ayuda co trojan.downloader (Solucionado)

Buscar

		Foro de Spyware » Spyware - Adware - Hijackers - Malwares » Temas Solucionados
ayuda co trojan.downloader (Solucionado)

Para evitar Virus, Spyware y ventanas emergentes, en InfoSpyware recomendamos navegar con: FIREFOX

Temas Solucionados Casos de HijackThis y Malwares resueltos.
(Solo lectura)

Página 1 de 2

Herramientas

post #1 (permalink)

18/09/08, 07:47:00

bizen

Usuario

Registrado: sep 2008

Ubicación: Béjar

Mensajes: 12

ayuda co trojan.downloader (Solucionado)

Hola a todos, tengo un trojano y no puedo con él.
Tengo en el pc el trojano "trojan.downloader".
Utilizo el malwarebytes, que me detecta el trojano sin problema, lo pongo en cuarentena, lo elimino y al pasar otra vez el malwarebytes, todo sigue igual.
Está ubicado en: HKEY_CLASSES_ROOT\CLSID\{3a55ffce-5ae2-4eeb-922a-0239d924c801}.
Ya he pasado el panda, activescan de panda, ccleaner, malwarebytes, regseeker, vundofix, combofix y sigue en el mismo sitio.
Todo lo hice con restaurar sistema desactivado, en modo normal, en modo seguro, pero nada.
Encontré en este foro a una persona con el mismo problema (http://www.forospyware.com/t30502.html) pero a mi lo único que me aparace es "trojan.downloader" sin ninguna extensión ni nada.
Espero ayuda.
Gracias y salu2.
Una pregunta: Puedo eliminar esa HKEY manualmente donde está ubicado el trojano, o es peligroso por si la KEY es útil?.
...O incluso elimnándola volvería a aparecer?.
Junto con este, tuve el trojan.vundo en el pc, pero me lo eliminó bien el malwarebytes.
Espero ayuda.
Gracias y salu2... y perdón por el royo.

post #2 (permalink)

18/09/08, 09:04:16

Gwain26

Usuario Habitual

Registrado: may 2008

Ubicación: ESPAÑA

Mensajes: 796

Re: ayuda co trojan.downloader

Sí, la puedes eliminar sin problemas, aparte de que si la eliminas no te va a volver a aparecer. Para ello tienes que entrar en el editor de registro de Windows, pero la forma de hacerlo es distinta en el XP que en el Vista, por lo que necesito que me digas cuál de los dos es el que tienes instalado en tu PC.

post #3 (permalink)

18/09/08, 10:54:08

bizen

Usuario

Registrado: sep 2008

Ubicación: Béjar

Mensajes: 12

Re: ayuda co trojan.downloader

Mi SO es xp sp2.
Salu2.

post #4 (permalink)

18/09/08, 11:38:22

Gwain26

Usuario Habitual

Registrado: may 2008

Ubicación: ESPAÑA

Mensajes: 796

Re: ayuda co trojan.downloader

Entonces sigue estos pasos:

En el menú Inicio de Windows ve a Ejecutar y escribe el comando regedit.

Clickea en el signo + que te aparece a la izquierda y navega hasta que encuentres la clave de registro HKEY_CLASSES_ROOT\CLSID\{3a55ffce-5ae2-4eeb-922a-0239d924c801}

Borra toda referencia al archivo {3a55ffce-5ae2-4eeb-922a-0239d924c801}.

Sal del editor de registro y comenta los resultados aquí.

post #5 (permalink)

18/09/08, 15:12:59

bizen

Usuario

Registrado: sep 2008

Ubicación: Béjar

Mensajes: 12

Re: ayuda co trojan.downloader

Ya llegué hasta la HKEY, pero no me deja eliminarla, me dice "error al eliminar la clave".
Que más puedo hacer?

post #6 (permalink)

18/09/08, 15:26:18

Kirigi

Warrior

Registrado: jun 2007

Ubicación: Venezuela- Vargas- La Guaira

Mensajes: 4.930

Re: ayuda co trojan.downloader

Hola y con permiso

Esa CLSID pertenece al malware Vundo.

- Descarga la herramienta ComboFix.exe y guárdala en el escritorio.

Desactiva temporalmente el Antivirus y/o Antispyware.
Cierra todas las ventanas abiertas.
Hacele doble clic al archivo ComboFix.exe y seguí las instrucciones.
Cuando termine, generara un registro en C:\ComboFix.txt.
- *Nota* Mientras CF este trabajando no mover el mouse ya que pararía su proceso.
- *Nota* ComboFix puede reiniciar automáticamente el PC para completar el proceso de eliminación.

Cita:

Atención!! No use ComboFix a menos que se le haya indicado específicamente en su mensaje por un integrante de nuestro Staff. Es una herramienta de gran alcance destinada por su creador a ser usada bajo la orientación y supervisión de un experto, no para uso privado. El uso de ComboFix incorrectamente podría generar problemas en su sistema. Por favor, lea las "Negaciones de la Garantía" de ComboFix.

Reinicia y pega el reporte de C:\ComboFix.txt en este mismo mensaje.

Salu2

Novedades del Foro | Antivirus Online | Eliminar Malwares | Políticas del Foro | Blog

* Ayúdanos haciendo una DONACIÓN para poder seguir Ayudando.
* Para evitar Virus y Spywares al navegar por internet, USE FIREFOX !!
* No se resuelven dudas por Privados ni por E-mail, ya que para eso esta el foro.

post #7 (permalink)

18/09/08, 16:09:17

Gwain26

Usuario Habitual

Registrado: may 2008

Ubicación: ESPAÑA

Mensajes: 796

Re: ayuda co trojan.downloader

Ante esa perspectiva creo que la mejor opción es que sigas los consejos de Kirigi, pues creo que si lo haces lograrás solucionar tu problema.

post #8 (permalink)

19/09/08, 06:35:34

bizen

Usuario

Registrado: sep 2008

Ubicación: Béjar

Mensajes: 12

Re: ayuda co trojan.downloader

OK, voy a probarlo y os cuento...y sí tuve el maldito malware vundo.
Os cuento, salu2.

Log de combofix:
ComboFix 08-09-16.05 - Vicente 2008-09-19 11:37:14.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1397 [GMT 2:00]
Running from: C:\Documents and Settings\Vicente\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
C:\Documents and Settings\Vicente\Application Data\addon.dat
C:\Program Files\PCHealthCenter\0.gif
C:\Program Files\PCHealthCenter\1.gif
C:\Program Files\PCHealthCenter\2.gif
C:\Program Files\PCHealthCenter\3.gif
C:\Program Files\PCHealthCenter\sc.html
C:\WINDOWS\BM9fda6d66.txt
C:\WINDOWS\BM9fda6d66.xml
C:\WINDOWS\system32\akgcej.dll
C:\WINDOWS\system32\byvlywwk.ini
C:\WINDOWS\system32\ghagsrvc.ini
C:\WINDOWS\system32\kwwylvyb.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\NTssCcfe.ini
C:\WINDOWS\system32\NTssCcfe.ini2
C:\WINDOWS\system32\nuwxetvr.ini
C:\WINDOWS\system32\rfdcoldy.dll
C:\WINDOWS\system32\ydlocdfr.ini

.
((((((((((((((((((((((((( Files Created from 2008-08-19 to 2008-09-19 )))))))))))))))))))))))))))))))
.

