| Re: AYUDA! Antivirus 2008 Pro AQUI ESTA EL REPORTE DE COMBOFIX
ComboFix 08-08-04.09 - Jean Paul 2008-08-05 22:51:21.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1033.18.424 [GMT -4.5:30]
Running from: C:\Users\Jean Paul.JuanPablo-PC\Desktop\ComboFix.exe
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Users\Jean Paul.JuanPablo-PC\AppData\Roaming\inst.exe
.
((((((((((((((((((((((((( Files Created from 2008-07-06 to 2008-08-06 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2008-08-06 01:34 --------- d-----w C:\Program Files\RelevantKnowledge
2008-08-04 18:58 --------- d-----w C:\Program Files\DelPSGuard
2008-08-04 18:51 --------- d-----w C:\Program Files\Trend Micro
2008-08-04 18:29 --------- d-----w C:\Users\Jean Paul.JuanPablo-PC\AppData\Roaming\Malwarebytes
2008-08-04 18:29 --------- d-----w C:\ProgramData\Malwarebytes
2008-08-04 18:29 --------- d-----w C:\Program Files\Malwarebytes' Anti-Malware
2008-08-02 23:28 --------- d-----w C:\Program Files\Demo-IMG2MS
2008-08-02 17:57 --------- d-----w C:\Program Files\Java
2008-08-02 06:19 --------- d-----w C:\Users\Jean Paul.JuanPablo-PC\AppData\Roaming\uTorrent
2008-07-31 00:37 38,472 ----a-w C:\Windows\system32\drivers\mbamswissarmy.sys
2008-07-31 00:37 17,144 ----a-w C:\Windows\system32\drivers\mbam.sys
2008-07-06 02:21 --------- d-----w C:\Users\Juan Pablo\AppData\Roaming\Apple Computer
2008-07-06 01:34 42,778 ----a-w C:\Users\Juan Pablo\AppData\Roaming\nvModes.dat
2008-07-03 00:53 --------- d-----w C:\Users\Juan Pablo\AppData\Roaming\HP
2008-06-26 20:52 --------- d-----w C:\Users\Jean Paul.JuanPablo-PC\AppData\Roaming\HP
2008-06-23 23:22 --------- d-----w C:\Program Files\NSS
2008-06-23 20:31 0 ---ha-w C:\Windows\system32\drivers\Msft_Kernel_ccdcmb_010 05.Wdf
2008-06-21 23:05 134,335 ----a-w C:\Users\Jean Paul.JuanPablo-PC\AppData\Roaming\nvModes.dat
2008-06-13 22:04 --------- d-----w C:\Program Files\Xvid
2008-06-13 20:16 --------- d-----w C:\ProgramData\Ulead Systems
2008-06-13 20:16 --------- d-----w C:\Program Files\Ulead Systems
2008-06-13 20:06 --------- d-----w C:\Users\Jean Paul.JuanPablo-PC\AppData\Roaming\Sony
2008-06-13 20:06 --------- d-----w C:\Program Files\Vstplugins
2008-06-13 20:06 --------- d-----w C:\Program Files\Sony
2008-06-13 20:02 --------- d-----w C:\Program Files\Common Files\Sonic Shared
2008-06-13 20:00 --------- d-----w C:\Program Files\Nokia
2008-06-11 19:56 --------- d-----w C:\ProgramData\WEBREG
2008-06-11 19:32 --------- d-----w C:\ProgramData\HP
2008-06-11 19:30 --------- d-----w C:\Program Files\Common Files\Hewlett-Packard
2008-06-11 19:25 --------- d-----w C:\Program Files\HP
2008-06-08 21:22 1,355,776 ----a-w C:\Windows\System32\msvbvm50.dll
2008-06-06 14:34 --------- d-----w C:\Program Files\CyberLink
2008-03-20 23:52 27,839 ----a-w C:\Users\Guest\AppData\Roaming\nvModes.dat
2008-02-16 11:04 47,360 ----a-w C:\Users\Jean Paul.JuanPablo-PC\AppData\Roaming\pcouffin.sys
2007-12-01 10:51 32 ----a-w C:\Users\All Users\ezsid.dat
2007-12-01 10:51 32 ----a-w C:\ProgramData\ezsid.dat
2007-11-13 18:38 174 --sha-w C:\Program Files\desktop.ini
2008-03-21 00:54 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Lo cal\Microsoft\Windows\History\History.IE5\index.da t
2008-03-21 00:54 32,768 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Lo cal\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2008-03-21 00:54 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Ro aming\Microsoft\Windows\Cookies\index.dat
