Posible infección (Solucionado)

Buscar

		Foro de Spyware » Spyware - Adware - Hijackers - Malwares » Temas Solucionados
Posible infección (Solucionado)

Para evitar Virus, Spyware y otros Malwares, te recomendamos mantenerte informado en: InfoSpyware Blog

Temas Solucionados Casos de HijackThis y Malwares resueltos.
(Solo lectura)

Página 1 de 2

Enviar a:

Herramientas

post #1

16/10/09, 16:22:07

jaguer2

Usuario

Registrado: oct 2009

Ubicación: Caracas

Mensajes: 6

Posible infección (Solucionado)

Hola, reciban un gran saludo. Mi PC está muy lenta al iniciar y apagar. También he notado que tiene ocho archivos invisibles en mi carpeta temporal de usuario, detectados con el Administrador de Tareas como servicios detenidos con inicio manual; en un log Hijackthis de hace un par de semanas esos servicios aparecen con su nombre de propietario y su dirección www (mismos datos para los ocho), pero ahora aparecen con propietario desconocido. En el log he notado otros detalles adicionales. Aprecio mucho su ayuda para resolver mi(s) problema(s).

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 04:38:10 p.m., on 15/10/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18294)
Boot mode: Normal

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\a-squared Anti-Dialer\a2service.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\Program Files\a-squared Anti-Dialer\a2adguard.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Windows\System32\svchost.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
c:\Program Files\Lenovo\System Update\SUService.exe
C:\Windows\System32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe
C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe
C:\Utilidades\HighjackThis\HijackThis.exe
C:\Windows\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://lenovo.live.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.latam.msn.com/0SEESXL/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.latam.msn.com/0SEESXL/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.ve/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://lenovo.live.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.latam.msn.com/0SEESXL/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O1 - Hosts: ::1 localhost
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\s wg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - c:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: ThinkVantage Password Manager - {F040E541-A427-4CF7-85D8-75E3E0F476C5} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - c:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [a-squared] "C:\Program Files\a-squared Anti-Dialer\a2adguard.exe"
O4 - HKLM\..\Run: [TVT Scheduler Proxy] C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICIO LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICIO LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Servicio de red')
O4 - Global Startup: Búsqueda rápida de Microsoft.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Inicio de Office.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O8 - Extra context menu item: &Windows Live Search - res://c:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {0045D4BC-5189-4b67-969C-83BB1906C421} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll
O9 - Extra 'Tools' menuitem: ThinkVantage Password Manager... - {0045D4BC-5189-4b67-969C-83BB1906C421} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll
O9 - Extra button: Portafolios de HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Selección inteligente de HP - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O22 - SharedTaskScheduler: FencesShellExt - {1984DD45-52CF-49cd-AB77-18F378FEA264} - C:\Program Files\Stardock\Fences\FencesMenu.dll
O23 - Service: a-squared Anti-Dialer Service (a2AntiDialer) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Dialer\a2service.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: FIDS - Unknown owner - C:\Users\Jorge\AppData\Local\Temp\FIDS.exe (file missing)
O23 - Service: Servicio de actualización de Google (gupdate1c9e0087019dce1) (gupdate1c9e0087019dce1) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HNYKMATNF - Unknown owner - C:\Users\Jorge\AppData\Local\Temp\HNYKMATNF.exe (file missing)
O23 - Service: HQV - Unknown owner - C:\Users\Jorge\AppData\Local\Temp\HQV.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: ILJJ - Unknown owner - C:\Users\Jorge\AppData\Local\Temp\ILJJ.exe (file missing)
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LGOF - Unknown owner - C:\Users\Jorge\AppData\Local\Temp\LGOF.exe (file missing)
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NIILOQ - Unknown owner - C:\Users\Jorge\AppData\Local\Temp\NIILOQ.exe (file missing)
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: System Update (SUService) - Lenovo Group Limited - c:\Program Files\Lenovo\System Update\SUService.exe
O23 - Service: ThinkVantage Registry Monitor Service - Lenovo Group Limited - C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
O23 - Service: TOMAKBCRS - Unknown owner - C:\Users\Jorge\AppData\Local\Temp\TOMAKBCRS.exe (file missing)
O23 - Service: TSS Core Service (TSSCoreService) - IBM - C:\Program Files\Lenovo\Client Security Solution\tvttcsd.exe
O23 - Service: TVT Backup Protection Service - Unknown owner - C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe
O23 - Service: TVT Backup Service - Lenovo Group Limited - C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe
O23 - Service: TVT Scheduler - Lenovo Group Limited - c:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe
O23 - Service: tvtnetwk - Unknown owner - C:\Program Files\Lenovo\Rescue and Recovery\ADM\IUService.exe
O23 - Service: Y - Unknown owner - C:\Users\Jorge\AppData\Local\Temp\Y.exe (file missing)

--
End of file - 12957 bytes

InfoSpyware

post #2

18/10/09, 13:52:32

GPastor

FS-Admin

Registrado: mar 2005

Ubicación: Lima - Perú

Mensajes: 22.227

Re: Posible infección

Hola, te doy la bienvenida al Foro de InfoSpyware.

ForoSpyware lo mantenemos voluntarios que tenemos nuestros trabajos y obligaciones fuera, por lo que no estamos 24/7, a lo que te pedimos paciencia en el análisis y respuesta de tu caso. Si 48hrs después de dejarnos un nuevo log de HijackThis no recibes una respuesta me puedes enviar un Mensaje Privado de recordatorio.

Vamos a comenzar por estos pasos:

Paso 1- Descarga, instala y actualiza las siguientes herramientas:
- CCleaner // Manual de uso.
- Malwarebytes' Anti-Malware // Manual de uso.
Paso 2- Ejecuta CCleaner para hacerle una limpieza de cookies, archivos temporales e innecesarios para mejorar el rendimiento de tu equipo y generar reportes mas limpios.(NO necesitamos este reporte)
Paso 3- Ejecuta Malwarebytes' Anti-Malware (MBAM) y selecciona todo lo que este encuentre para luego presionar el botón de "Quitar lo Seleccionado" y así mandarlo a cuarentena.
Paso 4- Reinicia tu PC, y vuelve a generar un nuevo reporte de HijackThis 2.0.2 para pegarlo junto con el reporte de MBAM en este mismo mensaje contándonos si hubiera habido alguna mejora en el problema o rendimiento del equipo.

Por ultimo te recomiendo suscribirte al feed de nuestro Blog de InfoSpyware para estar al tanto de las nuevas amenazas que circulan por la red y así en un futuro puedas prevenirlas.

No te olvides de volver a dejarnos los reportes para continuar con el tema....

Saludos

Novedades del Foro | Antivirus Online | Eliminar Malwares | Políticas del Foro | Blog

* Ayúdanos haciendo una DONACIÓN para poder seguir Ayudando.
* Infórmate de las ultimas amenazas de la red desde: InfoSpyware Blog
* No se resuelven dudas por Privados ni por E-mail, ya que para eso esta el foro.

post #3

18/10/09, 23:39:56

jaguer2

Usuario

Registrado: oct 2009

Ubicación: Caracas

Mensajes: 6

Re: Posible infección

Muchas gracias por la ayuda. Te comento que seguí las instrucciones de limpieza y escaneo, pero todo sigue igual. Aquí están los reportes del MBAM y Highjackthis.
Saludos.

