Problemas con software anti-spyware

[malevo_kun]

Hola chicos:

mi problema es el siguiente, Instale dos programas anti-spyware: el spyboy y Malwarebytes' Anti-Malware, en ambos casos al iniciar el analisis se me reinicia la pc, me parecio extraño ya que nunca me paso esto antes ya que la pc me funciona normalmente y nunca antes se habia reiniciado al usar un sofware especifico y sobre todo me llama la atencion que no se reinicie cuando hago un analisis con el antivirus o limpio mi registro con el ccleaner..

Realmente no puedo saber cual es la causa de esta particular funcionamiento de mi pc cuando utilizo software anti-spyware, espero que ud chicos puedan darme alguna ayuda.



Saludos

[msc hotline sat]

Pues arranca en MODO SEGURO CON FUNCIONES DE RED y descarga el ELISTARA.EXE:


[quote="para DESCARGAR el ELISTARA, msc"] http://www.zonavirus.com/descargas/elistara.asp



Tras probarlo, reiniciar y postearnos el contenido de C:\infosat.txt para ver el resultado del proceso [/quote]

y por si no se tratara de un troyano y pudieramos ver algo en el registro y dmás, si con lo del ELISTARA no oluciona el problema y no pide muestras para analizar, descarga el SPROCES y tras probarlo, nos posteas el informe resultante:


[quote="msc"]
[b]SPROCES.EXE[/b] (herramienta de investigación)

http://www.zonavirus.com/descargas/sproces.asp



Y tras pulsar en SALIR, posteanos el contenido del C:\SPROCLOG.TXT [/quote]
lo analizaremos e informaremos al respecto.



saludos



ms, 21-4-2010

RARBA

[malevo_kun]

Despues de pasar el EliStarA volvia a probar los anti-spyware y se me volvio a reiniciar la pc..



[b]

En modo A Prueba de Fallos[/b]



(21-4-2010 03:00:02 (GMT))

EliStartPage v20.77 (c)2010 S.G.H. / Satinfo S.L. (Actualizado el 20 de Abril del 2010)

--------------------------------------------------

Lista de Acciones (por Acción Directa):

Linea Eliminada del HOSTS --> 127.0.0.1 007guard.com

Linea Eliminada del HOSTS --> 127.0.0.1 www.007guard.com

Linea Eliminada del HOSTS --> 127.0.0.1 008i.com

Linea Eliminada del HOSTS --> 127.0.0.1 008k.com

Linea Eliminada del HOSTS --> 127.0.0.1 www.008k.com

Linea Eliminada del HOSTS --> 127.0.0.1 00hq.com

Linea Eliminada del HOSTS --> 127.0.0.1 www.00hq.com

Linea Eliminada del HOSTS --> 127.0.0.1 010402.com

Linea Eliminada del HOSTS --> 127.0.0.1 032439.com

Linea Eliminada del HOSTS --> 127.0.0.1 www.032439.com

Linea Eliminada del HOSTS --> 127.0.0.1 1001-search.info

Linea Eliminada del HOSTS --> 127.0.0.1 www.1001-search.info

Linea Eliminada del HOSTS --> 127.0.0.1 100888290cs.com

Linea Eliminada del HOSTS --> 127.0.0.1 www.100888290cs.com

Linea Eliminada del HOSTS --> 127.0.0.1 100sexlinks.com

Linea Eliminada del HOSTS --> 127.0.0.1 www.100sexlinks.com

Linea Eliminada del HOSTS --> 127.0.0.1 10sek.com

Linea Eliminada del HOSTS --> 127.0.0.1 www.10sek.com

Linea Eliminada del HOSTS --> 127.0.0.1 123topsearch.com

Linea Eliminada del HOSTS --> 127.0.0.1 www.123topsearch.com

...

No detectado SP3 de Windows XP

No detectado Parche MS08-067 de Microsoft instalado. (SServidor)

Restaurado fichero de Configuración del IE, (IERESET.INF)

Eliminadas las Paginas de Inicio y de Busqueda del IE

Eliminados Ficheros Temporales del IE



(21-4-2010 03:09:42 (GMT))

EliStartPage v20.77 (c)2010 S.G.H. / Satinfo S.L. (Actualizado el 20 de Abril del 2010)

--------------------------------------------------

Lista de Acciones (por Exploración):

Explorando "C:\"

C:\Program Files\Realtek\Audio\Drivers\WDM\ALCMTR.EXE --> Eliminado, SpyRealtek



Nº Total de Directorios: 8734

Nº Total de Ficheros: 68326

Nº de Ficheros Analizados: 17308

Nº de Ficheros Infectados: 1

Nº de Ficheros Limpiados: 1



(21-4-2010 03:21:46 GMT)

SProces v4.5 (c)2010 S.G.H. / Satinfo S.L.

