www.owapay.com (SOLUCIONADO)

[Aguiladelfin1]

Hola a todos. Otra vez por aqui con un problemita.

Mi cuenta de hotmail está enviando mails a todos mis contactos. No se como puede suceder esto. No se si lo están enviando desde webmail o desde mi computadora. Es asunto es que tienen acceso a la libreta de direcciones completa.

Los mail van dirigidos a la siguiente dirección adriana_bl81@hotmail.com

Pero también a todos mis contactos.

Al inicio de la libreta de direcciones puse un contacto sin dirección de mail para intentar que produzca error y nada mandan a todos igualmente.

Los textos que envian son los siguientes:

I think this is a nice website,I like it very much.If you have time please browse it.Maybe you can find some products that are suitable for you.Their priciple is :100% original and brand new,100% satisfied! Their address is J ⊕www.owapay.com⊕

Hi



how are you ?

Just received my iphone4 32gb and Ipad from this website http://www.owapay.com much cheaper than others and genuine . if you would like to get one,you can check it out,

all the best for 2010



Espero su invalorable ayuda como siempre.

Saludos.



Jorge

[msc hotline sat]

Pues parece que se trata de un medio de envio de spams



Pues prueba el ELISTARA y nos posteas el informe resultante:


[quote="para DESCARGAR el ELISTARA, msc"]



http://www.zonavirus.com/descargas/elistara.asp



Tras probarlo, reiniciar y postearnos el contenido de C:\infosat.txt para ver el resultado

del proceso [/quote]



Y si en el informe no se detectara nada ni pidiera muestra para analizar, envianos el log generado por el SPROCES :




[quote="msc"]
[b]SPROCES.EXE[/b] (herramienta de investigación)

http://www.zonavirus.com/descargas/sproces.asp



Y tras pulsar en SALIR, posteanos el contenido del C:\SPROCLOG.TXT [/quote]
lo analizaremos e informaremos al respecto.





saludos



ms, 15-12-2010

RARBA

[Aguiladelfin1]

Aqui van los datos, no se observa nada raro a simple vista.



Analisis on-line con Bit Defender:

BitDefender Online Scanner



Informe de anlisis generado a: Tue, Dec 14, 2010 - 16:58:16



Objeto del anlisis: C:\;



Estdisticas



Tiempo

01:46:55



Ficheros

487872



Carpetas

10198



Sectores de arranque

0



Archivos

40131



Ficheros comprimidos

26906





Resultados



Virus identificados

7



Ficheros infectados

10



Ficheros sospechosos

0



Advertencias

0



Desinfectados

0



Ficheros eliminados

0









Informacin sobre los motores de anlisis



Firmas de virus

6416045



Versin del motor de anlisis

AVCORE v2.1 Windows/i386 11.0.0.42 (Oct 18 2010)



Complementos de anlisis

18



Complementos de archivo

44



Complementos de descomprimir

10



Complementos de correo

6



Complementos de sistema

4









Configuracin de anlisis



Primera accin

Preguntar al usuario



Segunda accin

Ninguna



Heursticas

S



Activar advertencias

S



Extensiones analizadas

*;



Excluir extensiones





Analizar correo

S



Analizar archivos

S



Analizar ficheros comprimidos

S



Analizar ficheros

S



Analizar el sector de arranque

S









Fichero analizado

Estado



C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\29CE129A.exe=>(Quarantine-2)

Infectado con: Trojan.Generic.4071687



C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\663C2710.exe=>(Quarantine-2)

Infectado con: Trojan.Generic.3858861



C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\75BA1ADF.exe=>(Quarantine-2)

Infectado con: Trojan.Dropper.SMD



C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\795604E6.exe=>(Quarantine-2)

Infectado con: Trojan.Generic.4082662



C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\7E0E33B5.exe=>(Quarantine-2)

Infectado con: Trojan.Dropper.SMD



C:\Mis Documentos\Temporal\Limpia registros\Tune Up Utilities 2008+keygen\TU2008 Keymaker.exe

Infectado con: IRC-Worm.Generic.11798



C:\Mis Documentos\Temporal\Limpia registros\Tune Up Utilities 2008+keygen\TU2008 Keymaker.rar=>TU2008 Keymaker.exe

Infectado con: IRC-Worm.Generic.11798



C:\Mis Documentos\Temporal\Nero\Nero 8 Ultra Edition v8.3.2.1b - Full Version\Nero-8.3.2.1b_eng_setup.exe

Infectado con: Trojan.Dropper.SMD



C:\Mis Documentos\Temporal\Particion Disco\Acronis Disk Director Suite 10 Build 2160.rar=>Acronis Disk Director Suite 10 Build 2160\keygen.exe

Infectado con: Dropped:Trojan.Injector.CG



C:\WINDOWS\onlqdsr-virus.dat

Infectado con: Gen:Trojan.Kates.by8@aSjBvFii





Informe de Elistara:



(14-12-2010 16:22:46 (GMT))

EliStartPage v22.18 (c)2010 S.G.H. / Satinfo S.L. (Actualizado el 13 de Diciembre del 2010)

--------------------------------------------------

Lista de Acciones (por Acción Directa):

Restaurado fichero de Configuración del IE, (IERESET.INF)

Eliminadas las Paginas de Inicio y de Busqueda del IE

Eliminados Ficheros Temporales del IE

Detectado HOSTS no Standar.

Restaurado HOSTS por Defecto.



(14-12-2010 16:34:59 (GMT))

EliStartPage v22.18 (c)2010 S.G.H. / Satinfo S.L. (Actualizado el 13 de Diciembre del 2010)

--------------------------------------------------

Lista de Acciones (por Exploración):

Explorando "C:\"



Nº Total de Directorios: 10149

Nº Total de Ficheros: 98047

Nº de Ficheros Analizados: 29981

Nº de Ficheros Infectados: 0

Nº de Ficheros Limpiados: 0



(14-12-2010 16:37:41 (GMT))

EliStartPage v22.18 (c)2010 S.G.H. / Satinfo S.L. (Actualizado el 13 de Diciembre del 2010)

--------------------------------------------------

Lista de Acciones (por Exploración):

Explorando "D:\"



Nº Total de Directorios: 354

Nº Total de Ficheros: 8364

Nº de Ficheros Analizados: 138

Nº de Ficheros Infectados: 0

Nº de Ficheros Limpiados: 0



(14-12-2010 16:39:10 (GMT))

EliStartPage v22.18 (c)2010 S.G.H. / Satinfo S.L. (Actualizado el 13 de Diciembre del 2010)

--------------------------------------------------

Lista de Acciones (por Exploración):

Explorando "I:\"



Nº Total de Directorios: 2822

Nº Total de Ficheros: 41597

Nº de Ficheros Analizados: 2717

Nº de Ficheros Infectados: 0

Nº de Ficheros Limpiados: 0





Informe de Sprocess

(15-12-2010 16:40:20 GMT)

SProces v4.9 (c)2010 S.G.H. / Satinfo S.L.

-------------------------------------------

Sistema Operativo: Microsoft Windows XP (v5.1.2600) Service Pack 3

Parche MS08-067 (Servicio Servidor) Instalado.

Internet Explorer: (v8.0.6001.18702) 0

Nombre Equipo: NBJORGE

Nombre Usuario: Jorge



Procesos Activos:

C:\WINDOWS\SYSTEM32\SMSS.EXE

C:\WINDOWS\SYSTEM32\WINLOGON.EXE

C:\WINDOWS\SYSTEM32\SERVICES.EXE

C:\WINDOWS\SYSTEM32\LSASS.EXE

C:\WINDOWS\SYSTEM32\SVCHOST.EXE

C:\WINDOWS\SYSTEM32\SVCHOST.EXE

C:\PROGRAM FILES\INTEL\WIRELESS\BIN\EVTENG.EXE

C:\PROGRAM FILES\INTEL\WIRELESS\BIN\S24EVMON.EXE

C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASWUPDSV.EXE

C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHSERV.EXE

C:\WINDOWS\EXPLORER.EXE

C:\WINDOWS\SYSTEM32\CTFMON.EXE

C:\PROGRAM FILES\APOINT\APOINT.EXE

C:\WINDOWS\EHOME\EHTRAY.EXE

C:\PROGRAM FILES\INTEL\INTEL MATRIX STORAGE MANAGER\IAANOTIF.EXE

C:\PROGRAM FILES\SONY\ISB UTILITY\ISBMGR.EXE

C:\WINDOWS\SYSTEM32\RUNDLL32.EXE

C:\PROGRAM FILES\SONY\APPMONUTIL\APPMONUTILITY.EXE

C:\PROGRAM FILES\SONY\VAIO POWER MANAGEMENT\SPMGR.EXE

C:\PROGRAM FILES\SONY\WIRELESS SWITCH SETTING UTILITY\SWITCHER.EXE

C:\WINDOWS\SYSTEM32\DLA\DLACTRLW.EXE

C:\PROGRAM FILES\SONY\VAIO CAMERA UTILITY\VCUSERVE.EXE

C:\PROGRA~1\ALWILS~1\AVAST4\ASHDISP.EXE

C:\PROGRAM FILES\COMMON FILES\JAVA\JAVA UPDATE\JUSCHED.EXE

C:\WINDOWS\SYSTEM32\WSERVICE.EXE

C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\TEATIMER.EXE

C:\PROGRAM FILES\SKYPE\PHONE\SKYPE.EXE

C:\PROGRAM FILES\APOINT\APNTEX.EXE

C:\WINDOWS\SYSTEM32\SPOOLSV.EXE

C:\PROGRAM FILES\SKYPE\PLUGIN MANAGER\SKYPEPM.EXE

C:\PROGRAM FILES\ADOBE\PHOTOSHOP ELEMENTS 4.0\PHOTOSHOPELEMENTSFILEAGENT.EXE

C:\WINDOWS\EHOME\EHRECVR.EXE

C:\WINDOWS\EHOME\EHSCHED.EXE

C:\PROGRAM FILES\INTEL\INTEL MATRIX STORAGE MANAGER\IAANTMON.EXE

C:\PROGRAM FILES\JAVA\JRE6\BIN\JQS.EXE

C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\PIF\{B8E1DD85-8582-4C61-B58F-2F227FCA9A08}\PIFSVC.EXE

C:\PROGRAM FILES\MICROSOFT SQL SERVER\MSSQL$VAIO_VEDB\BINN\SQLSERVR.EXE

C:\PROGRAM FILES\NERO\NERO8\NERO BACKITUP\NBSERVICE.EXE

C:\WINDOWS\SYSTEM32\NVSVC32.EXE

C:\PROGRAM FILES\INTEL\WIRELESS\BIN\REGSRVC.EXE

C:\PROGRAM FILES\COMMON FILES\SONY SHARED\WMPLUGIN\SONICSTAGEMONITORING.EXE

C:\PROGRAM FILES\SIGMATEL\C-MAJOR AUDIO\WDM\STACSV.EXE

C:\WINDOWS\SYSTEM32\SVCHOST.EXE

C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-LC\SYMLCSVC.EXE

C:\PROGRAM FILES\SONY\VAIO EVENT SERVICE\VESMGR.EXE

C:\PROGRAM FILES\COMMON FILES\SONY SHARED\VAIO ENTERTAINMENT PLATFORM\VCSW\VCSW.EXE

C:\WINDOWS\SYSTEM32\DRIVERS\WTSRV.EXE

C:\PROGRAM FILES\COMMON FILES\SONY SHARED\VAIO ENTERTAINMENT PLATFORM\VZCDB\VZCDBSVC.EXE

C:\PROGRAM FILES\COMMON FILES\SONY SHARED\VAIO ENTERTAINMENT PLATFORM\VZCDB\VZFW.EXE

C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHMAISV.EXE

C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHWEBSV.EXE

C:\WINDOWS\SYSTEM32\DLLHOST.EXE

C:\WINDOWS\EHOME\EHMSAS.EXE

C:\PROGRAM FILES\WINDOWS LIVE\MESSENGER\MSNMSGR.EXE

C:\PROGRAM FILES\WINDOWS LIVE\CONTACTS\WLCOMM.EXE

C:\WINDOWS\SYSTEM32\SVCHOST.EXE

C:\WINDOWS\SYSTEM32\WSCNTFY.EXE

C:\PROGRAM FILES\YAHOO!\MESSENGER\YAHOOMESSENGER.EXE

C:\PROGRAM FILES\UTORRENT\UTORRENT.EXE

C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE

C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE

C:\PROGRAM FILES\SKYPE\TOOLBARS\SHARED\SKYPENAMES2.EXE

C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE

C:\MIS DOCUMENTOS\TEMPORAL\ELISTARA\SPROCES.EXE



R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

R3 - URLSearchHook: Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\system32\ieframe.dll

F2 - REG:system.ini: UserInit=C:\WINDOWS\SYSTEM32\Userinit.exe,

O1 - Hosts: 127.0.0.1 localhost

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL

O2 - BHO: Windows Live Aplicación auxiliar de inicio de sesión - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Skype add-on for Internet Explorer - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl Class - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\PROGRA~1\Yahoo!\MESSEN~1\YahooMessenger.exe" -quiet

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe

O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe

O4 - HKLM\..\Run: [VAIO Recovery] C:\WINDOWS\Sonysys\VAIO Recovery\PartSeal.exe

O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe

O4 - HKLM\..\Run: [ISBMgr.exe] C:\Program Files\Sony\ISB Utility\ISBMgr.exe

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [AppMon Utility] C:\Program Files\Sony\AppMonUtil\AppMonUtility.exe @@@Start

O4 - HKLM\..\Run: [SonyPowerCfg] C:\Program Files\Sony\VAIO Power Management\SPMgr.exe

O4 - HKLM\..\Run: [Switcher.exe] C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe

O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE

O4 - HKLM\..\Run: [VAIOCameraUtility] "C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe"

O4 - HKLM\..\Run: [PartSeal] C:\WINDOWS\Sonysys\VAIO Recovery\PartSeal.exe

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [WService] WService.EXE

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe

O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scanner/sources/es/scan8/oscan8.cab

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1256405533782

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Plug-in 1.6.0_22) - http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} (Java Plug-in 1.5.0_06) - http://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab

O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} (Java Plug-in 1.6.0_22) - http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} (Java Plug-in 1.6.0_22) - http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - Winlogon Notify: DIMSNTFY - %SYSTEMROOT%\SYSTEM32\DIMSNTFY.DLL

O20 - Winlogon Notify: VESWINLOGON - VESWINLOGON.DLL

O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - %SystemRoot%\system32\SHELL32.dll

O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - %SystemRoot%\system32\SHELL32.dll

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\system32\webcheck.dll

O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINDOWS\system32\stobject.dll

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O22 - SharedTaskScheduler: {438755C2-A8BA-11D1-B96B-00A0C90312E1} - Browseui preloader - %SystemRoot%\system32\browseui.dll

O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - %SystemRoot%\system32\browseui.dll



Información Adicional:

----------------------

ShellExecuteHooks: {03A80B1D-5C6A-42c2-9DFB-81B6005D8023} - Trend Micro Anti-Spyware Shell Extension - C:\Program Files\Trend Micro\Tmas\sshook.dll

WinSys\Drivers\ati2mtag.sys (de 701440 bytes) () ATI Technologies Inc.

WinSys\Drivers\dmboot.sys (de 799744 bytes) () Microsoft Corp., Veritas Software

WinSys\Drivers\hsfcxts2.sys (de 685056 bytes) () Conexant Systems, Inc.

WinSys\Drivers\HSF_CNXT.sys (de 721280 bytes) () Conexant Systems, Inc.

WinSys\Drivers\HSF_DPV.sys (de 998656 bytes) () Conexant Systems, Inc.

WinSys\Drivers\mrxsmb.sys (de 455680 bytes) () Microsoft Corporation

WinSys\Drivers\mtxparhm.sys (de 452736 bytes) () Matrox Graphics Inc.

WinSys\Drivers\ntfs.sys (de 574976 bytes) () Microsoft Corporation

WinSys\Drivers\slim.sys (de 698496 bytes) () Sony Corporation

WinSys\Drivers\slntamr.sys (de 404990 bytes) () Smart Link



Listado de Servicios (Carga Automatica):

----------------------------------------

O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe

O23 - Service: AEGIS Protocol (IEEE 802.1x) v3.4.9.0 (AegisP) - Meetinghouse Data Communications - C:\WINDOWS\SYSTEM32\DRIVERS\AegisP.sys

O23 - Service: aswFsBlk - ALWIL Software - C:\WINDOWS\SYSTEM32\DRIVERS\aswFsBlk.sys

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

**O23 - Service: DCOM Server Process Launcher (DcomLaunch) - Unknown owner - C:\WINDOWS\system32\svchost -k DcomLaunch (file missing)

O23 - Service: DLABOIOM - Sonic Solutions - C:\WINDOWS\SYSTEM32\DLA\DLABOIOM.SYS

O23 - Service: DLADResN - Sonic Solutions - C:\WINDOWS\SYSTEM32\DLA\DLADResN.SYS

O23 - Service: DLAIFS_M - Sonic Solutions - C:\WINDOWS\SYSTEM32\DLA\DLAIFS_M.SYS

O23 - Service: DLAOPIOM - Sonic Solutions - C:\WINDOWS\SYSTEM32\DLA\DLAOPIOM.SYS

O23 - Service: DLAPoolM - Sonic Solutions - C:\WINDOWS\SYSTEM32\DLA\DLAPoolM.SYS

O23 - Service: DLAUDFAM - Sonic Solutions - C:\WINDOWS\SYSTEM32\DLA\DLAUDFAM.SYS

O23 - Service: DLAUDF_M - Sonic Solutions - C:\WINDOWS\SYSTEM32\DLA\DLAUDF_M.SYS

O23 - Service: DRVNDDM - Sonic Solutions - C:\WINDOWS\SYSTEM32\Drivers\DRVNDDM.SYS

O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.con (file missing)

O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)

O23 - Service: mdmxsdk - Conexant - C:\WINDOWS\SYSTEM32\DRIVERS\mdmxsdk.sys

O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

**O23 - Service: Remote Procedure Call (RPC) (RpcSs) - Unknown owner - C:\WINDOWS\system32\svchost -k rpcss (file missing)

O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

O23 - Service: WLAN Transport (s24trans) - Intel Corporation - C:\WINDOWS\SYSTEM32\DRIVERS\s24trans.sys

O23 - Service: SonicStageMonitoring - Sony Corporation - C:\Program Files\Common Files\Sony Shared\WMPlugIn\SonicStageMonitoring.exe

O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Program Files\SigmaTel\C-Major Audio\WDM\StacSV.exe

O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

O23 - Service: symlcbrd - Symantec Corporation - C:\WINDOWS\system32\drivers\symlcbrd.sys

O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe

O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe

O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe

O23 - Service: WinTab Service (WinTabService) - Tablet Driver - C:\WINDOWS\System32\Drivers\WTSRV.EXE



Listado de Servicios (Carga Manual):

------------------------------------

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Alps Pointing-device Filter Driver (ApfiltrService) - Alps Electric Co., Ltd. - C:\WINDOWS\SYSTEM32\DRIVERS\Apfiltr.sys

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

**O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - Microsoft Corp., Veritas Software - C:\WINDOWS\System32\dmadmin.exe

O23 - Service: Intel(R) PRO Network Connection Driver (E100B) - Intel Corporation - C:\WINDOWS\SYSTEM32\DRIVERS\e100b325.sys

O23 - Service: Intel(R) PRO/1000 PCI Express Network Connection Driver (e1express) - Intel Corporation - C:\WINDOWS\SYSTEM32\DRIVERS\e1e5132.sys

O23 - Service: Microsoft UAA Bus Driver for High Definition Audio (HDAudBus) - Windows (R) Server 2003 DDK provider - C:\WINDOWS\SYSTEM32\DRIVERS\HDAudBus.sys

O23 - Service: IEEE-1284.4 Driver HPZid412 (HPZid412) - HP - C:\WINDOWS\SYSTEM32\DRIVERS\HPZid412.sys

O23 - Service: Print Class Driver for IEEE-1284.4 HPZipr12 (HPZipr12) - HP - C:\WINDOWS\SYSTEM32\DRIVERS\HPZipr12.sys

O23 - Service: USB to IEEE-1284.4 Translation Driver HPZius12 (HPZius12) - HP - C:\WINDOWS\SYSTEM32\DRIVERS\HPZius12.sys

O23 - Service: HSFHWAZL - Conexant Systems, Inc. - C:\WINDOWS\SYSTEM32\DRIVERS\HSFHWAZL.sys

O23 - Service: HSF_DPV - Conexant Systems, Inc. - C:\WINDOWS\SYSTEM32\DRIVERS\HSF_DPV.sys

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program Files\Sony\Image Converter 2\IcVzMon.exe

O23 - Service: IVI ASPI Shell (Iviaspi) - InterVideo, Inc. - C:\WINDOWS\SYSTEM32\drivers\iviaspi.sys

O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe

O23 - Service: Sony Visual Communication Camera VGP-VCC2 (Mvc25U870_VID_1262&PID_25FD) - Micro Vision Co.,Ltd - C:\WINDOWS\SYSTEM32\Drivers\Mvc25U870.sys

O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe

O23 - Service: nv - NVIDIA Corporation - C:\WINDOWS\SYSTEM32\DRIVERS\nv4_mini.sys

O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe

O23 - Service: Direct Parallel Link Driver (Ptilink) - Parallel Technologies, Inc. - C:\WINDOWS\SYSTEM32\DRIVERS\ptilink.sys

O23 - Service: Secdrv - Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K. - C:\WINDOWS\SYSTEM32\DRIVERS\secdrv.sys

O23 - Service: Sony Lucid Integrated Mpeg encoder (slim) - Sony Corporation - C:\WINDOWS\SYSTEM32\drivers\slim.sys

O23 - Service: Sony Notebook Control Device (SNC) - Sony Corporation - C:\WINDOWS\SYSTEM32\Drivers\SonyNC.sys

O23 - Service: Sony Image Conversion Filter Driver (SonyImgF) - Sony Corporation - C:\WINDOWS\SYSTEM32\DRIVERS\SonyImgF.sys

O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe

O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe

O23 - Service: SigmaTel High Definition Audio CODEC (STHDA) - SigmaTel, Inc. - C:\WINDOWS\SYSTEM32\drivers\sthda.sys

O23 - Service: Serial Tablet Port Driver (Tablet2k) - Windows (R) 2000 DDK provider - C:\WINDOWS\System32\Drivers\Tablet2k.sys

O23 - Service: Tablet Class Driver (TClass2k) - Tablet Driver - C:\WINDOWS\SYSTEM32\DRIVERS\TClass2k.sys

*O23 - Service: Terminal Services (TermService) - Unknown owner - C:\WINDOWS\System32\svchost -k DComLaunch (file missing)

O23 - Service: ti21sony - Texas Instruments - C:\WINDOWS\SYSTEM32\drivers\ti21sony.sys

O23 - Service: Bluetooth Port Driver from Toshiba (tosporte) - TOSHIBA Corporation - C:\WINDOWS\SYSTEM32\DRIVERS\tosporte.sys

O23 - Service: Bluetooth RFBUS from TOSHIBA (Tosrfbd) - TOSHIBA CORPORATION - C:\WINDOWS\SYSTEM32\Drivers\tosrfbd.sys

O23 - Service: Bluetooth RFBNEP from TOSHIBA (Tosrfbnp) - TOSHIBA Corporation - C:\WINDOWS\SYSTEM32\Drivers\tosrfbnp.sys

O23 - Service: Bluetooth RFHID from TOSHIBA (Tosrfhid) - TOSHIBA Corporation. - C:\WINDOWS\SYSTEM32\DRIVERS\Tosrfhid.sys

O23 - Service: Bluetooth Personal Area Network from TOSHIBA (tosrfnds) - TOSHIBA Corporation. - C:\WINDOWS\SYSTEM32\DRIVERS\tosrfnds.sys

O23 - Service: Bluetooth USB Controller (Tosrfusb) - TOSHIBA CORPORATION - C:\WINDOWS\SYSTEM32\Drivers\tosrfusb.sys

O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

O23 - Service: HID Tablet Port Driver (UCTblHid) - Tablet Driver - C:\WINDOWS\SYSTEM32\DRIVERS\UCTblHid.sys

O23 - Service: ULCDRHlp - Ulead Systems, Inc. - C:\WINDOWS\SYSTEM32\Drivers\ULCDRHlp.sys

O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe

O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe

O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Unknown owner - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe" /Service=VAIOMediaPlatform-IntegratedServer-HTTP /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" (file missing)

O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe

O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Unknown owner - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe" /Service=VAIOMediaPlatform-Mobile-Gateway /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" (file missing)

O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe

O23 - Service: Intel(R) PRO/Wireless 3945ABG Adapter Driver (w39n51) - Intel® Corporation - C:\WINDOWS\SYSTEM32\DRIVERS\w39n51.sys

O23 - Service: winachsf - Conexant Systems, Inc. - C:\WINDOWS\SYSTEM32\DRIVERS\HSF_CNXT.sys



Listado de Servicios (Deshabilitados):

--------------------------------------

**O23 - Service: dmboot - Microsoft Corp., Veritas Software - C:\WINDOWS\SYSTEM32\drivers\dmboot.sys

**O23 - Service: dmio - Microsoft Corp., Veritas Software - C:\WINDOWS\SYSTEM32\drivers\dmio.sys

**O23 - Service: dmload - Microsoft Corp., Veritas Software. - C:\WINDOWS\SYSTEM32\drivers\dmload.sys



88 Servicios.

34 de Carga Automatica.

51 de Carga Manual.

3 Deshabilitados.





Informe de Hijackthis

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 13:34:33, on 15/12/2010

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal



Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Apoint\Apoint.exe

C:\WINDOWS\ehome\ehtray.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe

C:\Program Files\Sony\ISB Utility\ISBMgr.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\Sony\AppMonUtil\AppMonUtility.exe

C:\Program Files\Sony\VAIO Power Management\SPMgr.exe

C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe

C:\WINDOWS\System32\DLA\DLACTRLW.EXE

C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\WINDOWS\system32\WService.EXE

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\Program Files\Apoint\Apntex.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Skype\Plugin Manager\skypePM.exe

C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe

C:\WINDOWS\eHome\ehRecvr.exe

C:\WINDOWS\eHome\ehSched.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe

C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

C:\Program Files\Common Files\Sony Shared\WMPlugIn\SonicStageMonitoring.exe

C:\Program Files\SigmaTel\C-Major Audio\WDM\StacSV.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

C:\Program Files\Sony\VAIO Event Service\VESMgr.exe

C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe

C:\WINDOWS\System32\Drivers\WTSRV.EXE

C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe

C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\system32\dllhost.exe

C:\WINDOWS\eHome\ehmsas.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\Program Files\Windows Live\Contacts\wlcomm.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

C:\Program Files\uTorrent\utorrent.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Skype\Toolbars\Shared\SkypeNames2.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe



R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL

O2 - BHO: Windows Live Aplicación auxiliar de inicio de sesión - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe

O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe

O4 - HKLM\..\Run: [VAIO Recovery] C:\WINDOWS\Sonysys\VAIO Recovery\PartSeal.exe

O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe

O4 - HKLM\..\Run: [ISBMgr.exe] C:\Program Files\Sony\ISB Utility\ISBMgr.exe

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [AppMon Utility] C:\Program Files\Sony\AppMonUtil\AppMonUtility.exe @@@Start

O4 - HKLM\..\Run: [SonyPowerCfg] C:\Program Files\Sony\VAIO Power Management\SPMgr.exe

O4 - HKLM\..\Run: [Switcher.exe] C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe

O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE

O4 - HKLM\..\Run: [VAIOCameraUtility] "C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe"

O4 - HKLM\..\Run: [PartSeal] C:\WINDOWS\Sonysys\VAIO Recovery\PartSeal.exe

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [WService] WService.EXE

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\PROGRA~1\Yahoo!\MESSEN~1\YahooMessenger.exe" -quiet

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - S-1-5-18 Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (User 'SYSTEM')

O4 - .DEFAULT Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (User 'Default user')

O4 - .DEFAULT User Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (User 'Default user')

O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scanner/sources/es/scan8/oscan8.cab

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1256405533782

O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program Files\Sony\Image Converter 2\IcVzMon.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe

O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

O23 - Service: SonicStageMonitoring - Sony Corporation - C:\Program Files\Common Files\Sony Shared\WMPlugIn\SonicStageMonitoring.exe

O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe

O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe

O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Program Files\SigmaTel\C-Major Audio\WDM\StacSV.exe

O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe

O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe

O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe

O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe

O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe

O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe

O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe

O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe

O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe

O23 - Service: WinTab Service (WinTabService) - Tablet Driver - C:\WINDOWS\System32\Drivers\WTSRV.EXE



--

End of file - 14350 bytes





Es todo

[msc hotline sat]

No se aprecia ninguna clave sospechosa...



Veamos dos cosas, dice que envia mails a todas las direcciones de la libreta, pero por otro lado dice:



[i][b]Los mail van dirigidos a la siguiente dirección adriana_bl81@hotmail.com[/b][/i]



Van dirigidos a una direccion y las recibe todo el mundo ???



Otra cosa es que el remitente figure su cuenta de correo y no la esté enviando su ordenador, como lo hacen casi todos los que envian mails masivos actualmente, desde el NETSKY hasta el Bagle...



asi despistan sobre el origen y se las carga quien no es.



Ha visto que su router o en la relacion de correos enviados figuren estos que dice que ha enviado su ordenador ???



Si es el caso, lance el McAfee RootKit detective y posteenos el informe resultante:



ROOTKITDETECTIVE (ACCESO AL LINK DE DESCARGA)

http://download.nai.com/products/mcafee-avert/McafeeRootkitDetective.zip



saludos



ms, 15-12-2010

[Aguiladelfin1]

A ver si entiendo ...

esto es interesante: puede ser que no se estén enviando desde mi compu o desde el webmail?

Revisando las carpetas de elementos enviados tanto en webmail como en el outlook no se observa el envio de ningún correo con ese texto, ni tampoco correos de toda la libreta.

Me doy cuenta porque mis contactos comienzan a reclamarme por el envio de estos mails y algunos de las direcciones que no funcionan aparecen en la carpeta de entrada con la leyenda postmaster, error en el envío, etc.

En cuanto a la direccion de mail adriana_bl81@hotmail.com es la que aparece según copio a continuación el mensaje que me mandan como respuesta alguno de mis contactos cuando les pregunto que estoy enviando:



From: aguiladelfin@hotmail.com

To: adriana_bl81@hotmail.com

Subject: FW:

Date: Tue, 14 Dec 2010 22:31:54 +0000



I think this is a nice website,I like it very much.If you have time please browse it.Maybe you can find some products that are suitable for you.Their priciple is :100% original and brand new,100% satisfied! Their address is J ⊕www.owapay.com⊕



Espero alguna otra indicación para ver como corrijo esto.

Gracias

[Aguiladelfin1]

A continuacion va el informe del Rootkit





McAfee(R) Rootkit Detective 1.1 scan report

On 15-12-2010 at 17:45:20

OS-Version 5.1.2600

Service Pack 3.0

====================================



Object-Type: SSDT-hook

Object-Name: ZwClose

Object-Path: C:\WINDOWS\system32\drivers\aswSP.sys



Object-Type: SSDT-hook

Object-Name: ZwCreateKey

Object-Path: C:\WINDOWS\system32\drivers\aswSP.sys



Object-Type: SSDT-hook

Object-Name: ZwDeleteValueKey

Object-Path: C:\WINDOWS\system32\drivers\aswSP.sys



Object-Type: SSDT-hook

Object-Name: ZwDuplicateObject

Object-Path: C:\WINDOWS\system32\drivers\aswSP.sys



Object-Type: SSDT-hook

Object-Name: ZwOpenKey

Object-Path: C:\WINDOWS\system32\drivers\aswSP.sys



Object-Type: SSDT-hook

Object-Name: ZwOpenProcess

Object-Path: C:\WINDOWS\system32\drivers\aswSP.sys



Object-Type: SSDT-hook

Object-Name: ZwOpenThread

Object-Path: C:\WINDOWS\system32\drivers\aswSP.sys



Object-Type: SSDT-hook

Object-Name: ZwQueryValueKey

Object-Path: C:\WINDOWS\system32\drivers\aswSP.sys



Object-Type: SSDT-hook

Object-Name: ZwRestoreKey

Object-Path: C:\WINDOWS\system32\drivers\aswSP.sys



Object-Type: SSDT-hook

Object-Name: ZwSetValueKey

Object-Path: C:\WINDOWS\system32\drivers\aswSP.sys



Object-Type: Process

Object-Name: System Idle Process

Pid: 0

Object-Path:

Status: Visible



Object-Type: Process

Object-Name: AppMonUtility.e

Pid: 1860

Object-Path: C:\Program Files\Sony\AppMonUtil\AppMonUtility.exe

Status: Visible



Object-Type: Process

Object-Name: spoolsv.exe

Pid: 992

Object-Path: C:\WINDOWS\system32\spoolsv.exe

Status: Visible



Object-Type: Process

Object-Name: notepad.exe

Pid: 3132

Object-Path: C:\WINDOWS\system32\Notepad.exe

Status: Visible



Object-Type: Process

Object-Name: WService.exe

Pid: 312

Object-Path: C:\WINDOWS\system32\WService.EXE

Status: Visible



Object-Type: Process

Object-Name: smss.exe

Pid: 964

Object-Path: C:\WINDOWS\System32\smss.exe

Status: Visible



Object-Type: Process

Object-Name: svchost.exe

Pid: 1584

Object-Path: C:\WINDOWS\system32\svchost.exe

Status: Visible



Object-Type: Process

Object-Name: rundll32.exe

Pid: 1832

Object-Path: C:\WINDOWS\system32\RUNDLL32.EXE

Status: Visible



Object-Type: Process

Object-Name: YahooMessenger.

Pid: 2824

Object-Path: C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

Status: Visible



Object-Type: Process

Object-Name: utorrent.exe

Pid: 3320

Object-Path: C:\Program Files\uTorrent\utorrent.exe

Status: Visible



Object-Type: Process

Object-Name: System

Pid: 4

Object-Path:

Status: Visible



Object-Type: Process

Object-Name: mcrdsvc.exe

Pid: 3972

Object-Path: C:\WINDOWS\ehome\mcrdsvc.exe

Status: Visible



Object-Type: Process

Object-Name: ashWebSv.exe

Pid: 2112

Object-Path: C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

Status: Visible



Object-Type: Process

Object-Name: ISBMgr.exe

Pid: 1772

Object-Path: C:\Program Files\Sony\ISB Utility\ISBMgr.exe

Status: Visible



Object-Type: Process

Object-Name: jusched.exe

Pid: 284

Object-Path: C:\Program Files\Common Files\Java\Java Update\jusched.exe

Status: Visible



Object-Type: Process

Object-Name: iexplore.exe

Pid: 3508

Object-Path: C:\Program Files\Internet Explorer\IEXPLORE.EXE

Status: Visible



Object-Type: Process

Object-Name: IAANTmon.exe

Pid: 3168

Object-Path: C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe

Status: Visible



Object-Type: Process

Object-Name: NBService.exe

Pid: 4036

Object-Path: C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe

Status: Visible



Object-Type: Process

Object-Name: winlogon.exe

Pid: 1216

Object-Path: C:\WINDOWS\system32\winlogon.exe

Status: Visible



Object-Type: Process

Object-Name: ctfmon.exe

Pid: 596

Object-Path: C:\WINDOWS\system32\ctfmon.exe

Status: Visible



Object-Type: Process

Object-Name: msnmsgr.exe

Pid: 2580

Object-Path: C:\Program Files\Windows Live\Messenger\msnmsgr.exe

Status: Visible



Object-Type: Process

Object-Name: dllhost.exe

Pid: 2488

Object-Path: C:\WINDOWS\system32\dllhost.exe

Status: Visible



Object-Type: Process

Object-Name: DLACTRLW.EXE

Pid: 1900

Object-Path: C:\WINDOWS\System32\DLA\DLACTRLW.EXE

Status: Visible



Object-Type: Process

Object-Name: ehrecvr.exe

Pid: 2768

Object-Path: C:\WINDOWS\eHome\ehRecvr.exe

Status: Visible



Object-Type: Process

Object-Name: ashMaiSv.exe

Pid: 3760

Object-Path: C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

Status: Visible



Object-Type: Process

Object-Name: csrss.exe

Pid: 1188

Object-Path: C:\WINDOWS\system32\csrss.exe

Status: Visible



Object-Type: Process

Object-Name: ehSched.exe

Pid: 2924

Object-Path: C:\WINDOWS\eHome\ehSched.exe

Status: Visible



Object-Type: Process

Object-Name: VzFw.exe

Pid: 3048

Object-Path: C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe

Status: Visible



Object-Type: Process

Object-Name: alg.exe

Pid: 4164

Object-Path: C:\WINDOWS\System32\alg.exe

Status: Visible



Object-Type: Process

Object-Name: EvtEng.exe

Pid: 1716

Object-Path: C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

Status: Visible



Object-Type: Process

Object-Name: jqs.exe

Pid: 3204

Object-Path: C:\Program Files\Java\jre6\bin\jqs.exe

Status: Visible



Object-Type: Process

Object-Name: notepad.exe

Pid: 848

Object-Path: C:\WINDOWS\system32\Notepad.exe

Status: Visible



Object-Type: Process

Object-Name: svchost.exe

Pid: 1624

Object-Path: C:\WINDOWS\System32\svchost.exe

Status: Visible



Object-Type: Process

Object-Name: sqlservr.exe

Pid: 3608

Object-Path: C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe

Status: Visible



Object-Type: Process

Object-Name: VzCdbSvc.exe

Pid: 260

Object-Path: C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe

Status: Visible



Object-Type: Process

Object-Name: wlcomm.exe

Pid: 4104

Object-Path: C:\Program Files\Windows Live\Contacts\wlcomm.exe

Status: Visible



Object-Type: Process

Object-Name: wmiprvse.exe

Pid: 756

Object-Path: C:\WINDOWS\system32\wbem\wmiprvse.exe

Status: Visible



Object-Type: Process

Object-Name: ashServ.exe

Pid: 416

Object-Path: C:\Program Files\Alwil Software\Avast4\ashServ.exe

Status: Visible



Object-Type: Process

Object-Name: SkypeNames2.exe

Pid: 5624

Object-Path: C:\Program Files\Skype\Toolbars\Shared\SkypeNames2.exe

Status: Visible



Object-Type: Process

Object-Name: RegSrvc.exe

Pid: 2060

Object-Path: C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

Status: Visible



Object-Type: Process

Object-Name: aswUpdSv.exe

Pid: 356

Object-Path: C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

Status: Visible



Object-Type: Process

Object-Name: SonicStageMonit

Pid: 2216

Object-Path: C:\Program Files\Common Files\Sony Shared\WMPlugIn\SonicStageMonitoring.exe

Status: Visible



Object-Type: Process

Object-Name: SPMgr.exe

Pid: 1876

Object-Path: C:\Program Files\Sony\VAIO Power Management\SPMgr.exe

Status: Visible



Object-Type: Process

Object-Name: PIFSvc.exe

Pid: 3364

Object-Path: C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

Status: Visible



Object-Type: Process

Object-Name: svchost.exe

Pid: 2652

Object-Path: C:\WINDOWS\system32\svchost.exe

Status: Visible



Object-Type: Process

Object-Name: msimn.exe

Pid: 1164

Object-Path: C:\Program Files\Outlook Express\msimn.exe

Status: Visible



Object-Type: Process

Object-Name: explorer.exe

Pid: 576

Object-Path: C:\WINDOWS\Explorer.EXE

Status: Visible



Object-Type: Process

Object-Name: skypePM.exe

Pid: 2560

Object-Path: C:\Program Files\Skype\Plugin Manager\skypePM.exe

Status: Visible



Object-Type: Process

Object-Name: svchost.exe

Pid: 2312

Object-Path: C:\WINDOWS\system32\svchost.exe

Status: Visible



Object-Type: Process

Object-Name: iexplore.exe

Pid: 1692

Object-Path: C:\Program Files\Internet Explorer\IEXPLORE.EXE

Status: Visible



Object-Type: Process

Object-Name: svchost.exe

Pid: 2468

Object-Path: C:\WINDOWS\system32\svchost.exe

Status: Visible



Object-Type: Process

Object-Name: notepad.exe

Pid: 4452

Object-Path: C:\WINDOWS\system32\notepad.exe

Status: Visible



Object-Type: Process

Object-Name: services.exe

Pid: 1260

Object-Path: C:\WINDOWS\system32\services.exe

Status: Visible



Object-Type: Process

Object-Name: Skype.exe

Pid: 640

Object-Path: C:\Program Files\Skype\Phone\Skype.exe

Status: Visible



Object-Type: Process

Object-Name: ApntEx.exe

Pid: 1136

Object-Path: C:\Program Files\Apoint\Apntex.exe

Status: Visible



Object-Type: Process

Object-Name: symlcsvc.exe

Pid: 2872

Object-Path: C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

Status: Visible



Object-Type: Process

Object-Name: ashDisp.exe

Pid: 2036

Object-Path: C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

Status: Visible



Object-Type: Process

Object-Name: TeaTimer.exe

Pid: 548

Object-Path: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

Status: Visible



Object-Type: Process

Object-Name: svchost.exe

Pid: 3896

Object-Path: C:\WINDOWS\System32\svchost.exe

Status: Visible



Object-Type: Process

Object-Name: Apoint.exe

Pid: 1696

Object-Path: C:\Program Files\Apoint\Apoint.exe

Status: Visible



Object-Type: Process

Object-Name: ehmsas.exe

Pid: 5540

Object-Path: C:\WINDOWS\eHome\ehmsas.exe

Status: Visible



Object-Type: Process

Object-Name: svchost.exe

Pid: 1480

Object-Path: C:\WINDOWS\system32\svchost.exe

Status: Visible



Object-Type: Process

Object-Name: nvsvc32.exe

Pid: 240

Object-Path: C:\WINDOWS\system32\nvsvc32.exe

Status: Visible



Object-Type: Process

Object-Name: wscntfy.exe

Pid: 4208

Object-Path: C:\WINDOWS\system32\wscntfy.exe

Status: Visible



Object-Type: Process

Object-Name: S24EvMon.exe

Pid: 1760

Object-Path: C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

Status: Visible



Object-Type: Process

Object-Name: Rootkit_Detecti

Pid: 5728

Object-Path: C:\Mis Documentos\Temporal\Antivirus\McafeeRootkitDetective\Rootkit_Detective.exe

Status: Visible



Object-Type: Process

Object-Name: lsass.exe

Pid: 1296

Object-Path: C:\WINDOWS\system32\lsass.exe

Status: Visible



Object-Type: Process

Object-Name: IAAnotif.exe

Pid: 1544

Object-Path: C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe

Status: Visible



Object-Type: Process

Object-Name: VCUServe.exe

Pid: 1916

Object-Path: C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe

Status: Visible



Object-Type: Process

Object-Name: iexplore.exe

Pid: 4396

Object-Path: C:\Program Files\Internet Explorer\IEXPLORE.EXE

Status: Visible



Object-Type: Process

Object-Name: svchost.exe

Pid: 1948

Object-Path: C:\WINDOWS\system32\svchost.exe

Status: Visible



Object-Type: Process

Object-Name: VCSW.exe

Pid: 3560

Object-Path: C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe

Status: Visible



Object-Type: Process

Object-Name: svchost.exe

Pid: 1980

Object-Path: C:\WINDOWS\system32\svchost.exe

Status: Visible



Object-Type: Process

Object-Name: PhotoshopElemen

Pid: 2724

Object-Path: C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe

Status: Visible



Object-Type: Process

Object-Name: ehtray.exe

Pid: 1640

Object-Path: C:\WINDOWS\ehome\ehtray.exe

Status: Visible



Object-Type: Process

Object-Name: Switcher.exe

Pid: 1888

Object-Path: C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe

Status: Visible



Object-Type: Process

Object-Name: stacsv.exe

Pid: 2384

Object-Path: C:\Program Files\SigmaTel\C-Major Audio\WDM\StacSV.exe

Status: Visible



Object-Type: Process

Object-Name: VESMgr.exe

Pid: 3036

Object-Path: C:\Program Files\Sony\VAIO Event Service\VESMgr.exe

Status: Visible



Object-Type: Process

Object-Name: WtSrv.exe

Pid: 3780

Object-Path: C:\WINDOWS\System32\Drivers\WTSRV.EXE

Status: Visible



Scan complete. No hidden processes/files found.

Total files scanned: 101331

[msc hotline sat]

Pues no se trata de ningun rootkit de fichero:



"No hidden processes/files found."



por si fuera de MBR, puede arrancar con el CD de instalacion y pulsar R para acceder a la CONSOLA DE RECUPERACION, y desde alli ejecutar FIXMBR, pero vamos por lo que nos indica, esto mas bien parece un virus que envia mails masivos con tecnicas de SPOOFING, o falseo de remitente, pero por lo que parece, tambien de destinatario, ya que si en todos aparece



To: adriana_bl81@hotmail.com



está claro que no es el que ha utilizado en el envio, y posiblemente tampoco el del remitente, por lo que, como ya es sabido que muchos lo hacen, puede estar enviándolo algun conocido con amigos y direcciones comunes, a los que el virus envia dicho mail indicandolo que lo hace un tercero, en este caso Vd.



Esto ya es antiguo, ya el KLEZ empezó a hacerlo, y nos mareo lo suyo, y luego casi todos los que envian mails lo imitaron, pues despista y confunde a los afectados !



Cuentanos tus progresos al respecto, gracias



saludos



ms, 16/12/2010

[Aguiladelfin1]

Interesante asunto este. Pero como se entiende que vengan a parar a mi bandeja de entrada los postmaster de los correos de mi libreta que están fuera de uso o desactivados?

Si bien el virus no está en mi maquina como llegan a la bandeja de entrada los mail rebotados o que ya no existen?

Esta parte no la entiendo.

[msc hotline sat]

Sí, claro:



Las direcciones pbsoletas a las que se envian mails desde la máquina infectada, vuelven al destinatario como RETURNED OR DELIVERY FAILED, y a quien van a devolverlas... ??? pues al que figura en el remitente, que en este caso eres tú



Esto es lógico, pero de entrada sorprende y hace sospechar de que eres el que tiene el virus, pero una vez le has visto el plumero, se entiende perfectamente.



Y es que el que figura como remitente no solo recibe los mails devueltos, sino las broncas de quienes reciben el mail, pues se piensan que es quien se lo ha enviado.



Y el verdadero emisor de los mails, no se entera, ni nadie le puede avisar, como con los virus de mail anteriores, para que elimine el virus y deje de propagarlo.



Es un truco que les ha dado buen resultado, y que ha conseguido que algunos de estos virus hayan incordiado sin poderlo evitar, hasta que por lentitud, o por actualizacion del antivirus, el que está infectado lo detecta y elimina.



Creo que fue a primeros del 2002 cuando apareció el primer KLEZ y sobre el 2004 el primer NETSKY y estos sentaron cátedra. Ahora casi todos los virus que envian mails utilizan la técnica SPOOFING para lograr despistar y mantenerse el máximo tiempo posible en los ordenadores que infecta.



Ha quedado claro? Y no me sorprende la pregunta, pues nos la han hecho casi todos los usuarios que han recibido devueltos "sus" mails sin detectar virus... y han sido miles !



SI tienes alguna otra duda, adelante. Es posible que ya tengamos la respuesta :)



saludos



ms, 16-12-2010

[Aguiladelfin1]

Muy clara la respuesta y ojalá le sirva a muchos.

No tengo el virus pero si la bronca de mis contactos que no paran de enviarme mails pidiendome que deje de enviarles "porquerias". En definitiva es como si tuviera el virus.

Falta ver como resuelvo esto.

Por mi parte el tema ha quedado resuelto.

Muchas gracias.

[msc hotline sat]

No, es peor que si tuviera el virus, porque si asi fuera, lo eliminaríamos y listos :wink:



Pero ahora tiene que esperar a que el infectado se dé cuenta y lo limpie...



Hay una manera de descubrir quien es, mirando las direcciones que no conozca de los mails devueltos, y pensando en quien las pudo tener... Así se ha descubierto mas de uno infectado que no sabía que lo estaba, pero hace falta paciencia y suerte !



Deseamos que tenga éxito en la búsqueda, y dando el Tema por solucionado, procedemos a cerrarlo



Si nos necesita de nuevo, ya sabe donde estamos



saludos



ms, 17-12-2010