-0016ec8e0572}] \Shell\AutoRun\command - G:\ntde1ect.com \Shell\explore\Command - G:\ntde1ect.com \Shell\open\Command - G:\ntde1ect.com . ************************************************** ************************ catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-08 18:11:45 Windows 5.1.2600 Service Pack 2 NTFS escaneando procesos ocultos ... escaneando entradas ocultas de autostart ... escaneando archivos ocultos ... el escaneo se completo con exito archivos ocultos: 0 ************************************************** ************************ . ------------------------ Other Running Processes ------------------------ . C:\Archivos de programa\Panda Software\Panda Internet Security 2007\pavsrv51.exe C:\Archivos de programa\Panda Software\Panda Internet Security 2007\AVENGINE.EXE c:\archivos de programa\panda software\panda internet security 2007\firewall\PNMSRV.EXE C:\Archivos de programa\Panda Software\Panda Internet Security 2007\PavFnSvr.exe C:\Archivos de programa\Archivos comunes\Panda Software\PavShld\pavprsrv.exe C:\Archivos de programa\Panda Software\Panda Internet Security 2007\AntiSpam\pskmssvc.exe C:\Archivos de programa\Panda Software\Panda Internet Security 2007\PsImSvc.exe C:\WINDOWS\system32\wdfmgr.exe C:\Archivos de programa\Panda Software\Panda Internet Security 2007\SRVLOAD.EXE c:\archivos de programa\panda software\panda internet security 2007\WebProxy.exe C:\ARCHIV~1\Yahoo!\MESSEN~1\ymsgr_tray.exe . ************************************************** ************************ . Tiempo completado: 2008-03-08 18:20:32 - machine was rebooted ComboFix-quarantined-files.txt 2008-03-09 00:20:26 . 2008-02-14 03:32:36 --- E O F --- |
|
08/03/08, 20:06:11
| |
| ||||
| Re: estoy siendo atacado por, virus, help Hola omegas el reporte de Combofix muestra que en esa PC se ha usado una memoria USb (Pendrive) que esta infectada. Por favor realiza los siguientes pasos: Paso 1- Apagar el "Restaurar Sistema" y activa ver archivos ocultos. Paso 2- Descargar esta herramienta. (pero no ejecutarla aun) Flash_Disinfector.exe (al final del post) Paso 3- Ejecutar Flash_Disinfector.exe en el PC y luego Colocar el Pendrive en el puerto USB y ejecutarlo nuevamente. Paso 4 1.-Abrir el Notepad (Bloc de Notas)
Código: KillAll::
File::
C:\WINDOWS\system32\C419.tmp
C:\WINDOWS\system32\30D7.tmp
C:\WINDOWS\system32\9D0.tmp
C:\WINDOWS\system32\twqfgsai.tmp
C:\WINDOWS\system32\drivers\Mhb28.sys
C:\WINDOWS\system32\ieupdate.exe
C:\WINDOWS\system32\ncycnyen.ini
C:\WINDOWS\system32\avpo.exe
DirLook::
C:\tmp
C:\tmpDownload
Driver::
Mhb28
Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\amva]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0286d6ae-d809-11dc-9af8-0016ec8e0572}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{04b10d37-e63f-11dc-9b18-0016ec8e0572}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{265b617a-c8c6-11dc-9adb-0016ec8e0572}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{33c80c28-c98c-11dc-9adc-0016ec8e0572}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{33c80c2b-c98c-11dc-9adc-0016ec8e0572}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3d5ce84e-a1ec-11dc-a86e-0016ec8e0572}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3f5a55fa-9c69-11dc-a85e-0016ec8e0572}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{580985e4-e895-11dc-9b27-0016ec8e0572}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{59e8b61c-bc55-11dc-9ac5-0016ec8e0572}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6caedd23-e30e-11dc-9b0f-0016ec8e0572}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6caedd24-e30e-11dc-9b0f-0016ec8e0572}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{72b8e728-d7ff-11dc-9af7-0016ec8e0572}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9369dc4c-c734-11dc-9ad8-0016ec8e0572}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b85170b2-dfe3-11dc-9b07-0016ec8e0572}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cfa27dc1-dc1c-11dc-9aff-0016ec8e0572}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d87171bc-c688-11dc-9ad7-0016ec8e0572}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d87171be-c688-11dc-9ad7-0016ec8e0572}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e890341d-e7bb-11dc-9b1e-0016ec8e0572}]
4.-  Antes de usar el CFScript....
NOTA: -Para mayor comodidad imprime los pasos. -Al terminar los pasos esconde los archivos ocultos y activa restaurar sistema. -Recuerda volver y contarnos los resultados. Novedades del Foro | Antivirus Online | Eliminar Malwares | Políticas del Foro | Blog * Ayúdanos haciendo una DONACIÓN para poder seguir Ayudando. * Para evitar Virus y Spywares al navegar por internet, USE FIREFOX !! * No se resuelven dudas por Privados ni por E-mail, ya que para eso esta el foro. |
|
11/03/08, 12:51:31
| |
| |||
| Re: estoy siendo atacado por, virus, help realize lo que me pediste y estos son los resultados, gracias por layuda. saludos. hv. ComboFix 08-03-10.1 - omega 2008-03-11 11:17:04.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.34.3082.18.191 [GMT -6:00] Se ejecuta desde: C:\Documents and Settings\omega\Escritorio\ComboFix.exe * Creado un nuevo punto de restauración ADVERTENCIA - ESTE EQUIPO NO TIENE INSTALADA LA CONSOLA DE RECUPERACION! . (((((((((((((((((((((((((((((((((((( Otras eliminaciones ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\drivers\Mhb28.sys C:\WINDOWS\youtubex.dll . (((((((((((((((((( Archivos creados desde 2008-02-11 - 2008-03-11 ))))))))))))))))))))))))))))))))) . 2008-03-08 18:53 . 2008-03-08 18:55 <DIR> d-------- C:\WINDOWS\system32\es-es 2008-03-08 18:46 . 2008-03-08 18:56 1,355 --a------ C:\WINDOWS\imsins.BAK 2008-03-08 18:41 . 2007-12-06 20:08 6,066,176 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll 2008-03-08 18:41 . 