2008-09-19 01:39 . 2008-09-19 01:39 <DIR> d-------- C:\Program Files\7-Zip
2008-09-18 20:15 . 2008-09-18 20:15 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-09-18 20:14 . 2008-09-18 20:15 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2008-09-18 20:14 . 2008-09-18 20:14 <DIR> d-------- C:\Documents and Settings\Vicente\Application Data\SUPERAntiSpyware.com
2008-09-17 20:13 . 2008-06-19 17:24 28,544 --a------ C:\WINDOWS\system32\drivers\pavboot.sys
2008-09-14 22:08 . 2008-07-18 22:07 270,880 --a------ C:\WINDOWS\system32\mucltui.dll
2008-09-14 22:08 . 2008-07-18 22:07 29,728 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-09-14 02:16 . 2008-09-15 23:24 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-09-14 02:16 . 2008-09-14 02:16 <DIR> d-------- C:\Documents and Settings\Vicente\Application Data\Malwarebytes
2008-09-14 02:16 . 2008-09-14 02:16 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-09-14 02:16 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-09-14 02:16 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-09-12 11:42 . 2008-09-12 11:42 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SlySoft
2008-09-12 11:38 . 2008-09-12 11:38 0 ---hs---- C:\WINDOWS\S16180593.tmp
2008-09-12 11:37 . 2008-09-12 11:37 <DIR> d-------- C:\Program Files\SlySoft
2008-09-11 23:08 . 2008-04-17 13:12 107,368 --a------ C:\WINDOWS\system32\GEARAspi.dll
2008-09-11 23:08 . 2008-04-17 13:12 15,464 --a------ C:\WINDOWS\system32\drivers\GEARAspiWDM.sys
2008-09-11 23:07 . 2008-09-11 23:08 <DIR> d-------- C:\Program Files\iTunes
2008-09-11 23:07 . 2008-09-11 23:07 <DIR> d-------- C:\Program Files\iPod
2008-09-11 23:07 . 2008-09-11 23:08 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-09-11 23:06 . 2008-09-11 23:06 <DIR> d-------- C:\Program Files\Bonjour
2008-09-11 23:06 . 2008-09-11 23:06 <DIR> d-------- C:\Program Files\Apple Software Update
2008-09-11 23:05 . 2008-09-11 23:08 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2008-09-11 23:05 . 2008-09-05 22:16 1,900,544 --a------ C:\WINDOWS\system32\usbaaplrc.dll
2008-09-11 23:05 . 2008-09-05 22:16 36,864 --a------ C:\WINDOWS\system32\drivers\usbaapl.sys
2008-09-11 15:41 . 2008-09-11 15:41 <DIR> d-------- C:\Program Files\Trend Micro
2008-09-10 22:59 . 2008-09-10 23:03 <DIR> d-------- C:\Program Files\QuickTime
2008-09-10 22:59 . 2008-09-11 23:04 <DIR> d-------- C:\Program Files\Common Files\Apple
2008-09-08 23:25 . 2008-09-12 20:39 257 --a------ C:\WINDOWS\wininit.ini
2008-09-08 22:14 . 2008-09-14 02:04 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-09-08 14:25 . 2008-09-08 14:25 754 --a------ C:\WINDOWS\system32\nnsecgyo.dll
2008-09-08 12:44 . 2008-09-08 12:44 354,560 --a------ C:\WINDOWS\system32\TuneUpDefragService.exe
2008-09-08 12:39 . 2008-09-08 12:43 <DIR> d-------- C:\Program Files\TuneUp Utilities 2008
2008-09-08 03:01 . 2008-09-08 03:01 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-09-08 02:06 . 2008-09-08 14:58 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-09-08 01:46 . 2008-09-08 01:46 <DIR> d-------- C:\Program Files\Google
2008-09-07 18:30 . 2008-09-18 22:44 <DIR> d-------- C:\Program Files\BitComet
2008-09-07 17:50 . 2008-09-07 17:50 0 --a------ C:\WINDOWS\nsreg.dat
2008-09-07 17:49 . 2008-09-08 00:56 <DIR> d-------- C:\Program Files\Mozilla Firefox(2)
2008-09-07 12:05 . 2008-09-14 19:09 <DIR> d-------- C:\WINDOWS\system32\CatRoot_bak
2008-09-07 12:04 . 2008-06-13 15:10 272,128 --------- C:\WINDOWS\system32\drivers\bthport.sys
2008-09-07 12:04 . 2008-06-13 15:10 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-09-07 12:03 . 2006-03-21 05:23 23,040 --------- C:\WINDOWS\kb913800.exe
2008-09-07 12:00 . 2008-09-17 21:02 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2008-09-06 15:09 . 2008-09-06 15:09 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
2008-09-06 15:09 . 2008-09-06 15:09 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts
2008-09-05 17:08 . 2008-09-05 17:08 <DIR> d-------- C:\Program Files\Common Files\SWF Studio
2008-09-05 01:41 . 2008-09-05 01:41 <DIR> d-------- C:\Documents and Settings\Vicente\Application Data\TuneUp Software
2008-09-05 01:41 . 2008-09-08 11:37 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\TuneUp Software
2008-09-05 01:40 . 2008-09-18 20:14 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-09-05 01:35 . 2008-09-05 01:36 <DIR> d-------- C:\Program Files\Cobian Backup 9
2008-09-05 01:31 . 2008-09-05 01:31 <DIR> d-------- C:\Program Files\ADSLNet
2008-09-05 01:30 . 2008-09-05 01:30 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2008-09-05 01:26 . 2008-09-18 23:58 67 --a------ C:\WINDOWS\DVDRegionFree.INI
2008-09-05 01:25 . 2008-09-05 01:25 <DIR> d-------- C:\Program Files\DVD Region+CSS Free
2008-09-05 01:17 . 2008-09-05 01:17 <DIR> d-------- C:\Program Files\Common Files\xing shared
2008-09-05 01:17 . 2008-09-05 01:17 <DIR> d-------- C:\Program Files\Common Files\Real
2008-09-05 01:16 . 2008-09-05 01:16 <DIR> d-------- C:\Program Files\Real
2008-09-05 01:08 . 2008-09-11 23:09 <DIR> d-------- C:\Documents and Settings\Vicente\Application Data\Apple Computer
2008-09-05 01:03 . 2008-09-11 23:07 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-09-05 01:01 . 2008-09-05 01:01 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple
2008-09-05 00:39 . 2008-09-05 00:39 <DIR> d-------- C:\Program Files\VideoLAN
2008-09-05 00:39 . 2008-09-05 00:39 <DIR> d-------- C:\Documents and Settings\Vicente\Application Data\vlc
2008-09-05 00:30 . 2008-09-05 00:30 <DIR> d-------- C:\Program Files\Alcohol Soft
2008-09-05 00:30 . 2008-09-05 00:30 <DIR> d-------- C:\Archivos de programa
2008-09-05 00:30 . 2004-04-30 09:37 160,640 --a------ C:\WINDOWS\system32\drivers\a347bus.sys
2008-09-05 00:30 . 2004-04-30 09:33 5,248 --a------ C:\WINDOWS\system32\drivers\a347scsi.sys
2008-09-05 00:16 . 2008-09-05 00:16 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-09-05 00:12 . 2008-09-05 00:12 <DIR> d-------- C:\Program Files\pspvideo9
2008-09-05 00:12 . 2008-09-05 00:12 <DIR> d-------- C:\Program Files\AviSynth 2.5
2008-09-05 00:08 . 2008-09-05 00:08 <DIR> d-------- C:\Documents and Settings\Vicente\Application Data\Media Player Classic
2008-09-05 00:05 . 2008-09-05 00:05 <DIR> d-------- C:\Program Files\DVD Shrink
2008-09-04 23:38 . 2008-09-08 01:01 <DIR> d-------- C:\Program Files\Supportsoft
2008-09-04 23:38 . 2008-09-07 17:46 <DIR> d-------- C:\Program Files\Support.com
2008-09-04 23:38 . 2008-09-04 23:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Support.com
2008-09-04 23:05 . 2008-09-08 01:01 <DIR> d-------- C:\Program Files\Telefonica
2008-09-04 21:06 . 2008-09-04 21:06 <DIR> d--h----- C:\Documents and Settings\All Users\Application Data\CanonBJ
2008-09-04 21:06 . 2005-05-06 22:00 140,288 --a------ C:\WINDOWS\system32\CNMLM7K.DLL
2008-09-04 21:06 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-09-04 21:06 . 2004-08-03 23:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2008-09-04 21:06 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2008-09-04 21:06 . 2004-08-03 22:58 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys
2008-09-04 21:06 . 2005-05-06 22:00 8,704 --a------ C:\WINDOWS\system32\CNMVS7K.DLL
2008-09-04 08:57 . 2008-09-04 08:57 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\DivX
2008-09-03 23:09 . 2008-09-03 23:09 <DIR> d-------- C:\Program Files\Recuva
2008-09-03 23:05 . 2008-09-03 23:05 <DIR> d-------- C:\Program Files\CCleaner
2008-09-03 22:57 . 2008-09-05 00:06 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\DVD Shrink
2008-09-03 22:53 . 2008-09-03 22:53 <DIR> d-------- C:\Program Files\K-Lite Codec Pack
2008-09-03 22:45 . 2008-09-03 22:45 <DIR> d-------- C:\Program Files\TotalAudioConverter
