http://tab.fastbrowsersearch.com (SOLUCIONADO)

[hbeltran7]

al abrir una nueva pestaña en el ie 8 aparece la pagina INTERVENIDO POR LUCL

https://foros.zonavirus.com/viewtopic.php?f=1&t=17044

. Segun me comentan entro con una aplicación Tattoodle on Facebook. no he podido eliminarlo. ayuda por favor





Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 02:07:30 p.m., on 23/12/2009

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v8.00 (8.00.6001.18865)

Boot mode: Normal



Running processes:

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Windows Defender\MSASCui.exe

C:\hp\support\hpsysdrv.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\HP\HP Software Update\hpwuSchd2.exe

C:\Program Files\Yahoo!\Common\YMailAdvisor.exe

C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe

C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe

C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe

C:\Program Files\SGPSA\ie3sh.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\PDFCreator\PDFCreator.exe

C:\Windows\System32\mobsync.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\hp\kbd\kbd.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe

C:\Windows\system32\Macromed\Flash\FlashUtil10d.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Windows\system32\wuauclt.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Users\Hollman\Heaven\software\1 Antivirus atispyware\SProces.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe



R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://co.yahoo.com/?fr=fp-yie8

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://espanol.yahoo.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=es_mx&c=84&bd=Pavilion&pf=cndt

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daxul.com/

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer proporcionado por Yahoo!

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - URLSearchHook: Barra Yahoo! - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll

R3 - URLSearchHook: SearchHelper Class - {91C18ED5-5E1C-4AE5-A148-A861DE8C8E16} - C:\Program Files\SGPSA\mtwb3sh.dll

O1 - Hosts: ::1 localhost

O1 - Hosts: 60.190.218.24 http://www.kavkiskey.com

O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll

O2 - BHO: Aplicación auxiliar de vínculos de Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: BrowserHelper Class - {8A9D74F9-560B-4FE7-ABEB-3B2E638E5CD6} - C:\Program Files\SGPSA\SearchAssistant.dll

O2 - BHO: Windows Live Aplicación auxiliar de inicio de sesión - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll

O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: Search Assistant - {F0626A63-410B-45E2-99A1-3F2475B2D695} - C:\Program Files\SGPSA\BHO.dll

O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\YTSingleInstance.dll

O3 - Toolbar: Barra Yahoo! - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll

O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe

O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KbdStub.EXE

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe

O4 - HKLM\..\Run: [DPService] "C:\Program Files\HP\DVDPlay\DPService.exe"

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [HP Software Update] c:\Program Files\HP\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [YMailAdvisor] "C:\Program Files\Yahoo!\Common\YMailAdvisor.exe"

O4 - HKLM\..\Run: [Google Quick Search Box] "C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe" /autorun

O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start

O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"

O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"

O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin

O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s

O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"

O4 - HKLM\..\Run: [FBSSA] C:\Program Files\SGPSA\ie3sh.exe

O4 - HKLM\..\Run: [Ink Monitor] C:\Program Files\EPSON\Ink Monitor\InkMonitor.exe

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

O4 - HKCU\..\Run: [HPAdvisor] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autorun=AUTORUN

O4 - HKCU\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup

O4 - HKCU\..\Run: [Search Protection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe

O4 - HKCU\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe

O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe

O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

O4 - HKUS\S-1-5-18\..\RunOnce: [] (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\RunOnce: [] (User 'Default user')

O4 - Global Startup: PDFCreator.lnk = C:\Program Files\PDFCreator\PDFCreator.exe

O8 - Extra context menu item: Agregar al componente Anti-Banners - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm

O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000

O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html

O9 - Extra button: Estadísticas de protección del tráfico Web - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL

O13 - Gopher Prefix:

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll

O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab

O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} (GMNRev Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/VistaMSNPUpldes-es.cab

O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll

O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe

O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

O23 - Service: LEC TranslateDotNet Server - Language Engineering Corporation, LLC - C:\Program Files\Power Translator 12\LogoMedia TranslateDotNet Server.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe

O23 - Service: Nero BackItUp Scheduler 4.0 - Unknown owner - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe (file missing)

O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\Super_DVD_Creator_9.8\NMSAccessU.exe

O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe

O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe

O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe



--

End of file - 11303 bytes





Gracias por la ayuda

[hbeltran7]

corri el SPROCES 4.3 pero al cerrar no me genera SProcLog.txt....

[lucl]

Te aseguraste de que no estaba en C verdad? Prueba si quieres este programa que te indico deberas hacerlo dandole privilegios de administrador por tratarse del vista, igual es por eso que no consigues el sproclog.txt. Prueba a pasarlo picando con el boton derecho del raton en el icono y darle los privilegios y a ver si asi consigues verlo. Cuando termines de pasar elistara peganos el log de Infosat.txt que tendras en C saludos





http://www.zonavirus.com/descargas/elistara.asp

[msc hotline sat]

y aun que no damos soporte al Vista, revisamos el log al sospechar de virus:



en el log vemos esta clave maliciosa, eliminela:



O1 - Hosts: 60.190.218.24 http://www.kavkiskey.com







y envianos estos ficheros para analizar:



C:\Program Files\SGPSA\BHO.dll



C:\Program Files\HP\DVDPlay\DPService.exe



C:\Program Files\SGPSA\ie3sh.exe







[b]¿Como enviar las muestras a zonavirus? - Para ello recordar[/b]:

https://foros.zonavirus.com/viewtopic.php?f=5&t=14253



Tras recibirlos, los analizaremos e implementaremos su control y eliminacion, si procede, en nuestras utilidades, de lo cual informaremos



saludos



ms, 24-12-1009









NOTA: y para desinstalar el buscador que indica en el título, vea:



http://help.fastbrowsersearch.com/uninstall.aspx



ms.

[hbeltran7]

corri corri el SPROCES 4.3 como administrador y genero el archivo de texto.



adjunto:





(24-12-2009 05:06:52 GMT)

SProces v4.3 (c)2009 S.G.H. / Satinfo S.L.

-------------------------------------------

Sistema Operativo: Windows Vista (TM) Home Basic (v6.0.6001)

Parche MS08-067 (Servicio Servidor) NO Instalado.