2008-01-15 02:25 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\L ocal\Microsoft\Windows\History\History.IE5\MSHist0 12008011420080115\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"LightScribe Control Panel"="C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-04-19 15:56 484904]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 08:05 125440]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 08:06 201728]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 19:03 152872]
"PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-06-27 16:21 1449984]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-09-15 06:20 1021224]
"QPService"="C:\Program Files\HP\QuickPlay\QPService.exe" [2007-04-23 20:41 176128]
"HP Health Check Scheduler"="C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2007-03-12 14:24 50696]
"SynTPStart"="C:\Program Files\Synaptics\SynTP\SynTPStart.exe" [2007-09-15 05:59 102400]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 23:21 39792]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-11-07 11:35 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-11-07 11:35 8534560]
"NvMediaCenter"="C:\Windows\system32\NvMcTray. dll" [2007-11-07 11:35 81920]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-27 23:50 266497]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 15:57 153136]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 21:52 49152]
"NSLauncher"="C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe" [2006-11-28 01:12 2658304]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2007-01-02 21:40:10 210520]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\policies\system]
"EnableLUA"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\Program,Files\RelevantKnowledge\ rlai.dll,C:\Program Files\RelevantKnowledge\rlai.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1330636959-3201756665-454828318-1001]
"EnableNotificationsRef"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpo licy\FirewallRules]
"{DDB79537-BE1B-49D8-9E35-865252F6818E}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{62DAD364-9054-4450-8B64-1E97F59A49D1}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{5BC58A37-88F1-48D7-8BE5-98236F326965}"= C:\Program Files\HP\QuickPlay\QP.exe:Quick Play
"{977244DC-0C6F-4602-9E5D-F53F4137696A}"= C:\Program Files\HP\QuickPlay\QPService.exe:Quick Play Resident Program
"{6B76B961-7BC3-47C4-B12A-42CF381A1E0A}"= UDP:C:\Program Files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{05F6F3EF-B25C-4001-8372-FE26E6D1B328}"= TCP:C:\Program Files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{097692B9-4521-4D1A-9F3E-8E0F924DCDB0}"= UDP:C:\Program Files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{F238082B-3978-480D-B122-CF2A1C1231A2}"= TCP:C:\Program Files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{C45F953C-C973-4D47-9B6F-8E3786D5C7A2}"= UDP:C:\Program Files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{87A0D74F-F719-4D0B-9A9D-EDC91DA7E7E8}"= TCP:C:\Program Files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{35368E9E-6F70-45AC-ADAD-77EF059C2F7E}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{8A6F5ADF-78B6-4A04-B095-E49984CDB49D}"= UDP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
"{D9B0FB4A-F9C4-472C-8825-4F25426C9F47}"= TCP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
"{0FA50BAF-2E5D-4A52-88FD-E85CAD249099}"= Disabled:UDP:C:\Program Files\Skype\Phone\Skype.exe:Skype
"{08D94C87-8F28-4F96-833C-AF3FE1963807}"= Disabled:TCP:C:\Program Files\Skype\Phone\Skype.exe:Skype
"{E1E8916B-3E55-42BA-A047-384E4D478EE4}"= UDP:C:\Users\Jean Paul.JuanPablo-PC\AppData\Local\Temp\nsj7B2C.tmp\utorrent.exe:µTo rrent
