Log HjackThis + Rootkit detective

Reglas del Foro
Normas Basicas | Los Titulos, dicen mucho | No postear en paralelo | Continua en tu tema | Cierra tu tema, antes de abrir otro | No escribas en temas antiguos
Enlaces a web/mail/blog/Msn NO estan permitidos | Mensajes Privados | Informes de resultados | Antivirus Online
Responder
renato_allegro_mercato
Mensajes: 29
Registrado: 13 Oct 2005, 19:51

Log HjackThis + Rootkit detective

Mensaje por renato_allegro_mercato » 20 Ene 2009, 12:34

Les agradeceria que le echaran un vistacio al log del HjackThis



Logfile of HijackThis v1.99.1

Scan saved at 12:27:06, on 20/01/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16762)



Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\LEXBCES.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\LEXPPS.EXE

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\SOUNDMAN.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\Archivos de programa\MSN Messenger\MsnMsgr.Exe

C:\Archivos de programa\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe

C:\Archivos de programa\Google\Web Accelerator\GoogleWebAccWarden.exe

C:\Archivos de programa\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\Archivos de programa\IVT Corporation\BlueSoleil\BTNtService.exe

C:\Archivos de programa\Java\jre6\bin\jqs.exe

C:\Archivos de programa\Archivos comunes\Microsoft Shared\VS7Debug\mdm.exe

C:\Archivos de programa\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe

C:\Archivos de programa\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

C:\WINDOWS\System32\svchost.exe

C:\Archivos de programa\UPHClean\uphclean.exe

c:\archivos de programa\pinnacle\shared files\programs\mediaserver\pmshost.exe

C:\Archivos de programa\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlagent.EXE

C:\Archivos de programa\Google\Web Accelerator\googlewebaccclient.exe

C:\Documents and Settings\user1\Escritorio\rapget141\rapget.exe

C:\Archivos de programa\Mozilla Firefox\firefox.exe

C:\Documents and Settings\user1\Escritorio\antivirus\HijackThis.exe



R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = WWW.GOOGLE.COM

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://localhost:9100/proxy.pac

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos

O1 - Hosts: AmsServer

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Archivos de programa\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Archivos de programa\Spybot - Search & Destroy\SDHelper.dll

O2 - BHO: Google Web Accelerator Helper - {69A87B7D-DE56-4136-9655-716BA50C19C7} - C:\Archivos de programa\Google\Web Accelerator\GoogleWebAccToolbar.dll

O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Archivos de programa\Java\jre6\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Archivos de programa\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\archivos de programa\google\googletoolbar4.dll

O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Archivos de programa\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Archivos de programa\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: Google Web Accelerator - {DB87BFA2-A2E3-451E-8E5A-C89982D87CBF} - C:\Archivos de programa\Google\Web Accelerator\GoogleWebAccToolbar.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\archivos de programa\google\googletoolbar4.dll

O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [Soltek] C:\WINDOWS\System32\autorun.exe

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [WinampAgent] C:\Archivos de programa\Winamp\winampa.exe

O4 - HKLM\..\Run: [AVG_CC] C:\ARCHIV~1\Grisoft\AVG6\avgcc32.exe /STARTUP

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [msnmsgr] "C:\Archivos de programa\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [AWMON] "C:\Archivos de programa\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe"

O4 - HKCU\..\Run: [eMuleAutoStart] C:\Archivos de programa\eMule\emule.exe -AutoStart

O4 - Global Startup: BlueSoleil.lnk = ?

O4 - Global Startup: Inicio rápido de Adobe Reader.lnk = C:\Archivos de programa\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Archivos de programa\Microsoft Office\Office10\OSA.EXE

O4 - Global Startup: Run Google Web Accelerator.lnk = C:\Archivos de programa\Google\Web Accelerator\GoogleWebAccWarden.exe

O8 - Extra context menu item: &Download by Arles Download Manager - C:\Documents and Settings\user1\Configuración local\Datos de programa\Ariel Download Manager\DownloadManager.htm