2007-06-30 21:31 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat 2008-03-08 18:41 . 2007-06-30 21:36 1,040,384 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui 2008-03-08 18:41 . 2007-12-06 20:08 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll 2008-03-08 18:41 . 2007-12-06 20:08 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll 2008-03-08 18:41 . 2007-12-06 20:08 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll 2008-03-08 18:41 . 2007-12-06 20:08 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll 2008-03-08 18:41 . 2007-12-06 20:08 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll 2008-03-08 18:41 . 2007-12-06 05:00 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe 2008-03-08 18:20 . 2008-03-08 18:20 <DIR> d-------- C:\WINDOWS\system32\config\systemprofile\Configura ci¾n local 2008-03-08 18:20 . 2008-03-08 18:20 <DIR> d-------- C:\Documents and Settings\omega\Configuraci¾n local 2008-03-08 18:20 . 2008-03-08 18:20 <DIR> d-------- C:\Documents and Settings\NetworkService\Configuraci¾n local 2008-03-08 18:20 . 2008-03-08 18:20 <DIR> d-------- C:\Documents and Settings\LocalService\Configuraci¾n local 2008-03-07 19:10 . 2008-03-07 19:10 289,280 --a------ C:\WINDOWS\system32\C419.tmp 2008-03-07 16:37 . 2008-03-07 16:37 <DIR> d-------- C:\Documents and Settings\omega\Datos de programa\Malwarebytes 2008-03-07 16:37 . 2008-03-07 16:37 <DIR> d-------- C:\Documents and Settings\All Users\Datos de programa\Malwarebytes 2008-03-07 16:36 . 2008-03-07 16:37 <DIR> d-------- C:\Archivos de programa\Malwarebytes' Anti-Malware 2008-03-07 16:13 . 2008-03-07 16:13 <DIR> d-------- C:\Archivos de programa\CCleaner 2008-03-07 12:46 . 2008-03-07 12:46 289,280 --a------ C:\WINDOWS\system32\30D7.tmp 2008-03-06 18:19 . 2008-03-06 18:19 289,280 --a------ C:\WINDOWS\system32\9D0.tmp 2008-03-06 14:41 . 2008-03-06 14:41 29 --a------ C:\WINDOWS\system32\twqfgsai.tmp 2008-03-05 12:52 . 2008-03-05 12:52 <DIR> d-------- C:\Archivos de programa\Trend Micro 2008-03-04 20:21 . 2008-03-05 02:35 76,288 -r-hs---- C:\WINDOWS\system32\ieupdate.exe 2008-03-03 13:24 . 2008-03-03 13:42 <DIR> d-------- C:\WINDOWS\system32\ActiveScan 2008-03-03 13:24 . 2008-03-03 13:30 30,590 --a------ C:\WINDOWS\system32\pavas.ico 2008-03-03 13:24 . 2008-03-03 13:30 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico 2008-03-03 13:24 . 2008-03-03 13:30 1,406 --a------ C:\WINDOWS\system32\Help.ico 2008-03-03 12:37 . 2008-03-04 14:02 1,304,758 ---hs---- C:\WINDOWS\system32\ncycnyen.ini 2008-02-28 18:29 . 2007-11-27 22:27 96,715 -r-hs---- C:\WINDOWS\system32\avpo.exe 2008-02-24 11:00 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll 2008-02-24 11:00 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll 2008-02-24 11:00 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui 2008-02-23 16:17 . 2008-02-23 16:25 <DIR> d--hsc--- C:\Archivos de programa\Archivos comunes\WindowsLiveInstaller 2008-02-23 16:16 . 2008-02-23 16:16 <DIR> d-------- C:\Documents and Settings\All Users\Datos de programa\WLInstaller 2008-02-23 16:16 . 2008-02-23 16:26 <DIR> d-------- C:\Archivos de programa\Windows Live 2008-02-22 15:36 . 2008-02-22 15:36 <DIR> d-------- C:\tmp 2008-02-21 17:56 . 2008-02-21 17:56 244 --ah----- C:\sqmnoopt11.sqm 2008-02-21 17:56 . 2008-02-21 17:56 232 --ah----- C:\sqmdata11.sqm 2008-02-21 11:18 . 2008-02-21 11:18 268 --ah----- C:\sqmdata10.sqm 2008-02-21 11:18 . 2008-02-21 11:18 244 --ah----- C:\sqmnoopt10.sqm 2008-02-20 16:43 . 2006-09-25 13:59 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2008-02-20 16:43 . 2006-09-25 13:59 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys 2008-02-20 15:53 . 2008-02-28 15:50 <DIR> d-------- C:\tmpDownload 2008-02-20 15:52 . 2008-02-20 16:08 <DIR> d-------- C:\Archivos de programa\YoutubeGet 2008-02-20 12:41 . 2008-02-20 12:41 268 --ah----- C:\sqmdata09.sqm 2008-02-20 12:41 . 2008-02-20 12:41 244 --ah----- C:\sqmnoopt09.sqm 2008-02-19 20:19 . 2008-02-19 20:19 244 --ah----- C:\sqmnoopt08.sqm 2008-02-19 20:19 . 2008-02-19 20:19 232 --ah----- C:\sqmdata08.sqm 2008-02-19 18:24 . 2008-02-19 18:24 244 --ah----- C:\sqmnoopt07.sqm 2008-02-19 18:24 . 2008-02-19 18:24 232 --ah----- C:\sqmdata07.sqm 2008-02-19 17:36 . 2008-02-19 17:36 244 --ah----- C:\sqmnoopt06.sqm 2008-02-19 17:36 . 2008-02-19 17:36 232 --ah----- C:\sqmdata06.sqm 2008-02-16 17:11 . 2008-02-17 12:59 <DIR> d-------- C:\Archivos de programa\Ares . (((((((((((((((((((((((((((((((((((((( Reporte Find3M )))))))))))))))))))))))))))))))))))))))))))))))))) ) . 2008-03-11 16:39 232,248 ----a-w C:\WINDOWS\system32\drivers\APPFCONT.DAT 2008-03-11 16:39 1,132 ----a-w C:\WINDOWS\system32\drivers\APPFLTR.CFG 2008-03-06 19:10 --------- d-----w C:\Documents and Settings\All Users\Datos de programa\Microsoft Help 2008-02-23 23:59 --------- d-----w C:\Archivos de programa\Freecorder 2008-02-23 22:37 --------- d-----w C:\Archivos de programa\MSN Messenger 2008-02-17 19:46 --------- d-----w C:\Archivos de programa\Replay Media Catcher 2008-02-03 20:20 --------- d-----w C:\Documents and Settings\omega\Datos de programa\Ahead 2008-02-03 20:20 --------- d-----w C:\Documents and Settings\All Users\Datos de programa\Ahead 2008-01-27 07:05 --------- d-----w C:\Documents and Settings\All Users\Datos de programa\Bluetooth 2008-01-27 07:00 --------- d-----w C:\Archivos de programa\IVT Corporation 2008-01-25 10:12 --------- d-----w C:\Documents and Settings\omega\Datos de programa\MegauploadToolbar 2008-01-22 14:07 --------- d-----w C:\Documents and Settings\omega\Datos de programa\GetRightToGo 2008-01-20 09:12 --------- d-----w C:\Archivos de programa\MP3 Player Utilities 3.68 2008-01-18 08:41 --------- d-----w C:\Documents and Settings\All Users\Datos de programa\Yahoo! 