Malwarebytes' Anti-Malware 1.41
Database version: 2982
Windows 6.0.6001 Service Pack 1

18/10/2009 08:41:25 p.m.
mbam-log-2009-10-18 (20-41-25).txt

Scan type: Full Scan (C:\|)
Objects scanned: 231593
Time elapsed: 1 hour(s), 37 minute(s), 46 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:59:25 p.m., on 18/10/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18294)
Boot mode: Normal

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\Windows\system32\taskeng.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\a-squared Anti-Dialer\a2service.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\igfxpers.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\a-squared Anti-Dialer\a2adguard.exe
C:\Windows\system32\svchost.exe
c:\Program Files\Lenovo\System Update\SUService.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Windows\System32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe
C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\SearchIndexer.exe
C:\Utilidades\HighjackThis\HijackThis.exe
C:\Windows\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://lenovo.live.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.latam.msn.com/0SEESXL/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.latam.msn.com/0SEESXL/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.ve/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://lenovo.live.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.latam.msn.com/0SEESXL/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O1 - Hosts: ::1 localhost
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\s wg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - c:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: ThinkVantage Password Manager - {F040E541-A427-4CF7-85D8-75E3E0F476C5} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - c:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [a-squared] "C:\Program Files\a-squared Anti-Dialer\a2adguard.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICIO LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICIO LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Servicio de red')
O4 - Global Startup: Búsqueda rápida de Microsoft.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Inicio de Office.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O8 - Extra context menu item: &Windows Live Search - res://c:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {0045D4BC-5189-4b67-969C-83BB1906C421} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll
O9 - Extra 'Tools' menuitem: ThinkVantage Password Manager... - {0045D4BC-5189-4b67-969C-83BB1906C421} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll
O9 - Extra button: Portafolios de HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Selección inteligente de HP - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O22 - SharedTaskScheduler: FencesShellExt - {1984DD45-52CF-49cd-AB77-18F378FEA264} - C:\Program Files\Stardock\Fences\FencesMenu.dll
O23 - Service: a-squared Anti-Dialer Service (a2AntiDialer) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Dialer\a2service.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: FIDS - Unknown owner - C:\Users\Jorge\AppData\Local\Temp\FIDS.exe (file missing)
O23 - Service: Servicio de actualización de Google (gupdate1c9e0087019dce1) (gupdate1c9e0087019dce1) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HNYKMATNF - Unknown owner - C:\Users\Jorge\AppData\Local\Temp\HNYKMATNF.exe (file missing)
O23 - Service: HQV - Unknown owner - C:\Users\Jorge\AppData\Local\Temp\HQV.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: ILJJ - Unknown owner - C:\Users\Jorge\AppData\Local\Temp\ILJJ.exe (file missing)
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LGOF - Unknown owner - C:\Users\Jorge\AppData\Local\Temp\LGOF.exe (file missing)
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NIILOQ - Unknown owner - C:\Users\Jorge\AppData\Local\Temp\NIILOQ.exe (file missing)
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: System Update (SUService) - Lenovo Group Limited - c:\Program Files\Lenovo\System Update\SUService.exe
O23 - Service: ThinkVantage Registry Monitor Service - Lenovo Group Limited - C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
O23 - Service: TOMAKBCRS - Unknown owner - C:\Users\Jorge\AppData\Local\Temp\TOMAKBCRS.exe (file missing)
O23 - Service: TSS Core Service (TSSCoreService) - IBM - C:\Program Files\Lenovo\Client Security Solution\tvttcsd.exe
O23 - Service: TVT Backup Protection Service - Unknown owner - C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe
O23 - Service: TVT Backup Service - Lenovo Group Limited - C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe
O23 - Service: TVT Scheduler - Lenovo Group Limited - c:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe
O23 - Service: tvtnetwk - Unknown owner - C:\Program Files\Lenovo\Rescue and Recovery\ADM\IUService.exe
O23 - Service: Y - Unknown owner - C:\Users\Jorge\AppData\Local\Temp\Y.exe (file missing)

--
End of file - 12803 bytes

post #4

19/10/09, 16:41:47

GPastor

FS-Admin

Registrado: mar 2005

Ubicación: Lima - Perú

Mensajes: 22.227

Re: Posible infección

Aún hay infecciones en tu sistema sigue estos pasos:

- Descarga la herramienta ComboFix.exe y guárdala en el escritorio.

Desactiva temporalmente el Antivirus y/o Antispyware.
Cierra todas las ventanas abiertas.
Haz doble clic al archivo ComboFix.exe y sigue las instrucciones.
Cuando termine, generará un registro en C:\ComboFix.txt.
- *Nota* Mientras CF este trabajando no mover el mouse ya que pararía su proceso.
- *Nota* ComboFix puede reiniciar automáticamente el PC para completar el proceso de eliminación.

Cita:

Atención!! No use ComboFix a menos que se le haya indicado específicamente en su mensaje por un integrante de nuestro Staff. Es una herramienta de gran alcance destinada por su creador a ser usada bajo la orientación y supervisión de un experto, no para uso privado. El uso de ComboFix incorrectamente podría generar problemas en su sistema. Por favor, lea las "Negaciones de la Garantía" de ComboFix.

Reinicia y pega el reporte de C:\ComboFix.txt en este mismo mensaje.

Saludos

post #5

20/10/09, 13:26:20

jaguer2

Usuario

Registrado: oct 2009

Ubicación: Caracas

Mensajes: 6

Re: Posible infección

Saludos GPastor, aquí está el log de combofix.
Por cierto, al terminar el análisis me apareció un nuevo icono de Internet Explorer en el escritorio, es un icono normal, sin flecha de acceso directo (el archivo iexplore.exe permanece en su sitio normal en la carpeta Archivos de Programa), al hacer clic derecho al icono se despliega un menú con 6 opciones, al abrir la opción de Propiedades me presenta exactamente la misma ventana como si el IExplorer estuviera abierto, la que se abre con Herramientas/Opciones de Internet. El icono permanece en el ecritorio después que reinicié la PC. ¿Podría enviar ese icono a la papelera de reciclaje?
Muchas gracias por la atención.

ComboFix 09-10-19.01 - Jorge 19/10/2009 21:54.1.2 - NTFSx86
Microsoft® Windows Vista™ Home Basic 6.0.6001.1.1252.58.3082.18.1014.360 [GMT -4,5:30]
Running from: c:\users\Jorge\Desktop\ComboFix.exe
SP: Spybot - Search and Destroy *disabled* (Updated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((( Files Created from 2009-09-20 to 2009-10-20 )))))))))))))))))))))))))))))))
.