Internet Explorer: (v8.0.6001.18865) 0



Procesos Activos:

C:\WINDOWS\SYSTEM32\TASKENG.EXE

C:\WINDOWS\SYSTEM32\DWM.EXE

C:\WINDOWS\EXPLORER.EXE

C:\PROGRAM FILES\WINDOWS DEFENDER\MSASCUI.EXE

C:\HP\SUPPORT\HPSYSDRV.EXE

C:\WINDOWS\SYSTEM32\RUNDLL32.EXE

C:\PROGRAM FILES\JAVA\JRE6\BIN\JUSCHED.EXE

C:\PROGRAM FILES\HP\HP SOFTWARE UPDATE\HPWUSCHD2.EXE

C:\PROGRAM FILES\YAHOO!\COMMON\YMAILADVISOR.EXE

C:\PROGRAM FILES\GOOGLE\QUICK SEARCH BOX\GOOGLEQUICKSEARCHBOX.EXE

C:\PROGRAM FILES\COMMON FILES\INSTALLSHIELD\UPDATESERVICE\ISSCH.EXE

C:\PROGRAM FILES\YAHOO!\SEARCH PROTECTION\SEARCHPROTECTION.EXE

C:\PROGRAM FILES\LAVASOFT\AD-AWARE\AAWTRAY.EXE

C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 2009\AVP.EXE

C:\PROGRAM FILES\SGPSA\IE3SH.EXE

C:\PROGRAM FILES\WINDOWS SIDEBAR\SIDEBAR.EXE

C:\PROGRAM FILES\HEWLETT-PACKARD\HP ADVISOR\HPADVISOR.EXE

C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPNSCFG.EXE

C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBARNOTIFIER\GOOGLETOOLBARNOTIFIER.EXE

C:\PROGRAM FILES\PDFCREATOR\PDFCREATOR.EXE

C:\WINDOWS\SYSTEM32\MOBSYNC.EXE

C:\HP\KBD\KBD.EXE

C:\WINDOWS\SYSTEM32\WUAUCLT.EXE

C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE

C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE

C:\PROGRAM FILES\GOOGLE\GOOGLE TOOLBAR\GOOGLETOOLBARUSER_32.EXE

C:\WINDOWS\SYSTEM32\MACROMED\FLASH\FLASHUTIL10D.EXE

C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE

C:\WINDOWS\SYSTEM32\SEARCHFILTERHOST.EXE

C:\USERS\HOLLMAN\HEAVEN\SOFTWARE\1 ANTIVIRUS ATISPYWARE\SPROCES.EXE



R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://espanol.yahoo.com/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =

R3 - URLSearchHook: Barra Yahoo! - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll

R3 - URLSearchHook: (no name) - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)

R3 - URLSearchHook: SearchHelper Class - {91C18ED5-5E1C-4AE5-A148-A861DE8C8E16} - C:\Program Files\SGPSA\mtwb3sh.dll

F2 - REG:system.ini: UserInit=C:\Windows\system32\userinit.exe,

O1 - Hosts: 127.0.0.1 localhost

O1 - Hosts: ::1 localhost

O1 - Hosts: 60.190.218.24 www.kavkiskey.com

O1 - Hosts: 127.0.0.1 applian.securesites.com

O1 - Hosts: 127.0.0.1 applianorders.securesites.netO2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll

O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - (no file)

O2 - BHO: IEVkbdBHO Class - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: BrowserHelper Class - {8A9D74F9-560B-4FE7-ABEB-3B2E638E5CD6} - C:\Program Files\SGPSA\SearchAssistant.dll

O2 - BHO: Windows Live Aplicación auxiliar de inicio de sesión - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll

O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: Search Assistant - {F0626A63-410B-45E2-99A1-3F2475B2D695} - C:\Program Files\SGPSA\BHO.dll

O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\YTSingleInstance.dll

O3 - Toolbar: Barra Yahoo! - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll

O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

O4 - HKCU\..\Run: [HPAdvisor] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autorun=AUTORUN

O4 - HKCU\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup

O4 - HKCU\..\Run: [Search Protection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe

O4 - HKCU\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe

O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe

O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe

O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KbdStub.EXE

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe

O4 - HKLM\..\Run: [DPService] "C:\Program Files\HP\DVDPlay\DPService.exe"

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [HP Software Update] c:\Program Files\HP\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [YMailAdvisor] "C:\Program Files\Yahoo!\Common\YMailAdvisor.exe"

O4 - HKLM\..\Run: [Google Quick Search Box] "C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe" /autorun

O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start

O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"

O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"

O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin

O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s

O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"

O4 - HKLM\..\Run: [FBSSA] C:\Program Files\SGPSA\ie3sh.exe

O4 - HKLM\..\Run: [Ink Monitor] C:\Program Files\EPSON\Ink Monitor\InkMonitor.exe

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - Global Startup: PDFCreator.lnk

O8 - Extra context menu item: Agregar al componente Anti-Banners - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm

O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000

O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html

O9 - Extra button: Estadísticas de protección del tráfico Web - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL

O10 - Unknown file in Winsock LSP: C:\WINDOWS\SYSTEM32\NLAAPI.DLL

O10 - Unknown file in Winsock LSP: C:\WINDOWS\SYSTEM32\NAPINSP.DLL

O10 - Unknown file in Winsock LSP: C:\WINDOWS\SYSTEM32\PNRPNSP.DLL

O10 - Unknown file in Winsock LSP: C:\WINDOWS\SYSTEM32\PNRPNSP.DLL

O13 - Gopher Prefix: NULL2

O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/3/9/E39C664F-A8E3-4F69-A109-1AE9849204EE/OGAControl.cab

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll

O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab

O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} (GMNRev Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Plug-in 1.6.0_17) - http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} (Java Plug-in 1.6.0_01) - http://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab

O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} (Java Plug-in 1.6.0_17) - http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} (Java Plug-in 1.6.0_17) - http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/VistaMSNPUpldes-es.cab

O18 - Protocol hijack: about - (no CLSID) - (no file)

O18 - Protocol hijack: dvd - (no CLSID) - (no file)

O18 - Protocol hijack: its - (no CLSID) - (no file)

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

O18 - Protocol hijack: mhtml - (no CLSID) - (no file)

O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll

O18 - Protocol hijack: ms-its - (no CLSID) - (no file)

O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

O18 - Protocol hijack: tv - (no CLSID) - (no file)

O18 - Protocol hijack: vbscript - (no CLSID) - (no file)

