Problemas al instalar el Nod32

[Negrocjs]

Buenas, muy bueno el foro felicitaciones....

Paso a mostrarle mi problema...basicamente es este.

[url=http://img5.imageshack.us/i/nodaf.jpg/][img]http://img5.imageshack.us/img5/6837/nodaf.jpg[/img][/url]



Me salta esa ventana cuando lo estoy instalando y no puedo terminar la instalacion

Queria saber si el problema es del programa o es de mi pc.







:arrow:

[msc hotline sat]

Veamos:



Accede o ha accedido alguna vez a la web de www.infiernorojo.com ???



Tiene algun fichero o imagen de infiernorojo.com ???



Tiene licencia para instalar el antivirus de NOD32 ???



Vemos que la web en cuestion está hospedada en Telecom de su pais, igual que Vd, asi que pensamos que puede ser que conozca su existencia e incluso que la utilice, si es así podría tener en caché algo de ella que le hiciera visualizar dicha pantalla en un siguiente acceso a la Red.



Contestenos las preguntas anteriores y posteenos el informe que genera el SPROCES, a ver si vemos algo relacionado con su problema.




[quote="msc"]
[b]SPROCES.EXE[/b] (herramienta de investigación)

http://www.zonavirus.com/descargas/sproces.asp



Y tras pulsar en SALIR, posteanos el contenido del C:\SPROCLOG.TXT [/quote]
lo analizaremos e informaremos al respecto.



saludos

10-11-2009

[Negrocjs]

Si, accedo a esa pagina.

Si, tengo imagenes de Infiernorojo.

No, no tengo licencia.



(10-11-2009 13:38:03 GMT)

SProces v4.2 (c)2009 S.G.H. / Satinfo S.L.

-------------------------------------------

Sistema Operativo: Microsoft Windows XP (v5.1.2600) Service Pack 3

Parche MS08-067 (Servicio Servidor) Instalado.

Internet Explorer: (v7.0.5730.13) 0

Nombre Equipo: PC-8FBE3EEB9BB2

Nombre Usuario: Pc



Procesos Activos:

C:\WINDOWS\SYSTEM32\SMSS.EXE

C:\WINDOWS\SYSTEM32\WINLOGON.EXE

C:\WINDOWS\SYSTEM32\SERVICES.EXE

C:\WINDOWS\SYSTEM32\LSASS.EXE

C:\WINDOWS\SYSTEM32\SVCHOST.EXE

C:\WINDOWS\SYSTEM32\SVCHOST.EXE

C:\WINDOWS\SYSTEM32\SPOOLSV.EXE

C:\ARCHIVOS DE PROGRAMA\ARCHIVOS COMUNES\APPLE\MOBILE DEVICE SUPPORT\BIN\APPLEMOBILEDEVICESERVICE.EXE

C:\ARCHIVOS DE PROGRAMA\BONJOUR\MDNSRESPONDER.EXE

C:\ARCHIVOS DE PROGRAMA\ARCHIVOS COMUNES\EPSON\EBAPI\SAGENT2.EXE

C:\ARCHIVOS DE PROGRAMA\SYMANTEC\NORTON GHOST 2003\GHOSTSTARTSERVICE.EXE

C:\ARCHIVOS DE PROGRAMA\JAVA\JRE6\BIN\JQS.EXE

C:\ARCHIVOS DE PROGRAMA\ARCHIVOS COMUNES\MICROSOFT SHARED\VS7DEBUG\MDM.EXE

C:\WINDOWS\SYSTEM32\SVCHOST.EXE

C:\WINDOWS\SYSTEM32\NVSVC32.EXE

C:\ARCHIVOS DE PROGRAMA\ELECTRONIC ARTS\MEDAL OF HONOR AIRBORNE\UNREALENGINE3\MOHAGAME\PB\PNKBSTRA.EXE

C:\ARCHIVOS DE PROGRAMA\CYBERLINK\SHARED FILES\RICHVIDEO.EXE

C:\ARCHIVOS DE PROGRAMA\MICROSOFT\SEARCH ENHANCEMENT PACK\SEAPORT\SEAPORT.EXE

C:\WINDOWS\SYSTEM32\SVCHOST.EXE

C:\WINDOWS\SYSTEM32\WBEM\WMIAPSRV.EXE

C:\WINDOWS\EXPLORER.EXE

C:\ARCHIVOS DE PROGRAMA\JAVA\JRE6\BIN\JUSCHED.EXE

C:\WINDOWS\SYSTEM32\RUNDLL32.EXE

C:\ARCHIVOS DE PROGRAMA\ARCHIVOS COMUNES\REAL\UPDATE_OB\REALSCHED.EXE

C:\WINDOWS\SYSTEM32\READER_S.EXE

C:\ARCHIVOS DE PROGRAMA\MICROSOFT STUDENT\MICROSOFT STUDENT CON ENCARTA PREMIUM 2009 DVD\EDICT.EXE

C:\WINDOWS\SYSTEM32\CTFMON.EXE

C:\DOCUMENTS AND SETTINGS\PC\READER_S.EXE

C:\ARCHIVOS DE PROGRAMA\TASKSWITCHXP\TASKSWITCHXP.EXE

C:\ARCHIVOS DE PROGRAMA\HUAWEI TECHNOLOGIES\HUAWEI SMARTAX MT810\DSLMON.EXE

C:\ARCHIVOS DE PROGRAMA\KODAK\KODAK SOFTWARE UPDATER\7288971\PROGRAM\KODAK SOFTWARE UPDATER.EXE

C:\ARCHIVOS DE PROGRAMA\MCAFEE SECURITY SCAN\1.0.150\SSSCHEDULER.EXE

C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\E_S10IC2.EXE

C:\ARCHIVOS DE PROGRAMA\MOZILLA FIREFOX\FIREFOX.EXE

C:\WINDOWS\SYSTEM32\SVCHOST.EXE

C:\WINDOWS\SYSTEM32\SVCHOST.EXE

C:\WINDOWS\SYSTEM32\SVCHOST.EXE

C:\DOCUMENTS AND SETTINGS\PC\MIS DOCUMENTOS\DESCARGAS\SPROCES.EXE



R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com.ar/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