-------------------------------------------

Sistema Operativo: Microsoft Windows XP (v5.1.2600) Service Pack 2

Parche MS08-067 (Servicio Servidor) NO Instalado.

Internet Explorer: (v6.0.2900.2180) ;SP2;

Nombre Equipo: HEILMALEVO

Nombre Usuario: Administrator



Procesos Activos:

C:\WINDOWS\SYSTEM32\SMSS.EXE

C:\WINDOWS\SYSTEM32\WINLOGON.EXE

C:\WINDOWS\SYSTEM32\SERVICES.EXE

C:\WINDOWS\SYSTEM32\LSASS.EXE

C:\WINDOWS\SYSTEM32\SVCHOST.EXE

C:\WINDOWS\SYSTEM32\SVCHOST.EXE

C:\WINDOWS\EXPLORER.EXE

C:\PROGRAM FILES\TORTOISESVN\BIN\TSVNCACHE.EXE

F:\DOWNLOAD\TORRENT\SPROCES.EXE



R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 96.9.147.201:3128 (0)

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = <local> (0)

R3 - URLSearchHook: Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - %SystemRoot%\system32\shdocvw.dll

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,

O1 - Hosts: 127.0.0.1 localhost

O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll

O2 - BHO: GetRight IE Download Helper - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll

O2 - BHO: BitComet Helper - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll

O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL

O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl Class - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll

O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\utorrent.exe"

O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice

O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - Startup: CoreCenter.lnk = C:\Program Files\MSI\Core Center\CoreCenter.exe

O4 - Global Startup: Actualizar la licencia de ESET.lnk = C:\Program Files\ESET\MiNODLogin\MiNODLogin.exe

O4 - Global Startup: AudioDeck.lnk = C:\Program Files\VIA Technologies, Inc\VIA Audio Driver Setup Program\AudioDeck\AudioDeck.exe

O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm

O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm

O8 - Extra context menu item: Download with GetRight Pro - C:\Program Files\GetRight\GRdownload.htm

O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O8 - Extra context menu item: Open with GetRight Pro Browser - C:\Program Files\GetRight\GRbrowse.htm

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\MSPROJ~1\Office12\REFIEBAR.DLL

O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing)

O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Plug-in 1.6.0_20) - http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

O16 - DPF: {CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA} (Java Plug-in 1.5.0_07) - http://java.sun.com/update/1.5.0/jinstall-1_5_0_07-windows-i586.cab

O16 - DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} (Java Plug-in 1.5.0_10) - http://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab

O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} (Java Plug-in 1.6.0_03) - http://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab

O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} (Java Plug-in 1.6.0_20) - http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} (Java Plug-in 1.6.0_20) - http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O18 - Protocol: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL

O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll

O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL

O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - %SystemRoot%\system32\SHELL32.dll

O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - %SystemRoot%\system32\SHELL32.dll

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - %SystemRoot%\system32\webcheck.dll

O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINDOWS\system32\stobject.dll

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O22 - SharedTaskScheduler: {438755C2-A8BA-11D1-B96B-00A0C90312E1} - Browseui preloader - %SystemRoot%\system32\browseui.dll

O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - %SystemRoot%\system32\browseui.dll



Información Adicional:

----------------------



Listado de Servicios (Carga Automatica):

----------------------------------------

O23 - Service: General Purpose USB Driver (adildr.sys) (ADILOADER) - Unknown owner - C:\WINDOWS\SYSTEM32\Drivers\adildr.sys (file missing)

O23 - Service: Arrowkey Device Access (CDRPDACC) - Arrowkey - C:\Program Files\Arrowkey\Shared\CDRPDACC.SYS

**O23 - Service: DCOM Server Process Launcher (DcomLaunch) - Unknown owner - C:\WINDOWS\system32\svchost -k DcomLaunch (file missing)

O23 - Service: EAMON (eamon) - ESET - C:\WINDOWS\SYSTEM32\DRIVERS\eamon.sys

O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

O23 - Service: Nod32 AV (EsetNod32Fix) - Unknown owner - C:\WINDOWS\Regedit.exe /s %WinDir%\Fix.reg (file missing)

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.con (file missing)

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe

**O23 - Service: Remote Procedure Call (RPC) (RpcSs) - Unknown owner - C:\WINDOWS\system32\svchost -k rpcss (file missing)

O23 - Service: Secdrv - Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K. - C:\WINDOWS\SYSTEM32\DRIVERS\secdrv.sys



Listado de Servicios (Carga Manual):

------------------------------------

O23 - Service: USB ADSL LAN Adapter (adiusbae) - Unknown owner - C:\WINDOWS\SYSTEM32\DRIVERS\adiusbae.sys (file missing)

O23 - Service: Service for Realtek AC97 Audio (WDM) (ALCXWDM) - Realtek Semiconductor Corp. - C:\WINDOWS\SYSTEM32\drivers\ALCXWDM.SYS

O23 - Service: MSI/Broadcom 440x 10/100 Integrated Controller XP Driver (bcm4sbxp) - Broadcom Corporation - C:\WINDOWS\SYSTEM32\DRIVERS\bcm4sbxp.sys

O23 - Service: C-Media WDM Audio Interface (cmuda) - C-Media Inc - C:\WINDOWS\SYSTEM32\drivers\cmuda.sys

**O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - Microsoft Corp., Veritas Software - C:\WINDOWS\System32\dmadmin.exe

O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe

O23 - Service: VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver (FETNDIS) - VIA Technologies, Inc. - C:\WINDOWS\SYSTEM32\DRIVERS\fetnd5.sys

O23 - Service: VIA Rhine Family Fast Ethernet Adapter Driver Service (FETNDISB) - VIA Technologies, Inc. - C:\WINDOWS\SYSTEM32\DRIVERS\fetnd5b.sys

O23 - Service: GMSIPCI - Unknown owner - G:\INSTALL\GMSIPCI.SYS (file missing)

O23 - Service: Intel(R) 536EP V.92 Modem (Intels51) - Intel Corporation - C:\WINDOWS\SYSTEM32\DRIVERS\Intels51.sys

O23 - Service: Nokia USB Phone Parent (nmwcd) - Nokia - C:\WINDOWS\SYSTEM32\drivers\ccdcmb.sys

O23 - Service: Nokia USB Generic (nmwcdc) - Nokia - C:\WINDOWS\SYSTEM32\drivers\ccdcmbo.sys

O23 - Service: NTACCESS - Unknown owner - G:\NTACCESS.sys (file missing)

O23 - Service: Upper Class Filter Driver (NTIDrvr) - NewTech Infosystems, Inc. - C:\WINDOWS\SYSTEM32\DRIVERS\NTIDrvr.sys

O23 - Service: NTSIM - VIA Networking Technologies, Inc. - C:\WINDOWS\system32\ntsim.sys

O23 - Service: nv - NVIDIA Corporation - C:\WINDOWS\SYSTEM32\DRIVERS\nv4_mini.sys

O23 - Service: PCAlertDriver - MICRO-STAR INT'L CO., LTD. - C:\Program Files\MSI\Core Center\NTGLM7X.sys

O23 - Service: PCCS Mode Change Filter Driver (pccsmcfd) - Nokia - C:\WINDOWS\SYSTEM32\DRIVERS\pccsmcfd.sys

O23 - Service: Low level access layer for CD devices (Pcouffin) - Unknown owner - C:\WINDOWS\SYSTEM32\Drivers\Pcouffin.sys (file missing)

O23 - Service: Padus ASPI Shell (pfc) - Padus, Inc. - C:\WINDOWS\SYSTEM32\drivers\pfc.sys

O23 - Service: Direct Parallel Link Driver (Ptilink) - Parallel Technologies, Inc. - C:\WINDOWS\SYSTEM32\DRIVERS\ptilink.sys

O23 - Service: RushTopDevice - Vireo Software - C:\Program Files\MSI\Core Center\RushTop.sys

O23 - Service: SetupNTGLM7X - Unknown owner - G:\NTGLM7X.sys (file missing)

O23 - Service: SymEvent - Symantec Corporation - C:\Program Files\Symantec\SYMEVENT.SYS

*O23 - Service: Terminal Services (TermService) - Unknown owner - C:\WINDOWS\System32\svchost -k DComLaunch (file missing)

O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe

O23 - Service: upperdev - Nokia - C:\WINDOWS\SYSTEM32\DRIVERS\usbser_lowerflt.sys

O23 - Service: UsbserFilt - Nokia - C:\WINDOWS\SYSTEM32\DRIVERS\usbser_lowerfltj.sys

O23 - Service: VIA AC'97 Audio Controller (WDM) (VIAudio) - VIA Technologies, Inc. - C:\WINDOWS\SYSTEM32\drivers\viaudios.sys

O23 - Service: Vsp - Unknown owner - C:\WINDOWS\system32\drivers\Vsp.sys



Listado de Servicios (Deshabilitados):

--------------------------------------

O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe

**O23 - Service: dmboot - Microsoft Corp., Veritas Software - C:\WINDOWS\SYSTEM32\drivers\dmboot.sys

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe



45 Servicios.

11 de Carga Automatica.

30 de Carga Manual.

4 Deshabilitados.



[b]En modo Normal[/b]



(21-4-2010 03:29:09 GMT)

SProces v4.5 (c)2010 S.G.H. / Satinfo S.L.

-------------------------------------------

Sistema Operativo: Microsoft Windows XP (v5.1.2600) Service Pack 2

Parche MS08-067 (Servicio Servidor) NO Instalado.

Internet Explorer: (v6.0.2900.2180) ;SP2;

Nombre Equipo: HEILMALEVO

Nombre Usuario: Administrator



Procesos Activos:

C:\WINDOWS\SYSTEM32\SMSS.EXE

C:\WINDOWS\SYSTEM32\WINLOGON.EXE

C:\WINDOWS\SYSTEM32\SERVICES.EXE

C:\WINDOWS\SYSTEM32\LSASS.EXE

C:\WINDOWS\SYSTEM32\SVCHOST.EXE

C:\WINDOWS\SYSTEM32\SVCHOST.EXE

C:\WINDOWS\SYSTEM32\SVCHOST.EXE

C:\WINDOWS\EXPLORER.EXE

C:\WINDOWS\SYSTEM32\SPOOLSV.EXE

C:\WINDOWS\SYSTEM32\RUNDLL32.EXE

C:\PROGRAM FILES\ESET\ESET NOD32 ANTIVIRUS\EGUI.EXE

C:\WINDOWS\SOUNDMAN.EXE

C:\PROGRAM FILES\COMMON FILES\JAVA\JAVA UPDATE\JUSCHED.EXE

C:\WINDOWS\SYSTEM32\CTFMON.EXE

C:\PROGRAM FILES\ROCKETDOCK\ROCKETDOCK.EXE

C:\PROGRAM FILES\MESSENGER\MSMSGS.EXE

C:\PROGRAM FILES\UTORRENT\UTORRENT.EXE

C:\PROGRAM FILES\VIA TECHNOLOGIES, INC\VIA AUDIO DRIVER SETUP PROGRAM\AUDIODECK\AUDIODECK.EXE

C:\PROGRAM FILES\TORTOISESVN\BIN\TSVNCACHE.EXE

C:\PROGRAM FILES\MSI\CORE CENTER\CORECENTER.EXE

C:\PROGRAM FILES\ESET\ESET NOD32 ANTIVIRUS\EKRN.EXE

C:\PROGRAM FILES\JAVA\JRE6\BIN\JQS.EXE

C:\WINDOWS\SYSTEM32\NVSVC32.EXE

C:\WINDOWS\SYSTEM32\OODAG.EXE

C:\WINDOWS\SYSTEM32\SVCHOST.EXE

C:\WINDOWS\SYSTEM32\WSCNTFY.EXE

C:\PROGRAM FILES\MOZILLA FIREFOX\FIREFOX.EXE

C:\WINDOWS\SYSTEM32\WUAUCLT.EXE

F:\DOWNLOAD\TORRENT\SPROCES.EXE



R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 96.9.147.201:3128 (0)

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = <local> (0)

R3 - URLSearchHook: Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - %SystemRoot%\system32\shdocvw.dll

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,

O1 - Hosts: 127.0.0.1 localhost

O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll

O2 - BHO: GetRight IE Download Helper - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll

O2 - BHO: BitComet Helper - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll

O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL

O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl Class - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll

O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\utorrent.exe"

O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice

O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - Startup: CoreCenter.lnk = C:\Program Files\MSI\Core Center\CoreCenter.exe

O4 - Global Startup: Actualizar la licencia de ESET.lnk = C:\Program Files\ESET\MiNODLogin\MiNODLogin.exe

O4 - Global Startup: AudioDeck.lnk = C:\Program Files\VIA Technologies, Inc\VIA Audio Driver Setup Program\AudioDeck\AudioDeck.exe

O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm

O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm

O8 - Extra context menu item: Download with GetRight Pro - C:\Program Files\GetRight\GRdownload.htm

O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O8 - Extra context menu item: Open with GetRight Pro Browser - C:\Program Files\GetRight\GRbrowse.htm

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\MSPROJ~1\Office12\REFIEBAR.DLL

O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing)

O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Plug-in 1.6.0_20) - http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

O16 - DPF: {CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA} (Java Plug-in 1.5.0_07) - http://java.sun.com/update/1.5.0/jinstall-1_5_0_07-windows-i586.cab

O16 - DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} (Java Plug-in 1.5.0_10) - http://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab

O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} (Java Plug-in 1.6.0_03) - http://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab

O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} (Java Plug-in 1.6.0_20) - http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} (Java Plug-in 1.6.0_20) - http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O18 - Protocol: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL

O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll

O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL

O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - %SystemRoot%\system32\SHELL32.dll

O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - %SystemRoot%\system32\SHELL32.dll

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - %SystemRoot%\system32\webcheck.dll

O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINDOWS\system32\stobject.dll

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O22 - SharedTaskScheduler: {438755C2-A8BA-11D1-B96B-00A0C90312E1} - Browseui preloader - %SystemRoot%\system32\browseui.dll

O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - %SystemRoot%\system32\browseui.dll



Información Adicional:

----------------------



Listado de Servicios (Carga Automatica):

----------------------------------------

O23 - Service: General Purpose USB Driver (adildr.sys) (ADILOADER) - Unknown owner - C:\WINDOWS\SYSTEM32\Drivers\adildr.sys (file missing)

O23 - Service: Arrowkey Device Access (CDRPDACC) - Arrowkey - C:\Program Files\Arrowkey\Shared\CDRPDACC.SYS

**O23 - Service: DCOM Server Process Launcher (DcomLaunch) - Unknown owner - C:\WINDOWS\system32\svchost -k DcomLaunch (file missing)

O23 - Service: EAMON (eamon) - ESET - C:\WINDOWS\SYSTEM32\DRIVERS\eamon.sys

O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

O23 - Service: Nod32 AV (EsetNod32Fix) - Unknown owner - C:\WINDOWS\Regedit.exe /s %WinDir%\Fix.reg (file missing)

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.con (file missing)

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe

**O23 - Service: Remote Procedure Call (RPC) (RpcSs) - Unknown owner - C:\WINDOWS\system32\svchost -k rpcss (file missing)

O23 - Service: Secdrv - Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K. - C:\WINDOWS\SYSTEM32\DRIVERS\secdrv.sys



Listado de Servicios (Carga Manual):

------------------------------------

O23 - Service: USB ADSL LAN Adapter (adiusbae) - Unknown owner - C:\WINDOWS\SYSTEM32\DRIVERS\adiusbae.sys (file missing)

O23 - Service: Service for Realtek AC97 Audio (WDM) (ALCXWDM) - Realtek Semiconductor Corp. - C:\WINDOWS\SYSTEM32\drivers\ALCXWDM.SYS

O23 - Service: MSI/Broadcom 440x 10/100 Integrated Controller XP Driver (bcm4sbxp) - Broadcom Corporation - C:\WINDOWS\SYSTEM32\DRIVERS\bcm4sbxp.sys

O23 - Service: C-Media WDM Audio Interface (cmuda) - C-Media Inc - C:\WINDOWS\SYSTEM32\drivers\cmuda.sys

**O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - Microsoft Corp., Veritas Software - C:\WINDOWS\System32\dmadmin.exe

O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe

O23 - Service: VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver (FETNDIS) - VIA Technologies, Inc. - C:\WINDOWS\SYSTEM32\DRIVERS\fetnd5.sys

O23 - Service: VIA Rhine Family Fast Ethernet Adapter Driver Service (FETNDISB) - VIA Technologies, Inc. - C:\WINDOWS\SYSTEM32\DRIVERS\fetnd5b.sys

O23 - Service: GMSIPCI - Unknown owner - G:\INSTALL\GMSIPCI.SYS (file missing)

O23 - Service: Intel(R) 536EP V.92 Modem (Intels51) - Intel Corporation - C:\WINDOWS\SYSTEM32\DRIVERS\Intels51.sys

O23 - Service: Nokia USB Phone Parent (nmwcd) - Nokia - C:\WINDOWS\SYSTEM32\drivers\ccdcmb.sys

O23 - Service: Nokia USB Generic (nmwcdc) - Nokia - C:\WINDOWS\SYSTEM32\drivers\ccdcmbo.sys

O23 - Service: NTACCESS - Unknown owner - G:\NTACCESS.sys (file missing)

O23 - Service: Upper Class Filter Driver (NTIDrvr) - NewTech Infosystems, Inc. - C:\WINDOWS\SYSTEM32\DRIVERS\NTIDrvr.sys

O23 - Service: NTSIM - VIA Networking Technologies, Inc. - C:\WINDOWS\system32\ntsim.sys

O23 - Service: nv - NVIDIA Corporation - C:\WINDOWS\SYSTEM32\DRIVERS\nv4_mini.sys

O23 - Service: PCAlertDriver - MICRO-STAR INT'L CO., LTD. - C:\Program Files\MSI\Core Center\NTGLM7X.sys

O23 - Service: PCCS Mode Change Filter Driver (pccsmcfd) - Nokia - C:\WINDOWS\SYSTEM32\DRIVERS\pccsmcfd.sys

O23 - Service: Low level access layer for CD devices (Pcouffin) - Unknown owner - C:\WINDOWS\SYSTEM32\Drivers\Pcouffin.sys (file missing)

O23 - Service: Padus ASPI Shell (pfc) - Padus, Inc. - C:\WINDOWS\SYSTEM32\drivers\pfc.sys

O23 - Service: Direct Parallel Link Driver (Ptilink) - Parallel Technologies, Inc. - C:\WINDOWS\SYSTEM32\DRIVERS\ptilink.sys

O23 - Service: RushTopDevice - Vireo Software - C:\Program Files\MSI\Core Center\RushTop.sys

O23 - Service: SetupNTGLM7X - Unknown owner - G:\NTGLM7X.sys (file missing)

O23 - Service: SymEvent - Symantec Corporation - C:\Program Files\Symantec\SYMEVENT.SYS

*O23 - Service: Terminal Services (TermService) - Unknown owner - C:\WINDOWS\System32\svchost -k DComLaunch (file missing)

O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe

O23 - Service: upperdev - Nokia - C:\WINDOWS\SYSTEM32\DRIVERS\usbser_lowerflt.sys

O23 - Service: UsbserFilt - Nokia - C:\WINDOWS\SYSTEM32\DRIVERS\usbser_lowerfltj.sys

O23 - Service: VIA AC'97 Audio Controller (WDM) (VIAudio) - VIA Technologies, Inc. - C:\WINDOWS\SYSTEM32\drivers\viaudios.sys

O23 - Service: Vsp - Unknown owner - C:\WINDOWS\system32\drivers\Vsp.sys



Listado de Servicios (Deshabilitados):

--------------------------------------

O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe

**O23 - Service: dmboot - Microsoft Corp., Veritas Software - C:\WINDOWS\SYSTEM32\drivers\dmboot.sys

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe



45 Servicios.

11 de Carga Automatica.

30 de Carga Manual.

4 Deshabilitados.

[msc hotline sat]

Pues de entrada te faltan muchos parches :



No detectado SP3 de Windows XP

No detectado Parche MS08-067 de Microsoft instalado. (SServidor)





Lanza un windowsupdate e instalalos !!!



y del log, puedes eliminar esta clave:





O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} (Java Plug-in 1.6.0_03) - http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab





[b]¿Como enviar las muestras a zonavirus? - Para ello recordar[/b]:

https://foros.zonavirus.com/viewtopic.php?f=5&t=14253



Ahora bien, descartando causas víricas, posiblemente el problema es debido a algun fichero que está corrupto o mal asignado en el disco duro, y que al ser analizado, se busca erroneamente alguna de sus partes, y ocasiona una alteracion del proceso por la que windows lanza un reset para que no haya males mayores...



Aparte de lo antes indicado, e incluso antes, lanza una comprobación de errores:



MIPC -> Botón derecho sobre unidad C: -> Propiedades -> Herramientas -> Comprobar errores



y nos comentas el resultado, gracias



saludos



ms, 21-4-2010

saludos



ms, 21-4-2010

[malevo_kun]

ok, gracias por la ayuda.. cuanto tenga algo de tiempo lo hago y posteo los resultados..

una cosa, puse a limpiar el registro con ccleaner y ahora se me reinicio tambien..

[msc hotline sat]

No decíamos nada de pasar el ccleaner, sino que lanzaras una comprobacion de errores, que actualizaras parches y que eliminaras una clave...



Haz lo que decimos y tras reiniciar dinos si se ha solucionado el problema.



saludos



ms, 25-4-2010