O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll

O20 - Winlogon Notify: KLOGON - C:\WINDOWS\SYSTEM32\KLOGON.DLL

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - (no file)

O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - %SystemRoot%\system32\browseui.dll



Información Adicional:

----------------------

Clave "HKLM\...\Image File Execution Options\IEInstal.exe"

"Debugger"="NULL1"



Listado de Servicios (Carga Automatica):

----------------------------------------

O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe

*O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program Files\LogMeIn Hamachi\hamachi-2.exe

**O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

O23 - Service: LEC TranslateDotNet Server - Language Engineering Corporation, LLC - C:\Program Files\Power Translator 12\LogoMedia TranslateDotNet Server.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

O23 - Service: mdmxsdk - Conexant - C:\WINDOWS\SYSTEM32\DRIVERS\mdmxsdk.sys

O23 - Service: Nero BackItUp Scheduler 4.0 - Unknown owner - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe (file missing)

O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\Super_DVD_Creator_9.8\NMSAccessU.exe

O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvvsvc.exe

O23 - Service: XAudio - Conexant Systems, Inc. - C:\WINDOWS\SYSTEM32\DRIVERS\xaudio.sys

O23 - Service: XAudioService - Conexant Systems, Inc. - C:\WINDOWS\system32\DRIVERS\xaudio.exe

O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe



Listado de Servicios (Carga Manual):

------------------------------------

O23 - Service: PPdus ASPI Shell (Afc) - Unknown owner - C:\WINDOWS\SYSTEM32\drivers\Afc.sys (file missing)

O23 - Service: AnyDVD - SlySoft, Inc. - C:\WINDOWS\SYSTEM32\Drivers\AnyDVD.sys

O23 - Service: Brother USB Mass-Storage Lower Filter Driver (BrFiltLo) - Brother Industries, Ltd. - C:\WINDOWS\system32\drivers\brfiltlo.sys

O23 - Service: Brother USB Mass-Storage Upper Filter Driver (BrFiltUp) - Brother Industries, Ltd. - C:\WINDOWS\system32\drivers\brfiltup.sys

O23 - Service: Brother MFC USB Serial WDM Driver (BrUsbSer) - Brother Industries Ltd. - C:\WINDOWS\system32\drivers\brusbser.sys

O23 - Service: Intel(R) PRO/1000 NDIS 6 Adapter Driver (E1G60) - Intel Corporation - C:\WINDOWS\SYSTEM32\DRIVERS\E1G60I32.sys

O23 - Service: ElbyCDFL - SlySoft, Inc. - C:\WINDOWS\SYSTEM32\Drivers\ElbyCDFL.sys

O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Hamachi Network Interface (hamachi) - LogMeIn, Inc. - C:\WINDOWS\SYSTEM32\DRIVERS\hamachi.sys

O23 - Service: HSF_DP - Conexant Systems, Inc. - C:\WINDOWS\SYSTEM32\DRIVERS\HSX_DP.sys

O23 - Service: HSXHWBS3 - Conexant Systems, Inc. - C:\WINDOWS\SYSTEM32\DRIVERS\HSXHWBS3.sys

O23 - Service: Service for Realtek HD Audio (WDM) (IntcAzAudAddService) - Realtek Semiconductor Corp. - C:\WINDOWS\SYSTEM32\drivers\RTKVHDA.sys

O23 - Service: IP in IP Tunnel Driver (IpInIp) - Unknown owner - C:\WINDOWS\SYSTEM32\DRIVERS\ipinip.sys (file missing)

O23 - Service: Kaspersky Lab KLFltDev (KLFLTDEV) - Kaspersky Lab - C:\WINDOWS\SYSTEM32\DRIVERS\klfltdev.sys

O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe

O23 - Service: @%SystemRoot%\system32\msimsg.dll,-27 (msiserver) - Unknown owner - C:\WINDOWS\system32\msiexec /V (file missing)

O23 - Service: NetGroup Packet Filter Driver (NPF) - CACE Technologies - C:\WINDOWS\SYSTEM32\drivers\npf.sys

O23 - Service: NPPTNT2 - INCA Internet Co., Ltd. - C:\Windows\system32\npptNT2.sys

O23 - Service: NVIDIA nForce 10/100 Mbps Ethernet (NVENETFD) - NVIDIA Corporation - C:\WINDOWS\SYSTEM32\DRIVERS\nvmfdx32.sys

O23 - Service: nvlddmkm - NVIDIA Corporation - C:\WINDOWS\SYSTEM32\DRIVERS\nvlddmkm.sys

O23 - Service: IPX Traffic Filter Driver (NwlnkFlt) - Unknown owner - C:\WINDOWS\SYSTEM32\DRIVERS\nwlnkflt.sys (file missing)

O23 - Service: IPX Traffic Forwarder Driver (NwlnkFwd) - Unknown owner - C:\WINDOWS\SYSTEM32\DRIVERS\nwlnkfwd.sys (file missing)

O23 - Service: VSO Software pcouffin (pcouffin) - VSO Software - C:\WINDOWS\SYSTEM32\Drivers\pcouffin.sys

O23 - Service: PS2 (Ps2) - Hewlett-Packard Company - C:\WINDOWS\SYSTEM32\DRIVERS\PS2.sys

O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

O23 - Service: winachsf - Conexant Systems, Inc. - C:\WINDOWS\SYSTEM32\DRIVERS\HSX_CNXT.sys

O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)



Listado de Servicios (Deshabilitados):

--------------------------------------

O23 - Service: adp94xx - Adaptec, Inc. - C:\WINDOWS\system32\drivers\adp94xx.sys

O23 - Service: adpahci - Adaptec, Inc. - C:\WINDOWS\system32\drivers\adpahci.sys

O23 - Service: adpu160m - Adaptec, Inc. - C:\WINDOWS\system32\drivers\adpu160m.sys

O23 - Service: adpu320 - Adaptec, Inc. - C:\WINDOWS\system32\drivers\adpu320.sys

O23 - Service: aic78xx - Adaptec, Inc. - C:\WINDOWS\system32\drivers\djsvs.sys

O23 - Service: aliide - Acer Laboratories Inc. - C:\WINDOWS\system32\drivers\aliide.sys