2008-01-18 08:40 --------- d-----w C:\Archivos de programa\Yahoo! 2007-11-28 04:27 96,715 --sh--r C:\WINDOWS\system32\avpo.exe . ((((((((((((((((((((((((((((( snapshot@2008-03-08_18.20.01.45 ))))))))))))))))))))))))))))))))))))))))) . + 2004-08-19 07:41:42 61,440 -c----w C:\WINDOWS\ie7\admparse.dll + 2004-08-19 07:41:42 101,376 -c----w C:\WINDOWS\ie7\advpack.dll + 2004-08-19 07:41:56 35,328 -c----w C:\WINDOWS\ie7\corpol.dll + 2006-06-02 19:32:20 33,792 -c----w C:\WINDOWS\ie7\custsat.dll + 2007-12-07 00:47:09 357,888 -c----w C:\WINDOWS\ie7\dxtmsft.dll + 2007-12-07 00:47:09 205,824 -c----w C:\WINDOWS\ie7\dxtrans.dll + 2007-12-07 00:47:09 55,808 -c----w C:\WINDOWS\ie7\extmgr.dll + 2004-08-19 07:42:10 38,912 -c----w C:\WINDOWS\ie7\hmmapi.dll + 2004-08-19 07:42:50 34,304 -c----w C:\WINDOWS\ie7\ie4uinit.exe + 2004-08-19 07:42:10 139,264 -c----w C:\WINDOWS\ie7\ieakeng.dll + 2004-08-19 07:42:10 221,184 -c----w C:\WINDOWS\ie7\ieaksie.dll + 2002-09-24 06:00:00 241,664 -c----w C:\WINDOWS\ie7\ieakui.dll + 2004-08-19 07:42:10 323,584 -c----w C:\WINDOWS\ie7\iedkcs32.dll + 2007-12-06 10:05:52 18,432 -c----w C:\WINDOWS\ie7\iedw.exe + 2004-08-19 07:42:10 81,920 -c----w C:\WINDOWS\ie7\ieencode.dll + 2007-12-07 00:47:09 251,904 -c----w C:\WINDOWS\ie7\iepeers.dll + 2004-08-19 07:42:10 49,152 -c----w C:\WINDOWS\ie7\iernonce.dll + 2004-08-19 07:42:10 63,488 -c----w C:\WINDOWS\ie7\iesetup.dll + 2004-08-19 07:42:50 93,184 -c----w C:\WINDOWS\ie7\iexplore.exe + 2004-08-19 07:42:10 35,840 -c----w C:\WINDOWS\ie7\imgutil.dll + 2007-12-07 00:47:09 96,768 -c----w C:\WINDOWS\ie7\inseng.dll + 2007-11-14 07:19:13 450,560 -c----w C:\WINDOWS\ie7\jscript.dll + 2007-12-07 00:47:09 16,384 -c----w C:\WINDOWS\ie7\jsproxy.dll + 2004-08-19 07:42:14 22,528 -c----w C:\WINDOWS\ie7\licmgr10.dll + 2004-08-19 07:42:58 29,184 -c----w C:\WINDOWS\ie7\mshta.exe + 2007-12-07 00:47:10 3,087,360 -c----w C:\WINDOWS\ie7\mshtml.dll + 2007-12-07 00:47:10 449,024 -c----w C:\WINDOWS\ie7\mshtmled.dll + 2004-08-19 07:39:30 57,344 -c----w C:\WINDOWS\ie7\mshtmler.dll + 2002-09-24 06:00:00 146,432 -c----w C:\WINDOWS\ie7\msls31.dll + 2007-12-07 00:47:10 146,432 -c----w C:\WINDOWS\ie7\msrating.dll + 2007-12-07 00:47:10 532,480 -c----w C:\WINDOWS\ie7\mstime.dll + 2004-08-19 07:42:22 97,280 -c----w C:\WINDOWS\ie7\occache.dll + 2007-12-07 00:47:10 39,424 -c----w C:\WINDOWS\ie7\pngfilt.dll + 2007-09-27 00:25:10 33,472 -c----w C:\WINDOWS\ie7\spuninst\iecustom.dll + 2007-09-27 00:18:52 66,048 -c--a-w C:\WINDOWS\ie7\spuninst\ieResetIcons.exe + 2006-09-06 23:43:22 215,776 -c----w C:\WINDOWS\ie7\spuninst\spuninst.exe + 2006-09-06 23:43:24 389,856 -c----w C:\WINDOWS\ie7\spuninst\updspapi.dll + 2004-08-19 07:42:28 37,888 -c----w C:\WINDOWS\ie7\url.dll + 2007-12-07 00:47:11 619,008 -c----w C:\WINDOWS\ie7\urlmon.dll + 2004-08-19 07:42:28 417,792 -c----w C:\WINDOWS\ie7\vbscript.dll + 2007-06-26 13:56:57 851,968 -c----w C:\WINDOWS\ie7\vgx.dll + 2004-08-19 07:42:30 280,576 -c----w C:\WINDOWS\ie7\webcheck.dll + 2007-12-07 00:47:12 668,672 -c----w C:\WINDOWS\ie7\wininet.dll + 2007-03-06 01:27:50 215,776 -c----w C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe + 2007-03-06 01:29:00 389,856 -c----w C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\updspapi.dll + 2007-08-14 00:54:10 765,952 -c----w C:\WINDOWS\ie7updates\KB938127-IE7\vgx.dll + 2007-08-14 00:39:00 123,904 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\advpack.dll + 2007-08-14 00:35:38 214,528 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\dxtrans.dll + 2007-08-14 00:54:10 131,584 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\extmgr.dll + 2007-08-14 00:36:26 61,952 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\icardie.dll + 2007-08-14 00:39:06 54,784 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\ie4uinit.exe + 2007-08-14 00:39:26 152,064 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\ieakeng.dll + 2007-08-14 00:39:54 229,376 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\ieaksie.dll + 2007-08-13 23:56:54 161,792 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\ieakui.dll + 2007-02-12 22  12 2,451,312 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\ieapfltr.dat+ 2007-07-11 18:27:48 383,488 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\ieapfltr.dll + 2007-08-14 00:39:50 382,976 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\iedkcs32.dll + 2007-08-14 00:54:10 6,049,280 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\ieframe.dll + 2007-08-14 00:39:10 43,008 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\iernonce.dll + 2007-08-14 00:34:04 266,752 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\iertutil.dll + 2007-08-14 00:39:10 13,312 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\ieudinit.exe + 2007-08-14 00:43:56 622,080 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\iexplore.exe + 2007-08-14 00:54:10 27,136 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\jsproxy.dll + 2007-08-14 00:54:10 458,752 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\msfeeds.dll + 2007-08-14 00:54:10 50,688 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\msfeedsbs.dll + 2007-08-14 00:54:12 3,578,368 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\mshtml.dll + 2007-08-14 00:54:10 475,648 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\mshtmled.dll + 2007-08-14 00:44:26 192,000 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\msrating.dll + 2007-08-14 00:54:10 670,720 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\mstime.dll + 2007-08-14 00:44:06 101,376 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\occache.dll + 2007-03-06 01:27:50 215,776 