2008-09-03 22:45 . 2008-09-03 22:45 <DIR> d-------- C:\Documents and Settings\Vicente\Application Data\Softplicity
2008-09-02 20:08 . 2008-09-02 20:08 <DIR> d-------- C:\Documents and Settings\Vicente\Application Data\CyberLink
2008-09-02 19:39 . 2004-08-04 00:56 21,504 --a------ C:\WINDOWS\system32\hidserv.dll
2008-09-02 19:39 . 2004-08-04 00:56 21,504 --a--c--- C:\WINDOWS\system32\dllcache\hidserv.dll
2008-09-02 19:38 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2008-09-02 19:38 . 2004-08-03 23:08 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys
2008-09-02 19:38 . 2001-08-17 13:48 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys
2008-09-02 19:38 . 2001-08-17 13:48 12,160 --a--c--- C:\WINDOWS\system32\dllcache\mouhid.sys
2008-09-02 19:38 . 2001-08-17 14:02 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys
2008-09-02 19:38 . 2001-08-17 14:02 9,600 --a--c--- C:\WINDOWS\system32\dllcache\hidusb.sys
2008-09-02 17:15 . 2008-09-18 23:58 69 --a------ C:\WINDOWS\NeroDigital.ini
2008-09-02 17:13 . 2008-09-02 17:13 13,646 --a------ C:\WINDOWS\system32\wpa.bak
2008-09-02 17:11 . 2008-09-19 00:27 273,592 --a------ C:\WINDOWS\system32\drivers\APPFCONT.DAT.bck
2008-09-02 17:11 . 2008-09-19 11:36 1,204 --a------ C:\WINDOWS\system32\drivers\APPFLTR.CFG.bck
2008-09-02 17:10 . 2008-09-02 17:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\sentinel
2008-09-02 17:03 . 2008-09-17 20:12 <DIR> d-------- C:\Program Files\Panda Security
2008-09-02 17:03 . 2007-07-12 08:42 292,144 --a------ C:\WINDOWS\system32\PavSHook.dll
2008-09-02 17:03 . 2007-03-13 18:01 161,328 --a------ C:\WINDOWS\system32\TpUtil.dll
2008-09-02 17:03 . 2007-04-24 15:43 142,128 --a------ C:\WINDOWS\system32\drivers\netimflt.sys
2008-09-02 17:03 . 2006-06-27 19:36 101,888 --a------ C:\WINDOWS\system32\SYSTOOLS.DLL
2008-09-02 17:03 . 2007-02-28 18:04 63,024 --a------ C:\WINDOWS\system32\pavipc.dll
2008-09-02 17:03 . 2007-03-15 19:38 54,832 --a------ C:\WINDOWS\system32\pavcpl.cpl
2008-09-02 17:03 . 2007-02-15 20:02 50,736 --a------ C:\WINDOWS\system32\avldr.dll
2008-09-02 17:03 . 2007-06-08 08:44 24,760 --a------ C:\WINDOWS\system32\drivers\cpoint.sys
2008-09-02 17:03 . 2007-04-24 16:43 1,990 --a------ C:\WINDOWS\system32\drivers\net_m32.inf
2008-09-02 17:02 . 2008-09-02 17:02 <DIR> d-------- C:\Program Files\Common Files\Panda Software
2008-09-02 17:02 . 2007-07-12 13:49 178,872 --a------ C:\WINDOWS\system32\drivers\PavProc.sys
2008-09-02 17:02 . 2007-05-23 15:40 38,968 --a------ C:\WINDOWS\system32\drivers\ShlDrv51.sys
2008-09-02 14:18 . 2001-08-17 15:59 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys
2008-09-02 14:17 . 2004-08-04 00:59 57,472 --a------ C:\WINDOWS\system32\drivers\redbook.sys
2008-09-02 14:16 . 2004-08-04 02:56 74,240 --a------ C:\WINDOWS\system32\usbui.dll
2008-09-02 14:14 . 2008-09-08 22:11 <DIR> dr------- C:\Documents and Settings\All Users\Documents
2008-09-02 14:13 . 2008-09-02 12:48 <DIR> d--h----- C:\Documents and Settings\Default User
2008-09-02 14:13 . 2008-09-02 12:28 <DIR> d-------- C:\Documents and Settings\All Users
2008-09-02 14:13 . 2008-09-02 12:36 <DIR> d-------- C:\Documents and Settings
2008-08-29 10:18 . 2008-08-29 10:18 87,336 --a------ C:\WINDOWS\system32\dns-sd.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2008-09-19 09:36 1,204 ----a-w C:\WINDOWS\system32\drivers\APPFLTR.CFG
2008-09-18 22:27 273,592 ----a-w C:\WINDOWS\system32\drivers\APPFCONT.DAT
2008-09-02 15:03 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-02 11:51 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-09-02 11:50 --------- d-----w C:\Program Files\MSBuild
2008-09-02 11:50 --------- d-----w C:\Program Files\Microsoft Works
2008-09-02 11:49 --------- d-----w C:\Program Files\Microsoft.NET
2008-09-02 11:36 --------- d-----w C:\Documents and Settings\Vicente\Application Data\Ahead
2008-09-02 11:35 --------- d-----w C:\Program Files\Common Files\Ahead
2008-09-02 11:32 --------- d-----w C:\Program Files\Nero
2008-09-02 11:29 --------- d-----w C:\Program Files\ScanSoft
2008-09-02 11:29 --------- d-----w C:\Program Files\Common Files\ScanSoft Shared
2008-09-02 11:29 --------- d-----w C:\Documents and Settings\Vicente\Application Data\ScanSoft
2008-09-02 11:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\SSScanWizard
2008-09-02 11:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\SSScanAppDataDir
2008-09-02 11:28 --------- d-----w C:\Program Files\ArcSoft
2008-09-02 11:27 --------- d-----w C:\Program Files\Canon
2008-09-02 11:24 --------- d-----w C:\Program Files\CyberLink
2008-09-02 11:24 --------- d-----w C:\Documents and Settings\All Users\Application Data\CyberLink
2008-09-02 11:23 --------- d-----w C:\Program Files\Internet Keyboard
2008-09-02 11:20 --------- d-----w C:\Program Files\WildTangent
2008-09-02 11:14 --------- d-----w C:\Program Files\ASUS
2008-09-02 11:09 --------- d-----w C:\Program Files\Realtek
2008-09-02 11:09 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-09-02 11:09 --------- d-----w C:\Documents and Settings\Vicente\Application Data\ATI
2008-09-02 11:07 --------- d-----w C:\Program Files\ATI Technologies
2008-09-02 10:46 --------- d-----w C:\Program Files\Windows XP MUI Pack
2008-09-02 10:30 --------- d-----w C:\Program Files\microsoft frontpage
2008-09-02 10:24 --------- d-----w C:\Program Files\Windows Plus
2008-07-25 08:34 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2008-07-25 08:34 683,520 ----a-w C:\WINDOWS\system32\divx.dll
2008-07-23 16:50 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-18 20:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
2008-07-07 20:32 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-23 16:57 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-06-01 94208]
"BitComet"="C:\Program Files\BitComet\BitComet.exe" [2006-06-23 3394048]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-05 64512]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056]
"PCMService"="C:\Program Files\CyberLink\PowerCinema\PCMService.exe" [2005-05-11 127118]
"MediaKey"="C:\PROGRA~1\INTERN~2\MEDIAKEY.EXE" [2000-08-01 73728]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2005-01-12 32768]
"OpwareSE2"="C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [2003-05-08 49152]
"OPSE reminder"="C:\Program Files\ScanSoft\OmniPageSE2.0\EregSpa\Ereg.exe" [2003-07-07 729088]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-09-05 185896]
"hcenter"="C:\Program Files\Support.com\bin\tgcmd.exe" [2004-07-07 1916928]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-09-06 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-09-08 289576]
"CloneCDTray"="C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" [2006-09-28 57344]
"Malwarebytes Anti-Malware (reboot)"="C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" [2008-09-10 1253040]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 C:\WINDOWS\system32\HdAShCut.exe]
"RTHDCPL"="RTHDCPL.EXE" [2005-11-10 C:\WINDOWS\RTHDCPL.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-10 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[hkey_local_machine\software\microsoft\windows\curr entversion\explorer\ShellExecuteHooks]
"{93994DE8-8239-4655-B1D1-5F4E91300429}"= "C:\PROGRA~1\DVDREG~1\DVDShell.dll" [2004-10-09 49152]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-07-23 16:28 352256 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr]
2007-02-15 20:02 50736 C:\WINDOWS\system32\avldr.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=akgcej.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\CyberLink\\PowerCinema\\PowerCinema.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\GloballyOpenPorts\List]
"4664:TCP"= 4664:TCP:BitComet 4664 TCP
"4664:UDP"= 4664:UDP:BitComet 4664 UDP
"4662:TCP"= 4662:TCP:BitComet 4662 TCP
"4662:UDP"= 4662:UDP:BitComet 4662 UDP