O23 - Service: arc - Adaptec, Inc. - C:\WINDOWS\system32\drivers\arc.sys

O23 - Service: arcsas - Adaptec, Inc. - C:\WINDOWS\system32\drivers\arcsas.sys

O23 - Service: Brother MFC Serial Port Interface Driver (WDM) (Brserid) - Brother Industries Ltd. - C:\WINDOWS\system32\drivers\brserid.sys

O23 - Service: Brother WDM Serial driver (BrSerWdm) - Brother Industries Ltd. - C:\WINDOWS\system32\drivers\brserwdm.sys

O23 - Service: Brother MFC USB Fax Only Modem (BrUsbMdm) - Brother Industries Ltd. - C:\WINDOWS\system32\drivers\brusbmdm.sys

O23 - Service: cmdide - CMD Technology, Inc. - C:\WINDOWS\system32\drivers\cmdide.sys

O23 - Service: elxstor - Emulex - C:\WINDOWS\system32\drivers\elxstor.sys

O23 - Service: Servicio Google Update (gupdate1c9ca88e7ca1fff) (gupdate1c9ca88e7ca1fff) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: HpCISSs - Hewlett-Packard Company - C:\WINDOWS\system32\drivers\hpcisss.sys

O23 - Service: Intel RAID Controller Vista (iaStorV) - Intel Corporation - C:\WINDOWS\system32\drivers\iastorv.sys

O23 - Service: iirsp - Intel Corp./ICP vortex GmbH - C:\WINDOWS\system32\drivers\iirsp.sys

O23 - Service: ITEATAPI_Service_Install (iteatapi) - Integrated Technology Express, Inc. - C:\WINDOWS\system32\drivers\iteatapi.sys

O23 - Service: ITERAID_Service_Install (iteraid) - Integrated Technology Express, Inc. - C:\WINDOWS\system32\drivers\iteraid.sys

O23 - Service: LSI_FC - LSI Logic - C:\WINDOWS\system32\drivers\lsi_fc.sys

O23 - Service: LSI_SAS - LSI Logic - C:\WINDOWS\system32\drivers\lsi_sas.sys

O23 - Service: LSI_SCSI - LSI Logic - C:\WINDOWS\system32\drivers\lsi_scsi.sys

O23 - Service: megasas - LSI Corporation - C:\WINDOWS\system32\drivers\megasas.sys

O23 - Service: MegaSR - LSI Corporation, Inc. - C:\WINDOWS\system32\drivers\megasr.sys

O23 - Service: Mraid35x - LSI Logic Corporation - C:\WINDOWS\system32\drivers\mraid35x.sys

O23 - Service: nfrd960 - IBM Corporation - C:\WINDOWS\system32\drivers\nfrd960.sys

O23 - Service: N-trig HID Tablet Driver (ntrigdigi) - N-trig Innovative Technologies - C:\WINDOWS\system32\drivers\ntrigdigi.sys

O23 - Service: NVIDIA nForce RAID Driver (nvraid) - NVIDIA Corporation - C:\WINDOWS\system32\drivers\nvraid.sys

O23 - Service: nvsmu - NVIDIA Corporation - C:\WINDOWS\system32\drivers\nvsmu.sys

O23 - Service: nvstor - NVIDIA Corporation - C:\WINDOWS\system32\drivers\nvstor.sys

O23 - Service: QLogic Fibre Channel Miniport Driver (ql2300) - QLogic Corporation - C:\WINDOWS\system32\drivers\ql2300.sys

O23 - Service: QLogic iSCSI Miniport Driver (ql40xx) - QLogic Corporation - C:\WINDOWS\system32\drivers\ql40xx.sys

O23 - Service: SiSRaid4 - Silicon Integrated Systems - C:\WINDOWS\system32\drivers\sisraid4.sys

O23 - Service: Symc8xx - LSI Logic - C:\WINDOWS\system32\drivers\symc8xx.sys

O23 - Service: Sym_hi - LSI Logic - C:\WINDOWS\system32\drivers\sym_hi.sys

O23 - Service: Sym_u3 - LSI Logic - C:\WINDOWS\system32\drivers\sym_u3.sys

O23 - Service: uliahci - ULi Electronics Inc. - C:\WINDOWS\system32\drivers\uliahci.sys

O23 - Service: UlSata - Promise Technology, Inc. - C:\WINDOWS\system32\drivers\ulsata.sys

O23 - Service: ulsata2 - Promise Technology, Inc. - C:\WINDOWS\system32\drivers\ulsata2.sys

O23 - Service: viaide - VIA Technologies, Inc. - C:\WINDOWS\system32\drivers\viaide.sys

O23 - Service: vsmraid - VIA Technologies Inc.,Ltd - C:\WINDOWS\system32\drivers\vsmraid.sys



82 Servicios.

12 de Carga Automatica.

29 de Carga Manual.

41 Deshabilitados.





gracias

[msc hotline sat]

Pues de entrada vemos:



Parche MS08-067 (Servicio Servidor) NO Instalado.



Lance un windowsupdate e instale los parches que encuentre a faltar.





Por otro lado, y aparte de lo indicado anteriormente, elimine estas claves:



O1 - Hosts: 127.0.0.1 applian.securesites.com



O1 - Hosts: 127.0.0.1 applianorders.securesites.netO2



Edite el HOSTS y elimine dichas entradas



(EL fichero HOSTS está en C:\windows\system32\drivers\etc\HOSTS)









y añada a los ficheros a enviar, los siguientes :





C:\Program Files\SGPSA\mtwb3sh.dll



C:\Program Files\SGPSA\SearchAssistant.dll







saludos



ms, 24-12-2009

[msc hotline sat]

Analizadas las muestras recibidas:



El actual Elistara ya controla dos de las muestras que nos ha enviado (BHO.RAR y VIRUS.RAR), y una nueva variante (la del mtwb3sh.rar) la pasamos a controlar con el ELISTARA de hoy 19.96


[quote]
[b] ELISTARA: [/b]

http://www.zonavirus.com/descargas/elistara.asp



Tras probarlo, reiniciar y postearnos el contenido de C:\infosat.txt para ver el resultado del proceso
[/quote]





A partir de las 15 h GMT, estará disponible en esta web, para pruebas de evaluacion en el foro de zonavirus



saludos



ms, 24-12-2009

[hbeltran7]

Corri el elistar A pero sigue apareciendo la ventana en el IE8 tab.fastbrowsersearch.com

Adicionamente al inicar windows aparece la ventana:



ie3sh- no se puede encontarle componente.