"{D05C5557-8C7D-4DD5-A8BA-0E94178B110C}"= TCP:C:\Users\Jean Paul.JuanPablo-PC\AppData\Local\Temp\nsj7B2C.tmp\utorrent.exe:µTo rrent
"{7B9D82E0-500E-46A6-81A7-03FF7212869B}"= UDP:C:\Users\Jean Paul.JuanPablo-PC\AppData\Local\Temp\nsqFBD3.tmp\utorrent.exe:µTo rrent
"{99C02D57-7C56-4A29-B166-C10C2130A93E}"= TCP:C:\Users\Jean Paul.JuanPablo-PC\AppData\Local\Temp\nsqFBD3.tmp\utorrent.exe:µTo rrent
"{A98B00E1-DFFF-441A-BFBE-3597AB8ADF33}"= UDP:C:\Users\Jean Paul.JuanPablo-PC\AppData\Local\Temp\nsh7CA6.tmp\utorrent.exe:µTo rrent
"{3C489E2C-A18B-4351-8B2A-31E7A8EC542F}"= TCP:C:\Users\Jean Paul.JuanPablo-PC\AppData\Local\Temp\nsh7CA6.tmp\utorrent.exe:µTo rrent
"{DA59BD55-1D98-4C8D-919B-EDD2EB3BA35E}"= UDP:C:\Users\Jean Paul.JuanPablo-PC\AppData\Local\Temp\nsq8CB5.tmp\utorrent.exe:µTo rrent
"{224DBF8B-1FCA-49BB-A578-FD367E1F22B6}"= TCP:C:\Users\Jean Paul.JuanPablo-PC\AppData\Local\Temp\nsq8CB5.tmp\utorrent.exe:µTo rrent
"{54721836-932D-43D2-88E2-FF66E240CDCC}"= UDP:C:\Users\Jean Paul.JuanPablo-PC\AppData\Local\Temp\nse56F7.tmp\utorrent.exe:µTo rrent
"{2A742F31-A993-44A5-A607-772AAAD14455}"= TCP:C:\Users\Jean Paul.JuanPablo-PC\AppData\Local\Temp\nse56F7.tmp\utorrent.exe:µTo rrent
"{030A113D-C496-48BA-92F8-3AF7597D5800}"= UDP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
"{67ABB782-6FD0-4B59-ABA1-4809335C227A}"= TCP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
"TCP Query User{C276118D-DB4F-40C0-A3FF-A96C3A72F6B8}C:\\program files\\tvuplayer\\tvuplayer.exe"= UDP:C:\program files\tvuplayer\tvuplayer.exe:TVUPlayer Component
"UDP Query User{AF53C47C-A4B4-4BF2-85D9-4DAA45668529}C:\\program files\\tvuplayer\\tvuplayer.exe"= TCP:C:\program files\tvuplayer\tvuplayer.exe:TVUPlayer Component
"{B2DE0645-AE00-4E60-BF90-3D981E594479}"= UDP:C:\Windows\Temp\~os94E0.tmp\ossproxy.exe:osspr oxy.exe
"{58718F47-B659-4AE9-9D17-D846FD9ADF5A}"= TCP:C:\Windows\Temp\~os94E0.tmp\ossproxy.exe:osspr oxy.exe
"TCP Query User{80C00EA3-D825-439C-B49C-C746C44F663F}C:\\program files\\orbitdownloader\\orbitnet.exe"= UDP:C:\program files\orbitdownloader\orbitnet.exe:P2P service of Orbit Downloader
"UDP Query User{5DD604CC-4CA7-4F99-B9E5-5615BADF10A4}C:\\program files\\orbitdownloader\\orbitnet.exe"= TCP:C:\program files\orbitdownloader\orbitnet.exe:P2P service of Orbit Downloader
"TCP Query User{3AB5F1B5-D2E1-4BD6-BDF2-75242EEBDC50}E:\\setup.exe"= UDP:E:\setup.exe:Setup
"UDP Query User{20A24EB6-3AB5-4C58-8561-0A6700286C66}E:\\setup.exe"= TCP:E:\setup.exe:Setup
"TCP Query User{E52233E8-395E-46BA-9028-9DD7B4268E24}E:\\setup.exe"= UDP:E:\setup.exe:Setup
"UDP Query User{017CAE9B-5373-46F1-A3A1-B148715DE80D}E:\\setup.exe"= TCP:E:\setup.exe:Setup
"TCP Query User{57067CA5-1A0F-4EBE-936B-7301D5137C04}C:\\program files\\nokia\\nokia software updater\\nsu_ui_client.exe"= UDP:C:\program files\nokia\nokia software updater\nsu_ui_client.exe:Nokia Software Updater
"UDP Query User{C017C593-7BF8-4CA9-9957-5D3ABCE83E48}C:\\program files\\nokia\\nokia software updater\\nsu_ui_client.exe"= TCP:C:\program files\nokia\nokia software updater\nsu_ui_client.exe:Nokia Software Updater
"TCP Query User{F9B2E15B-8CAB-412C-92FE-54CEB6CAC506}C:\\program files\\common files\\nokia\\service layer\\a\\nsl_host_process.exe"= UDP:C:\program files\common files\nokia\service layer\a\nsl_host_process.exe:Nokia Service Layer Host Process
"UDP Query User{A02F16E2-3B15-4F2F-877A-4AE49F61C077}C:\\program files\\common files\\nokia\\service layer\\a\\nsl_host_process.exe"= TCP:C:\program files\common files\nokia\service layer\a\nsl_host_process.exe:Nokia Service Layer Host Process