O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~2\Office10\EXCEL.EXE/3000

O8 - Extra context menu item: Enlace de descarga usando Mega Manager... - C:\Archivos de programa\Megaupload\Mega Manager\mm_file.htm

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe

O11 - Options group: [INTERNATIONAL] International*

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://oswaldtama.spaces.live.com//PhotoUpload/MsnPUpld.cab

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.es/scan_es/scan8/oscan8.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1130346447281

O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/es/securityadvisor/virusinfo/webscan.cab

O16 - DPF: {861FDA2A-2B57-4BDA-8B8B-305C9D5D8604} (_Multimedia Player) - http://stream.pussyharem.com/stream/mmp.cab

O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab

O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by142fd.bay142.hotmail.msn.com/activex/HMAtchmt.ocx

O17 - HKLM\System\CCS\Services\Tcpip\..\{C0F48583-33A8-4FBC-8A39-E12E544E1F97}: NameServer = 80.58.0.33,80.58.32.97

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARCHIV~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARCHIV~1\MSNMES~1\MSGRAP~1.DLL

O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Archivos de programa\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Archivos de programa\IVT Corporation\BlueSoleil\BTNtService.exe

O23 - Service: Windows Network Data Management System Service (BNDMSS) - Unknown owner - C:\WINDOWS\system32\bndmss.exe (file missing)

O23 - Service: Google Updater Service (gusvc) - Google - C:\Archivos de programa\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Archivos de programa\Archivos comunes\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - C:\Archivos de programa\Java\jre6\bin\jqs.exe" -service -config "C:\Archivos de programa\Java\jre6\lib\deploy\jqs\jqs.conf (file missing)

O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Archivos de programa\Archivos comunes\Macromedia Shared\Service\Macromedia Licensing.exe

O23 - Service: Pinnacle Systems Media Service (PinnacleSys.MediaServer) - Pinnacle Systems - c:\archivos de programa\pinnacle\shared files\programs\mediaserver\pmshost.exe

O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Archivos de programa\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe



Aqui les dejo tambien el del Rootkit detective ya que no sabia muy bien donde postearlo y ya aprovecho este tema





McAfee(R) Rootkit Detective 1.1 scan report

On 20-01-2009 at 12:23:04

OS-Version 5.1.2600

Service Pack 3.0

====================================



Object-Type: SSDT-hook

Object-Name: ZwClose

Object-Path: C:\WINDOWS\system32\drivers\Vax347b.sys



Object-Type: SSDT-hook

Object-Name: ZwCreateKey

Object-Path: C:\WINDOWS\system32\drivers\Vax347b.sys



Object-Type: SSDT-hook

Object-Name: ZwCreatePagingFile

Object-Path: C:\WINDOWS\system32\drivers\Vax347b.sys



Object-Type: SSDT-hook

Object-Name: ZwEnumerateKey

Object-Path: C:\WINDOWS\system32\drivers\Vax347b.sys



Object-Type: SSDT-hook

Object-Name: ZwEnumerateValueKey

Object-Path: C:\WINDOWS\system32\drivers\Vax347b.sys



Object-Type: SSDT-hook

Object-Name: ZwOpenKey

Object-Path: C:\WINDOWS\system32\drivers\Vax347b.sys



Object-Type: SSDT-hook

Object-Name: ZwOpenProcess

Object-Path: C:\Archivos de programa\Grisoft\AVG Anti-Spyware 7.5\guard.sys



Object-Type: SSDT-hook

Object-Name: ZwQueryKey

Object-Path: C:\WINDOWS\system32\drivers\Vax347b.sys



Object-Type: SSDT-hook

Object-Name: ZwQueryValueKey

Object-Path: C:\WINDOWS\system32\drivers\Vax347b.sys



Object-Type: SSDT-hook

Object-Name: ZwSetSystemPowerState

Object-Path: C:\WINDOWS\system32\drivers\Vax347b.sys



Object-Type: SSDT-hook

Object-Name: ZwSetValueKey

Object-Path: C:\WINDOWS\system32\drivers\sptd.sys



Object-Type: SSDT-hook

Object-Name: ZwTerminateProcess

Object-Path: C:\Archivos de programa\Grisoft\AVG Anti-Spyware 7.5\guard.sys



Object-Type: SSDT-hook

Object-Name: ZwUnloadKey

Object-Path: \??\C:\WINDOWS\system32\Drivers\uphcleanhlp.sys



Object-Type: IRP-hook

Object-Name: \Driver\Ftdisk->IRP_MJ_SYSTEM_CONTROL

Object-Path:



Object-Type: IRP-hook

Object-Name: \Driver\Ftdisk->IRP_MJ_POWER

Object-Path:



Object-Type: IRP-hook

Object-Name: \Driver\Ftdisk->IRP_MJ_CLEANUP

Object-Path:



Object-Type: IRP-hook

Object-Name: \Driver\Ftdisk->IRP_MJ_SHUTDOWN

Object-Path:



Object-Type: IRP-hook

Object-Name: \Driver\Ftdisk->IRP_MJ_INTERNAL_DEVICE_CONTROL

Object-Path:



Object-Type: IRP-hook

Object-Name: \Driver\Ftdisk->IRP_MJ_DEVICE_CONTROL

Object-Path:



Object-Type: IRP-hook

Object-Name: \Driver\Ftdisk->IRP_MJ_FLUSH_BUFFERS

Object-Path:



Object-Type: IRP-hook

Object-Name: \Driver\Ftdisk->IRP_MJ_WRITE

Object-Path:



Object-Type: IRP-hook

Object-Name: \Driver\Ftdisk->IRP_MJ_READ

Object-Path:



Object-Type: IRP-hook

Object-Name: \Driver\Ftdisk->IRP_MJ_CREATE

Object-Path:



Object-Type: Registry-key

Object-Name: 19659239224E364682FA4BAF72C53EA4uphcleanhlp.sys

Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4

Status: Hidden



Object-Type: Registry-key

Object-Name: 00000001ontrolSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4

Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001

Status: Hidden



Object-Type: Registry-key

Object-Name: 0Jf40M\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001

Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40

Status: Hidden



Object-Type: Registry-key

Object-Name: 0Jf41M\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40

Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41

Status: Hidden



Object-Type: Registry-key

Object-Name: 0D79C293C1ED61418462E24595C90D04td\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41

Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04

Status: Hidden



Object-Type: Registry-key

Object-Name: 19659239224E364682FA4BAF72C53EA4td\Cfg\0D79C293C1ED61418462E24595C90D04

Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4

Status: Hidden



Object-Type: Registry-value

Object-Name: (Default)

Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg

Status: Unable to access registry key



Object-Type: Registry-key

Object-Name: 0D79C293C1ED61418462E24595C90D04td\Cfg

Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04

Status: Hidden



Object-Type: Registry-value

Object-Name: (Default)

Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04

Status: Unable to access registry key



Object-Type: Registry-value

Object-Name: h0

Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04

Status: Hidden



Object-Type: Registry-value

Object-Name: ujdew

Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04

Status: Hidden



Object-Type: Registry-key

Object-Name: 19659239224E364682FA4BAF72C53EA4td\Cfg\0D79C293C1ED61418462E24595C90D04

Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4

Status: Hidden



Object-Type: Registry-value

Object-Name: (Default)

Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4

Status: Unable to access registry key



Object-Type: Registry-value

Object-Name: h0

Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4

Status: Hidden



Object-Type: Registry-value

Object-Name: khjeh

Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4

Status: Hidden



Object-Type: Registry-value

Object-Name: s1

Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg

Status: Hidden



Object-Type: Registry-value

Object-Name: s2

Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg

Status: Hidden



Object-Type: Registry-value

Object-Name: g0

Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg

Status: Hidden



Object-Type: Registry-value

Object-Name: h0

Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg

Status: Hidden



Object-Type: Registry-key

Object-Name: jdgg40\ControlSet003\Services\sptd\Cfg

Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Vax347s\Config\jdgg40

Status: Hidden



Object-Type: Registry-value

Object-Name: (Default)

Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Vax347s\Config\jdgg40

Status: Unable to access registry key



Object-Type: Registry-key

Object-Name: 0D79C293C1ED61418462E24595C90D04x347s\Config\jdgg40

Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04

Status: Hidden



Object-Type: Registry-key

Object-Name: 19659239224E364682FA4BAF72C53EA4td\Cfg\0D79C293C1ED61418462E24595C90D04

Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4

Status: Hidden



Object-Type: Registry-value

Object-Name: (Default)

Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg

Status: Unable to access registry key



Object-Type: Registry-key

Object-Name: 0D79C293C1ED61418462E24595C90D04td\Cfg

Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04

Status: Hidden



Object-Type: Registry-value

Object-Name: (Default)

Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04

Status: Unable to access registry key



Object-Type: Registry-value

Object-Name: h0

Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04

Status: Hidden



Object-Type: Registry-value

Object-Name: ujdew

Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04

Status: Hidden



Object-Type: Registry-key

Object-Name: 19659239224E364682FA4BAF72C53EA4td\Cfg\0D79C293C1ED61418462E24595C90D04

Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4

Status: Hidden



Object-Type: Registry-value

Object-Name: (Default)

Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4

Status: Unable to access registry key



Object-Type: Registry-value

Object-Name: h0

Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4

Status: Hidden



Object-Type: Registry-value

Object-Name: khjeh

Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4

Status: Hidden



Object-Type: Registry-value

Object-Name: s1

Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg

Status: Hidden



Object-Type: Registry-value

Object-Name: s2

Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg

Status: Hidden



Object-Type: Registry-value

Object-Name: g0

Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg

Status: Hidden



Object-Type: Registry-value

Object-Name: h0

Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg

Status: Hidden



Object-Type: Registry-key

Object-Name: jdgg40\ControlSet003\Services\sptd\Cfg

Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Vax347s\Config\jdgg40

Status: Hidden



Object-Type: Registry-value

Object-Name: (Default)

Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Vax347s\Config\jdgg40

Status: Unable to access registry key



Object-Type: Registry-value

Object-Name: ProductName

Object-Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\32418F9EE1126B64A90E8365B85CFCF6

Status: Registy value-data mismatch



Object-Type: Registry-key

Object-Name: DataWARE\Classes\Installer\Products\32418F9EE1126B64A90E8365B85CFCF6

Object-Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Protected Storage System Provider\*Local Machine*\Data

Status: Hidden



Object-Type: Registry-key

Object-Name: a5c5c2e4-6bee-4ef9-a0f5-f76a07cce771 System Provider\*Local Machine*\Data

Object-Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Protected Storage System Provider\*Local Machine*\Data\a5c5c2e4-6bee-4ef9-a0f5-f76a07cce771

Status: Hidden



Object-Type: Registry-key

Object-Name: 00000000-0000-0000-0000-000000000000 System Provider\*Local Machine*\Data\a5c5c2e4-6bee-4ef9-a0f5-f76a07cce771

Object-Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Protected Storage System Provider\*Local Machine*\Data\a5c5c2e4-6bee-4ef9-a0f5-f76a07cce771\00000000-0000-0000-0000-000000000000

Status: Hidden



Object-Type: Registry-key

Object-Name: {6340E680-FF06-435f-8767-B79D88AEBD4D}ystem Provider\*Local Machine*\Data\a5c5c2e4-6bee-4ef9-a0f5-f76a07cce771\00000000-0000-0000-0000-000000000000

Object-Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Protected Storage System Provider\*Local Machine*\Data\a5c5c2e4-6bee-4ef9-a0f5-f76a07cce771\00000000-0000-0000-0000-000000000000\{6340E680-FF06-435f-8767-B79D88AEBD4D}

Status: Hidden



Object-Type: Registry-value

Object-Name: Item Data

Object-Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Protected Storage System Provider\*Local Machine*\Data\a5c5c2e4-6bee-4ef9-a0f5-f76a07cce771\00000000-0000-0000-0000-000000000000\{6340E680-FF06-435f-8767-B79D88AEBD4D}

Status: Hidden



Object-Type: Registry-value

Object-Name: Display String

Object-Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Protected Storage System Provider\*Local Machine*\Data\a5c5c2e4-6bee-4ef9-a0f5-f76a07cce771\00000000-0000-0000-0000-000000000000