R3 - URLSearchHook: Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\system32\ieframe.dll

R3 - URLSearchHook: Barra Yahoo! - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Archivos de programa\Yahoo!\Companion\Installs\cpn\yt.dll

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,

O1 - Hosts: 127.0.0.1 localhost

O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Archivos de programa\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: (no name) - {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - (no file)

O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Archivos de programa\AskBarDis\bar\bin\askBar.dll

O2 - BHO: (no name) - {5c255c8a-e604-49b4-9d64-90988571cecb} - (no file)

O2 - BHO: Search Helper - {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - C:\Archivos de programa\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll

O2 - BHO: Windows Live Aplicación auxiliar de inicio de sesión - {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Archivos de programa\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll

O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Archivos de programa\Java\jre6\bin\jp2ssv.dll

O2 - BHO: Windows Live Toolbar Helper - {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - C:\Archivos de programa\Windows Live\Toolbar\wltcore.dll

O2 - BHO: JQSIEStartDetectorImpl Class - {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - C:\Archivos de programa\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Archivos de programa\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll

O3 - Toolbar: Barra Yahoo! - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Archivos de programa\Yahoo!\Companion\Installs\cpn\yt.dll

O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Archivos de programa\AskBarDis\bar\bin\askBar.dll

O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Archivos de programa\Windows Live\Toolbar\wltcore.dll

O4 - HKCU\..\Run: [L09EXLRD_153234] "C:\Archivos de programa\Microsoft Student\Microsoft Student con Encarta Premium 2009 DVD\EDICT.EXE" -m

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [ares] "C:\Archivos de programa\Ares\Ares.exe" -h

O4 - HKCU\..\Run: [reader_s] C:\Documents and Settings\Pc\reader_s.exe

O4 - HKCU\..\Run: [TaskSwitchXP] C:\Archivos de programa\TaskSwitchXP\TaskSwitchXP.exe

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Archivos de programa\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [TkBellExe] "C:\Archivos de programa\Archivos comunes\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [QuickTime Task] "C:\Archivos de programa\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [Ink Monitor] C:\Archivos de programa\EPSON\Ink Monitor\InkMonitor.exe

O4 - HKLM\..\Run: [reader_s] C:\WINDOWS\System32\reader_s.exe

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Archivos de programa\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - Global Startup: DSLMON.lnk

O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk

O4 - Global Startup: KODAK Software Updater.lnk

O4 - Global Startup: McAfee Security Scan.lnk

O4 - Global Startup: Software Kodak EasyShare.lnk

O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Agregar entrada - {219c3416-8cb2-491a-a3c7-d9fcddc9d600} - C:\Archivos de programa\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: Referencia - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARCHIV~1\MICROS~3\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Barra de búsqueda de Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: C:\ARCHIVOS DE PROGRAMA\BONJOUR\MDNSNSP.DLL

O16 - DPF: {8ad9c840-044e-11d1-b3e9-00805f499d93} (Java Plug-in 1.6.0_13) - http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab

O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} (Java Plug-in 1.6.0_07) - http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab

O16 - DPF: {cafeefac-0016-0000-0013-abcdeffedcba} (Java Plug-in 1.6.0_13) - http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{FC0016C2-75C9-4338-884A-55D821A4E870}: NameServer = 200.45.191.35 200.45.48.233

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARCHIV~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL

O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\Information Retrieval\msitss.dll

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARCHIV~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL

O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\ARCHIV~1\ARCHIV~1\MICROS~1\WEBCOM~1\10\OWC10.DLL

O18 - Protocol: mso-offdap11 - {32505114-5902-49B2-880A-1F7738E5A384} - C:\ARCHIV~1\ARCHIV~1\MICROS~1\WEBCOM~1\11\OWC11.DLL

O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Archivos de programa\Windows Live\Mail\mailcomm.dll

O20 - Winlogon Notify: DIMSNTFY - %SYSTEMROOT%\SYSTEM32\DIMSNTFY.DLL

O20 - Winlogon Notify: IGFXCUI - IGFXDEV.DLL

O20 - Winlogon Notify: WGALOGON - WGALOGON.DLL

O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - %SystemRoot%\system32\SHELL32.dll

O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - %SystemRoot%\system32\SHELL32.dll

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\system32\webcheck.dll

O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINDOWS\system32\stobject.dll

O22 - SharedTaskScheduler: {438755C2-A8BA-11D1-B96B-00A0C90312E1} - Precargador Browseui - %SystemRoot%\system32\browseui.dll

O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Demonio de caché de las categorías de componente - %SystemRoot%\system32\browseui.dll



Información Adicional:

----------------------

Clave "HKLM\...\Image File Execution Options\a2service.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\ArcaCheck.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\arcavir.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\ashDisp.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\ashEnhcd.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\ashServ.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\ashUpd.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\aswUpdSv.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\autoruns.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\avadmin.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\avcenter.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\avcls.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\avconfig.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\avconsol.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\avgnt.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\avgrssvc.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\avguard.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\AvMonitor.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\avp.com"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\avp.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\AVP32.EXE"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\avscan.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\avz.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\avz4.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\avz_se.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\bdagent.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\bdinit.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\caav.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\caavguiscan.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\casecuritycenter.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\CCenter.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\ccupdate.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\cfp.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\cfpupdat.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\cmdagent.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\drwadins.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\DRWEB32.EXE"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\drwebupw.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\ekrn.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\FAMEH32.EXE"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\filemon.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\FPAVServer.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\fpscan.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\FPWin.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\fsav32.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\fsgk32st.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\FSMA32.EXE"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\GFRing3.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\guardgui.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\guardxservice.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\guardxup.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\HijackThis.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\KASMain.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\KASTask.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\KAV32.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\KAVDX.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\KAVPF.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\KAVPFW.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\KAVStart.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\KPFW32.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\KPFW32X.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\Navapsvc.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\Navapw32.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\navigator.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\NAVNT.EXE"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\NAVSTUB.EXE"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\NAVW32.EXE"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\NAVWNT.EXE"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\niu.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\nod32.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\nod32krn.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\Nvcc.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\OllyDBG.EXE"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\outpost.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\preupd.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\procexp.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\pskdr.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\regedit.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\regmon.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\RegTool.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\scan32.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\SfFnUp.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\Vba32arkit.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\vba32ldr.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\vsserv.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\Zanda.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\zapro.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\Zlh.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\zonealarm.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\zoneband.dll"

"Debugger"="ntsd -d"



Listado de Servicios (Carga Automatica):

----------------------------------------

O23 - Service: General Purpose USB Driver (adildr.sys) (ADILOADER) - Analog Deivces - C:\WINDOWS\SYSTEM32\Drivers\adildr.sys

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Archivos de programa\Archivos comunes\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Servicio Bonjour (Bonjour Service) - Apple Inc. - C:\Archivos de programa\Bonjour\mDNSResponder.exe

**O23 - Service: Iniciador de procesos de servidor DCOM (DcomLaunch) - Unknown owner - C:\WINDOWS\system32\svchost -k DcomLaunch (file missing)

O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Archivos de programa\Archivos comunes\EPSON\EBAPI\SAgent2.exe

O23 - Service: GhostStartService - Symantec Corporation - C:\Archivos de programa\Symantec\Norton Ghost 2003\GhostStartService.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Archivos de programa\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Java Quick Starter (javaquickstarterservice) - Unknown owner - C:\Archivos de programa\Java\jre6\bin\jqs.exe" -service -config "C:\Archivos de programa\Java\jre6\lib\deploy\jqs\jqs.con (file missing)

O23 - Service: Medios de almacenamiento extraíbles NtmsSvcaspnet_state (NtmsSvcaspnet_state) - Unknown owner - C:\WINDOWS\system32\actmovieb.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PunkBuster (PnkBstrA) - Unknown owner - C:\Archivos de programa\Electronic Arts\Medal of Honor Airborne\UnrealEngine3\MOHAGame\pb\PnkBstrA.exe

O23 - Service: DiRT Drivers Auto Removal (pr2ah4nb) (pr2ah4nb) - CODEMASTERS - C:\WINDOWS\system32\pr2ah4nb.exe

O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Archivos de programa\CyberLink\Shared Files\RichVideo.exe

**O23 - Service: Llamada a procedimiento remoto (RPC) (RpcSs) - Unknown owner - C:\WINDOWS\system32\svchost -k rpcss (file missing)

O23 - Service: SeaPort (seaport) - Microsoft Corp. - C:\Archivos de programa\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe



Listado de Servicios (Carga Manual):

------------------------------------

O23 - Service: USB ADSL WAN Adapter (adiusbaw) - Analog Devices Inc. - C:\WINDOWS\SYSTEM32\DRIVERS\adiusbaw.sys

O23 - Service: NDIS Miniport Driver for Attansic L2 Fast Ethernet Controller (AtcL002) - Attansic Technology corporation. - C:\WINDOWS\SYSTEM32\DRIVERS\atl02_xp.sys

**O23 - Service: Servicio del administrador de discos lógicos (dmadmin) - Microsoft Corp., VERITAS Software - C:\WINDOWS\System32\dmadmin.exe

O23 - Service: Eplpdx02 - MK Systems CO., LTD. - C:\WINDOWS\system32\Drivers\EPLPDX02.SYS

O23 - Service: GEAR ASPI Filter Driver (GEARAspiWDM) - GEAR Software Inc. - C:\WINDOWS\SYSTEM32\Drivers\GEARAspiWDM.sys

O23 - Service: Controlador de bus de Microsoft UAA para High Definition Audio (HDAudBus) - Windows (R) Server 2003 DDK provider - C:\WINDOWS\SYSTEM32\DRIVERS\HDAudBus.sys

O23 - Service: ialm - Intel Corporation - C:\WINDOWS\SYSTEM32\DRIVERS\igxpmp32.sys

O23 - Service: Service for Realtek HD Audio (WDM) (IntcAzAudAddService) - Realtek Semiconductor Corp. - C:\WINDOWS\SYSTEM32\drivers\RtkHDAud.sys

O23 - Service: Servicio del iPod (iPod Service) - Apple Inc. - C:\Archivos de programa\iPod\bin\iPodService.exe

O23 - Service: ATK0110 ACPI UTILITY (MTsensor) - Unknown owner - C:\WINDOWS\SYSTEM32\DRIVERS\ASACPI.sys

O23 - Service: NBService - Nero AG - C:\Archivos de programa\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Archivos de programa\Archivos comunes\Ahead\Lib\NMIndexingService.exe

O23 - Service: nv - NVIDIA Corporation - C:\WINDOWS\SYSTEM32\DRIVERS\nv4_mini.sys

O23 - Service: Motorola USB Device (p2k) - Motorola Inc - C:\WINDOWS\SYSTEM32\DRIVERS\P2k.sys

O23 - Service: VSO Software pcouffin (pcouffin) - VSO Software - C:\WINDOWS\SYSTEM32\Drivers\pcouffin.sys

O23 - Service: Padus ASPI Shell (pfc) - Padus, Inc. - C:\WINDOWS\SYSTEM32\drivers\pfc.sys

O23 - Service: Controlador de vínculo paralelo directo (Ptilink) - Parallel Technologies, Inc. - C:\WINDOWS\SYSTEM32\DRIVERS\ptilink.sys

O23 - Service: Secdrv - Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K. - C:\WINDOWS\SYSTEM32\DRIVERS\secdrv.sys

*O23 - Service: Servicios de Terminal Server (TermService) - Unknown owner - C:\WINDOWS\System32\svchost -k DComLaunch (file missing)



Listado de Servicios (Deshabilitados):

--------------------------------------

**O23 - Service: dmboot - Microsoft Corp., Veritas Software - C:\WINDOWS\SYSTEM32\drivers\dmboot.sys



35 Servicios.

15 de Carga Automatica.