2009-10-18 18:49 . 2009-10-18 18:49 -------- d-----w- c:\program files\Trend Micro
2009-10-16 12:49 . 2009-09-04 12:24 61440 ----a-w- c:\windows\system32\msasn1.dll
2009-10-16 12:48 . 2009-09-14 09:44 144896 ----a-w- c:\windows\system32\drivers\srv2.sys
2009-10-16 12:48 . 2009-04-02 12:37 604672 ----a-w- c:\windows\system32\WMSPDMOD.DLL
2009-10-15 16:41 . 2009-09-23 12:55 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys
2009-10-15 16:31 . 2009-10-15 16:31 -------- dc-h--w- c:\programdata\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}
2009-10-13 20:30 . 2009-10-13 20:30 -------- d-----w- c:\windows\Sun
2009-10-13 13:35 . 2009-10-13 14:04 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2009-10-13 13:35 . 2009-10-13 13:40 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-10-11 01:20 . 2009-10-13 15:22 -------- d-----w- c:\users\Jorge\DoctorWeb
2009-10-07 20:49 . 2009-10-07 20:49 -------- d-----w- c:\users\Jorge\AppData\Roaming\Stardock
2009-10-07 20:48 . 2009-10-07 20:48 -------- dc-h--w- c:\programdata\{A87EB928-0C6C-4071-AEF1-59E32BAEDF1B}
2009-10-07 20:48 . 2009-10-07 20:48 -------- d-----w- c:\program files\Stardock
2009-10-07 20:47 . 2009-10-07 20:47 -------- d-----w- c:\users\Jorge\AppData\Local\PackageAware
2009-10-06 06:52 . 2009-10-06 08:33 -------- d-----w- c:\program files\a-squared Anti-Dialer
2009-10-05 21:01 . 2009-08-07 02:24 44768 ----a-w- c:\windows\system32\wups2.dll
2009-10-05 21:01 . 2009-08-07 02:24 53472 ----a-w- c:\windows\system32\wuauclt.exe
2009-10-05 21:01 . 2009-08-07 02:23 1929952 ----a-w- c:\windows\system32\wuaueng.dll
2009-10-05 21:01 . 2009-08-07 01:45 2421760 ----a-w- c:\windows\system32\wucltux.dll
2009-10-05 21:00 . 2009-08-07 02:24 35552 ----a-w- c:\windows\system32\wups.dll
2009-10-05 21:00 . 2009-08-07 02:23 575704 ----a-w- c:\windows\system32\wuapi.dll
2009-10-05 21:00 . 2009-08-07 01:44 87552 ----a-w- c:\windows\system32\wudriver.dll
2009-10-05 21:00 . 2009-08-06 23:53 171608 ----a-w- c:\windows\system32\wuwebv.dll
2009-10-05 21:00 . 2009-08-06 23:14 33792 ----a-w- c:\windows\system32\wuapp.exe
2009-10-04 21:54 . 2009-09-03 09:17 15688 ----a-w- c:\windows\system32\lsdelete.exe
2009-10-04 20:03 . 2009-10-15 16:41 -------- dc----w- c:\windows\system32\DRVSTORE
2009-10-04 19:52 . 2009-10-04 20:03 -------- d-----w- c:\programdata\Lavasoft
2009-10-04 19:52 . 2009-10-04 19:52 -------- d-----w- c:\program files\Lavasoft
2009-10-03 08:41 . 2009-09-10 19:24 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-03 08:41 . 2009-10-03 08:41 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-10-03 08:41 . 2009-09-10 19:23 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-10-03 03:53 . 2009-10-03 03:53 -------- d-----w- c:\users\Jorge\AppData\Local\Mozilla
2009-10-02 17:41 . 2009-10-01 14:59 195440 ------w- c:\windows\system32\MpSigStub.exe
2009-10-01 08:59 . 2009-10-01 08:59 -------- d-----w- c:\program files\ESET
2009-10-01 04:15 . 2009-10-01 04:15 -------- d-----w- c:\programdata\IObit
2009-10-01 01:08 . 2009-10-01 01:08 -------- d-----w- c:\users\Jorge\AppData\Roaming\Malwarebytes
2009-10-01 01:08 . 2009-10-01 01:08 -------- d-----w- c:\programdata\Malwarebytes
2009-09-30 03:36 . 2009-10-14 13:14 -------- d-----w- C:\Utilidades
2009-09-27 00:57 . 2009-09-27 01:02 -------- d-----w- c:\program files\SIW
2009-09-21 07:19 . 2009-09-21 07:24 -------- d-----w- c:\program files\AutoDeskElectr2009

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2009-10-07 04:21 . 2009-09-17 22:36 -------- d-----w- c:\users\Jorge\AppData\Roaming\HpUpdate
2009-10-02 06:35 . 2009-09-01 05:21 -------- d-----w- c:\program files\IObit
2009-09-29 05:58 . 2009-08-28 23:41 -------- d-----w- c:\program files\Panda Security
2009-09-25 13:10 . 2008-09-11 11:19 -------- d-----w- c:\program files\Lenovo
2009-09-24 16:01 . 2009-06-27 11:07 -------- d-----w- c:\program files\Hewlett-Packard
2009-09-24 03:12 . 2009-05-23 00:03 2032 ----a-w- c:\users\Jorge\AppData\Local\d3d9caps.dat
2009-09-17 03:36 . 2009-09-17 03:36 10134 ----a-r- c:\users\Jorge\AppData\Roaming\Microsoft\Installer \{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe
2009-09-17 03:36 . 2009-09-17 03:36 -------- d-----w- c:\program files\Microsoft WSE
2009-09-17 03:33 . 2009-07-26 21:59 -------- d-----w- c:\program files\AutoCAD 2009
2009-09-16 23:27 . 2009-09-14 20:06 -------- d-----w- c:\program files\Microsoft Office 97
2009-09-16 03:38 . 2008-09-11 11:24 -------- d-----w- c:\program files\Common Files\Adobe
2009-09-15 23:50 . 2009-08-03 00:41 -------- d-----w- c:\users\Jorge\AppData\Roaming\Nero
2009-09-15 23:41 . 2008-09-11 11:19 -------- d-----w- c:\program files\Common Files\Lenovo
2009-09-15 20:43 . 2008-09-11 20:56 765930 ----a-w- c:\windows\system32\perfh00A.dat
2009-09-15 20:43 . 2008-09-11 20:56 175822 ----a-w- c:\windows\system32\perfc00A.dat
2009-09-15 19:52 . 2009-09-01 05:21 -------- d-----w- c:\users\Jorge\AppData\Roaming\IObit
2009-09-14 20:08 . 2009-09-14 20:08 -------- d-----w- c:\program files\Mensajería de Windows
2009-09-11 02:32 . 2009-09-11 02:32 -------- d-----w- c:\program files\Lavalys
2009-09-11 00:23 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-09-02 05:31 . 2008-09-11 12:04 -------- d-----w- c:\programdata\Microsoft Help
2009-08-31 00:30 . 2009-05-23 00:06 149952 ----a-w- c:\users\Jorge\AppData\Local\GDIPFONTCACHEV1.DAT
2009-08-29 03:27 . 2008-09-11 11:35 -------- d-----w- c:\program files\Java
2009-08-28 12:39 . 2009-09-02 23:45 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2009-08-28 10:15 . 2009-09-02 23:45 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2009-08-27 04:39 . 2009-08-27 04:38 -------- d-----w- c:\programdata\AVG Security Toolbar
2009-08-27 04:38 . 2009-08-27 04:38 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-08-27 04:38 . 2009-08-27 04:38 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-08-27 04:38 . 2009-08-27 04:38 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-08-27 04:38 . 2009-08-27 04:38 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-08-27 04:37 . 2009-08-27 04:37 -------- d-----w- c:\program files\AVG
2009-08-27 04:37 . 2009-08-27 04:37 -------- d-----w- c:\programdata\avg8
2009-08-27 04:25 . 2008-09-11 11:54 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-08-21 05:03 . 2009-06-27 10:54 162510 ----a-w- c:\windows\hpwins16.dat
2009-08-14 17:07 . 2009-09-10 03:32 897608 ----a-w- c:\windows\system32\drivers\tcpip.sys
2009-08-14 16:29 . 2009-09-10 03:32 104960 ----a-w- c:\windows\system32\netiohlp.dll
2009-08-14 16:29 . 2009-09-10 03:31 17920 ----a-w- c:\windows\system32\netevent.dll
2009-08-14 14:16 . 2009-09-10 03:31 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE
2009-08-14 14:16 . 2009-09-10 03:31 17920 ----a-w- c:\windows\system32\ROUTE.EXE
2009-08-14 14:16 . 2009-09-10 03:31 11264 ----a-w- c:\windows\system32\MRINFO.EXE
2009-08-14 14:16 . 2009-09-10 03:31 27136 ----a-w- c:\windows\system32\NETSTAT.EXE
2009-08-14 14:16 . 2009-09-10 03:31 19968 ----a-w- c:\windows\system32\ARP.EXE
2009-08-14 14:16 . 2009-09-10 03:31 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE
2009-08-14 14:16 . 2009-09-10 03:31 10240 ----a-w- c:\windows\system32\finger.exe
2009-07-25 09:53 . 2009-07-02 04:00 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-07-23 04:43 . 2009-07-23 04:43 93 ----a-w- c:\users\Jorge\AppData\Local\fusioncache.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-09-02 16:28 1107200 ----a-w- c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-10-17 2025752]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-02-12 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-02-12 166424]
"Persistence"="c:\windows\system32\igfxpers.ex e" [2008-02-12 133656]
"a-squared"="c:\program files\a-squared Anti-Dialer\a2adguard.exe" [2008-06-03 1497744]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2007-10-22 4702208]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
B£squeda r*pida de Microsoft.lnk - c:\program files\Microsoft Office\Office\FINDFAST.EXE [1997-9-3 111376]
Inicio de Office.lnk - c:\program files\Microsoft Office\Office\OSA.EXE [1997-9-3 51984]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\curr entversion\explorer\SharedTaskScheduler]
"{1984DD45-52CF-49cd-AB77-18F378FEA264}"= "c:\program files\Stardock\Fences\FencesMenu.dll" [2009-10-02 128360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\avgrsstx.dl l