R0 pavboot;pavboot;C:\WINDOWS\system32\drivers\pavboo t.sys [2008-06-19 28544]
R1 APPFLT;App Filter Plugin;C:\WINDOWS\system32\Drivers\APPFLT.SYS [2007-05-11 71736]
R1 DSAFLT;DSA Filter Plugin;C:\WINDOWS\system32\Drivers\DSAFLT.SYS [2007-05-11 51256]
R1 FNETMON;NetMon Filter Plugin;C:\WINDOWS\system32\Drivers\fnetmon.SYS [2007-05-11 22072]
R1 IDSFLT;Ids Filter Plugin;C:\WINDOWS\system32\Drivers\IDSFLT.SYS [2007-07-11 191672]
R1 NETFLTDI;Panda Net Driver [TDI Layer];C:\WINDOWS\system32\Drivers\NETFLTDI.SYS [2007-05-11 09:33 132920]
R1 ShldDrv;Panda File Shield Driver;C:\WINDOWS\system32\DRIVERS\ShlDrv51.sys [2007-05-23 38968]
R1 SMSFLT;SMS Filter Plugin;C:\WINDOWS\system32\Drivers\SMSFLT.SYS [2007-05-11 37304]
R1 WNMFLT;Wifi Monitor Filter Plugin;C:\WINDOWS\system32\Drivers\WNMFLT.SYS [2007-05-11 30648]
R2 CobianBackupAmanita;Servicio de Cobian Backup 9;C:\Program Files\Cobian Backup 9\cbService.exe [2008-07-03 582144]
R2 cpoint;Panda CPoint Driver;C:\WINDOWS\system32\Drivers\cpoint.sys [2007-06-08 24760]
R2 PavProc;Panda Process Protection Driver;C:\WINDOWS\system32\DRIVERS\PavProc.sys [2007-07-12 178872]
R3 3xHybrid;3xHybrid service;C:\WINDOWS\system32\DRIVERS\3xHybrid.sys [2005-12-26 2815744]
R3 AvFlt;Antivirus Filter Driver;C:\WINDOWS\system32\drivers\av5flt.sys [ ]
R3 NETIMFLT;PANDA NDIS IM Filter Miniport;C:\WINDOWS\system32\DRIVERS\netimflt.sys [2007-04-24 142128]
R3 PavSRK.sys;PavSRK.sys;C:\WINDOWS\system32\PavSRK.s ys [ ]
R3 PavTPK.sys;PavTPK.sys;C:\WINDOWS\system32\PavTPK.s ys [ ]
S2 MBAMService;MBAMService;C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [2008-09-10 110256]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.ex e [2008-09-08 354560]

*Newly Created Service* - MBAMSERVICE
.
Contents of the 'Scheduled Tasks' folder
.
- - - - ORPHANS REMOVED - - - -

Notify-geBsrQGx - (no file)

.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Vicente\Application Data\Mozilla\Firefox\Profiles\uch3ouee.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - www.google.com
FF -: plugin - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
.

************************************************** ************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-19 11:38:31
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

************************************************** ************************
.
Completion time: 2008-09-19 11:39:16
ComboFix-quarantined-files.txt 2008-09-19 09:39:13

Pre-Run: 106,090,283,008 bytes free
Post-Run: 106,128,596,992 bytes libres

310 --- E O F --- 2008-09-15 01:00:54

Edito: DESDE QUE HE PASADO EL COMBOFIX, SE ME HA RALENTIZADO EL PC MUCHÍÍÍÍÍÍSIMO.
Reedito: He reiniciado de nuevo y parece que va mas rápido.

Última edición por bizen fecha: 19/09/08 a las 07:50:12.

post #9 (permalink)

19/09/08, 20:03:22

Kirigi

Warrior

Registrado: jun 2007

Ubicación: Venezuela- Vargas- La Guaira

Mensajes: 4.930

Re: ayuda co trojan.downloader

Hola bizen

Después de esto recuerda comentar com sigue el pc

1.-Abrir el Notepad (Bloc de Notas)

Ir a INICIO > EJECUTAR >
Y ahí pones notepad.exe y ACEPTAR

2.-Ahora copia y pega estos archivos dentro del Notepad

Código:

KillAll::

File::
C:\WINDOWS\S16180593.tmp
C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
C:\WINDOWS\system32\nnsecgyo.dll

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"="

3.- Graba este archivo con el nombre CFScript.txt y déjalo en tu escritorio.

4.- Arrastrar y soltar el archivo CFScript.txt dentro del archivo ComboFix.exe como lo muestra la animación de abajo. Esto activara ComboFix nuevamente.

Reinicia tu PC y nos dejas un el nuevo reporte de ComboFix, comentándonos como esta funcionado todo actualmente?

post #10 (permalink)

22/09/08, 18:45:24

bizen

Usuario

Registrado: sep 2008

Ubicación: Béjar

Mensajes: 12

Re: ayuda co trojan.downloader

Hola de nuevo.
Os dejo el log de combofix:

ComboFix 08-09-16.05 - Vicente 2008-09-19 14:33:14.3 - NTFSx86 MINIMAL
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1723 [GMT 2:00]
Running from: C:\Documents and Settings\Vicente\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Vicente\Desktop\CFScript.txt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-08-19 to 2008-09-19 )))))))))))))))))))))))))))))))
.

2008-09-19 01:39 . 2008-09-19 01:39 <DIR> d-------- C:\Program Files\7-Zip
2008-09-18 20:15 . 2008-09-18 20:15 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-09-18 20:14 . 2008-09-18 20:15 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2008-09-18 20:14 . 2008-09-18 20:14 <DIR> d-------- C:\Documents and Settings\Vicente\Application Data\SUPERAntiSpyware.com
2008-09-17 20:13 . 2008-06-19 17:24 28,544 --a------ C:\WINDOWS\system32\drivers\pavboot.sys
2008-09-14 22:08 . 2008-07-18 22:07 270,880 --a------ C:\WINDOWS\system32\mucltui.dll
2008-09-14 22:08 . 2008-07-18 22:07 29,728 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-09-14 02:16 . 2008-09-15 23:24 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-09-14 02:16 . 2008-09-14 02:16 <DIR> d-------- C:\Documents and Settings\Vicente\Application Data\Malwarebytes
2008-09-14 02:16 . 2008-09-14 02:16 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-09-14 02:16 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-09-14 02:16 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-09-12 11:42 . 2008-09-12 11:42 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SlySoft
2008-09-12 11:38 . 2008-09-12 11:38 0 ---hs---- C:\WINDOWS\S16180593.tmp
2008-09-12 11:37 . 2008-09-12 11:37 <DIR> d-------- C:\Program Files\SlySoft
2008-09-11 23:08 . 2008-04-17 13:12 107,368 --a------ C:\WINDOWS\system32\GEARAspi.dll
2008-09-11 23:08 . 2008-04-17 13:12 15,464 --a------ C:\WINDOWS\system32\drivers\GEARAspiWDM.sys
2008-09-11 23:07 . 2008-09-11 23:08 <DIR> d-------- C:\Program Files\iTunes
2008-09-11 23:07 . 2008-09-11 23:07 <DIR> d-------- C:\Program Files\iPod
2008-09-11 23:07 . 2008-09-11 23:08 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-09-11 23:06 . 2008-09-11 23:06 <DIR> d-------- C:\Program Files\Bonjour
2008-09-11 23:06 . 2008-09-11 23:06 <DIR> d-------- C:\Program Files\Apple Software Update
2008-09-11 23:05 . 2008-09-11 23:08 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2008-09-11 23:05 . 2008-09-05 22:16 1,900,544 --a------ C:\WINDOWS\system32\usbaaplrc.dll
2008-09-11 23:05 . 2008-09-05 22:16 36,864 --a------ C:\WINDOWS\system32\drivers\usbaapl.sys
2008-09-11 15:41 . 2008-09-11 15:41 <DIR> d-------- C:\Program Files\Trend Micro
2008-09-10 22:59 . 2008-09-10 23:03 <DIR> d-------- C:\Program Files\QuickTime
2008-09-10 22:59 . 2008-09-11 23:04 <DIR> d-------- C:\Program Files\Common Files\Apple
2008-09-08 23:25 . 2008-09-12 20:39 257 --a------ C:\WINDOWS\wininit.ini
2008-09-08 22:14 . 2008-09-14 02:04 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-09-08 14:25 . 2008-09-08 14:25 754 --a------ C:\WINDOWS\system32\nnsecgyo.dll
2008-09-08 12:44 . 2008-09-08 12:44 354,560 --a------ C:\WINDOWS\system32\TuneUpDefragService.exe
2008-09-08 12:39 . 2008-09-08 12:43 <DIR> d-------- C:\Program Files\TuneUp Utilities 2008
2008-09-08 03:01 . 2008-09-08 03:01 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-09-08 02:06 . 2008-09-08 14:58 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-09-08 01:46 . 2008-09-08 01:46 <DIR> d-------- C:\Program Files\Google
2008-09-07 18:30 . 2008-09-18 22:44 <DIR> d-------- C:\Program Files\BitComet
2008-09-07 17:50 . 2008-09-07 17:50 0 --a------ C:\WINDOWS\nsreg.dat
2008-09-07 17:49 . 2008-09-08 00:56 <DIR> d-------- C:\Program Files\Mozilla Firefox(2)
2008-09-07 12:05 . 2008-09-14 19:09 <DIR> d-------- C:\WINDOWS\system32\CatRoot_bak
2008-09-07 12:04 . 2008-06-13 15:10 272,128 --------- C:\WINDOWS\system32\drivers\bthport.sys
2008-09-07 12:04 . 2008-06-13 15:10 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-09-07 12:03 . 2006-03-21 05:23 23,040 --------- C:\WINDOWS\kb913800.exe
2008-09-07 12:00 . 2008-09-17 21:02 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2008-09-06 15:09 . 2008-09-06 15:09 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
2008-09-06 15:09 . 2008-09-06 15:09 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts
2008-09-05 17:08 . 2008-09-05 17:08 <DIR> d-------- C:\Program Files\Common Files\SWF Studio
2008-09-05 01:41 . 2008-09-05 01:41 <DIR> d-------- C:\Documents and Settings\Vicente\Application Data\TuneUp Software
2008-09-05 01:41 . 2008-09-08 11:37 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\TuneUp Software
2008-09-05 01:40 . 2008-09-18 20:14 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-09-05 01:35 . 2008-09-05 01:36 <DIR> d-------- C:\Program Files\Cobian Backup 9
2008-09-05 01:31 . 2008-09-05 01:31 <DIR> d-------- C:\Program Files\ADSLNet
2008-09-05 01:30 . 2008-09-05 01:30 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2008-09-05 01:26 . 2008-09-19 12:48 68 --a------ C:\WINDOWS\DVDRegionFree.INI
2008-09-05 01:25 . 2008-09-05 01:25 <DIR> d-------- C:\Program Files\DVD Region+CSS Free
2008-09-05 01:17 . 2008-09-05 01:17 <DIR> d-------- C:\Program Files\Common Files\xing shared
2008-09-05 01:17 . 2008-09-05 01:17 <DIR> d-------- C:\Program Files\Common Files\Real
2008-09-05 01:16 . 2008-09-05 01:16 <DIR> d-------- C:\Program Files\Real
2008-09-05 01:08 . 2008-09-11 23:09 <DIR> d-------- C:\Documents and Settings\Vicente\Application Data\Apple Computer
2008-09-05 01:03 . 2008-09-11 23:07 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-09-05 01:01 . 2008-09-05 01:01 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple
2008-09-05 00:39 . 2008-09-05 00:39 <DIR> d-------- C:\Program Files\VideoLAN
2008-09-05 00:39 . 2008-09-05 00:39 <DIR> d-------- C:\Documents and Settings\Vicente\Application Data\vlc
2008-09-05 00:30 . 2008-09-05 00:30 <DIR> d-------- C:\Program Files\Alcohol Soft
2008-09-05 00:30 . 2008-09-05 00:30 <DIR> d-------- C:\Archivos de programa
2008-09-05 00:30 . 2004-04-30 09:37 160,640 --a------ C:\WINDOWS\system32\drivers\a347bus.sys
2008-09-05 00:30 . 2004-04-30 09:33 5,248 --a------ C:\WINDOWS\system32\drivers\a347scsi.sys
2008-09-05 00:16 . 2008-09-05 00:16 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-09-05 00:12 . 2008-09-05 00:12 <DIR> d-------- C:\Program Files\pspvideo9
2008-09-05 00:12 . 2008-09-05 00:12 <DIR> d-------- C:\Program Files\AviSynth 2.5
2008-09-05 00:08 . 2008-09-05 00:08 <DIR> d-------- C:\Documents and Settings\Vicente\Application Data\Media Player Classic
2008-09-05 00:05 . 2008-09-05 00:05 <DIR> d-------- C:\Program Files\DVD Shrink
2008-09-04 23:38 . 2008-09-08 01:01 <DIR> d-------- C:\Program Files\Supportsoft
2008-09-04 23:38 . 2008-09-07 17:46 <DIR> d-------- C:\Program Files\Support.com
2008-09-04 23:38 . 2008-09-04 23:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Support.com
2008-09-04 23:05 . 2008-09-08 01:01 <DIR> d-------- C:\Program Files\Telefonica
2008-09-04 21:06 . 2008-09-04 21:06 <DIR> d--h----- C:\Documents and Settings\All Users\Application Data\CanonBJ
2008-09-04 21:06 . 2005-05-06 22:00 140,288 --a------ C:\WINDOWS\system32\CNMLM7K.DLL
2008-09-04 21:06 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-09-04 21:06 . 2004-08-03 23:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2008-09-04 21:06 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2008-09-04 21:06 . 2004-08-03 22:58 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys
2008-09-04 21:06 . 2005-05-06 22:00 8,704 --a------ C:\WINDOWS\system32\CNMVS7K.DLL
2008-09-04 08:57 . 2008-09-04 08:57 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\DivX
2008-09-03 23:09 . 2008-09-03 23:09 <DIR> d-------- C:\Program Files\Recuva
2008-09-03 23:05 . 2008-09-03 23:05 <DIR> d-------- C:\Program Files\CCleaner
2008-09-03 22:57 . 2008-09-05 00:06 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\DVD Shrink
2008-09-03 22:53 . 2008-09-03 22:53 <DIR> d-------- C:\Program Files\K-Lite Codec Pack
2008-09-03 22:45 . 2008-09-03 22:45 <DIR> d-------- C:\Program Files\TotalAudioConverter
2008-09-03 22:45 . 2008-09-03 22:45 <DIR> d-------- C:\Documents and Settings\Vicente\Application Data\Softplicity
2008-09-02 20:08 . 2008-09-02 20:08 <DIR> d-------- C:\Documents and Settings\Vicente\Application Data\CyberLink
2008-09-02 19:39 . 2004-08-04 00:56 21,504 --a------ C:\WINDOWS\system32\hidserv.dll
2008-09-02 19:39 . 2004-08-04 00:56 21,504 --a--c--- C:\WINDOWS\system32\dllcache\hidserv.dll
2008-09-02 19:38 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2008-09-02 19:38 . 2004-08-03 23:08 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys
2008-09-02 19:38 . 2001-08-17 13:48 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys
2008-09-02 19:38 . 2001-08-17 13:48 12,160 --a--c--- C:\WINDOWS\system32\dllcache\mouhid.sys
2008-09-02 19:38 . 2001-08-17 14:02 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys
2008-09-02 19:38 . 2001-08-17 14:02 9,600 --a--c--- C:\WINDOWS\system32\dllcache\hidusb.sys
2008-09-02 17:15 . 2008-09-18 23:58 69 --a------ C:\WINDOWS\NeroDigital.ini
2008-09-02 17:13 . 2008-09-02 17:13 13,646 --a------ C:\WINDOWS\system32\wpa.bak
2008-09-02 17:11 . 2008-09-19 12:41 269,248 --a------ C:\WINDOWS\system32\drivers\APPFCONT.DAT.bck
2008-09-02 17:11 . 2008-09-19 12:41 1,204 --a------ C:\WINDOWS\system32\drivers\APPFLTR.CFG.bck
2008-09-02 17:10 . 2008-09-02 17:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\sentinel
2008-09-02 17:03 . 2008-09-17 20:12 <DIR> d-------- C:\Program Files\Panda Security
2008-09-02 17:03 . 2007-07-12 08:42 292,144 --a------ C:\WINDOWS\system32\PavSHook.dll
2008-09-02 17:03 . 2007-03-13 18:01 161,328 --a------ C:\WINDOWS\system32\TpUtil.dll
2008-09-02 17:03 . 2007-04-24 15:43 142,128 --a------ C:\WINDOWS\system32\drivers\netimflt.sys
2008-09-02 17:03 . 2006-06-27 19:36 101,888 --a------ C:\WINDOWS\system32\SYSTOOLS.DLL
2008-09-02 17:03 . 2007-02-28 18:04 63,024 --a------ C:\WINDOWS\system32\pavipc.dll
2008-09-02 17:03 . 2007-03-15 19:38 54,832 --a------ C:\WINDOWS\system32\pavcpl.cpl
2008-09-02 17:03 . 2007-02-15 20:02 50,736 --a------ C:\WINDOWS\system32\avldr.dll
2008-09-02 17:03 . 2007-06-08 08:44 24,760 --a------ C:\WINDOWS\system32\drivers\cpoint.sys
2008-09-02 17:03 . 2007-04-24 16:43 1,990 --a------ C:\WINDOWS\system32\drivers\net_m32.inf
2008-09-02 17:02 . 2008-09-02 17:02 <DIR> d-------- C:\Program Files\Common Files\Panda Software
2008-09-02 17:02 . 2007-07-12 13:49 178,872 --a------ C:\WINDOWS\system32\drivers\PavProc.sys
2008-09-02 17:02 . 2007-05-23 15:40 38,968 --a------ C:\WINDOWS\system32\drivers\ShlDrv51.sys
2008-09-02 14:18 . 2001-08-17 15:59 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys
2008-09-02 14:17 . 2004-08-04 00:59 57,472 --a------ C:\WINDOWS\system32\drivers\redbook.sys
2008-09-02 14:16 . 2004-08-04 02:56 74,240 --a------ C:\WINDOWS\system32\usbui.dll
2008-09-02 14:14 . 2008-09-08 22:11 <DIR> dr------- C:\Documents and Settings\All Users\Documents
2008-09-02 14:13 . 2008-09-19 11:39 <DIR> d--h----- C:\Documents and Settings\Default User
2008-09-02 14:13 . 2008-09-02 12:28 <DIR> d-------- C:\Documents and Settings\All Users
2008-09-02 14:13 . 2008-09-02 12:36 <DIR> d-------- C:\Documents and Settings
2008-08-29 10:18 . 2008-08-29 10:18 87,336 --a------ C:\WINDOWS\system32\dns-sd.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2008-09-19 10:41 269,248 ----a-w C:\WINDOWS\system32\drivers\APPFCONT.DAT
2008-09-19 10:41 1,204 ----a-w C:\WINDOWS\system32\drivers\APPFLTR.CFG
2008-09-02 15:03 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-02 11:51 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-09-02 11:50 --------- d-----w C:\Program Files\MSBuild
2008-09-02 11:50 --------- d-----w C:\Program Files\Microsoft Works
2008-09-02 11:49 --------- d-----w C:\Program Files\Microsoft.NET
2008-09-02 11:36 --------- d-----w C:\Documents and Settings\Vicente\Application Data\Ahead
2008-09-02 11:35 --------- d-----w C:\Program Files\Common Files\Ahead
2008-09-02 11:32 --------- d-----w C:\Program Files\Nero
2008-09-02 11:29 --------- d-----w C:\Program Files\ScanSoft
2008-09-02 11:29 --------- d-----w C:\Program Files\Common Files\ScanSoft Shared
2008-09-02 11:29 --------- d-----w C:\Documents and Settings\Vicente\Application Data\ScanSoft
2008-09-02 11:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\SSScanWizard
2008-09-02 11:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\SSScanAppDataDir
2008-09-02 11:28 --------- d-----w C:\Program Files\ArcSoft
2008-09-02 11:27 --------- d-----w C:\Program Files\Canon
2008-09-02 11:24 --------- d-----w C:\Program Files\CyberLink
2008-09-02 11:24 --------- d-----w C:\Documents and Settings\All Users\Application Data\CyberLink
2008-09-02 11:23 --------- d-----w C:\Program Files\Internet Keyboard
2008-09-02 11:20 --------- d-----w C:\Program Files\WildTangent
2008-09-02 11:14 --------- d-----w C:\Program Files\ASUS
2008-09-02 11:09 --------- d-----w C:\Program Files\Realtek
2008-09-02 11:09 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-09-02 11:09 --------- d-----w C:\Documents and Settings\Vicente\Application Data\ATI
2008-09-02 11:07 --------- d-----w C:\Program Files\ATI Technologies
2008-09-02 10:46 --------- d-----w C:\Program Files\Windows XP MUI Pack
2008-09-02 10:30 --------- d-----w C:\Program Files\microsoft frontpage
2008-09-02 10:24 --------- d-----w C:\Program Files\Windows Plus
2008-07-25 08:34 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2008-07-25 08:34 683,520 ----a-w C:\WINDOWS\system32\divx.dll
2008-07-23 16:50 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-18 20:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
2008-07-07 20:32 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-23 16:57 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-06-01 94208]
"BitComet"="C:\Program Files\BitComet\BitComet.exe" [2006-06-23 3394048]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-05 64512]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056]
"PCMService"="C:\Program Files\CyberLink\PowerCinema\PCMService.exe" [2005-05-11 127118]
"MediaKey"="C:\PROGRA~1\INTERN~2\MEDIAKEY.EXE" [2000-08-01 73728]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2005-01-12 32768]
"OpwareSE2"="C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [2003-05-08 49152]
"OPSE reminder"="C:\Program Files\ScanSoft\OmniPageSE2.0\EregSpa\Ereg.exe" [2003-07-07 729088]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-09-05 185896]
"hcenter"="C:\Program Files\Support.com\bin\tgcmd.exe" [2004-07-07 1916928]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-09-06 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-09-08 289576]
"CloneCDTray"="C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" [2006-09-28 57344]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 C:\WINDOWS\system32\HdAShCut.exe]
"RTHDCPL"="RTHDCPL.EXE" [2005-11-10 C:\WINDOWS\RTHDCPL.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-10 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[hkey_local_machine\software\microsoft\windows\curr entversion\explorer\ShellExecuteHooks]
"{93994DE8-8239-4655-B1D1-5F4E91300429}"= "C:\PROGRA~1\DVDREG~1\DVDShell.dll" [2004-10-09 49152]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-07-23 16:28 352256 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr]
2007-02-15 20:02 50736 C:\WINDOWS\system32\avldr.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=akgcej.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\CyberLink\\PowerCinema\\PowerCinema.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\GloballyOpenPorts\List]
"4664:TCP"= 4664:TCP:BitComet 4664 TCP
"4664:UDP"= 4664:UDP:BitComet 4664 UDP
"4662:TCP"= 4662:TCP:BitComet 4662 TCP
"4662:UDP"= 4662:UDP:BitComet 4662 UDP

S0 pavboot;pavboot;C:\WINDOWS\system32\drivers\pavboo t.sys [2008-06-19 28544]
S1 APPFLT;App Filter Plugin;C:\WINDOWS\system32\Drivers\APPFLT.SYS [2007-05-11 71736]
S1 DSAFLT;DSA Filter Plugin;C:\WINDOWS\system32\Drivers\DSAFLT.SYS [2007-05-11 51256]
S1 FNETMON;NetMon Filter Plugin;C:\WINDOWS\system32\Drivers\fnetmon.SYS [2007-05-11 22072]
S1 IDSFLT;Ids Filter Plugin;C:\WINDOWS\system32\Drivers\IDSFLT.SYS [2007-07-11 191672]
S1 NETFLTDI;Panda Net Driver [TDI Layer];C:\WINDOWS\system32\Drivers\NETFLTDI.SYS [2007-05-11 09:33 132920]
S1 ShldDrv;Panda File Shield Driver;C:\WINDOWS\system32\DRIVERS\ShlDrv51.sys [2007-05-23 38968]
S1 SMSFLT;SMS Filter Plugin;C:\WINDOWS\system32\Drivers\SMSFLT.SYS [2007-05-11 37304]
S1 WNMFLT;Wifi Monitor Filter Plugin;C:\WINDOWS\system32\Drivers\WNMFLT.SYS [2007-05-11 30648]
S2 CobianBackupAmanita;Servicio de Cobian Backup 9;C:\Program Files\Cobian Backup 9\cbService.exe [2008-07-03 582144]
S2 cpoint;Panda CPoint Driver;C:\WINDOWS\system32\Drivers\cpoint.sys [2007-06-08 24760]
S2 MBAMDrvService;MBAMDrvService;C:\WINDOWS\system32\ drivers\mbam.sys [2008-09-10 17200]
S2 MBAMService;MBAMService;C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [2008-09-10 110256]
S2 PavProc;Panda Process Protection Driver;C:\WINDOWS\system32\DRIVERS\PavProc.sys [2007-07-12 178872]
S3 3xHybrid;3xHybrid service;C:\WINDOWS\system32\DRIVERS\3xHybrid.sys [2005-12-26 2815744]
S3 AvFlt;Antivirus Filter Driver;C:\WINDOWS\system32\drivers\av5flt.sys [ ]
S3 NETIMFLT;PANDA NDIS IM Filter Miniport;C:\WINDOWS\system32\DRIVERS\netimflt.sys [2007-04-24 142128]
S3 PavSRK.sys;PavSRK.sys;C:\WINDOWS\system32\PavSRK.s ys [ ]
S3 PavTPK.sys;PavTPK.sys;C:\WINDOWS\system32\PavTPK.s ys [ ]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.ex e [2008-09-08 354560]
.
Contents of the 'Scheduled Tasks' folder
.

************************************************** ************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-19 14:36:20
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

************************************************** ************************
.
Completion time: 2008-09-19 14:38:35
ComboFix-quarantined-files.txt 2008-09-19 12:38:00
ComboFix2.txt 2008-09-19 09:39:18

Pre-Run: 106,126,766,080 bytes free
Post-Run: 106,111,836,160 bytes libres

277 --- E O F --- 2008-09-15 01:00:54

Gracias y salu2.

Página 1 de 2

« Tema Anterior | Próximo Tema »

Herramientas
Mostrar Versión Imprimible Enviar por Correo

Reglas del foro
No puedes crear nuevos temas No puedes responder temas No puedes subir adjuntos No puedes editar tus mensajes BB code is activado Las caritas están activado Código [IMG] está activado Código HTML está desactivado Trackbacks are desactivado Pingbacks are desactivado Refbacks are desactivado

Ir a

Temas Similares

Tema	Autor	Foro	Respuestas	Último mensaje
SUPERAantiSpyware Modo BootSafe ERROR !! (Solucionado)	pwargentina	Temas Solucionados	10	20/06/08 00:44:36
no puedo eliminar WINSPYWARE (Solucionado)	doomkel	Temas Solucionados	5	30/05/08 23:00:19
No se abren los antivirus	Shinichi2m	Foro de Virus y Spywares	3	31/03/08 14:57:12
Troj_corrp.mcs	Ulo198	Foro de Virus y Spywares	26	17/03/08 20:20:21
El virus sigue o se borró??	Nacho.tk	Foro de Virus y Spywares	6	13/03/08 11:04:15

Todas las horas son GMT -4. La hora es 10:14:16.

InfoSpyware es miembro de ASAP - Alliance of Security Analysis Professionals