"{4F9C8AB4-044C-4495-86F4-381F3A83BCE4}"= UDP:C:\Windows\Temp\~os3DDB.tmp\ossproxy.exe:osspr oxy.exe
"{64737069-5E6A-46C7-809E-11CCFEC39518}"= TCP:C:\Windows\Temp\~os3DDB.tmp\ossproxy.exe:osspr oxy.exe
"{86CE514B-AF3B-47D4-853F-1779B58745DA}"= UDP:C:\Windows\Temp\~os7501.tmp\ossproxy.exe:osspr oxy.exe
"{DC8C3CCB-CE57-47AC-A305-453A1E925476}"= TCP:C:\Windows\Temp\~os7501.tmp\ossproxy.exe:osspr oxy.exe
"{8460BAC9-79F4-4AC2-9712-D41F8AD3B325}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{373335DB-69DA-4653-937B-0BE4A5899EA5}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{F54E7094-D049-4A81-BC09-DF004C89B3C6}"= UDP:C:\Windows\Temp\~os5B91.tmp\ossproxy.exe:osspr oxy.exe
"{DA934F8A-E7D2-42D1-893E-59168644DC5D}"= TCP:C:\Windows\Temp\~os5B91.tmp\ossproxy.exe:osspr oxy.exe
"{D19ED98B-F80C-4DC7-8534-DB898558C9E0}"= UDP:C:\Windows\Temp\~os7581.tmp\ossproxy.exe:osspr oxy.exe
"{19DBC2E4-6188-497C-9800-761992BF9BF1}"= TCP:C:\Windows\Temp\~os7581.tmp\ossproxy.exe:osspr oxy.exe
"{FE2D35C2-4130-4618-AE9C-6F4A288F99E0}"= UDP:C:\Windows\Temp\~os4CBC.tmp\ossproxy.exe:osspr oxy.exe
"{8C107C5E-AE51-4ADE-AFFE-C925B905DCD8}"= TCP:C:\Windows\Temp\~os4CBC.tmp\ossproxy.exe:osspr oxy.exe
"{646ECE0A-AC14-486F-AE38-E085EE0A8AB7}"= UDP:C:\Windows\Temp\~os2A00.tmp\ossproxy.exe:osspr oxy.exe
"{65830792-1B56-4A7B-96BF-EE85530A682B}"= TCP:C:\Windows\Temp\~os2A00.tmp\ossproxy.exe:osspr oxy.exe
"{986EB042-108A-4494-A33E-65BC8C390708}"= UDP:C:\Windows\Temp\~os1EC7.tmp\ossproxy.exe:osspr oxy.exe
"{C673948A-8638-4FC8-8D12-E8B5F56B0E76}"= TCP:C:\Windows\Temp\~os1EC7.tmp\ossproxy.exe:osspr oxy.exe
"{564882A9-0855-4AA4-9363-5D67A79A0D4C}"= UDP:C:\Program Files\RelevantKnowledge\rlvknlg.exe:rlvknlg.exe
"{77460DEA-8DE2-4164-88BF-177F31490324}"= TCP:C:\Program Files\RelevantKnowledge\rlvknlg.exe:rlvknlg.exe
[HKLM\~\services\sharedaccess\parameters\firewallpo licy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|S vc=DFSR:Allow inbound TCP traffic|
R2 RelevantKnowledge;RelevantKnowledge;C:\Program Files\RelevantKnowledge\rlservice.exe [2008-07-29 21:06]
S3 PRODIGY;PRODIGY;C:\Windows\system32\Drivers\PRODIG Y.SYS [2006-08-29 10:26]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
Contents of the 'Scheduled Tasks' folder
2008-06-01 C:\Windows\Tasks\Uniblue SpeedUpMyPC Nag.job
- C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe []
2007-11-15 C:\Windows\Tasks\Uniblue SpeedUpMyPC.job
- C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe []
2008-08-06 C:\Windows\Tasks\User_Feed_Synchronization-{41A0B458-6128-44DD-AEC4-818120732FC4}.job
- C:\Windows\system32\msfeedssync.exe [2006-11-02 05:15]
2008-08-06 C:\Windows\Tasks\User_Feed_Synchronization-{FC51C35F-F514-49A4-89D9-08646ECEDF36}.job
- C:\Windows\system32\msfeedssync.exe [2006-11-02 05:15]
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Users\Jean Paul.JuanPablo-PC\AppData\Roaming\Mozilla\Firefox\Profiles\y5ivz6 95.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.x-caleta.com/
************************************************** ************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-05 22:55:19
Windows 6.0.6000 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
************************************************** ************************
.
Completion time: 2008-08-05 22:56:56
ComboFix-quarantined-files.txt 2008-08-06 03:26:53
Pre-Run: The system cannot find message text for message number 0x2379 in the message file for Application.
Post-Run: 103,587,635,200 bytes free
202 --- E O F --- 2008-06-06 20:05:35 |