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

R0 Lbd;Lbd;c:\windows\System32\drivers\Lbd.sys [15/10/2009 12:11 p.m. 64288]
R0 pavboot;pavboot;c:\windows\System32\drivers\pavboo t.sys [28/08/2009 07:11 p.m. 28544]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [27/08/2009 12:08 a.m. 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\System32\drivers\avgtdix.sys [27/08/2009 12:08 a.m. 108552]
R2 a2AntiDialer;a-squared Anti-Dialer Service;c:\program files\a-squared Anti-Dialer\a2service.exe [06/10/2009 02:22 a.m. 425080]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [27/08/2009 12:07 a.m. 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [27/08/2009 12:07 a.m. 297752]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [13/10/2009 09:05 a.m. 1153368]
R2 TVT Backup Protection Service;TVT Backup Protection Service;c:\program files\Lenovo\Rescue and Recovery\rrpservice.exe [10/07/2007 09:26 a.m. 569344]
R3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [24/09/2009 06:47 a.m. 1170768]
R3 TVTI2C;Lenovo SM bus driver;c:\windows\System32\drivers\tvti2c.sys [22/05/2007 09:29 a.m. 30336]
S2 gupdate1c9e0087019dce1;Servicio de actualización de Google (gupdate1c9e0087019dce1);c:\program files\Google\Update\GoogleUpdate.exe [28/05/2009 10:21 p.m. 133104]
S3 FIDS;FIDS;c:\users\Jorge\AppData\Local\Temp\FIDS.e xe --> c:\users\Jorge\AppData\Local\Temp\FIDS.exe [?]
S3 HNYKMATNF;HNYKMATNF;c:\users\Jorge\AppData\Local\T emp\HNYKMATNF.exe --> c:\users\Jorge\AppData\Local\Temp\HNYKMATNF.exe [?]
S3 HQV;HQV;c:\users\Jorge\AppData\Local\Temp\HQV.exe --> c:\users\Jorge\AppData\Local\Temp\HQV.exe [?]
S3 ILJJ;ILJJ;c:\users\Jorge\AppData\Local\Temp\ILJJ.e xe --> c:\users\Jorge\AppData\Local\Temp\ILJJ.exe [?]
S3 LGOF;LGOF;c:\users\Jorge\AppData\Local\Temp\LGOF.e xe --> c:\users\Jorge\AppData\Local\Temp\LGOF.exe [?]
S3 NIILOQ;NIILOQ;c:\users\Jorge\AppData\Local\Temp\NI ILOQ.exe --> c:\users\Jorge\AppData\Local\Temp\NIILOQ.exe [?]
S3 TOMAKBCRS;TOMAKBCRS;c:\users\Jorge\AppData\Local\T emp\TOMAKBCRS.exe --> c:\users\Jorge\AppData\Local\Temp\TOMAKBCRS.exe [?]
S3 VST_DPV;VST_DPV;c:\windows\System32\drivers\VSTDPV 3.SYS [20/01/2008 10:02 p.m. 987648]
S3 VSTHWBS2;VSTHWBS2;c:\windows\System32\drivers\VSTB S23.SYS [20/01/2008 10:02 p.m. 251904]
S3 Y;Y;c:\users\Jorge\AppData\Local\Temp\Y.exe --> c:\users\Jorge\AppData\Local\Temp\Y.exe [?]

--- Other Services/Drivers In Memory ---

*Deregistered* - mchInjDrv

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder

2009-10-20 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 16:33]

2009-10-20 c:\windows\Tasks\Comprobar actualizaciones de Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-02-12 20:24]

2009-10-19 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-09-11 01:52]

2009-10-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-29 02:51]

2009-10-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-29 02:51]

2009-10-20 c:\windows\Tasks\User_Feed_Synchronization-{3335D749-4BAD-4854-A673-300AE69CB57C}.job
- c:\windows\system32\msfeedssync.exe [2008-01-21 02:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.co.ve/
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xportar a Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
FF - ProfilePath - c:\users\Jorge\AppData\Roaming\Mozilla\Firefox\Pro files\33rbbnzr.default\
FF - plugin: c:\program files\Google\Google Updater\2.4.1601.7122\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dl l
FF - plugin: c:\program files\Picasa2\npPicasa3.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
FF - user.js: browser.cache.memory.capacity - 16000
FF - user.js: browser.chrome.favicons - fales
FF - user.js: browser.display.show_image_placeholders - true
FF - user.js: browser.turbo.enabled - true
FF - user.js: browser.urlbar.autocomplete.enabled - true
FF - user.js: browser.urlbar.autofill - true
FF - user.js: content.max.tokenizing.time - 3000000
FF - user.js: content.maxtextrun - 4095
FF - user.js: content.notify.backoffcount - 5
FF - user.js: content.notify.interval - 1000000
FF - user.js: content.notify.ontimer - true
FF - user.js: content.switch.threshold - 1000000
FF - user.js: dom.disable_window_status_change - true
FF - user.js: network.http.max-connections - 48
FF - user.js: network.http.max-connections-per-server - 16
FF - user.js: network.http.max-persistent-connections-per-proxy - 16
FF - user.js: network.http.max-persistent-connections-per-server - 8
FF - user.js: network.http.pipelining - true
FF - user.js: network.http.pipelining.firstrequest - true
FF - user.js: network.http.pipelining.maxrequests - 8
FF - user.js: network.http.proxy.pipelining - true
FF - user.js: network.http.request.max-start-delay - 0
FF - user.js: nglayout.initialpaint.delay - 1000
FF - user.js: plugin.expose_full_path - true
FF - user.js: ui.submenuDelay - 0
.

