Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Error messages while attempting to run a program


  • This topic is locked This topic is locked
28 replies to this topic

#1 rattenjunge

rattenjunge

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:02:47 AM

Posted 05 November 2010 - 08:49 PM

Referred from here: http://www.bleepingcomputer.com/forums/topic357862.html ~ OB

Hello.

I had this nasty infection in my computer, so i ran Avast!,Spybot S&D, Malwarebytes and SuperAntispyware. These programs found and deleted smitfraud-c, Win.32agent, Trojan.fakealert, trojan.alert, malware.trace, trojan.ircbot, among others.

Everything seemed to work fine, until while running Firefox, this message appeared:

C:\...\bin\jqsnotify.exe
Windows cannot access the specified device, path, file...

As well as when I run AutoCAD from a file icon:

C:\...\AutoCAD 2008\acad.exe
Windows cannot access the specified device, path, file...

I have tried re-instaling Firefox, Java and Autocad, but the messages are still showing. In the case of Firefox, everytime a window opens (even pop-ups), in the case of AutoCAD only when I try to run the program by double-clicking an icon. I have already had some help in the security forum (here), however, all attemps to fix this have been unsuccessful. So I've been asked to open a new topic here.

I have tried to run DDS and Gmer unsuccessfuly as well: .scr extension is associated with AutoCAD scripts in my PC, so everytime I double-clik dds.scr a text file full of code appears. As for Gmer, I tried to run GMER a couple of times, but everytime just when it started to run, my PC mysteriously restarted, and then showed me an error message: "System has recovered from Serious error".

So I've been advised in the security forum to run RSIT.exe. Here's the log (file Info.txt is attached:

Logfile of random's system information tool 1.08 (written by random/random)
Run by HERMIDA at 2010-11-05 19:26:13
Microsoft Windows XP Professional Service Pack 3
System drive C: has 111 GB (46%) free of 238 GB
Total RAM: 2037 MB (74% free)


======Scheduled tasks folder======

C:\WINDOWS\tasks\Google Software Updater.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
C:\WINDOWS\tasks\OGADaily.job
C:\WINDOWS\tasks\OGALogon.job
C:\WINDOWS\tasks\WGASetup.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Archivos de programa\Adobe\Adobe Acrobat 7.0\ActiveX\AcroIEHelper.dll [2006-12-18 59032]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0EEDB912-C5FA-486F-8334-57288578C627}]
Shareaza Web Download Hook - C:\Archivos de programa\Shareaza\RazaWebHook32.dll [2010-06-13 81408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}]
IEVkbdBHO Class - C:\Archivos de programa\Kaspersky Lab\Kaspersky Anti-Virus 2011\ievkbd.dll [2010-07-01 68280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live Aplicación auxiliar de inicio de sesión - C:\Archivos de programa\Archivos comunes\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
Adobe PDF Conversion Toolbar Helper - C:\Archivos de programa\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll [2006-12-18 231160]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Archivos de programa\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll [2009-03-23 668656]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java™ Plug-In 2 SSV Helper - C:\Archivos de programa\Java\jre6\bin\jp2ssv.dll [2010-10-29 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E33CF602-D945-461A-83F0-819F76A199F8}]
FilterBHO Class - C:\Archivos de programa\Kaspersky Lab\Kaspersky Anti-Virus 2011\klwtbbho.dll [2010-07-01 191160]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Archivos de programa\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-10-29 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{47833539-D0C5-4125-9FA8-0819E2EAAC93} - PDF de Adobe - C:\Archivos de programa\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll [2006-12-18 231160]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2007-08-10 16384000]
"SkyTel"=C:\WINDOWS\SkyTel.EXE [2007-08-02 1826816]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632]
"IgfxTray"=C:\WINDOWS\system32\igfxtray.exe [2007-06-12 142104]
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe [2007-06-12 162584]
"Persistence"=C:\WINDOWS\system32\igfxpers.exe [2007-06-12 138008]
"NeroFilterCheck"=C:\Archivos de programa\Archivos comunes\Ahead\Lib\NeroCheck.exe [2007-03-01 153136]
"SecurDisc"=C:\Archivos de programa\Nero\Nero 7\InCD\NBHGui.exe [2007-11-26 1629480]
"InCD"=C:\Archivos de programa\Nero\Nero 7\InCD\InCD.exe [2007-11-26 1057064]
"RemoteControl"=C:\Archivos de programa\CyberLink\PowerDVD\PDVDServ.exe [2007-03-14 71216]
"LanguageShortcut"=C:\Archivos de programa\CyberLink\PowerDVD\Language\Language.exe [2007-01-08 52256]
"LGODDFU"=C:\Archivos de programa\lg_fwupdate\fwupdate.exe [2010-02-05 557056]
"Ink Monitor"=C:\Archivos de programa\EPSON\Ink Monitor\InkMonitor.exe [2004-05-04 262210]
"EPSON Stylus CX3500 Series"=C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BL.EXE [2004-03-03 98304]
"Acrobat Assistant 7.0"=C:\Archivos de programa\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe [2008-04-23 483328]
""= []
"boincmgr"=C:\Archivos de programa\BOINC\boincmgr.exe [2009-05-29 4182784]
"boinctray"=C:\Archivos de programa\BOINC\boinctray.exe [2009-05-29 58112]
"NPSStartup"= []
"DivXUpdate"=C:\Archivos de programa\DivX\DivX Update\DivXUpdate.exe [2010-06-02 1144104]
"AVP"=C:\Archivos de programa\Kaspersky Lab\Kaspersky Anti-Virus 2011\avp.exe [2010-10-26 352976]
"SunJavaUpdateSched"=C:\Archivos de programa\Archivos comunes\Java\Java Update\jusched.exe [2010-05-14 248552]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]
"MSMSGS"=C:\Archivos de programa\Messenger\msmsgs.exe [2008-04-14 1695232]
"AutoStartNPSAgent"=C:\Archivos de programa\Samsung\Samsung New PC Studio\NPSAgent.exe [2009-04-02 102400]
"SUPERAntiSpyware"=C:\Archivos de programa\SUPERAntiSpyware\SUPERAntiSpyware.exe [2010-09-28 2424560]

C:\Documents and Settings\All Users.WINDOWS\Menú Inicio\Programas\Inicio
Adobe Gamma.lnk - C:\Archivos de programa\Archivos comunes\Adobe\Calibration\Adobe Gamma Loader.exe
Inicio rápido de Adobe Acrobat.lnk - C:\WINDOWS\Installer\{AC76BA86-1034-4700-7760-100000000002}\SC_Acrobat.exe
Windows Search.lnk - C:\Archivos de programa\Windows Desktop Search\WindowsSearch.exe

C:\Documents and Settings\HERMIDA\Menú Inicio\Programas\Inicio
Recorte de pantalla e Inicio rápido de OneNote 2007.lnk - C:\Archivos de programa\Microsoft Office\Office12\ONENOTEM.EXE
Tabla de contenido de OneNote.onetoc2

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\ARCHIV~1\KASPER~1\KASPER~1\mzvkbd3.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]
C:\Archivos de programa\SUPERAntiSpyware\SASWINLO.DLL [2009-09-03 548352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2007-06-05 204800]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
C:\WINDOWS\system32\klogon.dll [2010-07-01 228024]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
WgaLogon.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"=C:\Archivos de programa\Windows Desktop Search\MSNLNamespaceMgr.dll [2009-05-24 304128]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=C:\Archivos de programa\SUPERAntiSpyware\SASSEH.DLL [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Archivos de programa\VideoLAN\VLC\vlc.exe"="C:\Archivos de programa\VideoLAN\VLC\vlc.exe:*:Enabled:VLC Player"
"C:\Archivos de programa\Windows Live\Messenger\wlcstart.exe"="C:\Archivos de programa\Windows Live\Messenger\wlcstart.exe:*:Enabled:Windows Live Call"
"C:\Archivos de programa\Windows Live\Messenger\msnmsgr.exe"="C:\Archivos de programa\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger "
"C:\Archivos de programa\Google\Google SketchUp 7\LayOut\LayOut.exe"="C:\Archivos de programa\Google\Google SketchUp 7\LayOut\LayOut.exe:*:Enabled:LayOut"
"C:\Archivos de programa\Asistente Infinitum\ISA.exe"="C:\Archivos de programa\Asistente Infinitum\ISA.exe:*:Enabled:Asistente Infinitum"
"C:\Archivos de programa\Ipswitch\WS_FTP 12\UpWiz.exe"="C:\Archivos de programa\Ipswitch\WS_FTP 12\UpWiz.exe:*:Enabled:WS_FTP Upload Wizard"
"C:\Archivos de programa\Google\Google SketchUp 7\SketchUp.exe"="C:\Archivos de programa\Google\Google SketchUp 7\SketchUp.exe:*:Enabled:SketchUp Application"
"C:\Archivos de programa\Shareaza\Shareaza.exe"="C:\Archivos de programa\Shareaza\Shareaza.exe:*:Enabled:Shareaza"
"C:\WINDOWS\Network Diagnostic\xpnetdiag.exe"="C:\WINDOWS\Network Diagnostic\xpnetdiag.exe:*:Enabled:Network Diagnostic for Windows XP"
"C:\Archivos de programa\Google\Google Earth\client\googleearth.exe"="C:\Archivos de programa\Google\Google Earth\client\googleearth.exe:*:Enabled:Google Earth"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======File associations======

.scr - open - "C:\WINDOWS\system32\NOTEPAD.EXE" "%1"
.scr - install -
.scr - config -

======List of files/folders created in the last 1 months======

2010-11-05 19:26:13 ----D---- C:\rsit
2010-11-05 08:32:16 ----D---- C:\WINDOWS\CSC
2010-11-03 15:00:52 ----D---- C:\Archivos de programa\ESET
2010-11-01 13:21:04 ----RD---- C:\32788R22FWJFW
2010-11-01 13:18:10 ----ASH---- C:\pagefile.sys
2010-10-29 17:16:24 ----D---- C:\Archivos de programa\Archivos comunes\Java
2010-10-29 17:15:57 ----A---- C:\WINDOWS\system32\javaws.exe
2010-10-29 17:15:57 ----A---- C:\WINDOWS\system32\javaw.exe
2010-10-29 17:15:57 ----A---- C:\WINDOWS\system32\java.exe
2010-10-29 17:15:34 ----D---- C:\Archivos de programa\Java
2010-10-29 16:59:42 ----D---- C:\Documents and Settings\HERMIDA\Datos de programa\Mozilla
2010-10-26 08:26:17 ----D---- C:\Documents and Settings\All Users.WINDOWS\Datos de programa\Kaspersky Lab
2010-10-26 08:26:17 ----D---- C:\Archivos de programa\Kaspersky Lab
2010-10-26 08:26:03 ----A---- C:\WINDOWS\system32\drivers\klif.sys
2010-10-26 08:25:07 ----D---- C:\Documents and Settings\All Users.WINDOWS\Datos de programa\Kaspersky Lab Setup Files
2010-10-22 13:02:30 ----A---- C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2010-10-22 13:02:29 ----A---- C:\WINDOWS\system32\drivers\mbam.sys
2010-10-22 12:58:21 ----D---- C:\Documents and Settings\HERMIDA\Datos de programa\SUPERAntiSpyware.com
2010-10-22 12:58:15 ----D---- C:\Archivos de programa\SUPERAntiSpyware
2010-10-13 23:17:04 ----HDC---- C:\WINDOWS\$NtUninstallKB2387149$
2010-10-13 23:16:56 ----HDC---- C:\WINDOWS\$NtUninstallKB2279986$
2010-10-13 23:16:41 ----HDC---- C:\WINDOWS\$NtUninstallKB2345886$
2010-10-13 23:16:36 ----HDC---- C:\WINDOWS\$NtUninstallKB2296011$
2010-10-13 23:16:29 ----HDC---- C:\WINDOWS\$NtUninstallKB2378111_WM9$
2010-10-13 23:16:09 ----HDC---- C:\WINDOWS\$NtUninstallKB982132$
2010-10-13 23:15:26 ----HDC---- C:\WINDOWS\$NtUninstallKB979687$
2010-10-13 23:12:57 ----HDC---- C:\WINDOWS\$NtUninstallKB981957$
2010-10-13 23:12:48 ----HDC---- C:\WINDOWS\$NtUninstallKB2360937$