Status: Hidden



Object-Type: Registry-value

Object-Name: Display String

Object-Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Protected Storage System Provider\*Local Machine*\Data\a5c5c2e4-6bee-4ef9-a0f5-f76a07cce771

Status: Hidden



Object-Type: Registry-key

Object-Name: Data 2RE\Microsoft\Protected Storage System Provider\*Local Machine*\Data\a5c5c2e4-6bee-4ef9-a0f5-f76a07cce771

Object-Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Protected Storage System Provider\*Local Machine*\Data 2

Status: Hidden



Object-Type: Registry-key

Object-Name: WindowsE\Microsoft\Protected Storage System Provider\*Local Machine*\Data 2

Object-Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Protected Storage System Provider\*Local Machine*\Data 2\Windows

Status: Hidden



Object-Type: Registry-value

Object-Name: Value

Object-Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Protected Storage System Provider\*Local Machine*\Data 2\Windows

Status: Hidden



Object-Type: Registry-value

Object-Name: DisplayName

Object-Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E9F81423-211E-46B6-9AE0-38568BC5CF6F}

Status: Registy value-data mismatch



Object-Type: Process

Object-Name: System Idle Process

Pid: 0

Object-Path:

Status: Visible



Object-Type: Process

Object-Name: mdm.exe

Pid: 496

Object-Path: C:\Archivos de programa\Archivos comunes\Microsoft Shared\VS7Debug\mdm.exe

Status: Visible



Object-Type: Process

Object-Name: LEXPPS.EXE

Pid: 1396

Object-Path: C:\WINDOWS\system32\LEXPPS.EXE

Status: Visible



Object-Type: Process

Object-Name: Ad-Watch.exe

Pid: 1892

Object-Path: C:\Archivos de programa\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe

Status: Visible



Object-Type: Process

Object-Name: alg.exe

Pid: 652

Object-Path: C:\WINDOWS\System32\alg.exe

Status: Visible



Object-Type: Process

Object-Name: csrss.exe

Pid: 684

Object-Path: C:\WINDOWS\system32\csrss.exe

Status: Visible



Object-Type: Process

Object-Name: svchost.exe

Pid: 1088

Object-Path: C:\WINDOWS\system32\svchost.exe

Status: Visible



Object-Type: Process

Object-Name: System

Pid: 4

Object-Path:

Status: Visible



Object-Type: Process

Object-Name: svchost.exe

Pid: 1152

Object-Path: C:\WINDOWS\System32\svchost.exe

Status: Visible



Object-Type: Process

Object-Name: BTNtService.exe

Pid: 408

Object-Path: C:\Archivos de programa\IVT Corporation\BlueSoleil\BTNtService.exe

Status: Visible



Object-Type: Process

Object-Name: svchost.exe

Pid: 936

Object-Path: C:\WINDOWS\system32\svchost.exe

Status: Visible



Object-Type: Process

Object-Name: services.exe

Pid: 752

Object-Path: C:\WINDOWS\system32\services.exe

Status: Visible



Object-Type: Process

Object-Name: firefox.exe

Pid: 3232

Object-Path: C:\Archivos de programa\Mozilla Firefox\firefox.exe

Status: Visible



Object-Type: Process

Object-Name: uphclean.exe

Pid: 1528

Object-Path: C:\Archivos de programa\UPHClean\uphclean.exe

Status: Visible



Object-Type: Process

Object-Name: spoolsv.exe

Pid: 1344

Object-Path: C:\WINDOWS\system32\spoolsv.exe

Status: Visible



Object-Type: Process

Object-Name: SOUNDMAN.EXE

Pid: 1840

Object-Path: C:\WINDOWS\SOUNDMAN.EXE

Status: Visible



Object-Type: Process

Object-Name: sqlservr.exe

Pid: 448

Object-Path: C:\Archivos de programa\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe

Status: Visible



Object-Type: Process

Object-Name: smss.exe

Pid: 636

Object-Path: C:\WINDOWS\System32\smss.exe

Status: Visible



Object-Type: Process

Object-Name: ctfmon.exe

Pid: 1876

Object-Path: C:\WINDOWS\system32\ctfmon.exe

Status: Visible



Object-Type: Process

Object-Name: PMSHost.exe

Pid: 2404

Object-Path: c:\archivos de programa\pinnacle\shared files\programs\mediaserver\pmshost.exe