************************************************** ************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-19 22:00
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

************************************************** ************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Cl ass\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2009-10-20 22:01
ComboFix-quarantined-files.txt 2009-10-20 02:31

Pre-Run: 106.092.724.224 bytes libres
Post-Run: 106.035.871.744 bytes libres

- - End Of File - - 79474021ED5CA404784787FB6904F133

post #6

20/10/09, 15:16:46

GPastor

FS-Admin

Registrado: mar 2005

Ubicación: Lima - Perú

Mensajes: 22.227

Re: Posible infección

El icono de Internet Explorer que mencionas es porque ComboFix ha restaurado el ícono original, el que deberías eliminar es el acceso directo (el que tiene la flechita)

ComboFix detectó y eliminó ya algunos Malwares, pero todavía quedaron algunas cosas para sacar, sigue estos pasos:

1.-Abrir el Notepad

Clic en INICIO > EJECUTAR >
Y ahí pones notepad.exe y ACEPTAR

2.- Ahora copia y pega este código dentro del Notepad

Código HTML:

KillAll::

File::
c:\users\Jorge\AppData\Local\Temp\FIDS.exe
c:\users\Jorge\AppData\Local\Temp\HNYKMATNF.exe
c:\users\Jorge\AppData\Local\Temp\HQV.exe
c:\users\Jorge\AppData\Local\Temp\ILJJ.exe
c:\users\Jorge\AppData\Local\Temp\LGOF.exe
c:\users\Jorge\AppData\Local\Temp\NIILOQ.exe
c:\users\Jorge\AppData\Local\Temp\TOMAKBCRS.exe
c:\users\Jorge\AppData\Local\Temp\Y.exe

Driver::
FIDS
HNYKMATNF
HQV
ILJJ
LGOF
NIILOQ
TOMAKBCRS
Y

3.- Graba este archivo en el Escritorio con el nombre CFScript.txt

4.- Arrastrar y soltar el archivo CFScript.txt dentro del archivo ComboFix.exe como lo muestra la animación de abajo. Esto activara ComboFix nuevamente.

Reinicia y nos cuentas los resultados. junto con un nuevo reporte de ComboFix y uno de Hijackthis.

Saludos

post #7

21/10/09, 18:12:03

jaguer2

Usuario

Registrado: oct 2009

Ubicación: Caracas

Mensajes: 6

Re: Posible infección

Aquí están los logs del combofix y del highjackthis.
Probé la máquina varias veces y los tiempos de inicio y apagado siguen más o menos igual.

Lo siguiente ya lo tengo desde hace algún tiempo: Algunas veces al apagar, la máquina muestra en el proceso una pantalla (igual a la de MS-Dos) de Ambiente de Ejecución de Pre-boot del controlador ethernet, mostrando datos como: fabricante, versión y fecha: 20070328, mcaddress, guid, etc, y luego se reinicia sola. Ha mejorado, pues anteriormente se quedaba colgada algunas veces procesando en ambiente MS-Dos, mostrando datos similares a los nombrados y no reiniciaba, para reiniciar tenía que darle ctrl+alt+del.

Muchísimas gracias GPastor, por tu tiempo y ayuda!

ComboFix 09-10-19.01 - Jorge 20/10/2009 21:59.2.2 - NTFSx86
Microsoft® Windows Vista™ Home Basic 6.0.6001.1.1252.58.3082.18.1014.427 [GMT -4,5:30]
Running from: c:\users\Jorge\Desktop\ComboFix.exe
Command switches used :: c:\users\Jorge\Desktop\CFScript.txt
SP: Spybot - Search and Destroy *disabled* (Updated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

FILE ::
"c:\users\Jorge\AppData\Local\Temp\FIDS.exe"
"c:\users\Jorge\AppData\Local\Temp\HNYKMATNF.e xe"
"c:\users\Jorge\AppData\Local\Temp\HQV.exe"
"c:\users\Jorge\AppData\Local\Temp\ILJJ.exe"
"c:\users\Jorge\AppData\Local\Temp\LGOF.exe"
"c:\users\Jorge\AppData\Local\Temp\NIILOQ.exe"
"c:\users\Jorge\AppData\Local\Temp\TOMAKBCRS.e xe"
"c:\users\Jorge\AppData\Local\Temp\Y.exe"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_FIDS
-------\Legacy_HNYKMATNF
-------\Legacy_HQV
-------\Legacy_ILJJ
-------\Legacy_LGOF
-------\Legacy_NIILOQ
-------\Legacy_TOMAKBCRS
-------\Legacy_Y
-------\Service_FIDS
-------\Service_HNYKMATNF
-------\Service_HQV
-------\Service_ILJJ
-------\Service_LGOF
-------\Service_NIILOQ
-------\Service_TOMAKBCRS
-------\Service_Y

((((((((((((((((((((((((( Files Created from 2009-09-21 to 2009-10-21 )))))))))))))))))))))))))))))))
.