Error al iniciar la aplicacion porque no se encontro BHO.DLL. La reinstalacion de la aplicacion puede solucionar el problema.



Ayuda por favor,





(25-12-2009 19:14:40 (GMT))

EliStartPage v19.96 (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 24 de Diciembre del 2009)

--------------------------------------------------

Lista de Acciones (por Acción Directa):

No ha sido posible abrir IERESET.INF

Eliminadas las Paginas de Inicio y de Busqueda del IE

Eliminados Ficheros Temporales del IE



(26-12-2009 1:43:46 (GMT))

EliStartPage v19.96 (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 24 de Diciembre del 2009)

--------------------------------------------------

Lista de Acciones (por Acción Directa):



(26-12-2009 1:44:19 (GMT))

EliStartPage v19.96 (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 24 de Diciembre del 2009)

--------------------------------------------------

Lista de Acciones (por Exploración):

Explorando "C:\"



Nº Total de Directorios: 151

Nº Total de Ficheros: 769

Nº de Ficheros Analizados: 116

Nº de Ficheros Infectados: 0

Nº de Ficheros Limpiados: 0

Exploración Detenida por el Usuario.



(28-12-2009 16:23:14 (GMT))

EliStartPage v19.96 (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 24 de Diciembre del 2009)

--------------------------------------------------

Lista de Acciones (por Acción Directa):



(28-12-2009 16:23:46 (GMT))

EliStartPage v19.96 (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 24 de Diciembre del 2009)

--------------------------------------------------

Lista de Acciones (por Exploración):

Explorando "C:\"

C:\Program Files\SGPSA\BHO.DLL.VIR.VIR --> Eliminado, AdWare.BHO.IFR

C:\Users\Hollman\Desktop\proyectos audioss\efectos\adobe audition 2 0 spanish-español con keygen\ADOBE AUDITION 2.0 KEYGEN.EXE --> Eliminado, KeyGen.SSG

C:\Users\Hollman\Heaven\libros\religioso\biblias electronicas\BIBLIA ELECTRONICA - e-Sword + Manual + Biblias + Diccionarios + Mapas (Buenisima)\BARCLAY.EXE --> Infectado, LowZones(dr)

C:\Users\Hollman\Heaven\libros\religioso\biblias electronicas\BIBLIA ELECTRONICA - e-Sword + Manual + Biblias + Diccionarios + Mapas (Buenisima)\BLA.EXE --> Infectado, LowZones(dr)

C:\Users\Hollman\Heaven\libros\religioso\biblias electronicas\BIBLIA ELECTRONICA - e-Sword + Manual + Biblias + Diccionarios + Mapas (Buenisima)\BPD.EXE --> Infectado, LowZones(dr)

C:\Users\Hollman\Heaven\libros\religioso\biblias electronicas\BIBLIA ELECTRONICA - e-Sword + Manual + Biblias + Diccionarios + Mapas (Buenisima)\CAMR.EXE --> Infectado, LowZones(dr)

C:\Users\Hollman\Heaven\libros\religioso\biblias electronicas\BIBLIA ELECTRONICA - e-Sword + Manual + Biblias + Diccionarios + Mapas (Buenisima)\CONCORDANCIA.EXE --> Infectado, LowZones(dr)

C:\Users\Hollman\Heaven\libros\religioso\biblias electronicas\BIBLIA ELECTRONICA - e-Sword + Manual + Biblias + Diccionarios + Mapas (Buenisima)\DLP.EXE --> Infectado, LowZones(dr)

C:\Users\Hollman\Heaven\libros\religioso\biblias electronicas\BIBLIA ELECTRONICA - e-Sword + Manual + Biblias + Diccionarios + Mapas (Buenisima)\EUNSA.EXE --> Infectado, LowZones(dr)

C:\Users\Hollman\Heaven\libros\religioso\biblias electronicas\BIBLIA ELECTRONICA - e-Sword + Manual + Biblias + Diccionarios + Mapas (Buenisima)\GEOGRAFIA.EXE --> Infectado, LowZones(dr)

C:\Users\Hollman\Heaven\libros\religioso\biblias electronicas\BIBLIA ELECTRONICA - e-Sword + Manual + Biblias + Diccionarios + Mapas (Buenisima)\JER.EXE --> Infectado, LowZones(dr)

C:\Users\Hollman\Heaven\libros\religioso\biblias electronicas\BIBLIA ELECTRONICA - e-Sword + Manual + Biblias + Diccionarios + Mapas (Buenisima)\MINI.EXE --> Infectado, LowZones(dr)

C:\Users\Hollman\Heaven\libros\religioso\biblias electronicas\BIBLIA ELECTRONICA - e-Sword + Manual + Biblias + Diccionarios + Mapas (Buenisima)\NM.EXE --> Infectado, LowZones(dr)

C:\Users\Hollman\Heaven\libros\religioso\biblias electronicas\BIBLIA ELECTRONICA - e-Sword + Manual + Biblias + Diccionarios + Mapas (Buenisima)\RV1865.EXE --> Infectado, LowZones(dr)

C:\Users\Hollman\Heaven\libros\religioso\biblias electronicas\BIBLIA ELECTRONICA - e-Sword + Manual + Biblias + Diccionarios + Mapas (Buenisima)\RV2000.EXE --> Infectado, LowZones(dr)

C:\Users\Hollman\Heaven\libros\religioso\biblias electronicas\BIBLIA ELECTRONICA - e-Sword + Manual + Biblias + Diccionarios + Mapas (Buenisima)\SCIO.EXE --> Infectado, LowZones(dr)

C:\Users\Hollman\Heaven\libros\religioso\biblias electronicas\BIBLIA ELECTRONICA - e-Sword + Manual + Biblias + Diccionarios + Mapas (Buenisima)\SEPTUAGINTA.EXE --> Infectado, LowZones(dr)

C:\Users\Hollman\Heaven\libros\religioso\biblias electronicas\BIBLIA ELECTRONICA - e-Sword + Manual + Biblias + Diccionarios + Mapas (Buenisima)\STRONGSPA.EXE --> Infectado, LowZones(dr)

C:\Users\Hollman\Heaven\libros\religioso\biblias electronicas\BIBLIA ELECTRONICA - e-Sword + Manual + Biblias + Diccionarios + Mapas (Buenisima)\TORAH.EXE --> Infectado, LowZones(dr)

C:\Users\Hollman\Heaven\software\! abby finereader 8 0 ita-eng-spa-fra+keygen\AbbY Finereader 8.0 Ita+Keygen\FR80PE_TB_EFSIP.EXE --> Infectado, LowZones(dr)



Nº Total de Directorios: 38972

Nº Total de Ficheros: 343681

Nº de Ficheros Analizados: 67084

Nº de Ficheros Infectados: 20

Nº de Ficheros Limpiados: 2





(28-12-2009 16:56:20 GMT)

SProces v4.3 (c)2009 S.G.H. / Satinfo S.L.

-------------------------------------------

Sistema Operativo: Windows Vista (TM) Home Basic (v6.0.6001)

Parche MS08-067 (Servicio Servidor) NO Instalado.

Internet Explorer: (v8.0.6001.18865) 0



Procesos Activos:

C:\WINDOWS\SYSTEM32\TASKENG.EXE

C:\WINDOWS\SYSTEM32\DWM.EXE

C:\WINDOWS\EXPLORER.EXE

C:\PROGRAM FILES\WINDOWS DEFENDER\MSASCUI.EXE

C:\HP\SUPPORT\HPSYSDRV.EXE

C:\PROGRAM FILES\JAVA\JRE6\BIN\JUSCHED.EXE

C:\PROGRAM FILES\HP\HP SOFTWARE UPDATE\HPWUSCHD2.EXE

C:\PROGRAM FILES\YAHOO!\COMMON\YMAILADVISOR.EXE

C:\PROGRAM FILES\GOOGLE\QUICK SEARCH BOX\GOOGLEQUICKSEARCHBOX.EXE

C:\PROGRAM FILES\COMMON FILES\INSTALLSHIELD\UPDATESERVICE\ISSCH.EXE

C:\PROGRAM FILES\YAHOO!\SEARCH PROTECTION\SEARCHPROTECTION.EXE

C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 2009\AVP.EXE

C:\PROGRAM FILES\WINDOWS SIDEBAR\SIDEBAR.EXE

C:\PROGRAM FILES\HEWLETT-PACKARD\HP ADVISOR\HPADVISOR.EXE

C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPNSCFG.EXE

C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBARNOTIFIER\GOOGLETOOLBARNOTIFIER.EXE

C:\HP\KBD\KBD.EXE

C:\WINDOWS\SYSTEM32\CONIME.EXE

C:\WINDOWS\SYSTEM32\WUAUCLT.EXE

C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE

C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE

C:\PROGRAM FILES\GOOGLE\GOOGLE TOOLBAR\GOOGLETOOLBARUSER_32.EXE

C:\WINDOWS\SYSTEM32\NOTEPAD.EXE

C:\WINDOWS\SYSTEM32\MACROMED\FLASH\FLASHUTIL10D.EXE

C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE

C:\WINDOWS\SYSTEM32\SEARCHFILTERHOST.EXE

C:\USERS\HOLLMAN\HEAVEN\SOFTWARE\1 ANTIVIRUS ATISPYWARE\SPROCES.EXE



R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.forospyware.com/t292947.html

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

R3 - URLSearchHook: (no name) - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)

F2 - REG:system.ini: UserInit=C:\Windows\system32\userinit.exe,

O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll

O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - (no file)

O2 - BHO: IEVkbdBHO Class - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: BrowserHelper Class - {8A9D74F9-560B-4FE7-ABEB-3B2E638E5CD6} - C:\Program Files\SGPSA\SearchAssistant.dll

O2 - BHO: Windows Live Aplicación auxiliar de inicio de sesión - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll

O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\YTSingleInstance.dll

O3 - Toolbar: Barra Yahoo! - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll

O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

O4 - HKCU\..\Run: [HPAdvisor] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autorun=AUTORUN

O4 - HKCU\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup

O4 - HKCU\..\Run: [Search Protection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe

O4 - HKCU\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe

O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe

O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe

O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KbdStub.EXE

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe

O4 - HKLM\..\Run: [DPService] "C:\Program Files\HP\DVDPlay\DPService.exe"

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [HP Software Update] c:\Program Files\HP\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [YMailAdvisor] "C:\Program Files\Yahoo!\Common\YMailAdvisor.exe"

O4 - HKLM\..\Run: [Google Quick Search Box] "C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe" /autorun

O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start

O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"

O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"

O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin

O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s

O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"

O4 - HKLM\..\Run: [FBSSA] C:\Program Files\SGPSA\ie3sh.exe

O4 - HKLM\..\Run: [Ink Monitor] C:\Program Files\EPSON\Ink Monitor\InkMonitor.exe

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - Global Startup: PDFCreator.lnk

O8 - Extra context menu item: Agregar al componente Anti-Banners - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm

O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000

O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html

O9 - Extra button: Estadísticas de protección del tráfico Web - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL

O10 - Unknown file in Winsock LSP: C:\WINDOWS\SYSTEM32\NLAAPI.DLL

O10 - Unknown file in Winsock LSP: C:\WINDOWS\SYSTEM32\NAPINSP.DLL

O10 - Unknown file in Winsock LSP: C:\WINDOWS\SYSTEM32\PNRPNSP.DLL

O10 - Unknown file in Winsock LSP: C:\WINDOWS\SYSTEM32\PNRPNSP.DLL

O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/3/9/E39C664F-A8E3-4F69-A109-1AE9849204EE/OGAControl.cab

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll

O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab

O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} (GMNRev Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Plug-in 1.6.0_17) - http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} (Java Plug-in 1.6.0_01) - http://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab

O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} (Java Plug-in 1.6.0_17) - http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} (Java Plug-in 1.6.0_17) - http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/VistaMSNPUpldes-es.cab

O18 - Protocol hijack: about - (no CLSID) - (no file)

O18 - Protocol hijack: dvd - (no CLSID) - (no file)

O18 - Protocol hijack: its - (no CLSID) - (no file)

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

O18 - Protocol hijack: mhtml - (no CLSID) - (no file)

O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll

O18 - Protocol hijack: ms-its - (no CLSID) - (no file)

O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

O18 - Protocol hijack: tv - (no CLSID) - (no file)

O18 - Protocol hijack: vbscript - (no CLSID) - (no file)

O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll

O20 - Winlogon Notify: KLOGON - C:\WINDOWS\SYSTEM32\KLOGON.DLL

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - (no file)

O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - %SystemRoot%\system32\browseui.dll



Información Adicional:

----------------------

Clave "HKLM\...\Image File Execution Options\IEInstal.exe"

"Debugger"="NULL1"



Listado de Servicios (Carga Automatica):

----------------------------------------

O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe

*O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program Files\LogMeIn Hamachi\hamachi-2.exe

**O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

O23 - Service: LEC TranslateDotNet Server - Language Engineering Corporation, LLC - C:\Program Files\Power Translator 12\LogoMedia TranslateDotNet Server.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

O23 - Service: mdmxsdk - Conexant - C:\WINDOWS\SYSTEM32\DRIVERS\mdmxsdk.sys

O23 - Service: Nero BackItUp Scheduler 4.0 - Unknown owner - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe (file missing)

O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\Super_DVD_Creator_9.8\NMSAccessU.exe

O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvvsvc.exe

O23 - Service: XAudio - Conexant Systems, Inc. - C:\WINDOWS\SYSTEM32\DRIVERS\xaudio.sys

O23 - Service: XAudioService - Conexant Systems, Inc. - C:\WINDOWS\system32\DRIVERS\xaudio.exe

O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe



Listado de Servicios (Carga Manual):

------------------------------------

O23 - Service: PPdus ASPI Shell (Afc) - Unknown owner - C:\WINDOWS\SYSTEM32\drivers\Afc.sys (file missing)

O23 - Service: AnyDVD - SlySoft, Inc. - C:\WINDOWS\SYSTEM32\Drivers\AnyDVD.sys

O23 - Service: Brother USB Mass-Storage Lower Filter Driver (BrFiltLo) - Brother Industries, Ltd. - C:\WINDOWS\system32\drivers\brfiltlo.sys

O23 - Service: Brother USB Mass-Storage Upper Filter Driver (BrFiltUp) - Brother Industries, Ltd. - C:\WINDOWS\system32\drivers\brfiltup.sys

O23 - Service: Brother MFC USB Serial WDM Driver (BrUsbSer) - Brother Industries Ltd. - C:\WINDOWS\system32\drivers\brusbser.sys

O23 - Service: Intel(R) PRO/1000 NDIS 6 Adapter Driver (E1G60) - Intel Corporation - C:\WINDOWS\SYSTEM32\DRIVERS\E1G60I32.sys

O23 - Service: ElbyCDFL - SlySoft, Inc. - C:\WINDOWS\SYSTEM32\Drivers\ElbyCDFL.sys

O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Hamachi Network Interface (hamachi) - LogMeIn, Inc. - C:\WINDOWS\SYSTEM32\DRIVERS\hamachi.sys

O23 - Service: HSF_DP - Conexant Systems, Inc. - C:\WINDOWS\SYSTEM32\DRIVERS\HSX_DP.sys

O23 - Service: HSXHWBS3 - Conexant Systems, Inc. - C:\WINDOWS\SYSTEM32\DRIVERS\HSXHWBS3.sys

O23 - Service: Service for Realtek HD Audio (WDM) (IntcAzAudAddService) - Realtek Semiconductor Corp. - C:\WINDOWS\SYSTEM32\drivers\RTKVHDA.sys

O23 - Service: IP in IP Tunnel Driver (IpInIp) - Unknown owner - C:\WINDOWS\SYSTEM32\DRIVERS\ipinip.sys (file missing)

O23 - Service: Kaspersky Lab KLFltDev (KLFLTDEV) - Kaspersky Lab - C:\WINDOWS\SYSTEM32\DRIVERS\klfltdev.sys

O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe

O23 - Service: @%SystemRoot%\system32\msimsg.dll,-27 (msiserver) - Unknown owner - C:\WINDOWS\system32\msiexec /V (file missing)

O23 - Service: NetGroup Packet Filter Driver (NPF) - CACE Technologies - C:\WINDOWS\SYSTEM32\drivers\npf.sys

O23 - Service: NPPTNT2 - INCA Internet Co., Ltd. - C:\Windows\system32\npptNT2.sys

O23 - Service: NVIDIA nForce 10/100 Mbps Ethernet (NVENETFD) - NVIDIA Corporation - C:\WINDOWS\SYSTEM32\DRIVERS\nvmfdx32.sys

O23 - Service: nvlddmkm - NVIDIA Corporation - C:\WINDOWS\SYSTEM32\DRIVERS\nvlddmkm.sys

O23 - Service: IPX Traffic Filter Driver (NwlnkFlt) - Unknown owner - C:\WINDOWS\SYSTEM32\DRIVERS\nwlnkflt.sys (file missing)

O23 - Service: IPX Traffic Forwarder Driver (NwlnkFwd) - Unknown owner - C:\WINDOWS\SYSTEM32\DRIVERS\nwlnkfwd.sys (file missing)

O23 - Service: VSO Software pcouffin (pcouffin) - VSO Software - C:\WINDOWS\SYSTEM32\Drivers\pcouffin.sys

O23 - Service: PS2 (Ps2) - Hewlett-Packard Company - C:\WINDOWS\SYSTEM32\DRIVERS\PS2.sys

O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

O23 - Service: winachsf - Conexant Systems, Inc. - C:\WINDOWS\SYSTEM32\DRIVERS\HSX_CNXT.sys

O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)



Listado de Servicios (Deshabilitados):

--------------------------------------

O23 - Service: adp94xx - Adaptec, Inc. - C:\WINDOWS\system32\drivers\adp94xx.sys

O23 - Service: adpahci - Adaptec, Inc. - C:\WINDOWS\system32\drivers\adpahci.sys

O23 - Service: adpu160m - Adaptec, Inc. - C:\WINDOWS\system32\drivers\adpu160m.sys

O23 - Service: adpu320 - Adaptec, Inc. - C:\WINDOWS\system32\drivers\adpu320.sys

O23 - Service: aic78xx - Adaptec, Inc. - C:\WINDOWS\system32\drivers\djsvs.sys

O23 - Service: aliide - Acer Laboratories Inc. - C:\WINDOWS\system32\drivers\aliide.sys

O23 - Service: arc - Adaptec, Inc. - C:\WINDOWS\system32\drivers\arc.sys

O23 - Service: arcsas - Adaptec, Inc. - C:\WINDOWS\system32\drivers\arcsas.sys

O23 - Service: Brother MFC Serial Port Interface Driver (WDM) (Brserid) - Brother Industries Ltd. - C:\WINDOWS\system32\drivers\brserid.sys

O23 - Service: Brother WDM Serial driver (BrSerWdm) - Brother Industries Ltd. - C:\WINDOWS\system32\drivers\brserwdm.sys

O23 - Service: Brother MFC USB Fax Only Modem (BrUsbMdm) - Brother Industries Ltd. - C:\WINDOWS\system32\drivers\brusbmdm.sys

O23 - Service: cmdide - CMD Technology, Inc. - C:\WINDOWS\system32\drivers\cmdide.sys

O23 - Service: elxstor - Emulex - C:\WINDOWS\system32\drivers\elxstor.sys

O23 - Service: Servicio Google Update (gupdate1c9ca88e7ca1fff) (gupdate1c9ca88e7ca1fff) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: HpCISSs - Hewlett-Packard Company - C:\WINDOWS\system32\drivers\hpcisss.sys

O23 - Service: Intel RAID Controller Vista (iaStorV) - Intel Corporation - C:\WINDOWS\system32\drivers\iastorv.sys

O23 - Service: iirsp - Intel Corp./ICP vortex GmbH - C:\WINDOWS\system32\drivers\iirsp.sys

O23 - Service: ITEATAPI_Service_Install (iteatapi) - Integrated Technology Express, Inc. - C:\WINDOWS\system32\drivers\iteatapi.sys

O23 - Service: ITERAID_Service_Install (iteraid) - Integrated Technology Express, Inc. - C:\WINDOWS\system32\drivers\iteraid.sys

O23 - Service: LSI_FC - LSI Logic - C:\WINDOWS\system32\drivers\lsi_fc.sys

O23 - Service: LSI_SAS - LSI Logic - C:\WINDOWS\system32\drivers\lsi_sas.sys

O23 - Service: LSI_SCSI - LSI Logic - C:\WINDOWS\system32\drivers\lsi_scsi.sys

O23 - Service: megasas - LSI Corporation - C:\WINDOWS\system32\drivers\megasas.sys

O23 - Service: MegaSR - LSI Corporation, Inc. - C:\WINDOWS\system32\drivers\megasr.sys

O23 - Service: Mraid35x - LSI Logic Corporation - C:\WINDOWS\system32\drivers\mraid35x.sys

O23 - Service: nfrd960 - IBM Corporation - C:\WINDOWS\system32\drivers\nfrd960.sys

O23 - Service: N-trig HID Tablet Driver (ntrigdigi) - N-trig Innovative Technologies - C:\WINDOWS\system32\drivers\ntrigdigi.sys

O23 - Service: NVIDIA nForce RAID Driver (nvraid) - NVIDIA Corporation - C:\WINDOWS\system32\drivers\nvraid.sys

O23 - Service: nvsmu - NVIDIA Corporation - C:\WINDOWS\system32\drivers\nvsmu.sys

O23 - Service: nvstor - NVIDIA Corporation - C:\WINDOWS\system32\drivers\nvstor.sys

O23 - Service: QLogic Fibre Channel Miniport Driver (ql2300) - QLogic Corporation - C:\WINDOWS\system32\drivers\ql2300.sys

O23 - Service: QLogic iSCSI Miniport Driver (ql40xx) - QLogic Corporation - C:\WINDOWS\system32\drivers\ql40xx.sys

O23 - Service: SiSRaid4 - Silicon Integrated Systems - C:\WINDOWS\system32\drivers\sisraid4.sys

O23 - Service: Symc8xx - LSI Logic - C:\WINDOWS\system32\drivers\symc8xx.sys

O23 - Service: Sym_hi - LSI Logic - C:\WINDOWS\system32\drivers\sym_hi.sys

O23 - Service: Sym_u3 - LSI Logic - C:\WINDOWS\system32\drivers\sym_u3.sys

O23 - Service: uliahci - ULi Electronics Inc. - C:\WINDOWS\system32\drivers\uliahci.sys

O23 - Service: UlSata - Promise Technology, Inc. - C:\WINDOWS\system32\drivers\ulsata.sys

O23 - Service: ulsata2 - Promise Technology, Inc. - C:\WINDOWS\system32\drivers\ulsata2.sys

O23 - Service: viaide - VIA Technologies, Inc. - C:\WINDOWS\system32\drivers\viaide.sys

O23 - Service: vsmraid - VIA Technologies Inc.,Ltd - C:\WINDOWS\system32\drivers\vsmraid.sys



82 Servicios.

12 de Carga Automatica.

29 de Carga Manual.

41 Deshabilitados.





Gracias por la coboración que me puedan prestar

[msc hotline sat]

Pues vemos que no has hecho caso de lo que te decíamos sobre:



Parche MS08-067 (Servicio Servidor) NO Instalado.



lANZA UN WINDOWSUPDATE E INSTALA LOS QUE ENCUENTRES A FALTAR !!!







y eliminas estas claves:





O2 - BHO: BrowserHelper Class - {8A9D74F9-560B-4FE7-ABEB-3B2E638E5CD6} - C:\Program Files\SGPSA\SearchAssistant.dll





O4 - HKLM\..\Run: [FBSSA] C:\Program Files\SGPSA\ie3sh.exe





y para desinstalar el IE8 tab.fastbrowsersearch.com





sigue lo indicado en http://help.fastbrowsersearch.com/uninstall.aspx







saludos



ms, 28-12-2009

[hbeltran7]

Intente instalar el Parche MS08-067 desde la página de microsoft y aparece el aviso " la actualización no se aplica al sistema".

Solamente pude desinstalar efectivamente los archivos " O2 - BHO: BrowserHelper Class - {8A9D74F9-560B-4FE7-ABEB-3B2E638E5CD6} - C:\Program Files\SGPSA\SearchAssistant.dll y O4 - HKLM\..\Run: [FBSSA] C:\Program Files\SGPSA\ie3sh.exe " desde el modo a prueba de errores.



Al reiniciar ya no aparece en el ie8 tab.fastbrowsersearch.com.



Problema solucionado muchas gracias.

[msc hotline sat]

Bien, pero recuerda seguir intentando instalar el parche indicado con un windowsupdate, es importante para evitar el Conficker



Y dando por solucionado el Tema, procedemos a cerrarlo



saludos



ms, 29-12-2009