======List of files/folders modified in the last 1 months======

2010-11-05 19:26:17 ----D---- C:\Archivos de programa\Trend Micro
2010-11-05 19:25:58 ----D---- C:\WINDOWS\Temp
2010-11-05 19:24:54 ----D---- C:\Documents and Settings\All Users.WINDOWS\Datos de programa\BOINC
2010-11-05 18:54:07 ----A---- C:\WINDOWS\lgfwup.ini
2010-11-05 18:54:02 ----D---- C:\Archivos de programa\lg_fwupdate
2010-11-05 18:51:12 ----SD---- C:\WINDOWS\Tasks
2010-11-05 18:51:02 ----D---- C:\WINDOWS\system32\drivers
2010-11-05 17:28:27 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-11-05 16:56:03 ----D---- C:\WINDOWS\Minidump
2010-11-05 16:56:03 ----D---- C:\WINDOWS
2010-11-05 15:22:22 ----D---- C:\Documents and Settings\All Users.WINDOWS\Datos de programa\Google Updater
2010-11-05 08:42:23 ----D---- C:\WINDOWS\system32\CatRoot2
2010-11-04 23:54:38 ----D---- C:\Documents and Settings\All Users.WINDOWS\Datos de programa\Spybot - Search & Destroy
2010-11-04 23:53:22 ----D---- C:\Archivos de programa\CCleaner
2010-11-04 23:51:27 ----AD---- C:\Documents and Settings\All Users.WINDOWS\Datos de programa\TEMP
2010-11-04 22:06:41 ----SHD---- C:\System Volume Information
2010-11-04 22:06:41 ----D---- C:\WINDOWS\system32\Restore
2010-11-04 19:29:29 ----D---- C:\WINDOWS\Prefetch
2010-11-03 15:00:55 ----SD---- C:\WINDOWS\Downloaded Program Files
2010-11-03 15:00:52 ----D---- C:\Archivos de programa
2010-11-01 01:56:24 ----A---- C:\WINDOWS\NeroDigital.ini
2010-10-29 17:16:26 ----SHD---- C:\WINDOWS\Installer
2010-10-29 17:16:24 ----D---- C:\Archivos de programa\Archivos comunes
2010-10-29 17:15:57 ----D---- C:\WINDOWS\system32
2010-10-29 17:15:38 ----A---- C:\WINDOWS\system32\deployJava1.dll
2010-10-29 17:13:10 ----D---- C:\Documents and Settings\HERMIDA\Datos de programa\QuickScan
2010-10-29 16:59:36 ----D---- C:\Archivos de programa\Mozilla Firefox
2010-10-26 20:59:01 ----D---- C:\Archivos de programa\Archivos comunes\Adobe
2010-10-26 08:27:43 ----HD---- C:\WINDOWS\inf
2010-10-22 16:28:50 ----HDC---- C:\WINDOWS\$NtUninstallKB978601$
2010-10-22 13:02:33 ----D---- C:\Archivos de programa\Malwarebytes' Anti-Malware
2010-10-18 12:01:43 ----D---- C:\Documents and Settings\HERMIDA\Datos de programa\Any Video Converter
2010-10-14 11:48:33 ----D---- C:\WINDOWS\Debug
2010-10-13 23:17:11 ----D---- C:\WINDOWS\system32\dllcache
2010-10-13 23:17:02 ----HD---- C:\WINDOWS\$hf_mig$
2010-10-13 23:16:37 ----D---- C:\WINDOWS\WinSxS
2010-10-13 23:16:27 ----D---- C:\Documents and Settings\All Users.WINDOWS\Datos de programa\Microsoft Help
2010-10-13 23:14:51 ----D---- C:\Archivos de programa\Internet Explorer
2010-10-13 23:14:39 ----D---- C:\WINDOWS\ie8updates
2010-10-13 23:13:04 ----A---- C:\WINDOWS\system32\MRT.exe
2010-10-07 19:53:33 ----RSD---- C:\WINDOWS\assembly
2010-10-07 19:53:11 ----D---- C:\WINDOWS\Microsoft.NET
2010-10-07 02:03:59 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 KL1;kl1; C:\WINDOWS\system32\DRIVERS\kl1.sys [2010-06-09 132184]
R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2008-11-06 43528]
R0 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
R1 InCDPass;InCDPass; C:\WINDOWS\system32\drivers\InCDPass.sys [2007-11-26 36776]
R1 incdrm;InCD Reader; C:\WINDOWS\system32\drivers\InCDRm.sys [2007-11-26 38440]
R1 intelppm;Controlador de procesador Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 40576]
R1 kl2;kl2; C:\WINDOWS\system32\DRIVERS\kl2.sys [2010-06-09 11352]
R1 KLIF;Kaspersky Lab Driver; C:\WINDOWS\system32\DRIVERS\klif.sys [2010-10-26 475736]
R1 SASDIFSV;SASDIFSV; \??\C:\Archivos de programa\SUPERAntiSpyware\SASDIFSV.SYS []
R1 SASKUTIL;SASKUTIL; \??\C:\Archivos de programa\SUPERAntiSpyware\SASKUTIL.SYS []
R2 irda;Protocolo IrDA; C:\WINDOWS\system32\DRIVERS\irda.sys [2008-04-13 88192]
R2 MDC8021X;AEGIS Protocol (IEEE 802.1x) v2.3.1.9; C:\WINDOWS\system32\DRIVERS\mdc8021x.sys [2005-02-24 15781]
R3 FsUsbExDisk;FsUsbExDisk; \??\C:\WINDOWS\system32\FsUsbExDisk.SYS []
R3 HDAudBus;Controlador de bus de Microsoft UAA para High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 HidUsb;Controlador de clases HID de Microsoft; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\igxpmp32.sys [2007-06-05 5761728]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2007-08-09 4603904]
R3 klim5;Kaspersky Anti-Virus NDIS Filter; C:\WINDOWS\system32\DRIVERS\klim5.sys [2010-05-07 32856]
R3 klmouflt;Kaspersky Lab KLMOUFLT; C:\WINDOWS\system32\DRIVERS\klmouflt.sys [2009-11-02 19472]
R3 mouhid;Controlador HID de mouse; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-22 12416]
R3 Rasirda;Minipuerto WAN (IrDA); C:\WINDOWS\system32\DRIVERS\rasirda.sys [2001-08-17 19584]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2007-08-07 98944]
R3 usbuhci;Controlador minipuerto de la controladora de host universal USB de Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]
R4 InCDfs;InCD File System; C:\WINDOWS\system32\drivers\InCDFs.sys [2007-11-26 118952]
S3 FXDrv32;FXDrv32; \??\D:\FXDrv32.sys []
S3 irsir;Controlador de infrarrojos serie de Microsoft; C:\WINDOWS\system32\DRIVERS\irsir.sys [2001-08-17 18688]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2007-09-17 21632]
S3 SONYPVU1;Controlador de filtro USB de Sony (SONYPVU1); C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS [2001-08-17 7552]
S3 ss_bbus;SAMSUNG USB Mobile Device (WDM); C:\WINDOWS\system32\DRIVERS\ss_bbus.sys [2009-03-20 90112]
S3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter); C:\WINDOWS\system32\DRIVERS\ss_bmdfl.sys [2009-03-20 14976]
S3 ss_bmdm;SAMSUNG USB Mobile Modem; C:\WINDOWS\system32\DRIVERS\ss_bmdm.sys [2009-03-20 121856]
S3 usbccgp;Controlador primario genérico USB de Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
S3 usbprint;Clase de impresora USB de Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-14 25856]
S3 usbscan;Controlador de escáner USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-14 15104]
S3 USBSTOR;Dispositivo de almacenamiento masivo de datos USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AVP;Servicio Kaspersky Anti-Virus; C:\Archivos de programa\Kaspersky Lab\Kaspersky Anti-Virus 2011\avp.exe [2010-10-26 352976]
R2 FsUsbExService;FsUsbExService; C:\WINDOWS\system32\FsUsbExService.Exe [2009-03-31 233472]
R2 InCDsrv;InCD Helper; C:\Archivos de programa\Nero\Nero 7\InCD\InCDsrv.exe [2007-11-26 1554728]
R2 Irmon;Monitor de infrarrojos; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]
R2 IsaMonitor;ISA Monitor Service; C:\Archivos de programa\Asistente Infinitum\IsaMonitor.exe [2008-07-23 185856]
R2 JavaQuickStarterService;Java Quick Starter; C:\Archivos de programa\Java\jre6\bin\jqs.exe [2010-10-29 153376]
R2 RichVideo;Cyberlink RichVideo Service(CRVS); C:\Archivos de programa\CyberLink\Shared Files\RichVideo.exe [2007-05-13 272024]
R2 WSearch;Windows Search; C:\WINDOWS\system32\SearchIndexer.exe [2008-05-26 439808]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]
S2 gupdate1c987cd51b2834e;Google Update Service (gupdate1c987cd51b2834e); C:\Archivos de programa\Google\Update\GoogleUpdate.exe [2009-02-05 133104]
S2 gusvc;Google Software Updater; C:\Archivos de programa\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-03-23 183280]
S3 Adobe LM Service;Adobe LM Service; C:\Archivos de programa\Archivos comunes\Adobe Systems Shared\Service\Adobelmsvc.exe [2009-11-30 72704]
S3 aspnet_state;Servicio de estado de ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 Autodesk Licensing Service;Autodesk Licensing Service; C:\Archivos de programa\Archivos comunes\Autodesk Shared\Service\AdskScSrv.exe [2008-12-01 85096]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 NBService;NBService; C:\Archivos de programa\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-09-17 800040]
S3 NMIndexingService;NMIndexingService; C:\Archivos de programa\Archivos comunes\Ahead\Lib\NMIndexingService.exe [2007-06-27 279848]
S3 odserv;Microsoft Office Diagnostics Service; C:\Archivos de programa\Archivos comunes\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Archivos de programa\Archivos comunes\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 ServiceLayer;ServiceLayer; C:\Archivos de programa\PC Connectivity Solution\ServiceLayer.exe [2008-04-07 430592]
S3 WMPNetworkSvc;Servicio de uso compartido de red del Reproductor de Windows Media; C:\Archivos de programa\Windows Media Player\WMPNetwk.exe [2006-11-03 916480]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------


Thanks.

Attached Files

  • Attached File  info.txt   45.14KB   0 downloads

Edited by Orange Blossom, 05 November 2010 - 09:36 PM.


BC AdBot (Login to Remove)

 


#2 m0le

m0le

    Can U Dig It?


  • Malware Response Team
  • 34,527 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London, UK
  • Local time:08:47 AM

Posted 13 November 2010 - 06:07 PM

Click the link below and look for the .exe file association fix and follow the instructions at the top of the page.

http://www.dougknox.com/xp/file_assoc.htm


Please then download and run MBAM

Please download Posted Image Malwarebytes Anti-Malware and save it to your desktop.
  • Make sure you are connected to the Internet.
  • Double-click on mbam-setup.exe to install the application or, if you are using Vista, right-click and select Run As Administrator on mbam-setup.exe to install the application.
  • When the installation begins, follow the prompts and do not make any changes to default settings.
  • When installation has finished, make sure you leave both of these checked:
    • Update Malwarebytes' Anti-Malware
    • Launch Malwarebytes' Anti-Malware
  • Then click Finish.
  • MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
    If MBAM won't update then download and update MBAM on a clean computer then save the rules.ref folder to a memory stick. This file is found here: 'C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware' then transfer it across to the infected computer.
  • On the Scanner tab:
    • Make sure the "Perform Full Scan" option is selected.
    • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
  • Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad.
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply and exit MBAM.
Note: If MBAM encounters a file that is difficult to remove, you may be asked to reboot your computer so it can proceed with the disinfection process. Regardless if prompted to restart the computer or not, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware. MBAM may make changes to your registry as part of its disinfection routine. If you're using other security programs that detect registry changes, they may alert you after scanning with MBAM. Please permit the program to allow the changes.
Posted Image
m0le is a proud member of UNITE

#3 rattenjunge

rattenjunge
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:02:47 AM

Posted 14 November 2010 - 02:03 PM

Hello.
I've fixed .EXE asociations, and here's the MBAM log:


Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 5113

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

14/11/2010 12:45:03 PM
mbam-log-2010-11-14 (12-45-03).txt

Scan type: Full Scan (C:\|F:\|)
Objects scanned: 301442
Time elapsed: 1 hour(s), 51 minute(s), 40 secOnd(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 5

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\taskman (Worm.Palevo) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\System Volume Information\_restore{C46292E0-F81B-4062-B934-EBD245909FA7}\RP4\A0004519.exe (Worm.Palevo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{C46292E0-F81B-4062-B934-EBD245909FA7}\RP4\A0004499.exe (Worm.Palevo.Gen) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{C46292E0-F81B-4062-B934-EBD245909FA7}\RP5\A0004650.exe (Worm.Palevo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{C46292E0-F81B-4062-B934-EBD245909FA7}\RP5\A0004651.exe (Worm.Palevo) -> Quarantined and deleted successfully.
C:\Documents and Settings\HERMIDA\Datos de programa\jxiz.exe (Worm.Palevo) -> Delete on reboot.



However, error messages still show up.

#4 m0le

m0le

    Can U Dig It?


  • Malware Response Team
  • 34,527 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London, UK
  • Local time:08:47 AM

Posted 14 November 2010 - 05:20 PM

Please run Combofix. MBAM seems to have had a problem dealing with the worm

Please download ComboFix from one of these locations:* IMPORTANT !!! Save ComboFix.exe to your Desktop making sure you rename it comfix.exe
  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
  • Double click on Comfix.exe & follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Posted Image


Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Posted Image


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Posted Image
m0le is a proud member of UNITE

#5 rattenjunge

rattenjunge
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:02:47 AM

Posted 16 November 2010 - 11:12 AM

Hello again. I've tried to run comfix.exe, but several error messages appear:

32788R22FWJFW\iexplore.exe
Windows cannot access the specified device, path, file...

32788R22FWJFW\n.pif
Windows cannot access the specified device, path, file...

32788R22FWJFW\hidec.exe
Windows cannot access the specified device, path, file...

Another message appears, this one prompting with which program should I open nircmd.cfxxe

Bottomline is, i couldn't run combofix.

Edited by rattenjunge, 16 November 2010 - 11:13 AM.


#6 m0le

m0le

    Can U Dig It?


  • Malware Response Team
  • 34,527 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London, UK
  • Local time:08:47 AM

Posted 16 November 2010 - 06:49 PM

The same problems you were getting before.

Try fixing the file association with .exe again and then try running Combofix.

If that fails...

Let's try something a little bit more quiet and see how the PC deals with it.

  • Download TDSSKiller and save it to your Desktop.

  • Extract its contents to your desktop and make sure TDSSKiller.exe (the contents of the zipped file) is on the Desktop itself, not within a folder on the desktop.

  • Go to Start > Run (Or you can hold down your Windows key and press R) and copy and paste the following into the text field. (make sure you include the quote marks) Then press OK.

    "%userprofile%\Desktop\TDSSKiller.exe" -l report.txt

  • Now click Start Scan.
  • If Malicious objects are found, ensure Cure is selected then click Continue > Reboot now.
  • Click Close
  • Finally press Report and copy and paste the contents into your next reply. If you've rebooted then the log will be found at C:\

Edited by m0le, 16 November 2010 - 06:50 PM.

Posted Image
m0le is a proud member of UNITE

#7 rattenjunge

rattenjunge
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:02:47 AM

Posted 16 November 2010 - 08:04 PM

Hello.

I fixed .EXE associations again, but i couldn't run combofix.

Then I downloaded tdsskiller.zip, but the file has some kind of compression error that makes tdsskiller.exe impossible to extract. So I downloaded the file to my desktop from Kaspersky website.

Then I tried to run tdsskiller.exe using the string of code, but an error message appears which reads:

C:\Documents and Settings\HERMIDA\Desktop refers to a location that is unavailable. It could be on a hard drive on this computer, or on a network. Check to make sure that the disk is properly inserted, or that you are connected to the Internet or your network, and then try again. If it still cannot be located, the information might have been moved to a different location.

So i just double-clicked tdsskiller.exe. There wasn't any malicious objects. Here's the report:


2010/11/16 18:50:37.0015 TDSS rootkit removing tool 2.4.7.1 Nov 16 2010 08:18:13
2010/11/16 18:50:37.0015 ================================================================================
2010/11/16 18:50:37.0015 SystemInfo:
2010/11/16 18:50:37.0015
2010/11/16 18:50:37.0015 OS Version: 5.1.2600 ServicePack: 3.0
2010/11/16 18:50:37.0015 Product type: Workstation
2010/11/16 18:50:37.0015 ComputerName: NEUE-PC
2010/11/16 18:50:37.0015 UserName: HERMIDA
2010/11/16 18:50:37.0015 Windows directory: C:\WINDOWS
2010/11/16 18:50:37.0015 System windows directory: C:\WINDOWS
2010/11/16 18:50:37.0015 Processor architecture: Intel x86
2010/11/16 18:50:37.0015 Number of processors: 2
2010/11/16 18:50:37.0015 Page size: 0x1000
2010/11/16 18:50:37.0015 Boot type: Normal boot
2010/11/16 18:50:37.0015 ================================================================================
2010/11/16 18:50:37.0312 Initialize success
2010/11/16 18:50:41.0703 ================================================================================
2010/11/16 18:50:41.0703 Scan started
2010/11/16 18:50:41.0703 Mode: Manual;
2010/11/16 18:50:41.0703 ================================================================================
2010/11/16 18:50:42.0828 ACPI (cf2a07e1751a2d612d7e13aa431ab057) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2010/11/16 18:50:42.0875 ACPIEC (1c905333c0b9f3d7c68ddf25e54b00f9) C:\WINDOWS\system32\drivers\ACPIEC.sys
2010/11/16 18:50:42.0953 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
2010/11/16 18:50:43.0015 AFD (7e775010ef291da96ad17ca4b17137d7) C:\WINDOWS\System32\drivers\afd.sys
2010/11/16 18:50:43.0265 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2010/11/16 18:50:43.0343 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
2010/11/16 18:50:43.0468 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2010/11/16 18:50:43.0515 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2010/11/16 18:50:43.0562 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2010/11/16 18:50:43.0609 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2010/11/16 18:50:43.0640 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2010/11/16 18:50:43.0703 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
2010/11/16 18:50:43.0734 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2010/11/16 18:50:43.0937 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
2010/11/16 18:50:44.0031 dmboot (c252a99c0a78b39faa2e2d1d048b1050) C:\WINDOWS\system32\drivers\dmboot.sys
2010/11/16 18:50:44.0046 dmio (33b4d4039cd2cb25351a7bf13b2988d9) C:\WINDOWS\system32\drivers\dmio.sys
2010/11/16 18:50:44.0109 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2010/11/16 18:50:44.0156 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
2010/11/16 18:50:44.0234 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
2010/11/16 18:50:44.0328 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
2010/11/16 18:50:44.0375 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
2010/11/16 18:50:44.0437 Fips (e5e61f2c07344e91dbfb7eafde549ab4) C:\WINDOWS\system32\drivers\Fips.sys
2010/11/16 18:50:44.0468 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
2010/11/16 18:50:44.0531 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
2010/11/16 18:50:44.0578 FsUsbExDisk (790a4ca68f44be35967b3df61f3e4675) C:\WINDOWS\system32\FsUsbExDisk.SYS
2010/11/16 18:50:44.0656 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2010/11/16 18:50:44.0687 Ftdisk (cc5f3af5711a1c7c8fa1d43bb16b401a) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2010/11/16 18:50:44.0765 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2010/11/16 18:50:44.0812 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
2010/11/16 18:50:44.0875 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2010/11/16 18:50:45.0000 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
2010/11/16 18:50:45.0187 i8042prt (4a2490a66e8271901e89dd5fb79748ae) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
2010/11/16 18:50:45.0359 ialm (12c7f8d581c4a9f126f5f8f5683a1c29) C:\WINDOWS\system32\DRIVERS\igxpmp32.sys
2010/11/16 18:50:45.0562 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
2010/11/16 18:50:45.0625 InCDfs (b02a8a25192ee1c5e653628637ab6aaa) C:\WINDOWS\system32\drivers\InCDFs.sys
2010/11/16 18:50:45.0656 InCDPass (b49bd5b663e1af9bf3233b782b70d865) C:\WINDOWS\system32\drivers\InCDPass.sys
2010/11/16 18:50:45.0687 InCDrec (8fd364edbd97983575cee3e8909e62b4) C:\WINDOWS\system32\drivers\InCDrec.sys
2010/11/16 18:50:45.0718 incdrm (fc04e827133d54ab79ca254708f76cd0) C:\WINDOWS\system32\drivers\InCDRm.sys
2010/11/16 18:50:46.0093 IntcAzAudAddService (8f924588c272fdaa28cf31a9bbc21a72) C:\WINDOWS\system32\drivers\RtkHDAud.sys
2010/11/16 18:50:46.0250 intelppm (49a060498c09db18c3ea9939789005ab) C:\WINDOWS\system32\DRIVERS\intelppm.sys
2010/11/16 18:50:46.0281 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
2010/11/16 18:50:46.0312 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2010/11/16 18:50:46.0359 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2010/11/16 18:50:46.0406 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2010/11/16 18:50:46.0453 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2010/11/16 18:50:46.0500 irda (aca5e7b54409f9cb5eed97ed0c81120e) C:\WINDOWS\system32\DRIVERS\irda.sys
2010/11/16 18:50:46.0546 irsir (0501f0b9ab08425f8c0eacbdcc04aa32) C:\WINDOWS\system32\DRIVERS\irsir.sys
2010/11/16 18:50:46.0593 isapnp (0f3d281b0410fe5d482aada37d20524b) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2010/11/16 18:50:46.0640 Kbdclass (188ddd286bc0daea6984858c6a4d7bbf) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2010/11/16 18:50:46.0687 KL1 (94d67d49bd9503bb1d838405d80f2058) C:\WINDOWS\system32\DRIVERS\kl1.sys
2010/11/16 18:50:46.0734 kl2 (713576569667ac9e0f8556076004a96b) C:\WINDOWS\system32\DRIVERS\kl2.sys
2010/11/16 18:50:46.0781 KLIF (395a295fd9ea657b4a3621e402cc56c5) C:\WINDOWS\system32\DRIVERS\klif.sys
2010/11/16 18:50:46.0843 klim5 (8d6e11bfa9927978d25b1b8029554f07) C:\WINDOWS\system32\DRIVERS\klim5.sys
2010/11/16 18:50:46.0906 klmouflt (3959530f69e19da56f1f24f2c89f1e2c) C:\WINDOWS\system32\DRIVERS\klmouflt.sys
2010/11/16 18:50:46.0953 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
2010/11/16 18:50:47.0015 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
2010/11/16 18:50:47.0140 MDC8021X (d7010580bf4e45d5e793a1fe75758c69) C:\WINDOWS\system32\DRIVERS\mdc8021x.sys
2010/11/16 18:50:47.0203 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2010/11/16 18:50:47.0234 Modem (9024556e739b8469d2b8f5f0e4c9bc9f) C:\WINDOWS\system32\drivers\Modem.sys
2010/11/16 18:50:47.0296 Mouclass (6fd36b4994a2363659a65c9f970cfdb7) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2010/11/16 18:50:47.0343 mouhid (8ee532e516b2d23d686cfc1cc0a15c25) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2010/11/16 18:50:47.0406 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
2010/11/16 18:50:47.0515 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2010/11/16 18:50:47.0593 MRxSmb (f3aefb11abc521122b67095044169e98) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2010/11/16 18:50:47.0671 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
2010/11/16 18:50:47.0750 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2010/11/16 18:50:47.0765 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2010/11/16 18:50:47.0812 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
2010/11/16 18:50:47.0875 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2010/11/16 18:50:47.0906 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys
2010/11/16 18:50:48.0000 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
2010/11/16 18:50:48.0031 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2010/11/16 18:50:48.0078 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2010/11/16 18:50:48.0093 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2010/11/16 18:50:48.0109 NDProxy (6215023940cfd3702b46abc304e1d45a) C:\WINDOWS\system32\drivers\NDProxy.sys
2010/11/16 18:50:48.0140 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
2010/11/16 18:50:48.0250 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
2010/11/16 18:50:48.0312 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
2010/11/16 18:50:48.0343 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
2010/11/16 18:50:48.0421 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2010/11/16 18:50:48.0468 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2010/11/16 18:50:48.0484 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2010/11/16 18:50:48.0546 Parport (e7855cbd8bd1fda085a3f92cff7906e2) C:\WINDOWS\system32\DRIVERS\parport.sys
2010/11/16 18:50:48.0625 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
2010/11/16 18:50:48.0687 ParVdm (fad44d704ecd7d39ad01415b8bb34204) C:\WINDOWS\system32\drivers\ParVdm.sys
2010/11/16 18:50:48.0734 pccsmcfd (175cc28dcf819f78caa3fbd44ad9e52a) C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys
2010/11/16 18:50:48.0796 PCI (f11bc84ae6c7b003b5e0c8eeb4a1f444) C:\WINDOWS\system32\DRIVERS\pci.sys
2010/11/16 18:50:48.0828 PCIIde (33d63f0a9021acb4d75d83b646b93a30) C:\WINDOWS\system32\DRIVERS\pciide.sys
2010/11/16 18:50:48.0875 Pcmcia (f50c27cca56dc97b3a45e7f0059bd2ba) C:\WINDOWS\system32\drivers\Pcmcia.sys
2010/11/16 18:50:49.0093 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2010/11/16 18:50:49.0125 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
2010/11/16 18:50:49.0187 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2010/11/16 18:50:49.0234 PxHelp20 (d86b4a68565e444d76457f14172c875a) C:\WINDOWS\system32\Drivers\PxHelp20.sys
2010/11/16 18:50:49.0390 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2010/11/16 18:50:49.0437 Rasirda (0207d26ddf796a193ccd9f83047bb5fc) C:\WINDOWS\system32\DRIVERS\rasirda.sys
2010/11/16 18:50:49.0468 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2010/11/16 18:50:49.0500 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2010/11/16 18:50:49.0578 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2010/11/16 18:50:49.0625 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2010/11/16 18:50:49.0656 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2010/11/16 18:50:49.0703 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
2010/11/16 18:50:49.0750 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
2010/11/16 18:50:49.0781 redbook (20950948970a0ea329b4254052bcf093) C:\WINDOWS\system32\DRIVERS\redbook.sys
2010/11/16 18:50:49.0859 RTLE8023xp (badabe0940c01619e8510b90fb314929) C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys
2010/11/16 18:50:49.0953 SASDIFSV (a3281aec37e0720a2bc28034c2df2a56) C:\Archivos de programa\SUPERAntiSpyware\SASDIFSV.SYS
2010/11/16 18:50:49.0968 SASKUTIL (61db0d0756a99506207fd724e3692b25) C:\Archivos de programa\SUPERAntiSpyware\SASKUTIL.SYS
2010/11/16 18:50:50.0078 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2010/11/16 18:50:50.0109 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
2010/11/16 18:50:50.0140 Serial (f41b42b92ae9c1191858c3f80cc24a9c) C:\WINDOWS\system32\DRIVERS\serial.sys
2010/11/16 18:50:50.0171 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
2010/11/16 18:50:50.0250 SONYPVU1 (a1eceeaa5c5e74b2499eb51d38185b84) C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS
2010/11/16 18:50:50.0328 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
2010/11/16 18:50:50.0375 sr (ccb3065c3ee63a4515fe84af9e78d1dd) C:\WINDOWS\system32\DRIVERS\sr.sys
2010/11/16 18:50:50.0453 Srv (0f6aefad3641a657e18081f52d0c15af) C:\WINDOWS\system32\DRIVERS\srv.sys
2010/11/16 18:50:50.0562 ss_bbus (eaa66218cd39f5bb1b4853a78c67c787) C:\WINDOWS\system32\DRIVERS\ss_bbus.sys
2010/11/16 18:50:50.0593 ss_bmdfl (91765f99914ed8693d8bc76524f21581) C:\WINDOWS\system32\DRIVERS\ss_bmdfl.sys
2010/11/16 18:50:50.0625 ss_bmdm (840e7b738b03c10ee91d9b7d3d6eff15) C:\WINDOWS\system32\DRIVERS\ss_bmdm.sys
2010/11/16 18:50:50.0671 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
2010/11/16 18:50:50.0703 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
2010/11/16 18:50:51.0015 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
2010/11/16 18:50:51.0062 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2010/11/16 18:50:51.0109 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
2010/11/16 18:50:51.0140 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
2010/11/16 18:50:51.0187 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
2010/11/16 18:50:51.0328 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
2010/11/16 18:50:51.0468 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
2010/11/16 18:50:51.0546 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
2010/11/16 18:50:51.0593 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
2010/11/16 18:50:51.0625 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2010/11/16 18:50:51.0671 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
2010/11/16 18:50:51.0687 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
2010/11/16 18:50:51.0734 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2010/11/16 18:50:51.0781 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
2010/11/16 18:50:51.0843 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
2010/11/16 18:50:51.0937 VolSnap (c41ffdc191e6c832e2e53c967eae0a16) C:\WINDOWS\system32\drivers\VolSnap.sys
2010/11/16 18:50:52.0000 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2010/11/16 18:50:52.0046 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
2010/11/16 18:50:52.0218 WpdUsb (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\DRIVERS\wpdusb.sys
2010/11/16 18:50:52.0281 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
2010/11/16 18:50:52.0312 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
2010/11/16 18:50:52.0468 ================================================================================
2010/11/16 18:50:52.0468 Scan finished
2010/11/16 18:50:52.0468 ================================================================================


Thanks.

Edited by rattenjunge, 16 November 2010 - 08:06 PM.


#8 m0le

m0le

    Can U Dig It?


  • Malware Response Team
  • 34,527 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London, UK
  • Local time:08:47 AM

Posted 16 November 2010 - 08:12 PM

We need to execute an OTM script
  • Please download OTM by OldTimer and save it to your desktop.
  • Double click the Posted Image icon on your desktop.
  • Paste the following code under the Posted Image area.
    :Files
    C:\Documents and Settings\HERMIDA\Datos de programa\jxiz.exe
    
  • Push the large Posted Image button.
  • OTM may ask to reboot the machine. Please do so if asked.
  • Copy/Paste the contents under the Posted Image line here in your next reply.
  • If you are unable to copy/paste from this window (as will be the case if the machine was rebooted), open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.
Post the OTM log.


Please then post an OTL log. See below:

  • Download OTL to your desktop.
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Under the Standard Registry box change it to All.
  • Check the boxes beside LOP Check and Purity Check.
  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.

Edited by m0le, 16 November 2010 - 08:13 PM.

Posted Image
m0le is a proud member of UNITE

#9 rattenjunge

rattenjunge
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:02:47 AM

Posted 17 November 2010 - 12:57 AM

hello.

This are the OTM results:

========== FILES ==========
File/Folder C:\Documents and Settings\HERMIDA\Datos de programa\jxiz.exe not found.

OTM by OldTimer - Version 3.1.17.2 log created on 11162010_232147



And the OTL results:


OTL logfile created on: 16/11/2010 11:33:49 p.m. - Run 1
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Documents and Settings\HERMIDA\Escritorio
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 0000080A | Country: México | Language: ESM | Date Format: dd/MM/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 73.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 89.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Archivos de programa
Drive C: | 232.88 Gb Total Space | 106.76 Gb Free Space | 45.84% Space Free | Partition Type: NTFS

Computer Name: NEUE-PC | User Name: HERMIDA | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\HERMIDA\Escritorio\OTL.exe (OldTimer Tools)
PRC - C:\Archivos de programa\Kaspersky Lab\Kaspersky Anti-Virus 2011\avp.exe (Kaspersky Lab ZAO)
PRC - C:\Archivos de programa\Google\Update\1.2.183.39\GoogleCrashHandler.exe (Google Inc.)
PRC - C:\Archivos de programa\Archivos comunes\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Archivos de programa\BOINC\boincmgr.exe (Space Sciences Laboratory)
PRC - C:\Archivos de programa\BOINC\boinctray.exe (Space Sciences Laboratory)
PRC - C:\Archivos de programa\BOINC\boinc.exe (Space Sciences Laboratory)
PRC - C:\WINDOWS\system32\FsUsbExService.Exe (Teruten)
PRC - C:\Archivos de programa\Asistente Infinitum\IsaMonitor.exe (Fine Point Technologies, Inc.)
PRC - C:\Archivos de programa\Adobe\Adobe Acrobat 7.0\Distillr\acrotray.exe (Adobe Systems Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Archivos de programa\Nero\Nero 7\InCD\NBHGui.exe (Nero AG)
PRC - C:\Archivos de programa\Nero\Nero 7\InCD\InCDsrv.exe (Nero AG)
PRC - C:\Archivos de programa\Nero\Nero 7\InCD\InCD.exe (Nero AG)
PRC - C:\WINDOWS\system32\spool\drivers\w32x86\3\E_FATI9BL.EXE (SEIKO EPSON CORPORATION)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\HERMIDA\Escritorio\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (HidServ) -- C:\WINDOWS\System32\hidserv.dll File not found
SRV - (AVP) -- C:\Archivos de programa\Kaspersky Lab\Kaspersky Anti-Virus 2011\avp.exe (Kaspersky Lab ZAO)
SRV - (Adobe LM Service) -- C:\Archivos de programa\Archivos comunes\Adobe Systems Shared\Service\Adobelmsvc.exe (Adobe Systems)
SRV - (FsUsbExService) -- C:\WINDOWS\system32\FsUsbExService.Exe (Teruten)
SRV - (Autodesk Licensing Service) -- C:\Archivos de programa\Archivos comunes\Autodesk Shared\Service\AdskScSrv.exe (Autodesk)
SRV - (odserv) -- C:\Archivos de programa\Archivos comunes\Microsoft Shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (IsaMonitor) -- C:\Archivos de programa\Asistente Infinitum\IsaMonitor.exe (Fine Point Technologies, Inc.)
SRV - (ServiceLayer) -- C:\Archivos de programa\PC Connectivity Solution\ServiceLayer.exe (Nokia.)
SRV - (InCDsrv) -- C:\Archivos de programa\Nero\Nero 7\InCD\InCDsrv.exe (Nero AG)
SRV - (NMIndexingService) -- C:\Archivos de programa\Archivos comunes\Ahead\Lib\NMIndexingService.exe (Nero AG)
SRV - (ose) -- C:\Archivos de programa\Archivos comunes\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV - (IRENUM) -- C:\WINDOWS\System32\DRIVERS\irenum.sys File not found
DRV - (FXDrv32) -- D:\FXDrv32.sys File not found
DRV - (KLIF) -- C:\WINDOWS\system32\drivers\klif.sys (Kaspersky Lab)
DRV - (kl2) -- C:\WINDOWS\system32\drivers\kl2.sys (Kaspersky Lab ZAO)
DRV - (KL1) -- C:\WINDOWS\system32\DRIVERS\kl1.sys (Kaspersky Lab ZAO)
DRV - (SASKUTIL) -- C:\Archivos de programa\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (klim5) -- C:\WINDOWS\system32\drivers\klim5.sys (Kaspersky Lab ZAO)
DRV - (SASDIFSV) -- C:\Archivos de programa\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (klmouflt) -- C:\WINDOWS\system32\drivers\klmouflt.sys (Kaspersky Lab)
DRV - (FsUsbExDisk) -- C:\WINDOWS\system32\FsUsbExDisk.Sys ()
DRV - (ss_bmdm) -- C:\WINDOWS\system32\drivers\ss_bmdm.sys (MCCI Corporation)
DRV - (ss_bbus) SAMSUNG USB Mobile Device (WDM) -- C:\WINDOWS\system32\drivers\ss_bbus.sys (MCCI)
DRV - (ss_bmdfl) SAMSUNG USB Mobile Modem (Filter) -- C:\WINDOWS\system32\drivers\ss_bmdfl.sys (MCCI Corporation)
DRV - (HDAudBus) -- C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows ® Server 2003 DDK provider)
DRV - (incdrm) -- C:\WINDOWS\system32\drivers\InCDRm.sys (Nero AG)
DRV - (InCDPass) -- C:\WINDOWS\system32\drivers\InCDPass.sys (Nero AG)
DRV - (InCDfs) -- C:\WINDOWS\system32\drivers\InCDfs.sys (Nero AG)
DRV - (pccsmcfd) -- C:\WINDOWS\system32\drivers\pccsmcfd.sys (Nokia)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (RTLE8023xp) -- C:\WINDOWS\system32\drivers\Rtenicxp.sys (Realtek Semiconductor Corporation )
DRV - (ialm) -- C:\WINDOWS\system32\drivers\igxpmp32.sys (Intel Corporation)
DRV - (MDC8021X) AEGIS Protocol (IEEE 802.1x) -- C:\WINDOWS\system32\drivers\mdc8021x.sys (Meetinghouse Data Communications)
DRV - (irsir) -- C:\WINDOWS\system32\drivers\irsir.sys (Microsoft Corporation)


========== Standard Registry (All) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = prodigy.msn.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\system32\ieframe.dll (Microsoft Corporation)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..extensions.enabledItems: linkfilter@kaspersky.ru:11.0.1.400
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}:6.0.10
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}:6.0.11
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}:6.0.13
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}:6.0.15
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}:6.0.17
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}:6.0.19
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {20a82645-c095-46ed-80e3-08825760534b}:1.2.1
FF - prefs.js..extensions.enabledItems: {e001c731-5e37-4538-a5cb-8168736a2360}:0.9.9.52
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.12

FF - HKLM\software\mozilla\Firefox\extensions\\{20a82645-c095-46ed-80e3-08825760534b}: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009/08/06 15:14:52 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\extensions\\jqs@sun.com: C:\Archivos de programa\Java\jre6\lib\deploy\jqs\ff [2010/10/29 17:15:39 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Components: C:\Archivos de programa\Mozilla Firefox\components [2010/10/29 16:59:48 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Plugins: C:\Archivos de programa\Mozilla Firefox\plugins [2010/10/29 16:59:34 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\{eea12ec4-729d-4703-bc37-106ce9879ce2}: C:\Archivos de programa\Kaspersky Lab\Kaspersky Anti-Virus 2011\THBExt [2010/10/26 08:26:52 | 000,000,000 | ---D | M]

[2010/10/29 16:59:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HERMIDA\Datos de programa\Mozilla\Extensions
[2010/10/29 16:59:56 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\HERMIDA\Datos de programa\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2010/11/16 10:08:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HERMIDA\Datos de programa\Mozilla\Firefox\Profiles\m5e31i2k.default\extensions
[2010/11/16 10:08:06 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\HERMIDA\Datos de programa\Mozilla\Firefox\Profiles\m5e31i2k.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/11/16 10:08:02 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\HERMIDA\Datos de programa\Mozilla\Firefox\Profiles\m5e31i2k.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
[2010/11/11 17:27:10 | 000,001,148 | ---- | M] () -- C:\Documents and Settings\HERMIDA\Datos de programa\Mozilla\Firefox\Profiles\m5e31i2k.default\searchplugins\diccionario-de-espaol-rae.xml
[2010/11/16 10:08:30 | 000,000,000 | ---D | M] -- C:\Archivos de programa\Mozilla Firefox\extensions
[2010/10/29 16:59:34 | 000,000,000 | ---D | M] (Default) -- C:\Archivos de programa\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2008/12/01 16:28:36 | 000,000,000 | ---D | M] (Java Console) -- C:\Archivos de programa\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}
[2008/12/02 18:41:57 | 000,000,000 | ---D | M] (Java Console) -- C:\Archivos de programa\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
[2009/04/01 14:07:00 | 000,000,000 | ---D | M] (Java Console) -- C:\Archivos de programa\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
[2009/08/04 22:39:19 | 000,000,000 | ---D | M] (Java Console) -- C:\Archivos de programa\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
[2009/12/01 22:20:16 | 000,000,000 | ---D | M] (Java Console) -- C:\Archivos de programa\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
[2010/03/30 16:29:03 | 000,000,000 | ---D | M] (Java Console) -- C:\Archivos de programa\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}
[2010/05/11 08:54:59 | 000,000,000 | ---D | M] (Java Console) -- C:\Archivos de programa\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/08/05 15:08:16 | 000,000,000 | ---D | M] (Java Console) -- C:\Archivos de programa\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/10/25 16:59:01 | 000,000,000 | ---D | M] (Java Console) -- C:\Archivos de programa\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2010/10/26 08:27:46 | 000,000,000 | ---D | M] -- C:\Archivos de programa\Mozilla Firefox\extensions\linkfilter@kaspersky.ru
[2010/10/27 00:14:45 | 000,025,048 | ---- | M] (Mozilla Foundation) -- C:\Archivos de programa\Mozilla Firefox\components\browserdirprovider.dll
[2010/10/27 00:14:45 | 000,140,248 | ---- | M] (Mozilla Foundation) -- C:\Archivos de programa\Mozilla Firefox\components\brwsrcmp.dll
[2010/10/29 17:15:38 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Archivos de programa\Mozilla Firefox\plugins\npdeployJava1.dll
[2008/12/10 18:33:34 | 000,098,304 | ---- | M] (DivX, Inc) -- C:\Archivos de programa\Mozilla Firefox\plugins\npDivxPlayerPlugin.dll
[2010/10/27 00:14:45 | 000,066,520 | ---- | M] (mozilla.org) -- C:\Archivos de programa\Mozilla Firefox\plugins\npnul32.dll
[2006/10/26 20:12:16 | 000,016,192 | ---- | M] (Microsoft Corporation) -- C:\Archivos de programa\Mozilla Firefox\plugins\NPOFF12.DLL
[2004/12/14 02:19:18 | 000,057,344 | ---- | M] (Adobe Systems Inc.) -- C:\Archivos de programa\Mozilla Firefox\plugins\nppdf32.dll
[2010/10/26 23:58:59 | 000,001,394 | ---- | M] () -- C:\Archivos de programa\Mozilla Firefox\searchplugins\amazondotcom.xml
[2010/10/26 23:58:59 | 000,001,534 | ---- | M] () -- C:\Archivos de programa\Mozilla Firefox\searchplugins\creativecommons.xml
[2010/10/26 23:58:59 | 000,002,371 | ---- | M] () -- C:\Archivos de programa\Mozilla Firefox\searchplugins\google.xml
[2010/10/26 23:58:59 | 000,001,178 | ---- | M] () -- C:\Archivos de programa\Mozilla Firefox\searchplugins\wikipedia-es.xml
[2010/10/26 23:58:59 | 000,000,798 | ---- | M] () -- C:\Archivos de programa\Mozilla Firefox\searchplugins\yahoo-mx.xml

O1 HOSTS File: ([2010/09/18 21:28:23 | 000,000,698 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Archivos de programa\Adobe\Adobe Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Shareaza Web Download Hook) - {0EEDB912-C5FA-486F-8334-57288578C627} - C:\Archivos de programa\Shareaza\RazaWebHook32.dll (Shareaza Development Team)
O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Archivos de programa\Kaspersky Lab\Kaspersky Anti-Virus 2011\ievkbd.dll (Kaspersky Lab ZAO)
O2 - BHO: (Windows Live Aplicación auxiliar de inicio de sesión) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Archivos de programa\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Archivos de programa\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Archivos de programa\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Archivos de programa\Kaspersky Lab\Kaspersky Anti-Virus 2011\klwtbbho.dll (Kaspersky Lab ZAO)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Archivos de programa\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (PDF de Adobe) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Archivos de programa\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\ShellBrowser: (&Dirección) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (&Dirección) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (&Vínculos) - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (PDF de Adobe) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Archivos de programa\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Acrobat Assistant 7.0] C:\Archivos de programa\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [AVP] C:\Archivos de programa\Kaspersky Lab\Kaspersky Anti-Virus 2011\avp.exe (Kaspersky Lab ZAO)
O4 - HKLM..\Run: [boincmgr] C:\Archivos de programa\BOINC\boincmgr.exe (Space Sciences Laboratory)
O4 - HKLM..\Run: [boinctray] C:\Archivos de programa\BOINC\boinctray.exe (Space Sciences Laboratory)
O4 - HKLM..\Run: [DivXUpdate] C:\Archivos de programa\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [EPSON Stylus CX3500 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BL.EXE (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe (Intel Corporation)
O4 - HKLM..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe (Intel Corporation)
O4 - HKLM..\Run: [InCD] C:\Archivos de programa\Nero\Nero 7\InCD\InCD.exe (Nero AG)
O4 - HKLM..\Run: [Ink Monitor] C:\Archivos de programa\epson\Ink Monitor\InkMonitor.exe (Epson)
O4 - HKLM..\Run: [LanguageShortcut] C:\Archivos de programa\CyberLink\PowerDVD\Language\Language.exe ()
O4 - HKLM..\Run: [LGODDFU] C:\Archivos de programa\lg_fwupdate\fwupdate.exe (BitLeader)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Archivos de programa\Archivos comunes\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [NPSStartup] File not found
O4 - HKLM..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe (Intel Corporation)
O4 - HKLM..\Run: [RemoteControl] C:\Archivos de programa\CyberLink\PowerDVD\PDVDServ.exe (Cyberlink Corp.)
O4 - HKLM..\Run: [RTHDCPL] C:\WINDOWS\RTHDCPL.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SecurDisc] C:\Archivos de programa\Nero\Nero 7\InCD\NBHGui.exe (Nero AG)
O4 - HKLM..\Run: [SkyTel] C:\WINDOWS\SkyTel.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Archivos de programa\Archivos comunes\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKCU..\Run: [AutoStartNPSAgent] C:\Archivos de programa\Samsung\Samsung New PC Studio\NPSAgent.exe (Samsung Electronics Co., Ltd.)
O4 - HKCU..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (Microsoft Corporation)
O4 - HKCU..\Run: [MSMSGS] C:\Archivos de programa\Messenger\msmsgs.exe (Microsoft Corporation)
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Archivos de programa\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
O4 - Startup: C:\Documents and Settings\All Users.WINDOWS\Menú Inicio\Programas\Inicio\Adobe Gamma.lnk = C:\Archivos de programa\Archivos comunes\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Documents and Settings\All Users.WINDOWS\Menú Inicio\Programas\Inicio\Inicio rápido de Adobe Acrobat.lnk = C:\WINDOWS\Installer\{AC76BA86-1034-4700-7760-100000000002}\SC_Acrobat.exe ()
O4 - Startup: C:\Documents and Settings\All Users.WINDOWS\Menú Inicio\Programas\Inicio\Windows Search.lnk = C:\Archivos de programa\Windows Desktop Search\WindowsSearch.exe (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\HERMIDA\Menú Inicio\Programas\Inicio\Recorte de pantalla e Inicio rápido de OneNote 2007.lnk = C:\Archivos de programa\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\HERMIDA\Menú Inicio\Programas\Inicio\Tabla de contenido de OneNote.onetoc2 ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 28
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoRecentDocsMenu = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoRecentDocsHistory = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: ClearRecentDocsOnExit = 1
O8 - Extra context menu item: Convertir a PDF de Adobe - C:\Archivos de programa\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convertir a PDF existente - C:\Archivos de programa\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convertir destino de vínculo a PDF existente - C:\Archivos de programa\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convertir destino de vínculo en archivo PDF de Adobe - C:\Archivos de programa\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convertir selección a archivo PDF existente - C:\Archivos de programa\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convertir selección a PDF de Adobe - C:\Archivos de programa\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convertir vínculos seleccionados a PDF de Adobe - C:\Archivos de programa\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convertir vínculos seleccionados a PDF existente - C:\Archivos de programa\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Download with &Shareaza - C:\Archivos de programa\Shareaza\RazaWebHook32.dll (Shareaza Development Team)
O8 - Extra context menu item: E&xportar a Microsoft Excel - C:\Archivos de programa\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Enviar a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Archivos de programa\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Enviar a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Archivos de programa\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Teclado Virtual - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Archivos de programa\Kaspersky Lab\Kaspersky Anti-Virus 2011\klwtbbho.dll (Kaspersky Lab ZAO)
O9 - Extra 'Tools' menuitem : Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe ()
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Archivos de programa\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: Compro&bación de direcciones URL - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Archivos de programa\Kaspersky Lab\Kaspersky Anti-Virus 2011\klwtbbho.dll (Kaspersky Lab ZAO)
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\WINDOWS\system32\winrnr.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\system32\rsvpsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\WINDOWS\system32\rsvpsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} http://download.bitdefender.com/resources/scanner/sources/es/scan8/oscan8.cab (BDSCANONLINE Control)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1228488590687 (MUWebControl Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\system32\msvidctl.dll (Microsoft Corporation)
O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\gopher {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Archivos de programa\Archivos comunes\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Archivos de programa\Archivos comunes\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Archivos de programa\Archivos comunes\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Archivos de programa\Archivos comunes\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Archivos de programa\Archivos comunes\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Archivos de programa\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\WINDOWS\system32\inetcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Archivos de programa\Archivos comunes\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Archivos de programa\Archivos comunes\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Archivos de programa\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\sysimage {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\system32\msvidctl.dll (Microsoft Corporation)
O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\wia {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\system32\wiascr.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\Class Install Handler {32B533BB-EDAE-11d0-BD5A-00AA00B92AF1} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\deflate {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\gzip {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\lzdhtml {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/webviewhtml {733AC4CB-F1A4-11d0-B951-00A0C90312E1} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\ARCHIV~1\KASPER~1\KASPER~1\mzvkbd3.dll) - C:\Archivos de programa\Kaspersky Lab\Kaspersky Anti-Virus 2011\mzvkbd3.dll (Kaspersky Lab ZAO)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UIHost - (logonui.exe) - C:\WINDOWS\System32\logonui.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - C:\WINDOWS\System32\sysdm.cpl (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Archivos de programa\SUPERAntiSpyware\SASWINLO.DLL - C:\Archivos de programa\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\crypt32chain: DllName - crypt32.dll - C:\WINDOWS\System32\crypt32.dll (Microsoft Corporation)
O20 - Winlogon\Notify\cryptnet: DllName - cryptnet.dll - C:\WINDOWS\System32\cryptnet.dll (Microsoft Corporation)
O20 - Winlogon\Notify\cscdll: DllName - cscdll.dll - C:\WINDOWS\System32\cscdll.dll (Microsoft Corporation)
O20 - Winlogon\Notify\dimsntfy: DllName - %SystemRoot%\System32\dimsntfy.dll - C:\WINDOWS\system32\dimsntfy.dll (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O20 - Winlogon\Notify\klogon: DllName - C:\WINDOWS\system32\klogon.dll - C:\WINDOWS\system32\klogon.dll (Kaspersky Lab ZAO)
O20 - Winlogon\Notify\ScCertProp: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\Schedule: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\sclgntfy: DllName - sclgntfy.dll - C:\WINDOWS\System32\sclgntfy.dll (Microsoft Corporation)
O20 - Winlogon\Notify\SensLogn: DllName - WlNotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\termsrv: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\WgaLogon: DllName - WgaLogon.dll - File not found
O20 - Winlogon\Notify\wlballoon: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINDOWS\system32\stobject.dll (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\system32\webcheck.dll (Microsoft Corporation)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll (Microsoft Corporation)
O22 - SharedTaskScheduler: {438755C2-A8BA-11D1-B96B-00A0C90312E1} - Precargador Browseui - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Demonio de caché de las categorías de componente - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
O24 - Desktop Components:0 (Mi página de inicio actual) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\HERMIDA\Configuración local\Datos de programa\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\HERMIDA\Configuración local\Datos de programa\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Archivos de programa\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Archivos de programa\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (msapsspc.dll) - C:\WINDOWS\System32\msapsspc.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (schannel.dll) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (digest.dll) - C:\WINDOWS\System32\digest.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (msnsspc.dll) - C:\WINDOWS\System32\msnsspc.dll (Microsoft Corporation)
O30 - LSA: Authentication Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (kerberos) - C:\WINDOWS\System32\kerberos.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (schannel) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (wdigest) - C:\WINDOWS\System32\wdigest.dll (Microsoft Corporation)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/08/17 18:05:36 | 000,000,000 | ---D | M] - C:\Autodesk -- [ NTFS ]
O32 - AutoRun File - [2008/12/01 13:48:07 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{4fc698a9-043d-11de-83f2-001c25dd14e5}\Shell\AutoRun\command - "" = F:\SYSTEM\S-3-7-89-2225458569-9856321456-454423558-8896\explorer.exe -- File not found
O33 - MountPoints2\{4fc698a9-043d-11de-83f2-001c25dd14e5}\Shell\open\command - "" = F:\SYSTEM\S-3-7-89-2225458569-9856321456-454423558-8896\explorer.exe -- File not found
O33 - MountPoints2\{7e696b08-da08-11de-8735-001c25dd14e5}\Shell\AutoRun\command - "" = F:\.\5JywJKyw\5JywJKyw.exe -- File not found
O33 - MountPoints2\{7e696b08-da08-11de-8735-001c25dd14e5}\Shell\explore\Command - "" = F:\5JywJKyw\5JywJKyw.exe -- File not found
O33 - MountPoints2\{7e696b08-da08-11de-8735-001c25dd14e5}\Shell\open\Command - "" = F:\5JywJKyw\5JywJKyw.exe -- File not found
O33 - MountPoints2\{c61f196a-8305-11df-8aac-001c25dd14e5}\Shell\AutoRun\command - "" = .\winguard\wwload.exe
O33 - MountPoints2\{c61f196a-8305-11df-8aac-001c25dd14e5}\Shell\exploRE\coMMand - "" = .///winguard\\/wwload.exe
O33 - MountPoints2\{c61f196a-8305-11df-8aac-001c25dd14e5}\Shell\OPen\command - "" = .////\\\winguard\\\\/wwload.exe
O33 - MountPoints2\{ebc89183-98d1-11df-8b19-001c25dd14e5}\Shell\AutoRun\command - "" = F:\.\y591D691\y591D691.exe -- File not found
O33 - MountPoints2\{ebc89183-98d1-11df-8b19-001c25dd14e5}\Shell\explore\Command - "" = F:\y591D691\y591D691.exe -- File not found
O33 - MountPoints2\{ebc89183-98d1-11df-8b19-001c25dd14e5}\Shell\open\Command - "" = F:\y591D691\y591D691.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/11/16 23:21:47 | 000,000,000 | ---D | C] -- C:\_OTM
[2010/11/16 23:20:12 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\HERMIDA\Escritorio\OTL.exe
[2010/11/16 23:18:07 | 000,519,680 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\HERMIDA\Escritorio\OTM.exe
[2010/11/16 20:36:26 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\HERMIDA\Recent
[2010/11/16 18:33:57 | 000,000,000 | R--D | C] -- C:\32788R22FWJFW
[2010/11/16 09:55:04 | 000,000,000 | ---D | C] -- C:\ISA
[2010/11/15 00:21:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\HERMIDA\Mis documentos\PODCASTS Y RADIO
[2010/11/05 19:26:13 | 000,000,000 | ---D | C] -- C:\rsit
[2010/11/05 08:32:16 | 000,000,000 | ---D | C] -- C:\WINDOWS\CSC
[2010/11/03 15:00:52 | 000,000,000 | ---D | C] -- C:\Archivos de programa\ESET
[2010/10/29 17:16:24 | 000,000,000 | ---D | C] -- C:\Archivos de programa\Archivos comunes\Java
[2010/10/29 17:15:57 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2010/10/29 17:15:57 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2010/10/29 17:15:57 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2010/10/29 17:15:57 | 000,073,728 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[2010/10/29 17:15:34 | 000,000,000 | ---D | C] -- C:\Archivos de programa\Java
[2010/10/29 16:59:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\HERMIDA\Datos de programa\Mozilla
[2010/10/26 08:26:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Datos de programa\Kaspersky Lab
[2010/10/26 08:26:17 | 000,000,000 | ---D | C] -- C:\Archivos de programa\Kaspersky Lab
[2010/10/26 08:26:03 | 000,475,736 | ---- | C] (Kaspersky Lab) -- C:\WINDOWS\System32\drivers\klif.sys
[2010/10/26 08:25:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Datos de programa\Kaspersky Lab Setup Files
[2010/10/25 11:47:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\HERMIDA\Escritorio\logs virulencia
[2010/10/22 13:02:30 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/10/22 13:02:29 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/10/22 12:58:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\HERMIDA\Datos de programa\SUPERAntiSpyware.com
[2010/10/22 12:58:15 | 000,000,000 | ---D | C] -- C:\Archivos de programa\SUPERAntiSpyware
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/11/16 23:32:00 | 000,001,038 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/11/16 23:20:12 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\HERMIDA\Escritorio\OTL.exe
[2010/11/16 23:18:08 | 000,519,680 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\HERMIDA\Escritorio\OTM.exe
[2010/11/16 20:44:13 | 000,000,384 | ---- | M] () -- C:\WINDOWS\lgfwup.ini
[2010/11/16 20:44:08 | 000,002,387 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Menú Inicio\Programas\Inicio\Inicio rápido de Adobe Acrobat.lnk
[2010/11/16 20:43:54 | 000,000,264 | ---- | M] () -- C:\WINDOWS\tasks\OGALogon.job
[2010/11/16 20:43:29 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/11/16 20:43:22 | 000,001,012 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job
[2010/11/16 20:43:15 | 000,001,034 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/11/16 20:43:13 | 000,000,260 | ---- | M] () -- C:\WINDOWS\tasks\WGASetup.job
[2010/11/16 20:43:03 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/11/16 11:23:01 | 000,000,264 | ---- | M] () -- C:\WINDOWS\tasks\OGADaily.job
[2010/11/01 01:56:24 | 000,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2010/10/29 17:15:38 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll
[2010/10/29 17:15:38 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2010/10/29 17:15:38 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2010/10/29 17:15:38 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2010/10/29 17:15:38 | 000,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[2010/10/26 08:47:00 | 000,475,736 | ---- | M] (Kaspersky Lab) -- C:\WINDOWS\System32\drivers\klif.sys
[2010/10/26 08:27:35 | 000,113,933 | ---- | M] () -- C:\WINDOWS\System32\drivers\klin.dat
[2010/10/26 08:27:35 | 000,097,549 | ---- | M] () -- C:\WINDOWS\System32\drivers\klick.dat
[2010/10/26 08:24:44 | 000,000,002 | ---- | M] () -- C:\WINDOWS\System32\config.nt
[2010/10/22 13:02:32 | 000,000,731 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Escritorio\Malwarebytes' Anti-Malware.lnk
[2010/10/22 12:58:17 | 000,001,741 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Escritorio\SUPERAntiSpyware Free Edition.lnk
[2010/10/18 10:37:48 | 000,035,578 | ---- | M] () -- C:\Documents and Settings\HERMIDA\Escritorio\estampitas escrivá.docx
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/10/26 08:27:35 | 000,113,933 | ---- | C] () -- C:\WINDOWS\System32\drivers\klin.dat
[2010/10/26 08:27:35 | 000,097,549 | ---- | C] () -- C:\WINDOWS\System32\drivers\klick.dat
[2010/10/22 13:02:32 | 000,000,731 | ---- | C] () -- C:\Documents and Settings\All Users.WINDOWS\Escritorio\Malwarebytes' Anti-Malware.lnk
[2010/10/22 12:58:17 | 000,001,741 | ---- | C] () -- C:\Documents and Settings\All Users.WINDOWS\Escritorio\SUPERAntiSpyware Free Edition.lnk
[2010/10/18 10:37:36 | 000,035,578 | ---- | C] () -- C:\Documents and Settings\HERMIDA\Escritorio\estampitas escrivá.docx
[2010/04/10 14:48:53 | 000,484,352 | ---- | C] () -- C:\WINDOWS\System32\lame_enc.dll
[2010/03/05 23:22:42 | 000,034,308 | ---- | C] () -- C:\WINDOWS\System32\BASSMOD.dll
[2010/01/14 08:48:34 | 000,000,118 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI
[2009/10/17 19:34:51 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\FsUsbExDevice.Dll
[2009/10/17 19:34:51 | 000,036,608 | ---- | C] () -- C:\WINDOWS\System32\FsUsbExDisk.Sys
[2009/10/17 19:34:43 | 000,002,528 | ---- | C] () -- C:\Documents and Settings\HERMIDA\Datos de programa\$_hpcst$.hpc
[2009/08/28 22:00:49 | 000,000,232 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2009/07/29 19:09:21 | 000,000,112 | ---- | C] () -- C:\WINDOWS\ActiveSkin.INI
[2009/01/05 14:46:14 | 000,000,492 | ---- | C] () -- C:\WINDOWS\bdoscandellang.ini
[2008/12/31 17:04:42 | 000,691,560 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll
[2008/12/04 14:04:32 | 000,095,232 | ---- | C] () -- C:\Documents and Settings\HERMIDA\Configuración local\Datos de programa\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/12/04 10:22:49 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2008/12/02 12:47:26 | 000,096,768 | ---- | C] () -- C:\WINDOWS\SlantAdj.dll
[2008/12/02 12:47:26 | 000,000,072 | ---- | C] () -- C:\WINDOWS\System32\epDPE.ini
[2008/12/02 12:47:03 | 000,000,022 | ---- | C] () -- C:\WINDOWS\System32\PICSDK.ini
[2008/12/02 12:46:04 | 000,000,044 | ---- | C] () -- C:\WINDOWS\EPCX3500.ini
[2008/12/01 19:16:48 | 000,000,136 | ---- | C] () -- C:\Documents and Settings\HERMIDA\Configuración local\Datos de programa\fusioncache.dat
[2008/12/01 18:59:39 | 000,000,379 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2008/12/01 14:52:24 | 000,000,384 | ---- | C] () -- C:\WINDOWS\lgfwup.ini
[2008/12/01 14:39:37 | 000,204,800 | R--- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4837.dll
[2008/12/01 07:06:10 | 000,004,205 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2008/11/06 10:37:32 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2008/05/26 22:23:18 | 000,016,892 | ---- | C] () -- C:\WINDOWS\System32\gthrctr.ini
[2008/05/26 22:23:16 | 000,023,640 | ---- | C] () -- C:\WINDOWS\System32\idxcntrs.ini
[2008/05/26 22:23:14 | 000,016,164 | ---- | C] () -- C:\WINDOWS\System32\gsrvctr.ini
[2007/10/25 16:26:10 | 000,005,632 | ---- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys
[2004/05/10 04:00:00 | 000,000,054 | ---- | C] () -- C:\WINDOWS\System32\EAL32.INI

========== LOP Check ==========

[2010/08/17 18:08:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Datos de programa\Autodesk
[2010/11/16 20:44:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Datos de programa\BOINC
[2009/10/17 19:36:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Datos de programa\PC Suite
[2010/11/04 23:51:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Datos de programa\TEMP
[2010/10/18 12:01:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HERMIDA\Datos de programa\Any Video Converter
[2010/08/17 18:12:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HERMIDA\Datos de programa\Autodesk
[2009/09/16 20:20:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HERMIDA\Datos de programa\CoreFTP
[2009/01/02 13:05:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HERMIDA\Datos de programa\EPSON
[2010/06/24 11:40:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HERMIDA\Datos de programa\Facebook
[2010/04/10 14:48:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HERMIDA\Datos de programa\FreeAudioPack
[2010/09/16 21:46:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HERMIDA\Datos de programa\FreeCDRipper
[2010/07/18 19:08:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HERMIDA\Datos de programa\Mixup
[2009/10/17 19:36:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HERMIDA\Datos de programa\PC Suite
[2010/03/06 00:43:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HERMIDA\Datos de programa\Publish Providers
[2010/10/29 17:13:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HERMIDA\Datos de programa\QuickScan
[2009/03/03 18:38:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HERMIDA\Datos de programa\RarRecoverEasy
[2009/10/17 19:34:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HERMIDA\Datos de programa\Samsung
[2010/02/03 00:01:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HERMIDA\Datos de programa\Shareaza
[2009/01/23 19:08:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HERMIDA\Datos de programa\Softplicity
[2010/03/05 23:23:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HERMIDA\Datos de programa\Sony
[2008/12/02 10:59:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HERMIDA\Datos de programa\Windows Desktop Search
[2008/12/09 14:04:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HERMIDA\Datos de programa\Windows Search
[2010/11/16 11:23:01 | 000,000,264 | ---- | M] () -- C:\WINDOWS\Tasks\OGADaily.job
[2010/11/16 20:43:54 | 000,000,264 | ---- | M] () -- C:\WINDOWS\Tasks\OGALogon.job
[2010/11/16 20:43:13 | 000,000,260 | ---- | M] () -- C:\WINDOWS\Tasks\WGASetup.job

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 144 bytes -> C:\Documents and Settings\All Users.WINDOWS\Datos de programa\TEMP:16E029F0

< End of report >



OTL Extras logfile created on: 16/11/2010 11:33:49 p.m. - Run 1
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Documents and Settings\HERMIDA\Escritorio
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 0000080A | Country: México | Language: ESM | Date Format: dd/MM/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 73.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 89.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Archivos de programa
Drive C: | 232.88 Gb Total Space | 106.76 Gb Free Space | 45.84% Space Free | Partition Type: NTFS

Computer Name: NEUE-PC | User Name: HERMIDA | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Archivos de programa\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Archivos de programa\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /k cd "%L" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Archivos de programa\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusOverride" = 0
"FirewallOverride" = 0
"UpdatesDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
"C:\Archivos de programa\VideoLAN\VLC\vlc.exe" = C:\Archivos de programa\VideoLAN\VLC\vlc.exe:*:Enabled:VLC Player -- ()
"C:\Archivos de programa\Windows Live\Messenger\wlcstart.exe" = C:\Archivos de programa\Windows Live\Messenger\wlcstart.exe:*:Enabled:Windows Live Call -- (Microsoft Corporation)
"C:\Archivos de programa\Windows Live\Messenger\msnmsgr.exe" = C:\Archivos de programa\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger -- (Microsoft Corporation)
"C:\Archivos de programa\Google\Google SketchUp 7\LayOut\LayOut.exe" = C:\Archivos de programa\Google\Google SketchUp 7\LayOut\LayOut.exe:*:Enabled:LayOut -- (Google, Inc.)
"C:\Archivos de programa\Asistente Infinitum\ISA.exe" = C:\Archivos de programa\Asistente Infinitum\ISA.exe:*:Enabled:Asistente Infinitum -- (Fine Point Technologies, Inc.)
"C:\Archivos de programa\Ipswitch\WS_FTP 12\UpWiz.exe" = C:\Archivos de programa\Ipswitch\WS_FTP 12\UpWiz.exe:*:Enabled:WS_FTP Upload Wizard -- File not found
"C:\Archivos de programa\Google\Google SketchUp 7\SketchUp.exe" = C:\Archivos de programa\Google\Google SketchUp 7\SketchUp.exe:*:Enabled:SketchUp Application -- (Google, Inc.)
"C:\Archivos de programa\Shareaza\Shareaza.exe" = C:\Archivos de programa\Shareaza\Shareaza.exe:*:Enabled:Shareaza -- (Shareaza Development Team)
"C:\WINDOWS\Network Diagnostic\xpnetdiag.exe" = C:\WINDOWS\Network Diagnostic\xpnetdiag.exe:*:Enabled:Network Diagnostic for Windows XP -- (Microsoft Corporation)
"C:\Archivos de programa\Google\Google Earth\client\googleearth.exe" = C:\Archivos de programa\Google\Google Earth\client\googleearth.exe:*:Enabled:Google Earth -- (Google)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{010C0B4A-DC93-4BB4-893B-BDDE95355A3E}" = Freeware PDF Unlocker
"{0134A1A1-C283-4A47-91A1-92F19F960372}" = Adobe Creative Suite 2
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = DVD Suite
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Herramienta de carga de Windows Live
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{236BB7C4-4419-42FD-0C0A-1E257A25E34D}" = Adobe Photoshop CS2
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java™ 6 Update 22
"{350C9C0A-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{38A0481D-544D-4C01-BB32-39332391D012}" = Windows Live Call
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth
"{42D7C16D-2488-4637-9987-37FC93FC470E}" = BOINC
"{45B3A3BD-F90D-48FE-A147-D74878A51033}" = Nero 7 Essentials
"{48E15C9C-E25C-40AD-A46B-AB270729B9B9}" = Google SketchUp Pro 7
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5545EEE1-FA36-4F76-B6BE-5696E7F4E2D6}" = VBA (2627.01)
"{5545EEE9-FA36-4F76-B6BE-5696E7F4E2D6}" = VBA (2627.4)
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5783F2D7-6001-040A-0002-0060B0CE6BBA}" = AutoCAD 2008 - Español
"{5783F2D7-9028-0409-0000-0060B0CE6BBA}" = DWG TrueView 2011
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{6179550A-3E7C-499E-BCC9-9E8113E0A285}" = LG ODD Auto Firmware Update
"{66F1F013-008F-4875-B283-5A814B820347}" = Kaspersky Anti-Virus 2011
"{67EDD823-135A-4D59-87BD-950616D6E857}" = EPSON Copy Utility 3
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{6842DCCB-2840-4E46-8AF3-BEA9CFF3455B}" = Sony Sound Forge 9.0
"{6C11D561-620B-47DA-A693-4C597F3CDF40}" = EPSON Smart Panel
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7593234B-2AEB-4FC9-B02D-C9B30D86084C}" = Windows Live Asistente para el inicio de sesión
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{786C5747-1437-443D-B06E-79A00FE45110}" = Adobe Stock Photos 1.0
"{7E84FAC8-C518-40F9-9807-7455301D6D25}" = SamsungConnectivityCableDriver
"{7F4C8163-F259-49A0-A018-2857A90578BC}" = Adobe InDesign CS2
"{83169D43-4660-4347-BC95-E9D6E6BE65CE}" = Microsoft .NET Framework 1.1 Spanish Language Pack
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8EDBA74D-0686-4C99-BFDD-F894678E5103}" = Adobe Common File Installer
"{8F94D5AC-C1C6-432D-8924-2F5EEBC28446}" = Windows Live Essentials
"{90120000-0010-0C0A-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (Spanish) 12
"{90120000-0016-0C0A-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Spanish) 2007
"{90120000-0016-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{91A7F72A-3273-4C1E-8BE0-BC9DD0D9345C}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0C0A-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Spanish) 2007
"{90120000-0018-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{91A7F72A-3273-4C1E-8BE0-BC9DD0D9345C}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0C0A-0000-0000000FF1CE}" = Microsoft Office Word MUI (Spanish) 2007
"{90120000-001B-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{91A7F72A-3273-4C1E-8BE0-BC9DD0D9345C}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0403-0000-0000000FF1CE}" = Microsoft Office Proof (Catalan) 2007
"{90120000-001F-0403-0000-0000000FF1CE}_HOMESTUDENTR_{4B47C31E-46B0-462B-BEE4-DC383B6A1F2A}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0416-0000-0000000FF1CE}" = Microsoft Office Proof (Portuguese (Brazil)) 2007
"{90120000-001F-0416-0000-0000000FF1CE}_HOMESTUDENTR_{75EBE365-7FC5-4720-A7D3-804BF550D1BC}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-042D-0000-0000000FF1CE}" = Microsoft Office Proof (Basque) 2007
"{90120000-001F-0456-0000-0000000FF1CE}" = Microsoft Office Proof (Galician) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0C0A-0000-0000000FF1CE}" = Microsoft Office Proofing (Spanish) 2007
"{90120000-006E-0C0A-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Spanish) 2007
"{90120000-006E-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{6113C11D-BACA-4D8E-8002-03C8D06FD5E6}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0C0A-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (Spanish) 2007
"{90120000-00A1-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{91A7F72A-3273-4C1E-8BE0-BC9DD0D9345C}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9A346205-EA92-4406-B1AB-50379DA3F057}" = Autodesk DWF Viewer 7
"{9A5A134B-89FD-462C-942C-08776CF67D3F}" = Mixup Downloader
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A2172ACA-FFA8-4808-BD20-08565C7390F9}" = OGA Notifier 1.7.0105.35.0
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC599724-5755-48C1-ABE7-ABB857652930}" = PC Connectivity Solution
"{AC76BA86-1034-4700-7760-100000000002}" = Adobe Acrobat 7.0 Professional - Español, Italiano, Português
"{AEB9948B-4FF2-47C9-990E-47014492A0FE}" = MSXML 6.0 Parser
"{AF7E85DC-317C-47F5-810E-B82EE093A612}" = Samsung New PC Studio USB Driver Installer
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B2F5D08C-7E79-4FCD-AAF4-57AD35FF0601}" = Adobe Illustrator CS2
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B74D4E10-6884-0000-0000-000000000103}" = Adobe Bridge 1.0
"{BB0DCC5E-7477-3350-B5F5-7CE64E1E83B6}" = Microsoft .NET Framework 2.0 Service Pack 1 Language Pack - ESN
"{BB65C393-C76E-4F06-9B0C-2124AA8AF97B}" = Adobe Flash Player 9 ActiveX
"{BD1806A5-1B46-4DDC-A0B6-5F4D48022C78}" = Asistente Infinitum
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C9BED750-1211-4480-B1A5-718A3BE15525}" = REALTEK GbE & FE Ethernet PCI-E NIC Driver
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D533C9D4-ED96-4191-B9C3-279C0DD6BABA}" = Sony Noise Reduction Plug-In 2.0e
"{D9432306-513A-4695-977E-FC6AD9C3ED98}" = IDX Renditioner Express Free
"{DE5301C3-EBE3-4D48-9BBB-96E25F3C9780}" = Melodyne 3.1
"{E9787678-551D-4478-9682-DBB587257110}" = Adobe Help Center 1.0
"{EBAE381B-60A6-4863-AA9F-FCAB755BC9E5}" = ScanToWeb
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F193FC0E-9E18-40FC-A974-509A1BDD240A}" = Samsung New PC Studio
"{F2FFEEAA-0B48-4342-9B67-12ABB0B58F24}" = Windows Live Messenger
"2Wire SetupWiz" = Prodigy Infinitum Módem Router Inalámbrico
"3A5DEFA413DDE699DBA6EBE0A63534ACA524D30F" = Paquete de controladores de Windows - Nokia pccsmcfd (10/12/2007 6.85.4.0)
"6194C28A8F62DD817EA1B918E6E46E806A21B452" = Paquete de controladores de Windows - MobileTop (sshpmdm) Modem (02/23/2007 2.5.0.0)
"65B6FE5418CE28F4D72543FB2D964C3CEC83F161" = Paquete de controladores de Windows - MobileTop (sshpusb) USB (02/23/2007 2.5.0.0)
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Adobe SVG Viewer" = Adobe SVG Viewer 3.0
"Any Video Converter_is1" = Any Video Converter 2.6.7
"AutoCAD 2008 - Español" = AutoCAD 2008 - Español
"CCleaner" = CCleaner
"DivX Setup.divx.com" = Instalación de DivX
"DWG TrueView 2011" = DWG TrueView 2011
"EPSON Printer and Utilities" = Software de impresora EPSON
"EPSON Scanner" = EPSON Scan
"ESET Online Scanner" = ESET Online Scanner v3
"Free Mp3 Wma Converter_is1" = Free Mp3 Wma Converter V 1.9
"Google Updater" = Google Updater
"HDMI" = Intel® Graphics Media Accelerator Driver
"HijackThis" = HijackThis 2.0.2
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie8" = Windows Internet Explorer 8
"Ink Monitor" = Ink Monitor
"InstallShield_{AF7E85DC-317C-47F5-810E-B82EE093A612}" = Samsung New PC Studio USB Driver Installer
"InstallShield_{F193FC0E-9E18-40FC-A974-509A1BDD240A}" = Samsung New PC Studio
"InstallWIX_{66F1F013-008F-4875-B283-5A814B820347}" = Kaspersky Anti-Virus 2011
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.12)" = Mozilla Firefox (3.6.12)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"MSNINST" = MSN
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"SAMSUNG Mobile Composite Device" = SAMSUNG Mobile Composite Device Software
"SAMSUNG Mobile Modem" = SAMSUNG Mobile Modem Driver Set
"Samsung Mobile Modem Device" = Samsung Mobile Modem Device Software
"Samsung Mobile phone USB driver" = Samsung Mobile phone USB driver Software
"SAMSUNG Mobile USB Modem" = SAMSUNG Mobile USB Modem Software
"SAMSUNG Mobile USB Modem 1.0" = SAMSUNG Mobile USB Modem 1.0 Software
"SAMSUNG USB Mobile Device" = SAMSUNG USB Mobile Device Software
"Shareaza_is1" = Shareaza 2.5.3.0
"Silent Package Run-Time Sample" = Manual de Referencia del CX3500 - CX4500
"VLC media player" = VLC media player 1.1.4
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Reproductor de Windows Media 11
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = Compresor WinRAR
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Facebook Plug-In" = Facebook Plug-In

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 16/11/2010 11:37:19 a.m. | Computer Name = NEUE-PC | Source = Windows Search Service | ID = 3013
Description = No se puede actualizar la entrada <C:\DOCUMENTS AND SETTINGS\HERMIDA\RECENT\DESKTOP.INI>
en el mapa hash. Contexto: aplicación , catálogo SystemIndex Detalles: Uno de los
dispositivos vinculados al sistema no funciona. (0x8007001f)

Error - 16/11/2010 11:37:19 a.m. | Computer Name = NEUE-PC | Source = Windows Search Service | ID = 3013
Description = No se puede actualizar la entrada <C:\DOCUMENTS AND SETTINGS\HERMIDA\RECENT\DESKTOP.INI>
en el mapa hash. Contexto: aplicación , catálogo SystemIndex Detalles: Uno de los
dispositivos vinculados al sistema no funciona. (0x8007001f)

Error - 16/11/2010 11:42:38 a.m. | Computer Name = NEUE-PC | Source = Windows Search Service | ID = 3013
Description = No se puede actualizar la entrada <C:\DOCUMENTS AND SETTINGS\HERMIDA\MENÚ
INICIO\PROGRAMAS\CYBERLINK DVD SUITE\POWERDVD\CYBERLINK POWERDVD.LNK> en el mapa
hash. Contexto: aplicación , catálogo SystemIndex Detalles: Uno de los dispositivos
vinculados al sistema no funciona. (0x8007001f)

Error - 16/11/2010 11:42:38 a.m. | Computer Name = NEUE-PC | Source = Windows Search Service | ID = 3013
Description = No se puede actualizar la entrada <C:\DOCUMENTS AND SETTINGS\HERMIDA\MENÚ
INICIO\PROGRAMAS\CYBERLINK DVD SUITE\POWERDVD\CYBERLINK POWERDVD.LNK> en el mapa
hash. Contexto: aplicación , catálogo SystemIndex Detalles: Uno de los dispositivos
vinculados al sistema no funciona. (0x8007001f)

Error - 16/11/2010 11:42:39 a.m. | Computer Name = NEUE-PC | Source = Windows Search Service | ID = 3013
Description = No se puede actualizar la entrada <C:\DOCUMENTS AND SETTINGS\HERMIDA\MENÚ
INICIO\PROGRAMAS\CYBERLINK DVD SUITE\POWERDVD\AYUDA DE POWERDVD.LNK> en el mapa
hash. Contexto: aplicación , catálogo SystemIndex Detalles: Uno de los dispositivos
vinculados al sistema no funciona. (0x8007001f)

Error - 16/11/2010 11:42:39 a.m. | Computer Name = NEUE-PC | Source = Windows Search Service | ID = 3013
Description = No se puede actualizar la entrada <C:\DOCUMENTS AND SETTINGS\HERMIDA\MENÚ
INICIO\PROGRAMAS\CYBERLINK DVD SUITE\POWERDVD\AYUDA DE POWERDVD.LNK> en el mapa
hash. Contexto: aplicación , catálogo SystemIndex Detalles: Uno de los dispositivos
vinculados al sistema no funciona. (0x8007001f)

Error - 16/11/2010 11:42:39 a.m. | Computer Name = NEUE-PC | Source = Windows Search Service | ID = 3013
Description = No se puede actualizar la entrada <C:\DOCUMENTS AND SETTINGS\HERMIDA\MENÚ
INICIO\PROGRAMAS\CYBERLINK DVD SUITE\POWERDVD\LÉAME.LNK> en el mapa hash. Contexto:
aplicación , catálogo SystemIndex Detalles: Uno de los dispositivos vinculados al
sistema no funciona. (0x8007001f)

Error - 16/11/2010 11:42:39 a.m. | Computer Name = NEUE-PC | Source = Windows Search Service | ID = 3013
Description = No se puede actualizar la entrada <C:\DOCUMENTS AND SETTINGS\HERMIDA\MENÚ
INICIO\PROGRAMAS\CYBERLINK DVD SUITE\POWERDVD\LÉAME.LNK> en el mapa hash. Contexto:
aplicación , catálogo SystemIndex Detalles: Uno de los dispositivos vinculados al
sistema no funciona. (0x8007001f)

Error - 16/11/2010 11:42:39 a.m. | Computer Name = NEUE-PC | Source = Windows Search Service | ID = 3013
Description = No se puede actualizar la entrada <C:\DOCUMENTS AND SETTINGS\HERMIDA\MENÚ
INICIO\PROGRAMAS\CYBERLINK DVD SUITE\POWERDVD\DESINSTALAR POWERDVD.LNK> en el mapa
hash. Contexto: aplicación , catálogo SystemIndex Detalles: Uno de los dispositivos
vinculados al sistema no funciona. (0x8007001f)

Error - 16/11/2010 11:42:39 a.m. | Computer Name = NEUE-PC | Source = Windows Search Service | ID = 3013
Description = No se puede actualizar la entrada <C:\DOCUMENTS AND SETTINGS\HERMIDA\MENÚ
INICIO\PROGRAMAS\CYBERLINK DVD SUITE\POWERDVD\DESINSTALAR POWERDVD.LNK> en el mapa
hash. Contexto: aplicación , catálogo SystemIndex Detalles: Uno de los dispositivos
vinculados al sistema no funciona. (0x8007001f)

[ OSession Events ]
Error - 17/04/2009 11:45:16 a.m. | Computer Name = NEUE-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6331.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 1932
seconds with 60 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 09/11/2010 09:10:20 p.m. | Computer Name = NEUE-PC | Source = Service Control Manager | ID = 7009
Description = Intervalo de espera (30000 ms.) para la conexión con el servicio Windows
Search.

Error - 09/11/2010 09:10:20 p.m. | Computer Name = NEUE-PC | Source = Service Control Manager | ID = 7000
Description = El servicio Windows Search no pudo iniciarse debido al siguiente error:
%%1053

Error - 09/11/2010 09:11:00 p.m. | Computer Name = NEUE-PC | Source = DCOM | ID = 10005
Description = DCOM ha obtenido un error "%1053" al intentar iniciar el servicio
WSearch con argumentos "" para ejecutar el servidor: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}

Error - 09/11/2010 09:11:00 p.m. | Computer Name = NEUE-PC | Source = Service Control Manager | ID = 7009
Description = Intervalo de espera (30000 ms.) para la conexión con el servicio Windows
Search.

Error - 09/11/2010 09:11:00 p.m. | Computer Name = NEUE-PC | Source = Service Control Manager | ID = 7000
Description = El servicio Windows Search no pudo iniciarse debido al siguiente error:
%%1053

Error - 15/11/2010 01:42:17 a.m. | Computer Name = NEUE-PC | Source = W32Time | ID = 39452689
Description = El proveedor de tiempo NtpClient: ocurrió un error durante la búsqueda
DNS del homólogo configurado manualmente "time.windows.com,0x1". NtpClient volverá
a intentar la búsqueda DNS en 15 minutos. El error era: Se ha intentado una operación
de socket en un host no accesible. (0x80072751)

Error - 15/11/2010 01:42:17 a.m. | Computer Name = NEUE-PC | Source = W32Time | ID = 39452701
Description = El proveedor de tiempo NtpClient se ha configurado para adquirir la
hora desde uno o más recursos de hora, sin embargo, ninguno de los recursos está
accesible No se hará un intento de ponerse en contacto con un recurso durante 14
minutos. NtpClient no tiene recurso de hora exacta.

Error - 15/11/2010 01:02:20 p.m. | Computer Name = NEUE-PC | Source = DCOM | ID = 10010
Description = El servidor {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39} no se registró
con DCOM dentro del tiempo de espera requerido.

Error - 15/11/2010 01:03:02 p.m. | Computer Name = NEUE-PC | Source = W32Time | ID = 39452689
Description = El proveedor de tiempo NtpClient: ocurrió un error durante la búsqueda
DNS del homólogo configurado manualmente "time.windows.com,0x1". NtpClient volverá
a intentar la búsqueda DNS en 15 minutos. El error era: Se ha intentado una operación
de socket en un host no accesible. (0x80072751)

Error - 15/11/2010 01:03:02 p.m. | Computer Name = NEUE-PC | Source = W32Time | ID = 39452701
Description = El proveedor de tiempo NtpClient se ha configurado para adquirir la
hora desde uno o más recursos de hora, sin embargo, ninguno de los recursos está
accesible No se hará un intento de ponerse en contacto con un recurso durante 14
minutos. NtpClient no tiene recurso de hora exacta.


< End of report >



Thanks.

#10 m0le

m0le

    Can U Dig It?


  • Malware Response Team
  • 34,527 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London, UK
  • Local time:08:47 AM

Posted 17 November 2010 - 02:34 PM

Open OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following

:OTL
SRV - (HidServ) -- C:\WINDOWS\System32\hidserv.dll File not found
DRV - (IRENUM) -- C:\WINDOWS\System32\DRIVERS\irenum.sys File not found
DRV - (FXDrv32) -- D:\FXDrv32.sys File not found
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [NPSStartup] File not found
O33 - MountPoints2\{4fc698a9-043d-11de-83f2-001c25dd14e5}\Shell\AutoRun\command - "" = F:\SYSTEM\S-3-7-89-2225458569-9856321456-454423558-8896\explorer.exe -- File not found
O33 - MountPoints2\{4fc698a9-043d-11de-83f2-001c25dd14e5}\Shell\open\command - "" = F:\SYSTEM\S-3-7-89-2225458569-9856321456-454423558-8896\explorer.exe -- File not found
O33 - MountPoints2\{7e696b08-da08-11de-8735-001c25dd14e5}\Shell\AutoRun\command - "" = F:\.\5JywJKyw\5JywJKyw.exe -- File not found
O33 - MountPoints2\{7e696b08-da08-11de-8735-001c25dd14e5}\Shell\explore\Command - "" = F:\5JywJKyw\5JywJKyw.exe -- File not found
O33 - MountPoints2\{7e696b08-da08-11de-8735-001c25dd14e5}\Shell\open\Command - "" = F:\5JywJKyw\5JywJKyw.exe -- File not found
O33 - MountPoints2\{c61f196a-8305-11df-8aac-001c25dd14e5}\Shell\AutoRun\command - "" = .\winguard\wwload.exe
O33 - MountPoints2\{c61f196a-8305-11df-8aac-001c25dd14e5}\Shell\exploRE\coMMand - "" = .///winguard\\/wwload.exe
O33 - MountPoints2\{c61f196a-8305-11df-8aac-001c25dd14e5}\Shell\OPen\command - "" = .////\\\winguard\\\\/wwload.exe
O33 - MountPoints2\{ebc89183-98d1-11df-8b19-001c25dd14e5}\Shell\AutoRun\command - "" = F:\.\y591D691\y591D691.exe -- File not found
O33 - MountPoints2\{ebc89183-98d1-11df-8b19-001c25dd14e5}\Shell\explore\Command - "" = F:\y591D691\y591D691.exe -- File not found
O33 - MountPoints2\{ebc89183-98d1-11df-8b19-001c25dd14e5}\Shell\open\Command - "" = F:\y591D691\y591D691.exe -- File not found
@Alternate Data Stream - 144 bytes -> C:\Documents and Settings\All Users.WINDOWS\Datos de programa\TEMP:16E029F0
:reg
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Taskman"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command]
""=""%1" %*"


Then click the Run Fix button at the top

Let the program run unhindered.

When done it will say "Fix Complete press ok to open the log"
Please post that log in your next reply. Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTL\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

Then rerun a scan with OTL and post that log. :)
Posted Image
m0le is a proud member of UNITE

#11 rattenjunge

rattenjunge
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:02:47 AM

Posted 17 November 2010 - 10:12 PM

Hello.

here's the first log:

========== OTL ==========
Service HidServ stopped successfully!
Service HidServ deleted successfully!
File C:\WINDOWS\System32\hidserv.dll File not found not found.
Service IRENUM stopped successfully!
Service IRENUM deleted successfully!
File C:\WINDOWS\System32\DRIVERS\irenum.sys File not found not found.
Service FXDrv32 stopped successfully!
Service FXDrv32 deleted successfully!
File D:\FXDrv32.sys File not found not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\NPSStartup deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4fc698a9-043d-11de-83f2-001c25dd14e5}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4fc698a9-043d-11de-83f2-001c25dd14e5}\ not found.
File F:\SYSTEM\S-3-7-89-2225458569-9856321456-454423558-8896\explorer.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4fc698a9-043d-11de-83f2-001c25dd14e5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4fc698a9-043d-11de-83f2-001c25dd14e5}\ not found.
File F:\SYSTEM\S-3-7-89-2225458569-9856321456-454423558-8896\explorer.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7e696b08-da08-11de-8735-001c25dd14e5}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7e696b08-da08-11de-8735-001c25dd14e5}\ not found.
File F:\.\5JywJKyw\5JywJKyw.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7e696b08-da08-11de-8735-001c25dd14e5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7e696b08-da08-11de-8735-001c25dd14e5}\ not found.
File F:\5JywJKyw\5JywJKyw.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7e696b08-da08-11de-8735-001c25dd14e5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7e696b08-da08-11de-8735-001c25dd14e5}\ not found.
File F:\5JywJKyw\5JywJKyw.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c61f196a-8305-11df-8aac-001c25dd14e5}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c61f196a-8305-11df-8aac-001c25dd14e5}\ not found.
File .\winguard\wwload.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c61f196a-8305-11df-8aac-001c25dd14e5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c61f196a-8305-11df-8aac-001c25dd14e5}\ not found.
File .///winguard\\/wwload.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c61f196a-8305-11df-8aac-001c25dd14e5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c61f196a-8305-11df-8aac-001c25dd14e5}\ not found.
File .////\\\winguard\\\\/wwload.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ebc89183-98d1-11df-8b19-001c25dd14e5}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ebc89183-98d1-11df-8b19-001c25dd14e5}\ not found.
File F:\.\y591D691\y591D691.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ebc89183-98d1-11df-8b19-001c25dd14e5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ebc89183-98d1-11df-8b19-001c25dd14e5}\ not found.
File F:\y591D691\y591D691.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ebc89183-98d1-11df-8b19-001c25dd14e5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ebc89183-98d1-11df-8b19-001c25dd14e5}\ not found.
File F:\y591D691\y591D691.exe not found.
ADS C:\Documents and Settings\All Users.WINDOWS\Datos de programa\TEMP:16E029F0 deleted successfully.
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Taskman not found.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command\\""|""%1" %*" /E : value set successfully!

OTL by OldTimer - Version 3.2.17.3 log created on 11172010_204841


And here's the second log:


OTL logfile created on: 17/11/2010 09:05:53 p.m. - Run 2
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Documents and Settings\HERMIDA\Escritorio
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 0000080A | Country: México | Language: ESM | Date Format: dd/MM/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 66.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 83.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Archivos de programa
Drive C: | 232.88 Gb Total Space | 106.70 Gb Free Space | 45.82% Space Free | Partition Type: NTFS

Computer Name: NEUE-PC | User Name: HERMIDA | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\HERMIDA\Escritorio\OTL.exe (OldTimer Tools)
PRC - C:\Archivos de programa\Mozilla Firefox\plugin-container.exe (Mozilla Corporation)
PRC - C:\Archivos de programa\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Archivos de programa\Kaspersky Lab\Kaspersky Anti-Virus 2011\avp.exe (Kaspersky Lab ZAO)
PRC - C:\Archivos de programa\Google\Update\1.2.183.39\GoogleCrashHandler.exe (Google Inc.)
PRC - C:\Archivos de programa\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
PRC - C:\Archivos de programa\Kaspersky Lab\Kaspersky Anti-Virus 2011\klwtblfs.exe (Kaspersky Lab ZAO)
PRC - C:\Archivos de programa\DivX\DivX Update\DivXUpdate.exe ()
PRC - C:\Archivos de programa\Archivos comunes\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Archivos de programa\BOINC\boincmgr.exe (Space Sciences Laboratory)
PRC - C:\Archivos de programa\BOINC\boinctray.exe (Space Sciences Laboratory)
PRC - C:\Archivos de programa\BOINC\boinc.exe (Space Sciences Laboratory)
PRC - C:\WINDOWS\system32\FsUsbExService.Exe (Teruten)
PRC - C:\Archivos de programa\Asistente Infinitum\IsaMonitor.exe (Fine Point Technologies, Inc.)
PRC - C:\Archivos de programa\Adobe\Adobe Acrobat 7.0\Distillr\acrotray.exe (Adobe Systems Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Archivos de programa\Nero\Nero 7\InCD\NBHGui.exe (Nero AG)
PRC - C:\Archivos de programa\Nero\Nero 7\InCD\InCDsrv.exe (Nero AG)
PRC - C:\Archivos de programa\Nero\Nero 7\InCD\InCD.exe (Nero AG)
PRC - C:\WINDOWS\system32\spool\drivers\w32x86\3\E_FATI9BL.EXE (SEIKO EPSON CORPORATION)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\HERMIDA\Escritorio\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
MOD - C:\Archivos de programa\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
MOD - C:\Archivos de programa\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)


========== Win32 Services (SafeList) ==========

SRV - (AVP) -- C:\Archivos de programa\Kaspersky Lab\Kaspersky Anti-Virus 2011\avp.exe (Kaspersky Lab ZAO)
SRV - (Adobe LM Service) -- C:\Archivos de programa\Archivos comunes\Adobe Systems Shared\Service\Adobelmsvc.exe (Adobe Systems)
SRV - (FsUsbExService) -- C:\WINDOWS\system32\FsUsbExService.Exe (Teruten)
SRV - (Autodesk Licensing Service) -- C:\Archivos de programa\Archivos comunes\Autodesk Shared\Service\AdskScSrv.exe (Autodesk)
SRV - (odserv) -- C:\Archivos de programa\Archivos comunes\Microsoft Shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (IsaMonitor) -- C:\Archivos de programa\Asistente Infinitum\IsaMonitor.exe (Fine Point Technologies, Inc.)
SRV - (ServiceLayer) -- C:\Archivos de programa\PC Connectivity Solution\ServiceLayer.exe (Nokia.)
SRV - (InCDsrv) -- C:\Archivos de programa\Nero\Nero 7\InCD\InCDsrv.exe (Nero AG)
SRV - (NMIndexingService) -- C:\Archivos de programa\Archivos comunes\Ahead\Lib\NMIndexingService.exe (Nero AG)
SRV - (ose) -- C:\Archivos de programa\Archivos comunes\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV - (KLIF) -- C:\WINDOWS\system32\drivers\klif.sys (Kaspersky Lab)
DRV - (kl2) -- C:\WINDOWS\system32\drivers\kl2.sys (Kaspersky Lab ZAO)
DRV - (KL1) -- C:\WINDOWS\system32\DRIVERS\kl1.sys (Kaspersky Lab ZAO)
DRV - (SASKUTIL) -- C:\Archivos de programa\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (klim5) -- C:\WINDOWS\system32\drivers\klim5.sys (Kaspersky Lab ZAO)
DRV - (SASDIFSV) -- C:\Archivos de programa\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (klmouflt) -- C:\WINDOWS\system32\drivers\klmouflt.sys (Kaspersky Lab)
DRV - (FsUsbExDisk) -- C:\WINDOWS\system32\FsUsbExDisk.Sys ()
DRV - (ss_bmdm) -- C:\WINDOWS\system32\drivers\ss_bmdm.sys (MCCI Corporation)
DRV - (ss_bbus) SAMSUNG USB Mobile Device (WDM) -- C:\WINDOWS\system32\drivers\ss_bbus.sys (MCCI)
DRV - (ss_bmdfl) SAMSUNG USB Mobile Modem (Filter) -- C:\WINDOWS\system32\drivers\ss_bmdfl.sys (MCCI Corporation)
DRV - (HDAudBus) -- C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows ® Server 2003 DDK provider)
DRV - (incdrm) -- C:\WINDOWS\system32\drivers\InCDRm.sys (Nero AG)
DRV - (InCDPass) -- C:\WINDOWS\system32\drivers\InCDPass.sys (Nero AG)
DRV - (InCDfs) -- C:\WINDOWS\system32\drivers\InCDfs.sys (Nero AG)
DRV - (pccsmcfd) -- C:\WINDOWS\system32\drivers\pccsmcfd.sys (Nokia)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (RTLE8023xp) -- C:\WINDOWS\system32\drivers\Rtenicxp.sys (Realtek Semiconductor Corporation )
DRV - (ialm) -- C:\WINDOWS\system32\drivers\igxpmp32.sys (Intel Corporation)
DRV - (MDC8021X) AEGIS Protocol (IEEE 802.1x) -- C:\WINDOWS\system32\drivers\mdc8021x.sys (Meetinghouse Data Communications)
DRV - (irsir) -- C:\WINDOWS\system32\drivers\irsir.sys (Microsoft Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = prodigy.msn.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "Diccionario de Español RAE"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..extensions.enabledItems: linkfilter@kaspersky.ru:11.0.1.400
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {e001c731-5e37-4538-a5cb-8168736a2360}:0.9.9.52
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Components: C:\Archivos de programa\Mozilla Firefox\components [2010/10/29 16:59:48 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Plugins: C:\Archivos de programa\Mozilla Firefox\plugins [2010/10/29 16:59:34 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\{eea12ec4-729d-4703-bc37-106ce9879ce2}: C:\Archivos de programa\Kaspersky Lab\Kaspersky Anti-Virus 2011\THBExt [2010/10/26 08:26:52 | 000,000,000 | ---D | M]

[2010/10/29 16:59:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HERMIDA\Datos de programa\Mozilla\Extensions
[2010/11/17 11:42:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HERMIDA\Datos de programa\Mozilla\Firefox\Profiles\m5e31i2k.default\extensions
[2010/11/16 10:08:06 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\HERMIDA\Datos de programa\Mozilla\Firefox\Profiles\m5e31i2k.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/11/16 10:08:02 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\HERMIDA\Datos de programa\Mozilla\Firefox\Profiles\m5e31i2k.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
[2010/11/11 17:27:10 | 000,001,148 | ---- | M] () -- C:\Documents and Settings\HERMIDA\Datos de programa\Mozilla\Firefox\Profiles\m5e31i2k.default\searchplugins\diccionario-de-espaol-rae.xml
[2010/11/17 11:42:48 | 000,000,000 | ---D | M] -- C:\Archivos de programa\Mozilla Firefox\extensions
[2010/05/11 08:54:59 | 000,000,000 | ---D | M] (Java Console) -- C:\Archivos de programa\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/08/05 15:08:16 | 000,000,000 | ---D | M] (Java Console) -- C:\Archivos de programa\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/10/25 16:59:01 | 000,000,000 | ---D | M] (Java Console) -- C:\Archivos de programa\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2010/10/26 08:27:46 | 000,000,000 | ---D | M] -- C:\Archivos de programa\Mozilla Firefox\extensions\linkfilter@kaspersky.ru
[2010/10/29 17:15:38 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Archivos de programa\Mozilla Firefox\plugins\npdeployJava1.dll
[2010/10/26 23:58:59 | 000,001,178 | ---- | M] () -- C:\Archivos de programa\Mozilla Firefox\searchplugins\wikipedia-es.xml
[2010/10/26 23:58:59 | 000,000,798 | ---- | M] () -- C:\Archivos de programa\Mozilla Firefox\searchplugins\yahoo-mx.xml

O1 HOSTS File: ([2010/09/18 21:28:23 | 000,000,698 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Archivos de programa\Adobe\Adobe Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Shareaza Web Download Hook) - {0EEDB912-C5FA-486F-8334-57288578C627} - C:\Archivos de programa\Shareaza\RazaWebHook32.dll (Shareaza Development Team)
O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Archivos de programa\Kaspersky Lab\Kaspersky Anti-Virus 2011\ievkbd.dll (Kaspersky Lab ZAO)
O2 - BHO: (Windows Live Aplicación auxiliar de inicio de sesión) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Archivos de programa\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Archivos de programa\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.)
O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Archivos de programa\Kaspersky Lab\Kaspersky Anti-Virus 2011\klwtbbho.dll (Kaspersky Lab ZAO)
O3 - HKLM\..\Toolbar: (PDF de Adobe) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Archivos de programa\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (PDF de Adobe) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Archivos de programa\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Acrobat Assistant 7.0] C:\Archivos de programa\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [AVP] C:\Archivos de programa\Kaspersky Lab\Kaspersky Anti-Virus 2011\avp.exe (Kaspersky Lab ZAO)
O4 - HKLM..\Run: [boincmgr] C:\Archivos de programa\BOINC\boincmgr.exe (Space Sciences Laboratory)
O4 - HKLM..\Run: [boinctray] C:\Archivos de programa\BOINC\boinctray.exe (Space Sciences Laboratory)
O4 - HKLM..\Run: [DivXUpdate] C:\Archivos de programa\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [EPSON Stylus CX3500 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BL.EXE (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [InCD] C:\Archivos de programa\Nero\Nero 7\InCD\InCD.exe (Nero AG)
O4 - HKLM..\Run: [Ink Monitor] C:\Archivos de programa\epson\Ink Monitor\InkMonitor.exe (Epson)
O4 - HKLM..\Run: [LanguageShortcut] C:\Archivos de programa\CyberLink\PowerDVD\Language\Language.exe ()
O4 - HKLM..\Run: [LGODDFU] C:\Archivos de programa\lg_fwupdate\fwupdate.exe (BitLeader)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Archivos de programa\Archivos comunes\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [SecurDisc] C:\Archivos de programa\Nero\Nero 7\InCD\NBHGui.exe (Nero AG)
O4 - HKLM..\Run: [SkyTel] C:\WINDOWS\SkyTel.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Archivos de programa\Archivos comunes\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKCU..\Run: [AutoStartNPSAgent] C:\Archivos de programa\Samsung\Samsung New PC Studio\NPSAgent.exe (Samsung Electronics Co., Ltd.)
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Archivos de programa\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
O4 - Startup: C:\Documents and Settings\All Users.WINDOWS\Menú Inicio\Programas\Inicio\Adobe Gamma.lnk = C:\Archivos de programa\Archivos comunes\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Documents and Settings\All Users.WINDOWS\Menú Inicio\Programas\Inicio\Inicio rápido de Adobe Acrobat.lnk = C:\WINDOWS\Installer\{AC76BA86-1034-4700-7760-100000000002}\SC_Acrobat.exe ()
O4 - Startup: C:\Documents and Settings\HERMIDA\Menú Inicio\Programas\Inicio\Tabla de contenido de OneNote.onetoc2 ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 28
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Convertir a PDF de Adobe - C:\Archivos de programa\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convertir a PDF existente - C:\Archivos de programa\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convertir destino de vínculo a PDF existente - C:\Archivos de programa\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convertir destino de vínculo en archivo PDF de Adobe - C:\Archivos de programa\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convertir selección a archivo PDF existente - C:\Archivos de programa\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convertir selección a PDF de Adobe - C:\Archivos de programa\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convertir vínculos seleccionados a PDF de Adobe - C:\Archivos de programa\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convertir vínculos seleccionados a PDF existente - C:\Archivos de programa\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Download with &Shareaza - C:\Archivos de programa\Shareaza\RazaWebHook32.dll (Shareaza Development Team)
O9 - Extra Button: Teclado Virtual - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Archivos de programa\Kaspersky Lab\Kaspersky Anti-Virus 2011\klwtbbho.dll (Kaspersky Lab ZAO)
O9 - Extra Button: Compro&bación de direcciones URL - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Archivos de programa\Kaspersky Lab\Kaspersky Anti-Virus 2011\klwtbbho.dll (Kaspersky Lab ZAO)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} http://download.bitdefender.com/resources/scanner/sources/es/scan8/oscan8.cab (BDSCANONLINE Control)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1228488590687 (MUWebControl Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Archivos de programa\Archivos comunes\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Archivos de programa\Archivos comunes\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Archivos de programa\Archivos comunes\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Archivos de programa\Archivos comunes\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Archivos de programa\Archivos comunes\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Archivos de programa\Archivos comunes\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Archivos de programa\Archivos comunes\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\ARCHIV~1\KASPER~1\KASPER~1\mzvkbd3.dll) - C:\Archivos de programa\Kaspersky Lab\Kaspersky Anti-Virus 2011\mzvkbd3.dll (Kaspersky Lab ZAO)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Archivos de programa\SUPERAntiSpyware\SASWINLO.DLL - C:\Archivos de programa\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O20 - Winlogon\Notify\klogon: DllName - C:\WINDOWS\system32\klogon.dll - C:\WINDOWS\system32\klogon.dll (Kaspersky Lab ZAO)
O20 - Winlogon\Notify\WgaLogon: DllName - WgaLogon.dll - File not found
O24 - Desktop Components:0 (Mi página de inicio actual) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\HERMIDA\Configuración local\Datos de programa\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\HERMIDA\Configuración local\Datos de programa\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Archivos de programa\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Archivos de programa\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/08/17 18:05:36 | 000,000,000 | ---D | M] - C:\Autodesk -- [ NTFS ]
O32 - AutoRun File - [2008/12/01 13:48:07 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/11/17 20:48:41 | 000,000,000 | ---D | C] -- C:\_OTL
[2010/11/17 11:50:06 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\HERMIDA\Recent
[2010/11/16 23:21:47 | 000,000,000 | ---D | C] -- C:\_OTM
[2010/11/16 23:20:12 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\HERMIDA\Escritorio\OTL.exe
[2010/11/16 23:18:07 | 000,519,680 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\HERMIDA\Escritorio\OTM.exe
[2010/11/16 18:33:57 | 000,000,000 | R--D | C] -- C:\32788R22FWJFW
[2010/11/16 09:55:04 | 000,000,000 | ---D | C] -- C:\ISA
[2010/11/15 00:21:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\HERMIDA\Mis documentos\PODCASTS Y RADIO
[2010/11/05 19:26:13 | 000,000,000 | ---D | C] -- C:\rsit
[2010/11/05 08:32:16 | 000,000,000 | ---D | C] -- C:\WINDOWS\CSC
[2010/11/03 15:00:52 | 000,000,000 | ---D | C] -- C:\Archivos de programa\ESET
[2010/10/29 17:16:24 | 000,000,000 | ---D | C] -- C:\Archivos de programa\Archivos comunes\Java
[2010/10/29 17:15:57 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2010/10/29 17:15:57 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2010/10/29 17:15:57 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2010/10/29 17:15:57 | 000,073,728 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[2010/10/29 17:15:34 | 000,000,000 | ---D | C] -- C:\Archivos de programa\Java
[2010/10/29 16:59:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\HERMIDA\Datos de programa\Mozilla
[2010/10/26 08:26:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Datos de programa\Kaspersky Lab
[2010/10/26 08:26:17 | 000,000,000 | ---D | C] -- C:\Archivos de programa\Kaspersky Lab
[2010/10/26 08:26:03 | 000,475,736 | ---- | C] (Kaspersky Lab) -- C:\WINDOWS\System32\drivers\klif.sys
[2010/10/26 08:25:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Datos de programa\Kaspersky Lab Setup Files
[2010/10/25 11:47:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\HERMIDA\Escritorio\logs virulencia
[2010/10/22 13:02:30 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/10/22 13:02:29 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/10/22 12:58:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\HERMIDA\Datos de programa\SUPERAntiSpyware.com
[2010/10/22 12:58:15 | 000,000,000 | ---D | C] -- C:\Archivos de programa\SUPERAntiSpyware
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/11/17 20:32:00 | 000,001,038 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/11/17 18:42:31 | 000,115,465 | ---- | M] () -- C:\WINDOWS\System32\drivers\klin.dat
[2010/11/17 18:42:31 | 000,097,545 | ---- | M] () -- C:\WINDOWS\System32\drivers\klick.dat
[2010/11/17 18:28:18 | 000,002,387 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Menú Inicio\Programas\Inicio\Inicio rápido de Adobe Acrobat.lnk
[2010/11/17 18:28:13 | 000,000,384 | ---- | M] () -- C:\WINDOWS\lgfwup.ini
[2010/11/17 18:27:52 | 000,000,264 | ---- | M] () -- C:\WINDOWS\tasks\OGALogon.job
[2010/11/17 18:27:45 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/11/17 18:26:39 | 000,001,034 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/11/17 18:26:39 | 000,001,012 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job
[2010/11/17 18:26:31 | 000,000,260 | ---- | M] () -- C:\WINDOWS\tasks\WGASetup.job
[2010/11/17 18:26:15 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/11/16 23:20:12 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\HERMIDA\Escritorio\OTL.exe
[2010/11/16 23:18:08 | 000,519,680 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\HERMIDA\Escritorio\OTM.exe
[2010/11/16 11:23:01 | 000,000,264 | ---- | M] () -- C:\WINDOWS\tasks\OGADaily.job
[2010/11/01 01:56:24 | 000,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2010/10/29 17:15:38 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll
[2010/10/29 17:15:38 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2010/10/29 17:15:38 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2010/10/29 17:15:38 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2010/10/29 17:15:38 | 000,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[2010/10/26 08:47:00 | 000,475,736 | ---- | M] (Kaspersky Lab) -- C:\WINDOWS\System32\drivers\klif.sys
[2010/10/26 08:24:44 | 000,000,002 | ---- | M] () -- C:\WINDOWS\System32\config.nt
[2010/10/22 13:02:32 | 000,000,731 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Escritorio\Malwarebytes' Anti-Malware.lnk
[2010/10/22 12:58:17 | 000,001,741 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Escritorio\SUPERAntiSpyware Free Edition.lnk
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/10/26 08:27:35 | 000,115,465 | ---- | C] () -- C:\WINDOWS\System32\drivers\klin.dat
[2010/10/26 08:27:35 | 000,097,545 | ---- | C] () -- C:\WINDOWS\System32\drivers\klick.dat
[2010/10/22 13:02:32 | 000,000,731 | ---- | C] () -- C:\Documents and Settings\All Users.WINDOWS\Escritorio\Malwarebytes' Anti-Malware.lnk
[2010/10/22 12:58:17 | 000,001,741 | ---- | C] () -- C:\Documents and Settings\All Users.WINDOWS\Escritorio\SUPERAntiSpyware Free Edition.lnk
[2010/04/10 14:48:53 | 000,484,352 | ---- | C] () -- C:\WINDOWS\System32\lame_enc.dll
[2010/03/05 23:22:42 | 000,034,308 | ---- | C] () -- C:\WINDOWS\System32\BASSMOD.dll
[2010/01/14 08:48:34 | 000,000,118 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI
[2009/10/17 19:34:51 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\FsUsbExDevice.Dll
[2009/10/17 19:34:51 | 000,036,608 | ---- | C] () -- C:\WINDOWS\System32\FsUsbExDisk.Sys
[2009/10/17 19:34:43 | 000,002,528 | ---- | C] () -- C:\Documents and Settings\HERMIDA\Datos de programa\$_hpcst$.hpc
[2009/08/28 22:00:49 | 000,000,232 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2009/07/29 19:09:21 | 000,000,112 | ---- | C] () -- C:\WINDOWS\ActiveSkin.INI
[2009/01/05 14:46:14 | 000,000,492 | ---- | C] () -- C:\WINDOWS\bdoscandellang.ini
[2008/12/31 17:04:42 | 000,691,560 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll
[2008/12/04 14:04:32 | 000,095,232 | ---- | C] () -- C:\Documents and Settings\HERMIDA\Configuración local\Datos de programa\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/12/04 10:22:49 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2008/12/02 12:47:26 | 000,096,768 | ---- | C] () -- C:\WINDOWS\SlantAdj.dll
[2008/12/02 12:47:26 | 000,000,072 | ---- | C] () -- C:\WINDOWS\System32\epDPE.ini
[2008/12/02 12:47:03 | 000,000,022 | ---- | C] () -- C:\WINDOWS\System32\PICSDK.ini
[2008/12/02 12:46:04 | 000,000,044 | ---- | C] () -- C:\WINDOWS\EPCX3500.ini
[2008/12/01 19:16:48 | 000,000,136 | ---- | C] () -- C:\Documents and Settings\HERMIDA\Configuración local\Datos de programa\fusioncache.dat
[2008/12/01 18:59:39 | 000,000,379 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2008/12/01 14:52:24 | 000,000,384 | ---- | C] () -- C:\WINDOWS\lgfwup.ini
[2008/12/01 14:39:37 | 000,204,800 | R--- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4837.dll
[2008/12/01 07:06:10 | 000,004,205 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2008/11/06 10:37:32 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2008/05/26 22:23:18 | 000,016,892 | ---- | C] () -- C:\WINDOWS\System32\gthrctr.ini
[2008/05/26 22:23:16 | 000,023,640 | ---- | C] () -- C:\WINDOWS\System32\idxcntrs.ini
[2008/05/26 22:23:14 | 000,016,164 | ---- | C] () -- C:\WINDOWS\System32\gsrvctr.ini
[2007/10/25 16:26:10 | 000,005,632 | ---- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys
[2004/05/10 04:00:00 | 000,000,054 | ---- | C] () -- C:\WINDOWS\System32\EAL32.INI

< End of report >

#12 m0le

m0le

    Can U Dig It?


  • Malware Response Team
  • 34,527 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London, UK
  • Local time:08:47 AM

Posted 18 November 2010 - 06:25 PM

That looks better.

Please run an ESET scan next

  • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  • Click the Posted Image button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on Posted Image to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the Posted Image icon on your desktop.
  • Check Posted Image
  • Click the Posted Image button.
  • Accept any security warnings from your browser.
  • Leave the top box checked and then check Posted Image
  • Push the Start button.
  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push Posted Image
  • Push Posted Image, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  • Push the Posted Image button.
  • Push Posted Image
NOTE: If no malware is found then no log will be produced. Let me know if this is the case.

How's the computer now?
Posted Image
m0le is a proud member of UNITE

#13 rattenjunge

rattenjunge
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:02:47 AM

Posted 19 November 2010 - 01:13 AM

Hello.

Good news is Eset found no malware; however the error messages still show up.

#14 m0le

m0le

    Can U Dig It?


  • Malware Response Team
  • 34,527 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London, UK
  • Local time:08:47 AM

Posted 19 November 2010 - 05:15 PM

Does the filename change within the error message?
Posted Image
m0le is a proud member of UNITE

#15 rattenjunge

rattenjunge
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:02:47 AM

Posted 19 November 2010 - 05:58 PM

Hi.

No, the error messages are always for acad.exe, jqsnotify.exe, and I have just noticed wmplayer.exe shows the error message as well. In this case whenenver I try to open a video file from hotmail instead of saving it and then playing it.

When i tried to run Combofix, the error messages were always for 32788R22FWJFW\iexplore.exe, 32788R22FWJFW\n.pif, and 32788R22FWJFW\hidec.exe.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users