2009-10-21 02:36 . 2009-10-21 02:38 -------- d-----w- c:\users\Jorge\AppData\Local\temp
2009-10-18 18:49 . 2009-10-18 18:49 -------- d-----w- c:\program files\Trend Micro
2009-10-16 12:49 . 2009-09-04 12:24 61440 ----a-w- c:\windows\system32\msasn1.dll
2009-10-16 12:48 . 2009-09-14 09:44 144896 ----a-w- c:\windows\system32\drivers\srv2.sys
2009-10-16 12:48 . 2009-04-02 12:37 604672 ----a-w- c:\windows\system32\WMSPDMOD.DLL
2009-10-15 16:41 . 2009-09-23 12:55 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys
2009-10-15 16:31 . 2009-10-15 16:31 -------- dc-h--w- c:\programdata\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}
2009-10-13 20:30 . 2009-10-13 20:30 -------- d-----w- c:\windows\Sun
2009-10-13 13:35 . 2009-10-13 14:04 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2009-10-13 13:35 . 2009-10-13 13:40 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-10-11 01:20 . 2009-10-13 15:22 -------- d-----w- c:\users\Jorge\DoctorWeb
2009-10-07 20:49 . 2009-10-07 20:49 -------- d-----w- c:\users\Jorge\AppData\Roaming\Stardock
2009-10-07 20:48 . 2009-10-07 20:48 -------- dc-h--w- c:\programdata\{A87EB928-0C6C-4071-AEF1-59E32BAEDF1B}
2009-10-07 20:48 . 2009-10-07 20:48 -------- d-----w- c:\program files\Stardock
2009-10-07 20:47 . 2009-10-07 20:47 -------- d-----w- c:\users\Jorge\AppData\Local\PackageAware
2009-10-06 06:52 . 2009-10-06 08:33 -------- d-----w- c:\program files\a-squared Anti-Dialer
2009-10-05 21:01 . 2009-08-07 02:24 44768 ----a-w- c:\windows\system32\wups2.dll
2009-10-05 21:01 . 2009-08-07 02:24 53472 ----a-w- c:\windows\system32\wuauclt.exe
2009-10-05 21:01 . 2009-08-07 02:23 1929952 ----a-w- c:\windows\system32\wuaueng.dll
2009-10-05 21:01 . 2009-08-07 01:45 2421760 ----a-w- c:\windows\system32\wucltux.dll
2009-10-05 21:00 . 2009-08-07 02:24 35552 ----a-w- c:\windows\system32\wups.dll
2009-10-05 21:00 . 2009-08-07 02:23 575704 ----a-w- c:\windows\system32\wuapi.dll
2009-10-05 21:00 . 2009-08-07 01:44 87552 ----a-w- c:\windows\system32\wudriver.dll
2009-10-05 21:00 . 2009-08-06 23:53 171608 ----a-w- c:\windows\system32\wuwebv.dll
2009-10-05 21:00 . 2009-08-06 23:14 33792 ----a-w- c:\windows\system32\wuapp.exe
2009-10-04 21:54 . 2009-09-03 09:17 15688 ----a-w- c:\windows\system32\lsdelete.exe
2009-10-04 20:03 . 2009-10-15 16:41 -------- dc----w- c:\windows\system32\DRVSTORE
2009-10-04 19:52 . 2009-10-04 20:03 -------- d-----w- c:\programdata\Lavasoft
2009-10-04 19:52 . 2009-10-04 19:52 -------- d-----w- c:\program files\Lavasoft
2009-10-03 08:41 . 2009-09-10 19:24 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-03 08:41 . 2009-10-03 08:41 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-10-03 08:41 . 2009-09-10 19:23 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-10-03 03:53 . 2009-10-03 03:53 -------- d-----w- c:\users\Jorge\AppData\Local\Mozilla
2009-10-02 17:41 . 2009-10-01 14:59 195440 ------w- c:\windows\system32\MpSigStub.exe
2009-10-01 08:59 . 2009-10-01 08:59 -------- d-----w- c:\program files\ESET
2009-10-01 04:15 . 2009-10-01 04:15 -------- d-----w- c:\programdata\IObit
2009-10-01 01:08 . 2009-10-01 01:08 -------- d-----w- c:\users\Jorge\AppData\Roaming\Malwarebytes
2009-10-01 01:08 . 2009-10-01 01:08 -------- d-----w- c:\programdata\Malwarebytes
2009-09-30 03:36 . 2009-10-14 13:14 -------- d-----w- C:\Utilidades
2009-09-27 00:57 . 2009-09-27 01:02 -------- d-----w- c:\program files\SIW
2009-09-21 07:19 . 2009-09-21 07:24 -------- d-----w- c:\program files\AutoDeskElectr2009

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2009-10-20 21:45 . 2008-09-11 20:56 765930 ----a-w- c:\windows\system32\perfh00A.dat
2009-10-20 21:45 . 2008-09-11 20:56 175822 ----a-w- c:\windows\system32\perfc00A.dat
2009-10-07 04:21 . 2009-09-17 22:36 -------- d-----w- c:\users\Jorge\AppData\Roaming\HpUpdate
2009-10-02 06:35 . 2009-09-01 05:21 -------- d-----w- c:\program files\IObit
2009-09-29 05:58 . 2009-08-28 23:41 -------- d-----w- c:\program files\Panda Security
2009-09-25 13:10 . 2008-09-11 11:19 -------- d-----w- c:\program files\Lenovo
2009-09-24 16:01 . 2009-06-27 11:07 -------- d-----w- c:\program files\Hewlett-Packard
2009-09-24 03:12 . 2009-05-23 00:03 2032 ----a-w- c:\users\Jorge\AppData\Local\d3d9caps.dat
2009-09-17 03:36 . 2009-09-17 03:36 10134 ----a-r- c:\users\Jorge\AppData\Roaming\Microsoft\Installer \{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe
2009-09-17 03:36 . 2009-09-17 03:36 -------- d-----w- c:\program files\Microsoft WSE
2009-09-17 03:33 . 2009-07-26 21:59 -------- d-----w- c:\program files\AutoCAD 2009
2009-09-16 23:27 . 2009-09-14 20:06 -------- d-----w- c:\program files\Microsoft Office 97
2009-09-16 03:38 . 2008-09-11 11:24 -------- d-----w- c:\program files\Common Files\Adobe
2009-09-15 23:50 . 2009-08-03 00:41 -------- d-----w- c:\users\Jorge\AppData\Roaming\Nero
2009-09-15 23:41 . 2008-09-11 11:19 -------- d-----w- c:\program files\Common Files\Lenovo
2009-09-15 19:52 . 2009-09-01 05:21 -------- d-----w- c:\users\Jorge\AppData\Roaming\IObit
2009-09-14 20:08 . 2009-09-14 20:08 -------- d-----w- c:\program files\Mensajería de Windows
2009-09-11 02:32 . 2009-09-11 02:32 -------- d-----w- c:\program files\Lavalys
2009-09-11 00:23 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-09-02 05:31 . 2008-09-11 12:04 -------- d-----w- c:\programdata\Microsoft Help
2009-08-31 00:30 . 2009-05-23 00:06 149952 ----a-w- c:\users\Jorge\AppData\Local\GDIPFONTCACHEV1.DAT
2009-08-29 03:27 . 2008-09-11 11:35 -------- d-----w- c:\program files\Java
2009-08-28 12:39 . 2009-09-02 23:45 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2009-08-28 10:15 . 2009-09-02 23:45 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2009-08-27 04:39 . 2009-08-27 04:38 -------- d-----w- c:\programdata\AVG Security Toolbar
2009-08-27 04:38 . 2009-08-27 04:38 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-08-27 04:38 . 2009-08-27 04:38 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-08-27 04:38 . 2009-08-27 04:38 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-08-27 04:38 . 2009-08-27 04:38 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-08-27 04:37 . 2009-08-27 04:37 -------- d-----w- c:\program files\AVG
2009-08-27 04:37 . 2009-08-27 04:37 -------- d-----w- c:\programdata\avg8
2009-08-27 04:25 . 2008-09-11 11:54 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-08-21 05:03 . 2009-06-27 10:54 162510 ----a-w- c:\windows\hpwins16.dat
2009-08-14 17:07 . 2009-09-10 03:32 897608 ----a-w- c:\windows\system32\drivers\tcpip.sys
2009-08-14 16:29 . 2009-09-10 03:32 104960 ----a-w- c:\windows\system32\netiohlp.dll
2009-08-14 16:29 . 2009-09-10 03:31 17920 ----a-w- c:\windows\system32\netevent.dll
2009-08-14 14:16 . 2009-09-10 03:31 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE
2009-08-14 14:16 . 2009-09-10 03:31 17920 ----a-w- c:\windows\system32\ROUTE.EXE
2009-08-14 14:16 . 2009-09-10 03:31 11264 ----a-w- c:\windows\system32\MRINFO.EXE
2009-08-14 14:16 . 2009-09-10 03:31 27136 ----a-w- c:\windows\system32\NETSTAT.EXE
2009-08-14 14:16 . 2009-09-10 03:31 19968 ----a-w- c:\windows\system32\ARP.EXE
2009-08-14 14:16 . 2009-09-10 03:31 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE
2009-08-14 14:16 . 2009-09-10 03:31 10240 ----a-w- c:\windows\system32\finger.exe
2009-07-25 09:53 . 2009-07-02 04:00 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-07-23 04:43 . 2009-07-23 04:43 93 ----a-w- c:\users\Jorge\AppData\Local\fusioncache.dat
.