Status: Visible



Object-Type: Process

Object-Name: LEXBCES.EXE

Pid: 1320

Object-Path: C:\WINDOWS\system32\LEXBCES.EXE

Status: Visible



Object-Type: Process

Object-Name: lsass.exe

Pid: 764

Object-Path: C:\WINDOWS\system32\lsass.exe

Status: Visible



Object-Type: Process

Object-Name: sqlagent.EXE

Pid: 2872

Object-Path: C:\Archivos de programa\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlagent.EXE

Status: Visible



Object-Type: Process

Object-Name: GoogleWebAccCli

Pid: 2160

Object-Path: C:\Archivos de programa\Google\Web Accelerator\googlewebaccclient.exe

Status: Visible



Object-Type: Process

Object-Name: rapget.exe

Pid: 548

Object-Path: C:\Documents and Settings\user1\Escritorio\rapget141\rapget.exe

Status: Visible



Object-Type: Process

Object-Name: svchost.exe

Pid: 984

Object-Path: C:\WINDOWS\system32\svchost.exe

Status: Visible



Object-Type: Process

Object-Name: guard.exe

Pid: 364

Object-Path: C:\Archivos de programa\Grisoft\AVG Anti-Spyware 7.5\guard.exe

Status: Visible



Object-Type: Process

Object-Name: StarWindService

Pid: 1356

Object-Path: C:\Archivos de programa\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

Status: Visible



Object-Type: Process

Object-Name: svchost.exe

Pid: 1480

Object-Path: C:\WINDOWS\System32\svchost.exe

Status: Visible



Object-Type: Process

Object-Name: Rootkit_Detecti

Pid: 860

Object-Path: C:\Documents and Settings\user1\Escritorio\antivirus\Rootkit_Detective.exe

Status: Visible



Object-Type: Process

Object-Name: msnmsgr.exe

Pid: 1884

Object-Path: C:\Archivos de programa\MSN Messenger\MsnMsgr.Exe

Status: Visible



Object-Type: Process

Object-Name: svchost.exe

Pid: 1048

Object-Path: C:\WINDOWS\System32\svchost.exe

Status: Visible



Object-Type: Process

Object-Name: GoogleWebAccWar

Pid: 2040

Object-Path: C:\Archivos de programa\Google\Web Accelerator\GoogleWebAccWarden.exe

Status: Visible



Object-Type: Process

Object-Name: winlogon.exe

Pid: 708

Object-Path: C:\WINDOWS\system32\winlogon.exe

Status: Visible



Object-Type: Process

Object-Name: svchost.exe

Pid: 1204

Object-Path: C:\WINDOWS\System32\svchost.exe

Status: Visible



Object-Type: Process

Object-Name: jqs.exe

Pid: 584

Object-Path: C:\Archivos de programa\Java\jre6\bin\jqs.exe

Status: Visible



Object-Type: Process

Object-Name: explorer.exe

Pid: 1672

Object-Path: C:\WINDOWS\Explorer.EXE

Status: Visible



Scan complete. Hidden registry keys/values: 42





Muxas gracias de antemano :D :D
Arriba
Avatar de Usuario
flacoroo
Mensajes: 6289
Registrado: 09 Mar 2004, 20:32
Ubicación: Paso del Macho,Ver.México

Re: Log HjackThis + Rootkit detective

Mensaje por flacoroo » 20 Ene 2009, 17:55

sube este archivo a Virustotal para ver si es un virus aun que paresca el original....



C:\Archivos de programa\Archivos comunes\Microsoft Shared\VS7Debug\[color=#FF0000]mdm.exe[/color]



lo demas esta limpio y en cuanto al log del rootkit no lo se leer muy bien......
:lol: :lol: La vida es hermosa....para que complicarnosla :lol: :lol:
Arriba
Responder

Volver a “Foro HijackThis - copia y pega tu log”