19 de Carga Manual.

1 Deshabilitados.

[msc hotline sat]

Gracias por su sinceridad, y aunque en este foro pedimos que se utilicen antivirus freeware si no se tiene icencia de uso de uno comercial, vamos a ayudarle, no sin antes recordarle que los programas con Copyright deben usarse con la correspondiente licencia de uso.



Vemos en el log la existencia de READER_S.EXE:





C:\WINDOWS\SYSTEM32\READER_S.EXE



C:\DOCUMENTS AND SETTINGS\PC\READER_S.EXE





Normalmente se trata de un troyano que si el ELISTARA no elimina, pedirá muestras para analizar, por lo que proceda a descargar y probar dicha utilidad:




[quote]
[b] ELISTARA: [/b]

http://www.zonavirus.com/descargas/elistara.asp



Tras probarlo, reiniciar y postearnos el contenido de C:\infosat.txt para ver el resultado del proceso
[/quote]



Ademas, vemos este otro fichero, que aunque no pidiera muestras, envienoslo para analizar, pues es probable que sea un gusano:



C:\WINDOWS\system32\actmovieb.exe



segun:



http://www.prevx.com/filenames/118593160144326578-X1/ACTIVEDSM.EXE.html





Ademas, todas estas claves son propias de la accion de un troyano:



Clave "HKLM\...\Image File Execution Options\a2service.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\ArcaCheck.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\arcavir.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\ashDisp.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\ashEnhcd.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\ashServ.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\ashUpd.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\aswUpdSv.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\autoruns.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\avadmin.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\avcenter.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\avcls.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\avconfig.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\avconsol.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\avgnt.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\avgrssvc.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\avguard.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\AvMonitor.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\avp.com"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\avp.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\AVP32.EXE"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\avscan.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\avz.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\avz4.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\avz_se.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\bdagent.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\bdinit.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\caav.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\caavguiscan.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\casecuritycenter.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\CCenter.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\ccupdate.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\cfp.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\cfpupdat.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\cmdagent.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\drwadins.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\DRWEB32.EXE"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\drwebupw.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\ekrn.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\FAMEH32.EXE"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\filemon.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\FPAVServer.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\fpscan.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\FPWin.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\fsav32.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\fsgk32st.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\FSMA32.EXE"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\GFRing3.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\guardgui.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\guardxservice.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\guardxup.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\HijackThis.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\KASMain.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\KASTask.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\KAV32.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\KAVDX.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\KAVPF.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\KAVPFW.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\KAVStart.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\KPFW32.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\KPFW32X.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\Navapsvc.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\Navapw32.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\navigator.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\NAVNT.EXE"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\NAVSTUB.EXE"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\NAVW32.EXE"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\NAVWNT.EXE"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\niu.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\nod32.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\nod32krn.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\Nvcc.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\OllyDBG.EXE"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\outpost.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\preupd.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\procexp.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\pskdr.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\regedit.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\regmon.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\RegTool.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\scan32.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\SfFnUp.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\Vba32arkit.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\vba32ldr.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\vsserv.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\Zanda.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\zapro.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\Zlh.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\zonealarm.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\zoneband.dll"

"Debugger"="ntsd -d"





espero que el ELISTARA ya las eliminará, pues de lo contrario dichos ficheros quedarían sin poder ejecutarse !





A todos los ficheros pedidos para analizar, les puede añadir .VIR a su extension para que no se pongan en marcha a partir del siguiente reinicio.







[b]¿Como enviar las muestras a zonavirus? - Para ello recordar[/b]:

https://foros.zonavirus.com/viewtopic.php?f=5&t=14253





Tras recibir el/los fichero/s, lo/s analizaremos e implementaremos su control y eliminacion, si procede, en nuestras utilidades, de lo cual informaremos





saludos



ms, 10-11-2009

[Negrocjs]

[quote="msc hotline sat"]


A todos los ficheros pedidos para analizar, les puede añadir .VIR a su extension para que no se pongan en marcha a partir del siguiente reinicio.




[/quote]

El ELISTARA me elimino el troyano, muchas gracias....



En cuanto a lo que cite no entendi bien lo que me quisieron decir, soy bastante novato en estas cosas.

Por otro lado ya les estoy enviendo el fichero que me pidieron para analizar...

De verdad muchas gracias, creo que a ese troyano lo pezque del foro de la pagina de Infiernorojo.com creo que esta infectado.

[msc hotline sat]

Bueno, el ELISTARA ya habrá hecho faena, dinos si persiste la anomalia, y cuando mañana recibamos la muestra pedida, la analizaremos e informaremos



(Ahora ya son las 18:45 en España y SATINFO ya está cerrada)



saludos



ms, 10-11-2009

[Negrocjs]

Sigue, llega hasta ahi y no puede continuar.

[msc hotline sat]

SI has enviado la muestra pedida, hoy la recibiremos y, tras analizarla, informaremos.



Aparte, vuelve a probar el SPROCES y mientras esperamos, posteanos el ACTUAL informe resultante, a ver como ha quedado tras el ELISTARA.



saludos



ms, 11-11-2009

[msc hotline sat]

Recibida muestra, no se aprecian rutinas víricas.



Esperamos nos postees en nuevo informe del SPROCES, segun pedido.



saludos



ms, 11-11-2009

[Negrocjs]

(13-11-2009 01:32:18 GMT)

SProces v4.2 (c)2009 S.G.H. / Satinfo S.L.

-------------------------------------------

Sistema Operativo: Microsoft Windows XP (v5.1.2600) Service Pack 3

Parche MS08-067 (Servicio Servidor) Instalado.

Internet Explorer: (v7.0.5730.13) 0

Nombre Equipo: PC-8FBE3EEB9BB2

Nombre Usuario: Pc



Procesos Activos:

C:\WINDOWS\SYSTEM32\SMSS.EXE

C:\WINDOWS\SYSTEM32\WINLOGON.EXE

C:\WINDOWS\SYSTEM32\SERVICES.EXE

C:\WINDOWS\SYSTEM32\LSASS.EXE

C:\WINDOWS\SYSTEM32\SVCHOST.EXE

C:\WINDOWS\SYSTEM32\SVCHOST.EXE

C:\WINDOWS\SYSTEM32\SPOOLSV.EXE

C:\ARCHIVOS DE PROGRAMA\ARCHIVOS COMUNES\APPLE\MOBILE DEVICE SUPPORT\BIN\APPLEMOBILEDEVICESERVICE.EXE

C:\ARCHIVOS DE PROGRAMA\BONJOUR\MDNSRESPONDER.EXE

C:\ARCHIVOS DE PROGRAMA\ARCHIVOS COMUNES\EPSON\EBAPI\SAGENT2.EXE

C:\ARCHIVOS DE PROGRAMA\SYMANTEC\NORTON GHOST 2003\GHOSTSTARTSERVICE.EXE

C:\ARCHIVOS DE PROGRAMA\JAVA\JRE6\BIN\JQS.EXE

C:\ARCHIVOS DE PROGRAMA\ARCHIVOS COMUNES\MICROSOFT SHARED\VS7DEBUG\MDM.EXE

C:\WINDOWS\SYSTEM32\NVSVC32.EXE

C:\WINDOWS\SYSTEM32\SVCHOST.EXE

C:\ARCHIVOS DE PROGRAMA\ELECTRONIC ARTS\MEDAL OF HONOR AIRBORNE\UNREALENGINE3\MOHAGAME\PB\PNKBSTRA.EXE

C:\ARCHIVOS DE PROGRAMA\CYBERLINK\SHARED FILES\RICHVIDEO.EXE

C:\ARCHIVOS DE PROGRAMA\MICROSOFT\SEARCH ENHANCEMENT PACK\SEAPORT\SEAPORT.EXE

C:\WINDOWS\SYSTEM32\SVCHOST.EXE

C:\WINDOWS\SYSTEM32\WBEM\WMIAPSRV.EXE

C:\WINDOWS\EXPLORER.EXE

C:\ARCHIVOS DE PROGRAMA\JAVA\JRE6\BIN\JUSCHED.EXE

C:\WINDOWS\SYSTEM32\RUNDLL32.EXE

C:\ARCHIVOS DE PROGRAMA\ARCHIVOS COMUNES\REAL\UPDATE_OB\REALSCHED.EXE

C:\ARCHIVOS DE PROGRAMA\ADOBE\READER 8.0\READER\READER_SL.EXE

C:\ARCHIVOS DE PROGRAMA\MICROSOFT STUDENT\MICROSOFT STUDENT CON ENCARTA PREMIUM 2009 DVD\EDICT.EXE

C:\WINDOWS\SYSTEM32\CTFMON.EXE

C:\ARCHIVOS DE PROGRAMA\TASKSWITCHXP\TASKSWITCHXP.EXE

C:\DOCUMENTS AND SETTINGS\PC\READER_S.EXE

C:\ARCHIVOS DE PROGRAMA\HUAWEI TECHNOLOGIES\HUAWEI SMARTAX MT810\DSLMON.EXE

C:\ARCHIVOS DE PROGRAMA\MCAFEE SECURITY SCAN\1.0.150\SSSCHEDULER.EXE

C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\E_S10IC2.EXE

C:\WINDOWS\SYSTEM32\IGFXSRVC.EXE

C:\ARCHIVOS DE PROGRAMA\MOZILLA FIREFOX\FIREFOX.EXE

C:\WINDOWS\SYSTEM32\SVCHOST.EXE

C:\WINDOWS\SYSTEM32\SVCHOST.EXE

C:\WINDOWS\SYSTEM32\SVCHOST.EXE

C:\DOCUMENTS AND SETTINGS\PC\MIS DOCUMENTOS\DESCARGAS\SPROCES.EXE



R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local (1)

R3 - URLSearchHook: Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\system32\ieframe.dll

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,

O1 - Hosts: 127.0.0.1 localhost

O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Archivos de programa\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: (no name) - {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - (no file)

O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Archivos de programa\AskBarDis\bar\bin\askBar.dll

O2 - BHO: (no name) - {5c255c8a-e604-49b4-9d64-90988571cecb} - (no file)

O2 - BHO: Search Helper - {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - C:\Archivos de programa\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll

O2 - BHO: Windows Live Aplicación auxiliar de inicio de sesión - {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Archivos de programa\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll

O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Archivos de programa\Java\jre6\bin\jp2ssv.dll

O2 - BHO: Windows Live Toolbar Helper - {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - C:\Archivos de programa\Windows Live\Toolbar\wltcore.dll

O2 - BHO: JQSIEStartDetectorImpl Class - {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - C:\Archivos de programa\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Archivos de programa\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll

O3 - Toolbar: Barra Yahoo! - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Archivos de programa\Yahoo!\Companion\Installs\cpn\yt.dll

O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Archivos de programa\AskBarDis\bar\bin\askBar.dll

O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Archivos de programa\Windows Live\Toolbar\wltcore.dll

O4 - HKCU\..\Run: [L09EXLRD_153234] "C:\Archivos de programa\Microsoft Student\Microsoft Student con Encarta Premium 2009 DVD\EDICT.EXE" -m

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [ares] "C:\Archivos de programa\Ares\Ares.exe" -h

O4 - HKCU\..\Run: [TaskSwitchXP] C:\Archivos de programa\TaskSwitchXP\TaskSwitchXP.exe

O4 - HKCU\..\Run: [reader_s] C:\Documents and Settings\Pc\reader_s.exe

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Archivos de programa\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [TkBellExe] "C:\Archivos de programa\Archivos comunes\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [QuickTime Task] "C:\Archivos de programa\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [Ink Monitor] C:\Archivos de programa\EPSON\Ink Monitor\InkMonitor.exe

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Archivos de programa\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [reader_s] C:\WINDOWS\System32\reader_s.exe

O4 - Global Startup: DSLMON.lnk

O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk

O4 - Global Startup: KODAK Software Updater.lnk

O4 - Global Startup: McAfee Security Scan.lnk

O4 - Global Startup: Software Kodak EasyShare.lnk

O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Agregar entrada - {219c3416-8cb2-491a-a3c7-d9fcddc9d600} - C:\Archivos de programa\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: Referencia - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARCHIV~1\MICROS~3\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Barra de búsqueda de Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: C:\ARCHIVOS DE PROGRAMA\BONJOUR\MDNSNSP.DLL

O16 - DPF: {8ad9c840-044e-11d1-b3e9-00805f499d93} (Java Plug-in 1.6.0_13) - http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab

O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} (Java Plug-in 1.6.0_07) - http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab

O16 - DPF: {cafeefac-0016-0000-0013-abcdeffedcba} (Java Plug-in 1.6.0_13) - http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{FC0016C2-75C9-4338-884A-55D821A4E870}: NameServer = 200.45.191.35 200.45.48.233

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARCHIV~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL

O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\Information Retrieval\msitss.dll

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARCHIV~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL

O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\ARCHIV~1\ARCHIV~1\MICROS~1\WEBCOM~1\10\OWC10.DLL

O18 - Protocol: mso-offdap11 - {32505114-5902-49B2-880A-1F7738E5A384} - C:\ARCHIV~1\ARCHIV~1\MICROS~1\WEBCOM~1\11\OWC11.DLL

O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Archivos de programa\Windows Live\Mail\mailcomm.dll

O20 - Winlogon Notify: DIMSNTFY - %SYSTEMROOT%\SYSTEM32\DIMSNTFY.DLL

O20 - Winlogon Notify: IGFXCUI - IGFXDEV.DLL

O20 - Winlogon Notify: WGALOGON - WGALOGON.DLL

O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - %SystemRoot%\system32\SHELL32.dll

O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - %SystemRoot%\system32\SHELL32.dll

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\system32\webcheck.dll

O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINDOWS\system32\stobject.dll

O22 - SharedTaskScheduler: {438755C2-A8BA-11D1-B96B-00A0C90312E1} - Precargador Browseui - %SystemRoot%\system32\browseui.dll

O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Demonio de caché de las categorías de componente - %SystemRoot%\system32\browseui.dll



Información Adicional:

----------------------

Clave "HKLM\...\Image File Execution Options\a2service.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\ArcaCheck.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\arcavir.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\ashDisp.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\ashEnhcd.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\ashServ.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\ashUpd.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\aswUpdSv.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\autoruns.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\avadmin.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\avcenter.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\avcls.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\avconfig.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\avconsol.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\avgnt.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\avgrssvc.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\avguard.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\AvMonitor.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\avp.com"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\avp.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\AVP32.EXE"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\avscan.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\avz.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\avz4.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\avz_se.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\bdagent.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\bdinit.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\caav.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\caavguiscan.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\casecuritycenter.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\CCenter.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\ccupdate.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\cfp.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\cfpupdat.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\cmdagent.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\drwadins.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\DRWEB32.EXE"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\drwebupw.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\ekrn.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\FAMEH32.EXE"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\filemon.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\FPAVServer.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\fpscan.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\FPWin.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\fsav32.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\fsgk32st.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\FSMA32.EXE"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\GFRing3.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\guardgui.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\guardxservice.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\guardxup.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\HijackThis.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\KASMain.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\KASTask.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\KAV32.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\KAVDX.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\KAVPF.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\KAVPFW.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\KAVStart.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\KPFW32.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\KPFW32X.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\Navapsvc.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\Navapw32.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\navigator.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\NAVNT.EXE"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\NAVSTUB.EXE"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\NAVW32.EXE"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\NAVWNT.EXE"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\niu.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\nod32.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\nod32krn.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\Nvcc.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\OllyDBG.EXE"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\outpost.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\preupd.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\procexp.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\pskdr.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\regedit.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\regmon.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\RegTool.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\scan32.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\SfFnUp.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\Vba32arkit.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\vba32ldr.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\vsserv.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\Zanda.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\zapro.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\Zlh.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\zonealarm.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\zoneband.dll"

"Debugger"="ntsd -d"



Listado de Servicios (Carga Automatica):

----------------------------------------

O23 - Service: General Purpose USB Driver (adildr.sys) (ADILOADER) - Analog Deivces - C:\WINDOWS\SYSTEM32\Drivers\adildr.sys

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Archivos de programa\Archivos comunes\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Servicio Bonjour (Bonjour Service) - Apple Inc. - C:\Archivos de programa\Bonjour\mDNSResponder.exe

**O23 - Service: Iniciador de procesos de servidor DCOM (DcomLaunch) - Unknown owner - C:\WINDOWS\system32\svchost -k DcomLaunch (file missing)

O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Archivos de programa\Archivos comunes\EPSON\EBAPI\SAgent2.exe

O23 - Service: GhostStartService - Symantec Corporation - C:\Archivos de programa\Symantec\Norton Ghost 2003\GhostStartService.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Archivos de programa\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Java Quick Starter (javaquickstarterservice) - Unknown owner - C:\Archivos de programa\Java\jre6\bin\jqs.exe" -service -config "C:\Archivos de programa\Java\jre6\lib\deploy\jqs\jqs.con (file missing)

**O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Archivos de programa\Lavasoft\Ad-Aware\AAWService.exe

O23 - Service: Medios de almacenamiento extraíbles NtmsSvcaspnet_state (NtmsSvcaspnet_state) - Unknown owner - C:\WINDOWS\system32\actmovieb.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PunkBuster (PnkBstrA) - Unknown owner - C:\Archivos de programa\Electronic Arts\Medal of Honor Airborne\UnrealEngine3\MOHAGame\pb\PnkBstrA.exe

O23 - Service: DiRT Drivers Auto Removal (pr2ah4nb) (pr2ah4nb) - CODEMASTERS - C:\WINDOWS\system32\pr2ah4nb.exe

O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Archivos de programa\CyberLink\Shared Files\RichVideo.exe

**O23 - Service: Llamada a procedimiento remoto (RPC) (RpcSs) - Unknown owner - C:\WINDOWS\system32\svchost -k rpcss (file missing)

O23 - Service: SeaPort (seaport) - Microsoft Corp. - C:\Archivos de programa\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe



Listado de Servicios (Carga Manual):

------------------------------------

O23 - Service: USB ADSL WAN Adapter (adiusbaw) - Analog Devices Inc. - C:\WINDOWS\SYSTEM32\DRIVERS\adiusbaw.sys

O23 - Service: NDIS Miniport Driver for Attansic L2 Fast Ethernet Controller (AtcL002) - Attansic Technology corporation. - C:\WINDOWS\SYSTEM32\DRIVERS\atl02_xp.sys

O23 - Service: ddsxeiservice2 (ddsxeiservice) - Unknown owner - C:\Archivos de programa\sXe Injected\ddsxei.sys

**O23 - Service: Servicio del administrador de discos lógicos (dmadmin) - Microsoft Corp., VERITAS Software - C:\WINDOWS\System32\dmadmin.exe

O23 - Service: Eplpdx02 - MK Systems CO., LTD. - C:\WINDOWS\system32\Drivers\EPLPDX02.SYS

O23 - Service: GEAR ASPI Filter Driver (GEARAspiWDM) - GEAR Software Inc. - C:\WINDOWS\SYSTEM32\Drivers\GEARAspiWDM.sys

O23 - Service: Controlador de bus de Microsoft UAA para High Definition Audio (HDAudBus) - Windows (R) Server 2003 DDK provider - C:\WINDOWS\SYSTEM32\DRIVERS\HDAudBus.sys

O23 - Service: ialm - Intel Corporation - C:\WINDOWS\SYSTEM32\DRIVERS\igxpmp32.sys

O23 - Service: Service for Realtek HD Audio (WDM) (IntcAzAudAddService) - Realtek Semiconductor Corp. - C:\WINDOWS\SYSTEM32\drivers\RtkHDAud.sys

O23 - Service: Servicio del iPod (iPod Service) - Apple Inc. - C:\Archivos de programa\iPod\bin\iPodService.exe

O23 - Service: ATK0110 ACPI UTILITY (MTsensor) - Unknown owner - C:\WINDOWS\SYSTEM32\DRIVERS\ASACPI.sys

O23 - Service: NBService - Nero AG - C:\Archivos de programa\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Archivos de programa\Archivos comunes\Ahead\Lib\NMIndexingService.exe

O23 - Service: nv - NVIDIA Corporation - C:\WINDOWS\SYSTEM32\DRIVERS\nv4_mini.sys

O23 - Service: Motorola USB Device (p2k) - Motorola Inc - C:\WINDOWS\SYSTEM32\DRIVERS\P2k.sys

O23 - Service: VSO Software pcouffin (pcouffin) - VSO Software - C:\WINDOWS\SYSTEM32\Drivers\pcouffin.sys

O23 - Service: Padus ASPI Shell (pfc) - Padus, Inc. - C:\WINDOWS\SYSTEM32\drivers\pfc.sys

O23 - Service: Controlador de vínculo paralelo directo (Ptilink) - Parallel Technologies, Inc. - C:\WINDOWS\SYSTEM32\DRIVERS\ptilink.sys

O23 - Service: Secdrv - Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K. - C:\WINDOWS\SYSTEM32\DRIVERS\secdrv.sys

*O23 - Service: Servicios de Terminal Server (TermService) - Unknown owner - C:\WINDOWS\System32\svchost -k DComLaunch (file missing)



Listado de Servicios (Deshabilitados):

--------------------------------------

**O23 - Service: dmboot - Microsoft Corp., Veritas Software - C:\WINDOWS\SYSTEM32\drivers\dmboot.sys



37 Servicios.

16 de Carga Automatica.

20 de Carga Manual.

1 Deshabilitados.

[msc hotline sat]

Pues vemos un malware activo en tu ordenador:



C:\DOCUMENTS AND SETTINGS\PC\READER_S.EXE



envianos muestra de dicho fichero para analizar, o mejor prueba el ELISTARA que si lo conoce ya procederá con él y si no lo aparcará en C:\muestras desde donde poder enviarnoslo.


[quote="para DESCARGAR el ELISTARA, msc"] http://www.zonavirus.com/descargas/elistara.asp



Tras probarlo, reiniciar y postearnos el contenido de C:\infosat.txt para ver el resultado del proceso [/quote]



y voluntaria o involuntariamente, tienes instalado un proxy:



R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local (1)



confirmanos este último punto





y en el regiustro vemos tambien



O4 - HKCU\..\Run: [reader_s] C:\Documents and Settings\Pc\reader_s.exe



O4 - HKLM\..\Run: [reader_s] C:\WINDOWS\System32\reader_s.exe



que son maliciosas, y de ellas se encargará el ELISTARA.





y todos estas claves de debuguer son propias de troyanos:


[quote]
Clave "HKLM\...\Image File Execution Options\a2service.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\ArcaCheck.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\arcavir.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\ashDisp.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\ashEnhcd.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\ashServ.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\ashUpd.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\aswUpdSv.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\autoruns.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\avadmin.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\avcenter.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\avcls.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\avconfig.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\avconsol.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\avgnt.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\avgrssvc.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\avguard.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\AvMonitor.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\avp.com"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\avp.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\AVP32.EXE"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\avscan.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\avz.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\avz4.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\avz_se.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\bdagent.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\bdinit.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\caav.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\caavguiscan.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\casecuritycenter.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\CCenter.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\ccupdate.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\cfp.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\cfpupdat.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\cmdagent.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\drwadins.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\DRWEB32.EXE"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\drwebupw.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\ekrn.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\FAMEH32.EXE"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\filemon.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\FPAVServer.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\fpscan.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\FPWin.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\fsav32.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\fsgk32st.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\FSMA32.EXE"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\GFRing3.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\guardgui.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\guardxservice.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\guardxup.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\HijackThis.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\KASMain.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\KASTask.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\KAV32.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\KAVDX.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\KAVPF.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\KAVPFW.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\KAVStart.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\KPFW32.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\KPFW32X.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\Navapsvc.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\Navapw32.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\navigator.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\NAVNT.EXE"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\NAVSTUB.EXE"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\NAVW32.EXE"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\NAVWNT.EXE"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\niu.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\nod32.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\nod32krn.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\Nvcc.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\OllyDBG.EXE"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\outpost.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\preupd.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\procexp.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\pskdr.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\regedit.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\regmon.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\RegTool.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\scan32.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\SfFnUp.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\Vba32arkit.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\vba32ldr.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\vsserv.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\Zanda.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\zapro.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\Zlh.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\zonealarm.exe"

"Debugger"="ntsd -d"

Clave "HKLM\...\Image File Execution Options\zoneband.dll"

"Debugger"="ntsd -d"
[/quote]





y envianos tambien este otro sospechoso:



C:\WINDOWS\system32\actmovieb.exe





[b]¿Como enviar las muestras a zonavirus? - Para ello recordar[/b]:

https://foros.zonavirus.com/viewtopic.php?f=5&t=14253



Tras recibirlos, los analizaremos e implementaremos su control y eliminacion, si procede, en nuestras utilidades, de lo cual informaremos



saludos



ms, 13-11-1009







NOTA: Al revisar post anteriores de este Tema, veo que es mas de lo mismo que ya habiamos dicho, asi que esperamos recibir las muestras pedidas, y en cuanto las recibamos, implementaremos su control y eliminacion, si procede, en nuestras utilidades, de lo cual informaremos. ms.

[Negrocjs]

Hola que tal, la verdad son muy amables....el ELISTARA elimino los troyanos nuevamente.



Lamentablemente no puede encontrar este fichero..

C:\WINDOWS\system32\actmovieb.exe



Utilize el buscador y nada, despues lo busque yo archivo por archivo y tampoco. Les repito soy medio amateur en esto si me pueden explicar otro metodo mas efectivo para encontralo les agradecere.

Encontre otro archivo pero actmovie.exe pero no debe ser ese.

[msc hotline sat]

No, el actmovie.exe es del sistema, el que te pedimos es el que lanza esta clave:



O23 - Service: Medios de almacenamiento extraíbles NtmsSvcaspnet_state (NtmsSvcaspnet_state) - Unknown owner - C:\WINDOWS\system32\actmovieb.exe



Prueba a ver si puedes con el ELIMOVER,



ELIMOVER

http://www.zonavirus.com/descargas/elimover.asp



cuando lo tengas, con un copiar y pegar le copias lo siguiente:



C:\WINDOWS\system32\actmovieb.exe



y si te dice que lo ha copiado, vas a C:\muestras y nos lo envias para analizar



pero el bicho gordo seguro es el C:\DOCUMENTS AND SETTINGS\PC\READER_S.EXE



Tras descargar ekl actual ELISTARA, posteanos el contenido de c:\infopsat.txt, gracias



saludos



ms, 14-11-2009

[mermera]

hola,



tuve el mismo problema



Yo he visto más información en:



[url]http://INTERCEPTADO



Pásate si quieres y echa un vistazo



Un placer conocerte



Si quieres metete en mi blog personal que tengo en [url]http://INTERCEPTADO

Salu2





lucl 19/11/09

[lucl]

Hola Mermera no se pueden poner enlaces de webs etc y mucho menos poner direcciones personales, por lo que intercepto las direcciones y te advierto que es conveniente revisar las normas, saludos



https://foros.zonavirus.com/viewtopic.php?f=1&t=17044



https://foros.zonavirus.com/viewtopic.php?f=1&t=119

[msc hotline sat]

Y veamos si negrocjs nos dice si con el actual ELISTARA le ha resuelto el problema, y lo podemos dar por solucionado, informanos en cualquier sentido.



y a mermera recordarle que de reincidir en incumplimiento de Normas, será desactivado de este foro, sin mas avisos.



saludos



ms, 20-11-2009

ref MA/Ano+35.13-3.58