((((((((((((((((((((((((((((( SnapShot@2009-10-20_02.30.42 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-01-21 01:58 . 2009-10-20 23:52 62152 c:\windows\System32\WDI\ShutdownPerformanceDiagnos tics_SystemData.bin
+ 2006-11-02 13:02 . 2009-10-21 02:39 93684 c:\windows\System32\WDI\BootPerformanceDiagnostics _SystemData.bin
+ 2009-05-23 17:41 . 2009-10-21 02:39 10152 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2212488619-503867304-1053213551-1005_UserData.bin
+ 2009-05-23 00:02 . 2009-10-20 23:50 16384 c:\windows\System32\config\systemprofile\AppData\R oaming\Microsoft\Windows\Cookies\index.dat
- 2009-05-23 00:02 . 2009-10-20 02:05 16384 c:\windows\System32\config\systemprofile\AppData\R oaming\Microsoft\Windows\Cookies\index.dat
+ 2009-05-23 00:02 . 2009-10-20 23:50 32768 c:\windows\System32\config\systemprofile\AppData\L ocal\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-05-23 00:02 . 2009-10-20 02:05 32768 c:\windows\System32\config\systemprofile\AppData\L ocal\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-05-23 00:02 . 2009-10-20 02:05 16384 c:\windows\System32\config\systemprofile\AppData\L ocal\Microsoft\Windows\History\History.IE5\index.d at
+ 2009-05-23 00:02 . 2009-10-20 23:50 16384 c:\windows\System32\config\systemprofile\AppData\L ocal\Microsoft\Windows\History\History.IE5\index.d at
+ 2009-05-30 06:56 . 2009-10-21 02:36 4886 c:\windows\System32\WDI\ERCQueuedResolutions.dat
- 2009-05-30 06:56 . 2009-10-19 22:52 4886 c:\windows\System32\WDI\ERCQueuedResolutions.dat
+ 2009-10-21 02:37 . 2009-10-21 02:37 2048 c:\windows\ServiceProfiles\LocalService\AppData\Lo cal\lastalive1.dat
- 2009-10-19 23:20 . 2009-10-19 23:20 2048 c:\windows\ServiceProfiles\LocalService\AppData\Lo cal\lastalive1.dat
- 2009-10-19 23:20 . 2009-10-19 23:20 2048 c:\windows\ServiceProfiles\LocalService\AppData\Lo cal\lastalive0.dat
+ 2009-10-21 02:37 . 2009-10-21 02:37 2048 c:\windows\ServiceProfiles\LocalService\AppData\Lo cal\lastalive0.dat
+ 2009-05-23 01:34 . 2009-10-21 01:28 315256 c:\windows\System32\WDI\SuspendPerformanceDiagnost ics_SystemData_FastS4.bin
+ 2006-11-02 10:33 . 2009-10-20 21:45 672092 c:\windows\System32\perfh009.dat
- 2006-11-02 10:33 . 2009-09-15 20:43 672092 c:\windows\System32\perfh009.dat
- 2006-11-02 10:33 . 2009-09-15 20:43 134468 c:\windows\System32\perfc009.dat
+ 2006-11-02 10:33 . 2009-10-20 21:45 134468 c:\windows\System32\perfc009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-09-02 16:28 1107200 ----a-w- c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-10-17 2025752]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-02-12 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-02-12 166424]
"Persistence"="c:\windows\system32\igfxpers.ex e" [2008-02-12 133656]
"a-squared"="c:\program files\a-squared Anti-Dialer\a2adguard.exe" [2008-06-03 1497744]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2007-10-22 4702208]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
B£squeda r*pida de Microsoft.lnk - c:\program files\Microsoft Office\Office\FINDFAST.EXE [1997-9-3 111376]
Inicio de Office.lnk - c:\program files\Microsoft Office\Office\OSA.EXE [1997-9-3 51984]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\curr entversion\explorer\SharedTaskScheduler]
"{1984DD45-52CF-49cd-AB77-18F378FEA264}"= "c:\program files\Stardock\Fences\FencesMenu.dll" [2009-10-02 128360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\avgrsstx.dl l

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

R0 Lbd;Lbd;c:\windows\System32\drivers\Lbd.sys [15/10/2009 12:11 p.m. 64288]
R0 pavboot;pavboot;c:\windows\System32\drivers\pavboo t.sys [28/08/2009 07:11 p.m. 28544]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [27/08/2009 12:08 a.m. 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\System32\drivers\avgtdix.sys [27/08/2009 12:08 a.m. 108552]
R2 a2AntiDialer;a-squared Anti-Dialer Service;c:\program files\a-squared Anti-Dialer\a2service.exe [06/10/2009 02:22 a.m. 425080]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [27/08/2009 12:07 a.m. 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [27/08/2009 12:07 a.m. 297752]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [13/10/2009 09:05 a.m. 1153368]
R2 TVT Backup Protection Service;TVT Backup Protection Service;c:\program files\Lenovo\Rescue and Recovery\rrpservice.exe [10/07/2007 09:26 a.m. 569344]
R3 TVTI2C;Lenovo SM bus driver;c:\windows\System32\drivers\tvti2c.sys [22/05/2007 09:29 a.m. 30336]
S2 gupdate1c9e0087019dce1;Servicio de actualización de Google (gupdate1c9e0087019dce1);c:\program files\Google\Update\GoogleUpdate.exe [28/05/2009 10:21 p.m. 133104]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [24/09/2009 06:47 a.m. 1170768]
S3 VST_DPV;VST_DPV;c:\windows\System32\drivers\VSTDPV 3.SYS [20/01/2008 10:02 p.m. 987648]
S3 VSTHWBS2;VSTHWBS2;c:\windows\System32\drivers\VSTB S23.SYS [20/01/2008 10:02 p.m. 251904]

--- Other Services/Drivers In Memory ---

*Deregistered* - mchInjDrv

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder

2009-10-21 c:\windows\Tasks\Comprobar actualizaciones de Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-02-12 20:24]

2009-10-21 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-09-11 01:52]

2009-10-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-29 02:51]

2009-10-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-29 02:51]