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\spuninst\spuninst.exe + 2007-06-30 20:23:42 389,856 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\spuninst\updspapi.dll + 2007-08-14 00:44:30 105,984 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\url.dll + 2007-08-14 00:54:10 1,162,240 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\urlmon.dll + 2007-08-14 00:54:10 231,424 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\webcheck.dll + 2007-08-14 00:54:10 818,688 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\wininet.dll + 2007-10-10 23:50:10 124,928 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\advpack.dll + 2007-10-10 23:50:10 124,928 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\advpack.dll.000 + 2007-08-14 00:35:46 346,624 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\dxtmsft.dll + 2007-10-10 23:50:10 214,528 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\dxtrans.dll + 2007-10-10 23:50:10 214,528 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\dxtrans.dll.000 + 2007-10-10 23:50:10 132,608 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\extmgr.dll + 2007-10-10 23:50:10 63,488 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\icardie.dll + 2007-10-10 23:50:10 63,488 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\icardie.dll.000 + 2007-10-10 11:00:07 70,656 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\ie4uinit.exe + 2007-10-10 23:50:10 153,088 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\ieakeng.dll + 2007-10-10 23:50:10 230,400 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\ieaksie.dll + 2007-10-10 05:46:55 161,792 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\ieakui.dll + 2007-07-01 03:31:33 2,455,488 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\ieapfltr.dat + 2007-10-10 23:50:10 383,488 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\ieapfltr.dll + 2007-10-10 23:50:10 383,488 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\ieapfltr.dll.000 + 2007-10-10 23:50:10 384,512 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\iedkcs32.dll + 2007-10-10 23:50:11 6,065,664 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\ieframe.dll + 2007-10-10 23:50:11 6,065,664 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\ieframe.dll.000 + 2007-10-10 23:50:11 44,544 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\iernonce.dll + 2007-10-10 23:50:11 267,776 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\iertutil.dll + 2007-10-10 23:50:11 267,776 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\iertutil.dll.000 + 2007-10-10 10:59:40 13,824 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\ieudinit.exe + 2007-10-10 11:00:20 625,152 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\iexplore.exe + 2007-10-10 11:00:20 625,152 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\iexplore.exe.000 + 2007-10-10 23:50:11 27,648 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\jsproxy.dll + 2007-10-10 23:50:11 459,264 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\msfeeds.dll + 2007-10-10 23:50:11 459,264 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\msfeeds.dll.000 + 2007-10-10 23:50:11 52,224 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\msfeedsbs.dll + 2007-10-10 23:50:11 52,224 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\msfeedsbs.dll.000 + 2007-10-31 10:53:10 3,590,656 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\mshtml.dll + 2007-10-31 10:53:10 3,590,656 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\mshtml.dll.000 + 2007-10-10 23:50:12 478,208 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\mshtmled.dll + 2007-10-10 23:50:12 478,208 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\mshtmled.dll.000 + 2007-10-10 23:50:12 193,024 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\msrating.dll + 2007-10-10 23:50:12 671,232 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\mstime.dll + 2007-10-10 23:50:12 102,400 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\occache.dll + 2007-08-14 00:36:12 44,544 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\pngfilt.dll + 2007-03-06 01:27:50 215,776 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\spuninst\spuninst.exe + 2007-03-06 01:29:00 389,856 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\spuninst\updspapi.dll + 2007-10-10 23:50:12 105,984 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\url.dll + 2007-10-10 23:50:12 105,984 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\url.dll.000 + 2007-10-10 23:50:12 1,159,680 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\urlmon.dll + 2007-10-10 23:50:12 1,159,680 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\urlmon.dll.000 + 2007-10-10 23:50:12 232,960 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\webcheck.dll + 2007-10-10 23:50:12 232,960 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\webcheck.dll.000 + 2007-10-10 23:50:13 824,832 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\wininet.dll + 2007-10-10 23:50:13 824,832 -c----w C:\WINDOWS\ie7updates\KB944533-IE7\wininet.dll.000 + 2006-06-02 19:32:20 33,792 ------w C:\WINDOWS\network diagnostic\custsat.dll + 2006-10-10 12:44:50 557,568 ------w C:\WINDOWS\network diagnostic\xpnetdiag.exe - 2004-08-19 07:41:42 61,440 ----a-w C:\WINDOWS\system32\admparse.dll + 2007-08-14 00:39:20 71,680 ----a-w C:\WINDOWS\system32\admparse.dll - 2004-08-19 07:41:42 101,376 ----a-w C:\WINDOWS\system32\advpack.dll + 2007-12-07 02:08:48 124,928 ----a-w C:\WINDOWS\system32\advpack.dll - 2004-08-19 07:41:42 61,440 -c--a-w C:\WINDOWS\system32\dllcache\admparse.dll + 2007-08-14 00:39:20 71,680 -c--a-w C:\WINDOWS\system32\dllcache\admparse.dll - 2004-08-19 07:41:42 101,376 -c--a-w C:\WINDOWS\system32\dllcache\advpack.dll + 2007-12-07 02:08:48 124,928 -c----w C:\WINDOWS\system32\dllcache\advpack.dll - 2004-12-21 18:14:24 28,672 -c--a-w C:\WINDOWS\system32\dllcache\custsat.dll + 2007-08-14 00:54:10 33,792 -c--a-w C:\WINDOWS\system32\dllcache\custsat.dll - 2007-12-07 00:47:09 357,888 -c--a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll + 2007-12-19 22:53:07 347,136 -c----w C:\WINDOWS\system32\dllcache\dxtmsft.dll - 2007-12-07 00:47:09 205,824 -c--a-w C:\WINDOWS\system32\dllcache\dxtrans.dll + 2007-12-07 02:08:49 214,528 -c----w C:\WINDOWS\system32\dllcache\dxtrans.dll - 2007-12-07 00:47:09 55,808 -c--a-w C:\WINDOWS\system32\dllcache\extmgr.dll + 2007-12-07 02:08:49 133,120 -c----w C:\WINDOWS\system32\dllcache\extmgr.dll - 2004-08-19 07:42:10 38,912 -c--a-w C:\WINDOWS\system32\dllcache\hmmapi.dll + 2007-08-14 00:18:02 60,416 -c--a-w C:\WINDOWS\system32\dllcache\hmmapi.dll - 2004-08-19 07:42:50 34,304 -c--a-w C:\WINDOWS\system32\dllcache\ie4uinit.exe + 2007-12-06 11:01:34 70,656 -c----w C:\WINDOWS\system32\dllcache\ie4uinit.exe - 2004-08-19 07:42:10 139,264 -c--a-w C:\WINDOWS\system32\dllcache\ieakeng.dll + 2007-12-07 02:08:49 153,088 -c----w C:\WINDOWS\system32\dllcache\ieakeng.dll - 2004-08-19 07:42:10 221,184 -c--a-w C:\WINDOWS\system32\dllcache\ieaksie.dll + 2007-12-07 02:08:49 230,400 -c----w C:\WINDOWS\system32\dllcache\ieaksie.dll - 2002-09-24 06:00:00 241,664 -c--a-w C:\WINDOWS\system32\dllcache\ieakui.dll + 2007-12-06 04:59:51 161,792 -c----w C:\WINDOWS\system32\dllcache\ieakui.dll - 2004-08-19 07:42:10 323,584 -c--a-w C:\WINDOWS\system32\dllcache\iedkcs32.dll + 2007-12-07 02:08:49 384,512 -c----w C:\WINDOWS\system32\dllcache\iedkcs32.dll - 2007-12-06 10:05:52 18,432 -c--a-w C:\WINDOWS\system32\dllcache\iedw.exe + 2007-08-14 00:44:02 69,120 -c--a-w C:\WINDOWS\system32\dllcache\iedw.exe - 2004-08-19 07:42:10 81,920 -c--a-w C:\WINDOWS\system32\dllcache\ieencode.dll + 2007-08-14 00:45:18 78,336 -c--a-w C:\WINDOWS\system32\dllcache\ieencode.dll - 2007-12-07 00:47:09 251,904 -c--a-w C:\WINDOWS\system32\dllcache\iepeers.dll + 2007-08-14 00:54:10 191,488 -c--a-w C:\WINDOWS\system32\dllcache\iepeers.dll - 2004-08-19 07:42:10 49,152 -c--a-w C:\WINDOWS\system32\dllcache\iernonce.dll + 2007-12-07 02:08:51 44,544 -c----w C:\WINDOWS\system32\dllcache\iernonce.dll - 2004-08-19 07:42:10 63,488 -c--a-w C:\WINDOWS\system32\dllcache\iesetup.dll + 2007-08-14 00:39:12 55,296 -c--a-w C:\WINDOWS\system32\dllcache\iesetup.dll - 2004-08-19 07:42:50 93,184 -c--a-w C:\WINDOWS\system32\dllcache\iexplore.exe + 2007-12-06 11:02:07 625,664 -c----w C:\WINDOWS\system32\dllcache\iexplore.exe - 2004-08-19 07:42:10 35,840 -c--a-w C:\WINDOWS\system32\dllcache\imgutil.dll + 2007-08-14 00:36:06 36,352 -c--a-w C:\WINDOWS\system32\dllcache\imgutil.dll - 2007-12-07 00:47:09 96,768 -c--a-w C:\WINDOWS\system32\dllcache\inseng.dll + 2007-08-14 00:39:02 92,672 -c--a-w C:\WINDOWS\system32\dllcache\inseng.dll - 2007-11-14 07:19:13 450,560 -c--a-w C:\WINDOWS\system32\dllcache\jscript.dll + 2007-08-14 00:38:04 491,520 -c--a-w C:\WINDOWS\system32\dllcache\jscript.dll - 2007-12-07 00:47:09 16,384 -c--a-w C:\WINDOWS\system32\dllcache\jsproxy.dll + 2007-12-07 02:08:52 27,648 -c----w C:\WINDOWS\system32\dllcache\jsproxy.dll - 2004-08-19 07:42:14 22,528 -c--a-w C:\WINDOWS\system32\dllcache\licmgr10.dll + 2007-08-14 00:44:18 40,960 -c--a-w C:\WINDOWS\system32\dllcache\licmgr10.dll - 2004-08-19 07:42:58 29,184 -c--a-w C:\WINDOWS\system32\dllcache\mshta.exe + 2007-08-14 00:32:30 45,568 -c--a-w C:\WINDOWS\system32\dllcache\mshta.exe - 2007-12-07 00:47:10 3,087,360 -c--a-w C:\WINDOWS\system32\dllcache\mshtml.dll + 2007-12-08 16:38:54 3,592,192 -c----w C:\WINDOWS\system32\dllcache\mshtml.dll - 2007-12-07 00:47:10 449,024 -c--a-w C:\WINDOWS\system32\dllcache\mshtmled.dll + 2007-12-07 02:08:54 478,208 -c----w C:\WINDOWS\system32\dllcache\mshtmled.dll - 2004-08-19 07:39:30 57,344 -c--a-w C:\WINDOWS\system32\dllcache\mshtmler.dll + 2007-08-14 00:01:12 48,128 -c--a-w C:\WINDOWS\system32\dllcache\mshtmler.dll - 2002-09-24 06:00:00 146,432 -c--a-w C:\WINDOWS\system32\dllcache\msls31.dll + 2007-08-14 00:54:10 156,160 -c--a-w C:\WINDOWS\system32\dllcache\msls31.dll - 2007-12-07 00:47:10 146,432 -c--a-w C:\WINDOWS\system32\dllcache\msrating.dll + 2007-12-07 02:08:54 193,024 -c----w C:\WINDOWS\system32\dllcache\msrating.dll - 2007-12-07 00:47:10 532,480 -c--a-w C:\WINDOWS\system32\dllcache\mstime.dll + 2007-12-07 02:08:54 671,232 -c----w C:\WINDOWS\system32\dllcache\mstime.dll - 2004-08-19 07:42:22 97,280 -c--a-w C:\WINDOWS\system32\dllcache\occache.dll + 2007-12-07 02:08:54 102,912 -c----w C:\WINDOWS\system32\dllcache\occache.dll - 2007-12-07 00:47:10 39,424 -c--a-w C:\WINDOWS\system32\dllcache\pngfilt.dll + 2008-01-11 05:37:31 44,544 -c----w C:\WINDOWS\system32\dllcache\pngfilt.dll - 2004-08-19 07:42:28 37,888 -c--a-w C:\WINDOWS\system32\dllcache\url.dll + 2007-12-07 02:08:54 105,984 -c----w C:\WINDOWS\system32\dllcache\url.dll - 2007-12-07 00:47:11 619,008 -c--a-w C:\WINDOWS\system32\dllcache\urlmon.dll + 2007-12-07 02:08:55 1,159,680 -c----w C:\WINDOWS\system32\dllcache\urlmon.dll - 2004-08-19 07:42:28 417,792 -c--a-w C:\WINDOWS\system32\dllcache\vbscript.dll + 2007-08-14 00:54:10 413,696 -c--a-w C:\WINDOWS\system32\dllcache\vbscript.dll - 2007-06-26 13:56:57 851,968 -c--a-w C:\WINDOWS\system32\dllcache\vgx.dll + 2007-07-12 23:30:38 765,952 -c--a-w C:\WINDOWS\system32\dllcache\vgx.dll - 2006-09-25 06:02:04 49,152 -c--a-w C:\WINDOWS\system32\dllcache\wdigest.dll + 2006-03-24 04:48:51 49,152 -c--a-w C:\WINDOWS\system32\dllcache\wdigest.dll - 2004-08-19 07:42:30 280,576 -c--a-w C:\WINDOWS\system32\dllcache\webcheck.dll + 2007-12-07 02:08:55 233,472 -c----w C:\WINDOWS\system32\dllcache\webcheck.dll - 2007-12-07 00:47:12 668,672 -c--a-w C:\WINDOWS\system32\dllcache\wininet.dll + 2007-12-07 02:08:55 824,832 -c----w C:\WINDOWS\system32\dllcache\wininet.dll - 2007-12-07 00:47:09 357,888 ----a-w C:\WINDOWS\system32\dxtmsft.dll + 2007-12-19 22:53:07 347,136 ----a-w C:\WINDOWS\system32\dxtmsft.dll - 2007-12-07 00:47:09 205,824 ----a-w C:\WINDOWS\system32\dxtrans.dll + 2007-12-07 02:08:49 214,528 ----a-w C:\WINDOWS\system32\dxtrans.dll - 2007-12-07 00:47:09 55,808 ----a-w C:\WINDOWS\system32\extmgr.dll + 2007-12-07 02:08:49 133,120 ------w C:\WINDOWS\system32\extmgr.dll + 2007-12-07 02:08:49 63,488 ----a-w C:\WINDOWS\system32\icardie.dll + 2006-06-29 14:05:44 26,112 ------w C:\WINDOWS\system32\idndl.dll - 2004-08-19 07:42:50 34,304 ----a-w C:\WINDOWS\system32\ie4uinit.exe + 2007-12-06 11:01:34 70,656 ------w C:\WINDOWS\system32\ie4uinit.exe - 2004-08-19 07:42:10 139,264 ----a-w C:\WINDOWS\system32\ieakeng.dll + 2007-12-07 02:08:49 153,088 ------w C:\WINDOWS\system32\ieakeng.dll - 2004-08-19 07:42:10 221,184 ----a-w C:\WINDOWS\system32\ieaksie.dll + 2007-12-07 02:08:49 230,400 ------w C:\WINDOWS\system32\ieaksie.dll - 2002-09-24 06:00:00 241,664 ----a-w C:\WINDOWS\system32\ieakui.dll + 2007-12-06 04:59:51 161,792 ------w C:\WINDOWS\system32\ieakui.dll + 2007-04-17 09:32:38 2,455,488 ----a-w C:\WINDOWS\system32\ieapfltr.dat + 2007-12-07 02:08:49 383,488 ----a-w C:\WINDOWS\system32\ieapfltr.dll - 2004-08-19 07:42:10 323,584 ----a-w C:\WINDOWS\system32\iedkcs32.dll + 2007-12-07 02:08:49 384,512 ------w C:\WINDOWS\system32\iedkcs32.dll - 2004-08-19 07:42:10 81,920 ----a-w C:\WINDOWS\system32\ieencode.dll + 2007-08-14 00:45:18 78,336 ----a-w C:\WINDOWS\system32\ieencode.dll + 2007-12-07 02:08:51 6,066,176 ----a-w C:\WINDOWS\system32\ieframe.dll - 2007-12-07 00:47:09 251,904 ----a-w C:\WINDOWS\system32\iepeers.dll + 2007-08-14 00:54:10 191,488 ----a-w C:\WINDOWS\system32\iepeers.dll - 2004-08-19 07:42:10 49,152 ----a-w C:\WINDOWS\system32\iernonce.dll + 2007-12-07 02:08:51 44,544 ------w C:\WINDOWS\system32\iernonce.dll + 2007-12-07 02:08:51 267,776 ----a-w C:\WINDOWS\system32\iertutil.dll - 2004-08-19 07:42:10 63,488 ----a-w C:\WINDOWS\system32\iesetup.dll + 2007-08-14 00:39:12 55,296 ----a-w C:\WINDOWS\system32\iesetup.dll + 2007-12-06 11:00:58 13,824 ----a-w C:\WINDOWS\system32\ieudinit.exe + 2007-08-14 00:54:10 180,736 ------w C:\WINDOWS\system32\ieui.dll - 2004-08-19 07:42:10 35,840 ----a-w C:\WINDOWS\system32\imgutil.dll + 2007-08-14 00:36:06 36,352 ----a-w C:\WINDOWS\system32\imgutil.dll - 2007-12-07 00:47:09 96,768 ----a-w C:\WINDOWS\system32\inseng.dll + 2007-08-14 00:39:02 92,672 ----a-w C:\WINDOWS\system32\inseng.dll - 2007-11-14 07:19:13 450,560 ----a-w C:\WINDOWS\system32\jscript.dll + 2007-08-14 00:38:04 491,520 ----a-w C:\WINDOWS\system32\jscript.dll - 2007-12-07 00:47:09 16,384 ----a-w C:\WINDOWS\system32\jsproxy.dll + 2007-12-07 02:08:52 27,648 ------w C:\WINDOWS\system32\jsproxy.dll - 2004-08-19 07:42:14 22,528 ----a-w C:\WINDOWS\system32\licmgr10.dll + 2007-08-14 00:44:18 40,960 ----a-w C:\WINDOWS\system32\licmgr10.dll + 2007-12-07 02:08:52 459,264 ----a-w C:\WINDOWS\system32\msfeeds.dll + 2007-12-07 02:08:52 52,224 ----a-w C:\WINDOWS\system32\msfeedsbs.dll + 2007-08-14 00:36:40 12,288 ------w C:\WINDOWS\system32\msfeedssync.exe - 2004-08-19 07:42:58 29,184 ----a-w C:\WINDOWS\system32\mshta.exe + 2007-08-14 00:32:30 45,568 ----a-w C:\WINDOWS\system32\mshta.exe - 2007-12-07 00:47:10 3,087,360 ----a-w C:\WINDOWS\system32\mshtml.dll + 2007-12-08 16:38:54 3,592,192 ----a-w C:\WINDOWS\system32\mshtml.dll - 2007-12-07 00:47:10 449,024 ----a-w C:\WINDOWS\system32\mshtmled.dll + 2007-12-07 02:08:54 478,208 ----a-w C:\WINDOWS\system32\mshtmled.dll - 2004-08-19 07:39:30 57,344 ----a-w C:\WINDOWS\system32\mshtmler.dll + 2007-08-14 00:01:12 48,128 ----a-w C:\WINDOWS\system32\mshtmler.dll - 2002-09-24 06:00:00 146,432 ----a-w C:\WINDOWS\system32\msls31.dll + 2007-08-14 00:54:10 156,160 ----a-w C:\WINDOWS\system32\msls31.dll - 2007-12-07 00:47:10 146,432 ----a-w C:\WINDOWS\system32\msrating.dll + 2007-12-07 02:08:54 193,024 ------w C:\WINDOWS\system32\msrating.dll - 2007-12-07 00:47:10 532,480 ----a-w C:\WINDOWS\system32\mstime.dll + 2007-12-07 02:08:54 671,232 ------w C:\WINDOWS\system32\mstime.dll + 2006-06-28 23:59:26 24,576 ------w C:\WINDOWS\system32\nlsdl.dll + 2006-06-29 14:05:44 23,552 ------w C:\WINDOWS\system32\normaliz.dll - 2004-08-19 07:42:22 97,280 ----a-w C:\WINDOWS\system32\occache.dll + 2007-12-07 02:08:54 102,912 ------w C:\WINDOWS\system32\occache.dll - 2007-12-07 00:47:10 39,424 ----a-w C:\WINDOWS\system32\pngfilt.dll + 2008-01-11 05:37:31 44,544 ----a-w C:\WINDOWS\system32\pngfilt.dll - 2005-06-28 16:21:34 22,752 ----a-w C:\WINDOWS\system32\spupdsvc.exe + 2006-09-06 23:43:22 22,752 ----a-w C:\WINDOWS\system32\spupdsvc.exe - 2004-08-19 07:42:28 37,888 ----a-w C:\WINDOWS\system32\url.dll + 2007-12-07 02:08:54 105,984 ----a-w C:\WINDOWS\system32\url.dll - 2007-12-07 00:47:11 619,008 ----a-w C:\WINDOWS\system32\urlmon.dll + 2007-12-07 02:08:55 1,159,680 ----a-w C:\WINDOWS\system32\urlmon.dll - 2004-08-19 07:42:28 417,792 ----a-w C:\WINDOWS\system32\vbscript.dll + 2007-08-14 00:54:10 413,696 ----a-w C:\WINDOWS\system32\vbscript.dll - 2006-09-25 06:02:04 49,152 ----a-w C:\WINDOWS\system32\wdigest.dll + 2006-03-24 04:48:51 49,152 ----a-w C:\WINDOWS\system32\wdigest.dll - 2004-08-19 07:42:30 280,576 ----a-w C:\WINDOWS\system32\webcheck.dll + 2007-12-07 02:08:55 233,472 ----a-w C:\WINDOWS\system32\webcheck.dll + 2007-08-14 00:45:16 206,336 ------w C:\WINDOWS\system32\WinFXDocObj.exe - 2007-12-07 00:47:12 668,672 ----a-w C:\WINDOWS\system32\wininet.dll + 2007-12-07 02:08:55 824,832 ----a-w C:\WINDOWS\system32\wininet.dll + 2006-07-14 15:51:51 121,856 ------w C:\WINDOWS\system32\xmllite.dll . -- Snapshot reset to current date -- . ((((((((((((((((((((((((((((((((( Cargando Puntos Reg )))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Nota* entradas vacías & entradas legítimas predeterminadas no son mostradas [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 01:42 15360] "MsnMsgr"="C:\Archivos de programa\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184] "MSMSGS"="C:\Archivos de programa\Messenger\msmsgs.exe" [2006-09-25 13:59 1694208] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run] "APVXDWIN"="C:\Archivos de programa\Panda Software\Panda Internet Security 2007\APVXDWIN.exe" [2006-10-11 12:09 364544] "SCANINICIO"="C:\Archivos de programa\Panda Software\Panda Internet Security 2007\Inicio.exe" [2006-02-01 18:13 22528] "MSConfig"="C:\WINDOWS\pchealth\helpctr\Binaries\M SCONFIG.exe" [2004-08-19 01:42 159744] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 01:42 15360] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\RunOnce] "nlpo_01"="cmd.exe" [2004-08-19 01:42 402944 C:\WINDOWS\system32\cmd.exe] "nlpo_02"="advpack.dll" [2007-12-06 20:08 124928 C:\WINDOWS\system32\advpack.dll] "nlpo_03"="advpack.dll" [2007-12-06 20:08 124928 C:\WINDOWS\system32\advpack.dll] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr] avldr.dll 2005-09-27 12:13 45056 C:\WINDOWS\system32\avldr.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menú Inicio^Programas^Inicio^BlueSoleil.lnk] path=C:\Documents and Settings\All Users\Menú Inicio\Programas\Inicio\BlueSoleil.lnk backup=C:\WINDOWS\pss\BlueSoleil.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\amva] C:\WINDOWS\system32\amvo.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] --a------ 2007-03-12 13:49 153136 C:\Archivos de programa\Archivos comunes\Ahead\Lib\NMBgMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor] --a------ 2006-10-27 00:47 31016 C:\Archivos de programa\Microsoft Office\Office12\GrooveMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] --a------ 2004-01-07 13:02 49152 C:\Archivos de programa\Hewlett-Packard\HP Software Update\HPWuSchd2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\JavaCore] C:\Archivos de programa\JavaCore\JavaCore.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MapEDC] C:\Archivos de programa\MapEDC\MapEDC.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2007-03-09 18:53 153136 C:\Archivos de programa\Archivos comunes\Ahead\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NoDNS] C:\Archivos de programa\\NoDNS\\NoDNS.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan] --a------ 2006-01-11 15:08 577536 C:\WINDOWS\soundman.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StatusClient 2.6] --a------ 2004-02-27 11:29 61440 C:\Archivos de programa\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2007-09-25 01:11 132496 C:\Archivos de programa\Java\jre1.6.0_03\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] --a------ 2007-11-29 18:19 68856 C:\Archivos de programa\Google\GoogleToolbarNotifier\GoogleToolba rNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomcatStartup 2.5] --a------ 2004-05-20 10:40 188416 C:\Archivos de programa\Hewlett-Packard\Toolbox\hpbpsttp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Zero Setup] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager] --a------ 2007-08-30 17:43 4670704 C:\ARCHIV~1\Yahoo!\MESSEN~1\YAHOOM~1.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\PandaAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\PandaFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Archivos de programa\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "C:\\Archivos de programa\\Microsoft Office\\Office12\\GROOVE.EXE"= "C:\\Archivos de programa\\Microsoft Office\\Office12\\ONENOTE.EXE"= "C:\\Archivos de programa\\Messenger\\msmsgs.exe"= "C:\\Archivos de programa\\Yahoo!\\Messenger\\YahooMessenger.exe"= "C:\\Archivos de programa\\Yahoo!\\Messenger\\YServer.exe"= "C:\\Archivos de programa\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"= "C:\\Archivos de programa\\Windows Live\\Messenger\\msnmsgr.exe"= "C:\\Archivos de programa\\Windows Live\\Messenger\\livecall.exe"= "C:\\Archivos de programa\\Ares\\Ares.exe"= "C:\\WINDOWS\\system32\\spoolsv.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= R0 netflt;Panda Net Driver [NDIS Layer];C:\WINDOWS\system32\Drivers\NETFLT.SYS [2006-10-10 16:02] R1 APPFLT;App Filter Plugin;C:\WINDOWS\system32\Drivers\APPFLT.SYS [2006-08-03 16:37] R1 BIOS;BIOS;C:\WINDOWS\system32\drivers\BIOS.sys [2005-03-16 00:23] R1 DSAFLT;DSA Filter Plugin;C:\WINDOWS\system32\Drivers\DSAFLT.SYS [2006-08-02 14:08] R1 FNETMON;NetMon Filter Plugin;C:\WINDOWS\system32\Drivers\fnetmon.SYS [2006-06-29 22:50] R1 IDSFLT;Ids Filter Plugin;C:\WINDOWS\system32\Drivers\IDSFLT.SYS [2006-08-02 14:10] R1 NETFLTDI;Panda Net Driver [TDI Layer];C:\WINDOWS\system32\Drivers\NETFLTDI.SYS [2006-05-11 22:26] R1 ShldDrv;Panda File Shield Driver;C:\WINDOWS\system32\drivers\ShldDrv.sys [2005-08-29 07:23] R1 SMSFLT;SMS Filter Plugin;C:\WINDOWS\system32\Drivers\SMSFLT.SYS [2006-08-02 14:15] R1 WNMFLT;Wifi Monitor Filter Plugin;C:\WINDOWS\system32\Drivers\WNMFLT.SYS [2006-09-28 15:58] R2 cpoint;Panda CPoint Driver;C:\WINDOWS\system32\Drivers\cpoint.sys [2005-08-12 14:36] R2 PavProc;Panda Process Protection Driver;C:\WINDOWS\system32\DRIVERS\PavProc.sys [2006-04-25 10:02] R3 ComFiltr;Panda Anti-Dialer;C:\WINDOWS\system32\DRIVERS\COMFiltr.sys [] S3 se59bus;Sony Ericsson Device 089 driver (WDM);C:\WINDOWS\system32\DRIVERS\se59bus.sys [2006-09-05 12:07] [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{0286d6ae-d809-11dc-9af8-0016ec8e0572}] \shell\Auto\command - MSOCache\doWTP_RESTORE_0.exe -autorun \shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL MSOCache\doWTP_RESTORE_0.exe -autorun [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{04b10d37-e63f-11dc-9b18-0016ec8e0572}] \Shell\AutoRun\command - F:\ntde1ect.com \Shell\explore\Command - F:\ntde1ect.com \Shell\open\Command - F:\ntde1ect.com [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{265b617a-c8c6-11dc-9adb-0016ec8e0572}] \Shell\AutoRun\command - ntde1ect.com \Shell\explore\Command - ntde1ect.com \Shell\open\Command - ntde1ect.com [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{33c80c28-c98c-11dc-9adc-0016ec8e0572}] \Shell\AutoRun\command - F:\xn1i9x.com \Shell\explore\Command - F:\xn1i9x.com \Shell\open\Command - F:\xn1i9x.com [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{33c80c2b-c98c-11dc-9adc-0016ec8e0572}] \Shell\auto\command - Knight.exe open \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Knight.exe open \Shell\explore\command - Knight.exe open \Shell\find\command - Knight.exe open \Shell\install\command - Knight.exe open \Shell\open\command - Knight.exe open [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{3d5ce84e-a1ec-11dc-a86e-0016ec8e0572}] \Shell\AutoRun\command - ntde1ect.com \Shell\explore\Command - ntde1ect.com \Shell\open\Command - ntde1ect.com [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{3f5a55fa-9c69-11dc-a85e-0016ec8e0572}] \Shell\AutoRun\command - F:\x6.bat \Shell\explore\Command - F:\x6.bat \Shell\open\Command - F:\x6.bat [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{52a4a595-ee0c-11dc-9b3b-0016ec8e0572}] \Shell\AutoRun\command - F:\y82td3td.com \Shell\explore\Command - F:\y82td3td.com \Shell\open\Command - F:\y82td3td.com [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{52a4a59a-ee0c-11dc-9b3b-0016ec8e0572}] \Shell\auto\command - Knight.exe open \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Knight.exe open \Shell\explore\command - Knight.exe open \Shell\find\command - Knight.exe open \Shell\install\command - Knight.exe open \Shell\open\command - Knight.exe open [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{580985e4-e895-11dc-9b27-0016ec8e0572}] \Shell\AutoRun\command - F:\ntde1ect.com \Shell\explore\Command - F:\ntde1ect.com \Shell\open\Command - F:\ntde1ect.com [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{59e8b61c-bc55-11dc-9ac5-0016ec8e0572}] \Shell\AutoRun\command - F:\u.bat \Shell\explore\Command - F:\u.bat \Shell\open\Command - F:\u.bat [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{6caedd23-e30e-11dc-9b0f-0016ec8e0572}] \Shell\AutoRun\command - F:\oufddh.exe \Shell\explore\Command - F:\oufddh.exe \Shell\open\Command - F:\oufddh.exe [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{6caedd24-e30e-11dc-9b0f-0016ec8e0572}] \Shell\AutoRun\command - G:\oufddh.exe \Shell\explore\Command - G:\oufddh.exe \Shell\open\Command - G:\oufddh.exe [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{72b8e728-d7ff-11dc-9af7-0016ec8e0572}] \Shell\AutoRun\command - tio8x6.cmd \Shell\explore\Command - tio8x6.cmd \Shell\open\Command - tio8x6.cmd [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{9369dc4c-c734-11dc-9ad8-0016ec8e0572}] \Shell\AutoRun\command - F:\3wcxx91.cmd \Shell\explore\Command - F:\3wcxx91.cmd \Shell\open\Command - F:\3wcxx91.cmd [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{b85170b2-dfe3-11dc-9b07-0016ec8e0572}] \Shell\AutoRun\command - tio8x6.cmd \Shell\explore\Command - tio8x6.cmd \Shell\open\Command - tio8x6.cmd [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{cfa27dc1-dc1c-11dc-9aff-0016ec8e0572}] \Shell\AutoRun\command - F:\d6fagcs8.cmd \Shell\explore\Command - F:\d6fagcs8.cmd \Shell\open\Command - F:\d6fagcs8.cmd [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{d87171bc-c688-11dc-9ad7-0016ec8e0572}] \Shell\Auto\command - fasfeaepm.exe \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL fasfeaepm.exe [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{d87171be-c688-11dc-9ad7-0016ec8e0572}] \Shell\AutoRun\command - ntde1ect.com \Shell\explore\Command - ntde1ect.com \Shell\open\Command - ntde1ect.com [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{e890341d-e7bb-11dc-9b1e-0016ec8e0572}] \Shell\AutoRun\command - G:\ntde1ect.com \Shell\explore\Command - G:\ntde1ect.com \Shell\open\Command - G:\ntde1ect.com . ************************************************** ************************ catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-11 11:21:24 Windows 5.1.2600 Service Pack 2 NTFS escaneando procesos ocultos ... escaneando entradas ocultas de autostart ... escaneando archivos ocultos ... el escaneo se completo con exito archivos ocultos: 0 ************************************************** ************************ . Tiempo completado: 2008-03-11 11:22:30 ComboFix-quarantined-files.txt 2008-03-11 17:22:08 ComboFix2.txt 2008-03-09 00:20:33 . 2008-03-09 17:46:28 --- E O F --- |
|
11/03/08, 13:27:53
| |
| ||||
 Re: estoy siendo atacado por, virus, help Hola por favor repite el procedimiento anterior ya que el reporte muestra las mismas infecciones ya que Combofix no se ejecuto desde el CFScript sino directamente haciendo doble clic sobre el ejecutable y los resultados no fueron los esperados. Por favor es muy importante que arrastres y sueltes el CFScript como lo muestra la imagen Cita:
Saludos.  Novedades del Foro | Antivirus Online | Eliminar Malwares | Políticas del Foro | Blog * Ayúdanos haciendo una DONACIÓN para poder seguir Ayudando. * Para evitar Virus y Spywares al navegar por internet, USE FIREFOX !! * No se resuelven dudas por Privados ni por E-mail, ya que para eso esta el foro. |