2009-10-21 c:\windows\Tasks\User_Feed_Synchronization-{3335D749-4BAD-4854-A673-300AE69CB57C}.job
- c:\windows\system32\msfeedssync.exe [2008-01-21 02:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.co.ve/
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xportar a Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
FF - ProfilePath - c:\users\Jorge\AppData\Roaming\Mozilla\Firefox\Pro files\33rbbnzr.default\
FF - plugin: c:\program files\Google\Google Updater\2.4.1601.7122\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dl l
FF - plugin: c:\program files\Picasa2\npPicasa3.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
FF - user.js: browser.cache.memory.capacity - 16000
FF - user.js: browser.chrome.favicons - fales
FF - user.js: browser.display.show_image_placeholders - true
FF - user.js: browser.turbo.enabled - true
FF - user.js: browser.urlbar.autocomplete.enabled - true
FF - user.js: browser.urlbar.autofill - true
FF - user.js: content.max.tokenizing.time - 3000000
FF - user.js: content.maxtextrun - 4095
FF - user.js: content.notify.backoffcount - 5
FF - user.js: content.notify.interval - 1000000
FF - user.js: content.notify.ontimer - true
FF - user.js: content.switch.threshold - 1000000
FF - user.js: dom.disable_window_status_change - true
FF - user.js: network.http.max-connections - 48
FF - user.js: network.http.max-connections-per-server - 16
FF - user.js: network.http.max-persistent-connections-per-proxy - 16
FF - user.js: network.http.max-persistent-connections-per-server - 8
FF - user.js: network.http.pipelining - true
FF - user.js: network.http.pipelining.firstrequest - true
FF - user.js: network.http.pipelining.maxrequests - 8
FF - user.js: network.http.proxy.pipelining - true
FF - user.js: network.http.request.max-start-delay - 0
FF - user.js: nglayout.initialpaint.delay - 1000
FF - user.js: plugin.expose_full_path - true
FF - user.js: ui.submenuDelay - 0
.

************************************************** ************************
scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files:

************************************************** ************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Cl ass\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'Explorer.exe'(4068)
c:\program files\Stardock\Fences\FencesMenu.dll
c:\program files\Lenovo\Drag-to-Disc\Shellex.dll
c:\windows\system32\DLAAPI_W.DLL
c:\program files\Lenovo\Drag-to-Disc\ShellRes.dll
c:\program files\stardock\fences\DesktopDock.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\System32\audiodg.exe
c:\program files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
c:\progra~1\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\program files\Lenovo\System Update\SUService.exe
c:\program files\AVG\AVG8\avgcsrvx.exe
c:\windows\servicing\TrustedInstaller.exe
c:\combofix\CF21441.exe
c:\program files\AVG\AVG8\avgtray.exe
c:\windows\System32\igfxsrvc.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\Lenovo\Rescue and Recovery\rrservice.exe
c:\windows\System32\VSSVC.exe
.
************************************************** ************************
.
Completion time: 2009-10-21 22:14 - machine was rebooted
ComboFix-quarantined-files.txt 2009-10-21 02:43

Pre-Run: 105.119.789.056 bytes libres
Post-Run: 104.631.242.752 bytes libres

- - End Of File - - 7EE2DE071BD9DFD3FD07F9B3344427AC

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:56:44 p.m., on 20/10/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18294)
Boot mode: Normal

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\a-squared Anti-Dialer\a2service.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\a-squared Anti-Dialer\a2adguard.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
C:\Windows\System32\svchost.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Windows\System32\mobsync.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\system32\svchost.exe
c:\Program Files\Lenovo\System Update\SUService.exe
C:\Windows\System32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe
C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\SearchIndexer.exe
C:\Utilidades\HighjackThis\HijackThis.exe
C:\Windows\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.ve/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.latam.msn.com/0SEESXL/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\s wg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - c:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: ThinkVantage Password Manager - {F040E541-A427-4CF7-85D8-75E3E0F476C5} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - c:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [a-squared] "C:\Program Files\a-squared Anti-Dialer\a2adguard.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Búsqueda rápida de Microsoft.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Inicio de Office.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O8 - Extra context menu item: &Windows Live Search - res://c:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {0045D4BC-5189-4b67-969C-83BB1906C421} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll
O9 - Extra 'Tools' menuitem: ThinkVantage Password Manager... - {0045D4BC-5189-4b67-969C-83BB1906C421} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll
O9 - Extra button: Portafolios de HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Selección inteligente de HP - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: C:\Windows\System32\avgrsstx.dll
O22 - SharedTaskScheduler: FencesShellExt - {1984DD45-52CF-49cd-AB77-18F378FEA264} - C:\Program Files\Stardock\Fences\FencesMenu.dll
O23 - Service: a-squared Anti-Dialer Service (a2AntiDialer) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Dialer\a2service.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: Servicio de actualización de Google (gupdate1c9e0087019dce1) (gupdate1c9e0087019dce1) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: System Update (SUService) - Lenovo Group Limited - c:\Program Files\Lenovo\System Update\SUService.exe
O23 - Service: ThinkVantage Registry Monitor Service - Lenovo Group Limited - C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
O23 - Service: TSS Core Service (TSSCoreService) - IBM - C:\Program Files\Lenovo\Client Security Solution\tvttcsd.exe
O23 - Service: TVT Backup Protection Service - Unknown owner - C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe
O23 - Service: TVT Backup Service - Lenovo Group Limited - C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe
O23 - Service: TVT Scheduler - Lenovo Group Limited - c:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe
O23 - Service: tvtnetwk - Unknown owner - C:\Program Files\Lenovo\Rescue and Recovery\ADM\IUService.exe

--
End of file - 11208 bytes

post #8

22/10/09, 18:40:28

GPastor

FS-Admin

Registrado: mar 2005

Ubicación: Lima - Perú

Mensajes: 22.227

Re: Posible infección

Los reportes están limpios, solo te quedaría quitar CF de la siguiente manera:

Ir a Inicio > Ejecutar
Escribir lo siguiente: ComboFix /u como muestra la imagen debajo:

Esto realizara las siguientes tareas:

Se borraran:
- ComboFix: sus archivos y carpetas.
- VundoFix: copias de seguridad (si está presente)
- La carpeta C:\Deckard (si está presente)
- La carpeta C: _OtMoveIt (si está presente)
Restablece la configuración del reloj.
Ocultar extensiones de archivo (si es necesario.)
Oculta los archivos que estaban ocultos
Reactiva el "Restaurar Sistema"

Si el problema persiste sigue los pasos para Optimizar Windows así como también descarga y ejecuta la utilidad Advanced SystemCare, para reparar y optimizar a fondo tu PC.

post #9

24/10/09, 16:02:01

jaguer2

Usuario

Registrado: oct 2009

Ubicación: Caracas

Mensajes: 6

Re: Posible infección

Un gran saludo GPastor, te agradezco mucho tu intervención para eliminar las infecciones de mi PC y las recomendaciones para optimizar Windows.

Te comento lo siguiente para que por favor me ayudes a aclarar las dudas:

1) Después de la desinstalación del combofix todavía quedó en C:\ la carpeta ComboFix, conteniendo un archivo ¿Los envío a la papelera?

2) Las carpetas originalmente ocultas en C: $Recycle.Bin y la vault de mi antivirus, quedaron visibles.

3) Otras carpetas actualmente visibles en C:\ de las que tengo dudas sobre sus atributos originales (ocultas o no?):

a) Config.Msi (vacía) y PerfLogs (contiene archivos y carpetas): al abrirlas para ver su contenido, la 1era vez una ventana informó Acceso denegado pero abrieron; posteriormente se pueden abrir sin que salga la ventana.

b) preboot y tvtos (ambas vacías): no se pueden abrir, una ventana informa Acceso denegado.

c) MSOCache (contiene archivos y carpetas).

Mil gracias!!

post #10

28/10/09, 16:18:56

GPastor

FS-Admin

Registrado: mar 2005

Ubicación: Lima - Perú

Mensajes: 22.227

Re: Posible infección

Cita: