Losing space on the HD and virus - Free Antivirus Forum

Losing space on the HD and virus

BullGuard Antivirus Forum > Virus Removal > Removal Help > Losing space on the HD and virus

Forum Quick Jump

[ << Previous Thread | Next Thread >> ]

JeromeMorrow

Date Joined Jan 2008
Total Posts : 0

Posted 1-28-2008 4:41 (GMT +1)

Hi I found this virus (with nod32, kasperky, avast!):

win/32.bagle.MH.worm
Win32.Trojan-gen {UPX]
Trojan.Win32.Delf.acq
Win32.Adware-gen [Adw]

I noticed that my HD began to lose space quicky... some GB per day.

I Follow the link "Before posting a log"... and this are the result:

********************************* ROOTCHK-(28-12-07)-LOG, by ejvindh
28/01/2008 4:22:22,25

NOTICE!! Rootchk is not being updated anymore, and is thus gradually getting outdated.
Last update was made 28-12-07

The rootkits that are detected by this tool were not found.

********************************* ROOTCHK-LOG-end

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-28 04:22:23
Windows 6.0.6000
scanning hidden processes ...

scanning hidden services & system hive ...
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001a921c4381]
"00027280fab1"=hex:3b,2b,eb,27,a3,be,fc,3d,52,33,ff,56,63,37,13,ee
"008025118f79"=hex:0b,3d,0e,14,69,fc,f9,55,5c,64,f3,04,1d,01,bc,44
"0016cfd86198"=hex:8e,f3,52,ed,65,99,1d,37,5e,38,4f,e6,40,cd,c9,cf
"080037bacd81"=hex:51,bc,22,7c,f9,04,fa,8b,9a,be,b6,b9,65,5f,cf,2c
"001237bacd81"=hex:f5,bf,a7,06,61,87,ed,bf,78,a1,bb,46,58,1e,1f,49
"0007616db243"=hex:94,61,ed,8e,aa,88,43,a5,00,93,0a,e2,04,90,f3,7b
"001963c71c78"=hex:0a,23,7a,14,f0,c9,ad,1a,f5,96,6a,c7,3d,fa,d0,7e
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:56c776a1
"s2"=dword:36d4cd87
"h0"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"p0"="C:\Program Files\Alcohol Soft\Alcohol 52\"
"h0"=dword:00000000
"ujdew"=hex:4c,b7,31,39,fe,e5,79,10,47,6c,6b,9c,30,60,39,a6,01,14,5e,bd,15,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\001a921c4381]
"00027280fab1"=hex:3b,2b,eb,27,a3,be,fc,3d,52,33,ff,56,63,37,13,ee
"008025118f79"=hex:0b,3d,0e,14,69,fc,f9,55,5c,64,f3,04,1d,01,bc,44
"0016cfd86198"=hex:8e,f3,52,ed,65,99,1d,37,5e,38,4f,e6,40,cd,c9,cf
"080037bacd81"=hex:51,bc,22,7c,f9,04,fa,8b,9a,be,b6,b9,65,5f,cf,2c
"001237bacd81"=hex:f5,bf,a7,06,61,87,ed,bf,78,a1,bb,46,58,1e,1f,49
"0007616db243"=hex:94,61,ed,8e,aa,88,43,a5,00,93,0a,e2,04,90,f3,7b
"001963c71c78"=hex:0a,23,7a,14,f0,c9,ad,1a,f5,96,6a,c7,3d,fa,d0,7e
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"p0"="C:\Program Files\Alcohol Soft\Alcohol 52\"
"h0"=dword:00000000
"ujdew"=hex:4c,b7,31,39,fe,e5,79,10,47,6c,6b,9c,30,60,39,a6,01,14,5e,bd,15,..

scanning hidden registry entries ...

scanning hidden files ...

hidden processes: 0
hidden services: 0
hidden files: 0

ComboFix 08-01-23.1C - Juan Ignacio 2008-01-28 3:53:42.1 - NTFSx86
Microsoft® Windows Vista™ Business 6.0.6000.0.1252.1.3082.18.2106 [GMT 1:00]
Se ejecuta desde: D:\Users\Juan Ignacio\Downloads\ComboFix.exe
* Creado un nuevo punto de restauración
.

(((((((((((((((((((((((((((((((((((( Otras eliminaciones )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\WebGuide
C:\Program Files\WebGuide\WebGuide4\app_data\config_error.txt
C:\Program Files\WebGuide\WebGuide4\app_data\config_log.txt
C:\Program Files\WebGuide\WebGuide4\app_data\roles.xml
C:\Program Files\WebGuide\WebGuide4\app_data\settings.xml
C:\Program Files\WebGuide\WebGuide4\app_data\users.xml
C:\Program Files\WebGuide\WebGuide4\app_data\WGStreamService_log.txt
C:\Program Files\WebGuide\WebGuide4\bin\WebGuideServicedComponent.tlb
C:\Users\Juan Ignacio\AppData\Roaming\inst.exe
C:\Windows\msvrc20.dll
C:\Windows\system32\x64

.
(((((((((((((((((( Archivos creados desde 2007-12-28 - 2008-01-28 )))))))))))))))))))))))))))))))))
.

2008-01-28 03:50 . 2000-08-31 08:00 51,200 --a------ C:\Windows\Nircmd.exe
2008-01-28 02:40 . 2007-05-30 13:10 10,872 --a------ C:\Windows\System32\drivers\AvgAsCln.sys
2008-01-28 02:15 . 2008-01-28 02:15 2,560 --a------ C:\Windows\_MSRSTRT.EXE
2008-01-27 21:02 . 2008-01-27 21:02 <DIR> d-------- C:\Program Files\Trend Micro
2008-01-27 19:08 . 2008-01-27 19:08 <DIR> d-------- C:\Program Files\Lavasoft
2008-01-27 19:06 . 2008-01-27 19:06 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-01-27 18:23 . 2007-12-04 15:51 42,912 --a------ C:\Windows\System32\drivers\aswTdi.sys
2008-01-27 18:23 . 2007-12-04 15:53 23,152 --a------ C:\Windows\System32\drivers\aswRdr.sys
2008-01-27 18:21 . 2007-12-04 13:54 95,608 --a------ C:\Windows\System32\AvastSS.scr
2008-01-27 18:20 . 2008-01-27 18:20 <DIR> d-------- C:\Program Files\Alwil Software
2008-01-27 18:20 . 2007-12-04 14:04 837,496 --a------ C:\Windows\System32\aswBoot.exe
2008-01-27 18:20 . 2004-01-09 10:13 380,928 --a------ C:\Windows\System32\actskin4.ocx
2008-01-27 18:20 . 2007-12-04 15:52 45,648 --a------ C:\Windows\System32\drivers\aswMonFlt.sys
2008-01-27 13:46 . 2008-01-27 13:46 91,492 --a------ C:\Windows\System32\drivers\klin.dat
2008-01-27 13:46 . 2008-01-27 13:46 85,860 --a------ C:\Windows\System32\drivers\klick.dat
2008-01-27 13:44 . 2008-01-27 13:44 <DIR> d-------- C:\Program Files\Kaspersky Lab
2008-01-27 13:44 . 2008-01-28 04:09 26,250,400 --ahs---- C:\Windows\System32\drivers\fidbox.dat
2008-01-27 13:44 . 2008-01-28 03:59 352,424 --ahs---- C:\Windows\System32\drivers\fidbox.idx
2008-01-27 13:36 . 2008-01-27 13:36 <DIR> d-------- C:\kav
2008-01-27 07:32 . 2008-01-27 07:32 <DIR> d-------- C:\Program Files\CCleaner
2008-01-27 07:26 . 2008-01-27 07:26 <DIR> d-------- C:\Windows\System32\Kaspersky Lab
2008-01-27 07:24 . 2008-01-27 07:26 <DIR> d-------- C:\Program Files\EsetOnlineScanner
2008-01-26 21:51 . 2008-01-26 21:51 <DIR> d-------- C:\Program Files\Defraggler
2008-01-26 21:31 . 2008-01-27 14:52 <DIR> d-------- C:\Windows\BDOSCAN8
2008-01-26 21:15 . 2008-01-26 21:15 <DIR> d-------- C:\Program Files\Microsoft Silverlight
2008-01-26 20:11 . 2008-01-26 20:12 <DIR> d-------- C:\Program Files\Disk Cleaner
2008-01-26 19:37 . 2008-01-26 15:30 240,979 --a------ C:\Windows\8445-frenchfrog-Laptop_vista.ico
2008-01-26 16:35 . 2008-01-26 16:58 <DIR> d-------- C:\Program Files\Norton Internet Security
2008-01-09 14:10 . 2007-10-18 08:55 188,416 --a------ C:\Windows\System32\igfxres.dll
2008-01-09 13:55 . 2008-01-09 13:55 802,816 --a------ C:\Windows\System32\drivers\tcpip.sys
2008-01-09 13:55 . 2008-01-09 13:55 216,760 --a------ C:\Windows\System32\drivers\netio.sys
2008-01-09 13:55 . 2008-01-09 13:55 167,424 --a------ C:\Windows\System32\tcpipcfg.dll
2008-01-09 13:55 . 2008-01-09 13:55 24,064 --a------ C:\Windows\System32\netcfg.exe
2008-01-09 13:55 . 2008-01-09 13:55 22,016 --a------ C:\Windows\System32\netiougc.exe
2008-01-09 13:53 . 2008-01-09 13:53 4,247,552 --a------ C:\Windows\System32\GameUXLegacyGDFs.dll
2008-01-09 13:53 . 2008-01-09 13:53 1,686,016 --a------ C:\Windows\System32\gameux.dll
2008-01-09 13:52 . 2008-01-09 13:52 1,060,920 --a------ C:\Windows\System32\drivers\ntfs.sys
2008-01-09 13:52 . 2008-01-09 13:52 211,000 --a------ C:\Windows\System32\drivers\volsnap.sys
2008-01-09 13:52 . 2008-01-09 13:52 154,624 --a------ C:\Windows\System32\drivers\nwifi.sys
2008-01-09 13:52 . 2008-01-09 13:52 109,624 --a------ C:\Windows\System32\drivers\ataport.sys
2008-01-09 13:52 . 2008-01-09 13:52 45,112 --a------ C:\Windows\System32\drivers\pciidex.sys
2008-01-09 13:52 . 2008-01-09 13:52 21,560 --a------ C:\Windows\System32\drivers\atapi.sys
2008-01-09 13:52 . 2008-01-09 13:52 17,464 --a------ C:\Windows\System32\drivers\intelide.sys
2008-01-09 13:52 . 2008-01-09 13:52 11,776 --a------ C:\Windows\System32\sbunattend.exe

.
(((((((((((((((((((((((((((((((((((((( Reporte Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-28 03:01 45,056 ----a-w C:\Windows\System32\acovcnt.exe
2008-01-28 01:26 22,528 ----a-w C:\Windows\system32\drivers\nhcDriver.sys
2008-01-28 01:19 --------- d-----w C:\Program Files\LphantBar
2008-01-27 01:01 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-26 19:09 --------- d-----w C:\Program Files\PDF Annotator
2008-01-26 17:59 --------- d-----w C:\Program Files\RocketDock
2008-01-26 17:14 --------- d-----w C:\Program Files\Sony Setup
2008-01-26 17:14 --------- d-----w C:\Program Files\Protector Suite QL
2008-01-26 17:14 --------- d-----w C:\Program Files\Microsoft Works
2008-01-26 17:14 --------- d-----w C:\Program Files\google
2008-01-26 17:14 --------- d-----w C:\Program Files\East-Tec Eraser 2007
2008-01-26 17:14 --------- d-----w C:\Program Files\Common Files\Skype
2008-01-26 17:14 --------- d-----w C:\Program Files\Common Files\LightScribe
2008-01-26 15:58 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-01-26 01:26 --------- d-----w C:\Program Files\Microsoft
2008-01-20 13:11 --------- d-----w C:\Program Files\Lx_cats
2008-01-11 06:22 --------- d-----w C:\Program Files\Participatory Culture Foundation
2008-01-09 12:57 --------- d-----w C:\Program Files\Windows Sidebar
2008-01-09 12:57 --------- d-----w C:\Program Files\Windows Mail
2008-01-09 12:53 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-01-09 12:53 449,024 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-01-09 12:53 2,143,744 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-01-09 12:53 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2007-12-17 23:44 219,664 ----a-w C:\Windows\System32\klogon.dll
2007-12-17 23:43 23,396 ----a-w C:\Windows\system32\drivers\klopp.dat
2007-12-16 18:51 --------- d-----w C:\Program Files\DUE
2007-12-16 16:14 --------- d-----w C:\Program Files\ElcomSoft
2007-12-16 15:31 --------- d-----w C:\Program Files\ARPR
2007-12-16 13:00 --------- d-----w C:\Program Files\Mindjet
2007-12-16 12:47 --------- d-----w C:\Program Files\VS Revo Group
2007-12-15 17:27 --------- d-----w C:\Program Files\Mindjet Labs
2007-12-14 10:32 12,632 ----a-w C:\Windows\System32\lsdelete.exe
2007-12-11 23:42 --------- d-----w C:\Program Files\DivX
2007-12-11 23:42 --------- d-----w C:\Program Files\Common Files\PX Storage Engine
2007-12-11 19:45 9,728 ----a-w C:\Windows\System32\LAPRXY.DLL
2007-12-11 19:45 223,232 ----a-w C:\Windows\System32\WMASF.DLL
2007-12-11 19:45 1,327,104 ----a-w C:\Windows\System32\quartz.dll
2007-12-11 19:44 824,832 ----a-w C:\Windows\System32\wininet.dll
2007-12-11 19:44 56,320 ----a-w C:\Windows\System32\iesetup.dll
2007-12-11 19:44 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2007-12-11 19:44 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
2007-12-11 19:43 84,992 ----a-w C:\Windows\system32\drivers\srvnet.sys
2007-12-11 19:43 58,368 ----a-w C:\Windows\system32\drivers\mrxsmb20.sys
2007-12-11 19:43 130,048 ----a-w C:\Windows\system32\drivers\srv2.sys
2007-12-11 19:43 101,888 ----a-w C:\Windows\system32\drivers\mrxsmb.sys
2007-12-11 19:41 3,504,824 ----a-w C:\Windows\System32\ntkrnlpa.exe
2007-12-11 19:41 3,470,520 ----a-w C:\Windows\System32\ntoskrnl.exe
2007-12-10 08:35 --------- d-----w C:\Program Files\Easy CD-DA Extractor 10
2007-12-07 16:37 --------- d-----w C:\Program Files\PrinterAnywhere
2007-12-04 18:38 524,288 ----a-w C:\Windows\System32\DivXsm.exe
2007-12-04 18:38 3,596,288 ----a-w C:\Windows\System32\qt-dx331.dll
2007-12-04 18:38 200,704 ----a-w C:\Windows\System32\ssldivx.dll
2007-12-04 18:38 1,044,480 ----a-w C:\Windows\System32\libdivx.dll
2007-12-04 18:36 823,296 ----a-w C:\Windows\System32\divx_xx0c.dll
2007-12-04 18:36 823,296 ----a-w C:\Windows\System32\divx_xx07.dll
2007-12-04 18:36 81,920 ----a-w C:\Windows\System32\dpl100.dll
2007-12-04 18:36 802,816 ----a-w C:\Windows\System32\divx_xx11.dll
2007-12-04 18:36 682,496 ----a-w C:\Windows\System32\DivX.dll
2007-12-04 18:36 593,920 ----a-w C:\Windows\System32\dpuGUI11.dll
2007-12-04 18:36 57,344 ----a-w C:\Windows\System32\dpv11.dll
2007-12-04 18:36 53,248 ----a-w C:\Windows\System32\dpuGUI10.dll
2007-12-04 18:36 344,064 ----a-w C:\Windows\System32\dpus11.dll
2007-12-04 18:36 294,912 ----a-w C:\Windows\System32\dpu11.dll
2007-12-04 18:36 294,912 ----a-w C:\Windows\System32\dpu10.dll
2007-12-04 18:36 196,608 ----a-w C:\Windows\System32\dtu100.dll
2007-12-04 18:35 156,992 ----a-w C:\Windows\System32\DivXCodecVersionChecker.exe
2007-12-04 18:35 12,288 ----a-w C:\Windows\System32\DivXWMPExtType.dll
2007-12-02 18:28 18,599,936 ----a-w C:\Windows\System32\imageres.dll
2007-12-02 18:10 --------- d-----w C:\Program Files\Stardock
2007-12-01 23:55 --------- d-----w C:\Program Files\Switcher
2007-12-01 20:37 --------- d-----w C:\Program Files\SyncToy 2.0 Beta
2007-11-30 13:49 --------- d-----w C:\Program Files\Windows Live
2007-08-30 09:03 174 --sha-w C:\Program Files\desktop.ini
2007-08-19 08:46 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012007081920070820\index.dat
.

((((((((((((((((((((((((((((((((( Cargando Puntos Reg ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* entradas vac¡as & entradas leg¡timas predeterminadas no son mostradas

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{07A11D74-9D25-4fea-A833-8B0D76A5577A}]
2007-05-17 23:05 71184 -ra------ C:\Program Files\Mindjet\MindManager 7\Mm7InternetExplorer.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlay]
@={F2F31467-B1AC-4df0-AE79-FD5FA085E22B}

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlayOpen]
@={A3E208F7-0E3A-4182-A7A6-B169D5D691AA}

[HKEY_CLASSES_ROOT\CLSID\{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}]
2006-10-04 21:17 2652672 --a------ C:\Program Files\Protector Suite QL\farchns.dll

[HKEY_CLASSES_ROOT\CLSID\{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}]
2006-10-04 21:17 2652672 --a------ C:\Program Files\Protector Suite QL\farchns.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-09 13:52 1232896]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]
"RocketDock"="C:\Program Files\RocketDock\RocketDock.exe" [2007-09-02 13:58 495616]
"NB Probe"="" []
"googletalk"="C:\Users\Juan Ignacio\AppData\Roaming\Google\Google Talk\googletalk.exe" [2007-01-01 22:22 3739648]
"Start++"="C:\Program Files\Brandon Paddock\Start++\Start++.exe" [2007-09-26 14:03 577536]
"Switcher"="C:\Program Files\Switcher\Switcher.exe" [2007-10-28 11:35 425984]
"VistaBatterySaver"="C:\Program Files\SharpSoft\Vista Battery Saver\VistaBatterySaver.exe" [2007-08-24 23:11 479232]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-04-10 23:04 1006264]
"SMSERIAL"="sm56hlpr.exe" [2005-05-26 16:12 544768 C:\Windows\sm56hlpr.exe]
"PSQLLauncher"="C:\Program Files\Protector Suite QL\launcher.exe" [2006-10-04 20:46 43520]
"IFXSPMGT"="C:\Windows\system32\IFXSPMGT.exe" [2006-11-13 07:23 661024]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-11-22 06:27 815104]
"VX3000"="C:\Windows\vVX3000.exe" [2006-12-05 14:39 707360]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 14:40 155648]
"LifeCam"="C:\Program Files\Microsoft LifeCam\LifeExp.exe" [2007-01-12 16:48 275800]
"VirtualCloneDrive"="C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2006-04-29 14:21 94208]
"LXCFCATS"="C:\Windows\system32\spool\DRIVERS\W32X86\3\LXCFtime.dll" [2005-07-20 18:47 73728]
"Windows Mobile Device Center"="%windir%\WindowsMobile\wmdc.exe" [ ]
"LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2007-02-07 15:21 54832]
"MMReminderService"="C:\Program Files\Mindjet\MindManager 7\MMReminderService.exe" [2007-05-17 23:05 37392]
"NotebookHardwareControl"="C:\Program Files\Notebook Hardware Control\nhc.exe" [2007-05-04 17:16 2629632]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11 132496]
"RtHDVCpl"="RtHDVCpl.exe" [2007-09-10 14:20 4702208 C:\Windows\RtHDVCpl.exe]
"Skytel"="Skytel.exe" [2007-08-03 12:22 1826816 C:\Windows\SkyTel.exe]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 16:15 81920]
"SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 09:03 210472]
"PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2007-08-07 01:05 200704]
"Acrobat Assistant 8.0"="C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2007-05-10 22:46 624248]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 07:00 33648]
"IgfxTray"="C:\Windows\system32\igfxtray.exe" [2007-10-18 09:19 141848]
"HotKeysCmds"="C:\Windows\system32\hkcmd.exe" [2007-10-18 09:18 166424]
"Persistence"="C:\Windows\system32\igfxpers.exe" [2007-10-18 09:18 133656]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" [2007-12-18 00:43 227856]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312]

C:\Users\Juan Ignacio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
ChkMail.lnk - C:\Program Files\ChkMail\ChkMail\ChkMail.exe [2007-03-14 23:38:17 737280]
Recorte de pantalla e Inicio r pido de OneNote 2007.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2007-08-24 04:45:42 101784]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableCAD"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
C:\Windows\system32\psqlpwd.dll 2006-10-04 21:05 52224 C:\Windows\System32\psqlpwd.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\ARCHIV~1\Google\GOOGLE~2\GOEC62~1.DLL,C:\PROGRA~1\KASPER~1\KASPER~1.0\r3hook.dll,C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2007-06-29 05:24 286720 C:\Program Files\quicktime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--------- 2007-02-07 15:24 71216 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"LogMeIn GUI"="C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
"Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
"QuickTime Task"="C:\Program Files\VistaCodecPack\QT\qttask.exe" -atboottime

R0 psecbdr;psecbdr;C:\Windows\system32\Drivers\psecbdr.sys [2006-09-06 15:08]
R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;C:\Windows\system32\DRIVERS\klim6.sys [2007-10-16 11:05]
R1 PersonalSecureDrive;PersonalSecureDrive;C:\Windows\system32\drivers\psd.sys [2006-10-12 13:37]
R2 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B};C:\Program Files\CyberLink\PowerDVD\000.fcl [2006-11-02 15:51]
R2 ASLDRService;ASLDR Service;C:\Program Files\ATK Hotkey\ASLDRSrv.exe [2006-12-20 22:59]
R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2007-12-04 15:52]
R2 ghaio;ghaio;C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys [2006-12-28 09:17]
R2 MSCamSvc;MSCamSvc;"C:\Program Files\Microsoft LifeCam\MSCamS32.exe" [2007-01-04 13:13]
R2 Notebook Hardware Control Service;Notebook Hardware Control Service;C:\Program Files\Notebook Hardware Control\nhcservice.exe [2007-09-30 22:02]
R2 RapiMgr;Windows Mobile-based device connectivity;C:\Windows\system32\svchost.exe [2006-11-02 10:45]
R2 WcesComm;Windows Mobile-2003-based device connectivity;C:\Windows\system32\svchost.exe [2006-11-02 10:45]
R3 igfx;igfx;C:\Windows\system32\DRIVERS\igdkmd32.sys [2007-10-18 09:05]
R3 NETw3v32;Controlador del adaptador Intel(R) PRO/Wireless 3945ABG para Windows Vista de 32 bits;C:\Windows\system32\DRIVERS\NETw3v32.sys [2006-12-19 02:12]
R3 RegKill;RegKill;C:\Windows\system32\Drivers\RegKill.sys [2007-02-16 01:56]
R3 RTL8169;Realtek 8169 NT Driver;C:\Windows\system32\DRIVERS\Rtlh86.sys [2007-08-03 09:44]
R3 RTSTOR;USB Mass Storage Device;C:\Windows\system32\drivers\RTSTOR.SYS [2006-11-11 00:08]
R3 TBS;Servicios de base TPM;C:\Windows\System32\svchost.exe [2006-11-02 10:45]
R3 TcUsb;TC USB Kernel Driver;C:\Windows\system32\Drivers\tcusb.sys [2006-10-04 20:38]
R3 TPM;TPM;C:\Windows\system32\drivers\tpm.sys [2006-11-02 10:50]
R3 WCPU;WCPU;C:\Program Files\P4G\WCPU.sys [2007-01-02 23:37]
S2 gupdate;Google Update Service;"C:\Program Files\Google\Update\1.0.103.0\GoogleUpdate.exe" [2008-01-13 13:35]
S3 AF05BDA;AF9005 BDA Device;C:\Windows\system32\drivers\AF05BDA.sys [2006-03-02 16:24]
S3 NETw4v32;Controlador del adaptador Intel(R) Wireless WiFi Link para Windows Vista de 32 bits;C:\Windows\system32\DRIVERS\NETw4v32.sys [2007-09-11 23:56]
S3 w300bus;Sony Ericsson W300 Driver driver (WDM);C:\Windows\system32\DRIVERS\w300bus.sys [2006-03-13 15:49]
S3 w300mdfl;Sony Ericsson W300 USB WMC Modem Filter;C:\Windows\system32\DRIVERS\w300mdfl.sys [2006-03-13 15:50]
S3 w300mdm;Sony Ericsson W300 USB WMC Modem Driver;C:\Windows\system32\DRIVERS\w300mdm.sys [2006-03-13 15:50]
S3 w300mgmt;Sony Ericsson W300 USB WMC Device Management Drivers (WDM);C:\Windows\system32\DRIVERS\w300mgmt.sys [2006-03-13 15:50]
S3 w300obex;Sony Ericsson W300 USB WMC OBEX Interface;C:\Windows\system32\DRIVERS\w300obex.sys [2006-03-13 15:50]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalService REG_MULTI_SZ nsi lltdsvc SSDPSRV upnphost SCardSvr w32time EventSystem RemoteRegistry WinHttpAutoProxySvc lanmanworkstation TBS SLUINotify THREADORDER fdrespub netprofm fdphost wcncsvc QWAVE WebClient
LocalSystemNetworkRestricted REG_MULTI_SZ hidserv UxSms WdiSystemHost Netman trkwks AudioEndpointBuilder WUDFSvc irmon sysmain IPBusEnum dot3svc PcaSvc CscService TabletInputService UmRdpService wlansvc WPDBusEnum EMDMgmt
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
LocalServiceNetworkRestricted REG_MULTI_SZ DHCP eventlog AudioSrv LmHosts wscsvc p2pimsvc PNRPSvc p2psvc PnrpAutoReg
bthsvcs REG_MULTI_SZ BthServ
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1456a5d2-d279-11db-aeb0-806e6f6e6963}]
\shell\AutoRun\command - I:\autorun.bat

*Newly Created Service* - AVGASCLN
.
Contenido de carpeta 'Tareas Programadas'
"2007-12-17 20:30:06 C:\Windows\Tasks\Advanced WindowsCare V2 Pro.job"
- C:\Program Files\IObit\Advanced WindowsCare V2 Pro\AutoCare.exe
"2008-01-28 03:02:10 C:\Windows\Tasks\AutoSmartDefrag.job"
- C:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe
"2008-01-28 03:02:10 C:\Windows\Tasks\GoogleUpdateTask.job"
- C:\Program Files\Google\Update\1.0.103.0\GoogleUpdate.exe
"2008-01-27 11:00:22 C:\Windows\Tasks\Security Platform Backup Schedule.job"
- C:\Program Files\Infineon\Security Platform Software\SpBackupWz.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-28 04:07:21
Windows 6.0.6000 NTFS

escaneando procesos ocultos ...

escaneando entradas ocultas de autostart ...

escaneando archivos ocultos ...

el escaneo se completo con exito
archivos ocultos: 0

**************************************************************************
.
--------------------- DLLs cargados bajo los procesos en ejecuci¢n ---------------------

PROCESS: C:\Windows\Explorer.EXE [6.00.6000.16549]
-> C:\Program Files\Brandon Paddock\Start++\SPPHookDll32.dll
-> C:\Program Files\RocketDock\RocketDock.dll
.
Tiempo completado: 2008-01-28 4:17:37 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-28 03:17:33
.
2008-01-26 17:40:39 --- E O F ---

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:33:16, on 28/01/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16575)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\conime.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\sm56hlpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\vVX3000.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\Windows\WindowsMobile\wmdc.exe
C:\Program Files\Mindjet\MindManager 7\MmReminderService.exe
C:\Program Files\java\jre1.6.0_03\bin\jusched.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\acrotray.exe
C:\Program Files\Protector Suite QL\psqltray.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Users\Juan Ignacio\AppData\Roaming\Google\Google Talk\googletalk.exe
C:\Program Files\Brandon Paddock\Start++\Start++.exe
C:\Program Files\Switcher\Switcher.exe
C:\Program Files\SharpSoft\Vista Battery Saver\VistaBatterySaver.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Windows\system32\igfxsrvc.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Infineon\Security Platform Software\PSDrt.exe
C:\Program Files\Infineon\Security Platform Software\SpTna.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\PROGRA~1\Mozilla Firefox\firefox.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Aplicación auxiliar de vínculos de Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: CmjBrowserHelperObject Object - {07A11D74-9D25-4fea-A833-8B0D76A5577A} - C:\Program Files\Mindjet\MindManager 7\Mm7InternetExplorer.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O2 - BHO: Google Gears Helper - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Program Files\Google\Google Gears\Internet Explorer\0.1.54.0\gears.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [PSQLLauncher] "C:\Program Files\Protector Suite QL\launcher.exe" /startup
O4 - HKLM\..\Run: [IFXSPMGT] C:\Windows\system32\IFXSPMGT.exe /NotifyLogon
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [VX3000] C:\Windows\vVX3000.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [LXCFCATS] rundll32 C:\Windows\system32\spool\DRIVERS\W32X86\3\LXCFtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [MMReminderService] C:\Program Files\Mindjet\MindManager 7\MMReminderService.exe
O4 - HKLM\..\Run: [NotebookHardwareControl] "C:\Program Files\Notebook Hardware Control\nhc.exe" -quiet
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [googletalk] C:\Users\Juan Ignacio\AppData\Roaming\Google\Google Talk\googletalk.exe /autostart
O4 - HKCU\..\Run: [Start++] "C:\Program Files\Brandon Paddock\Start++\Start++.exe" /startup
O4 - HKCU\..\Run: [Switcher] "C:\Program Files\Switcher\Switcher.exe" /quiet
O4 - HKCU\..\Run: [VistaBatterySaver] C:\Program Files\SharpSoft\Vista Battery Saver\VistaBatterySaver.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICIO LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICIO LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Servicio de red')
O4 - Startup: ChkMail.lnk = ?
O4 - Startup: Recorte de pantalla e Inicio rápido de OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O8 - Extra context menu item: Anexar a PDF existente - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir a Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir destino de vínculo a PDF existente - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir destino de vínculo en archivo Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir selección a Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir selección a archivo PDF existente - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir vínculos seleccionados a Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convertir vínculos seleccionados a PDF existente - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.1.54.0\gears.dll
O9 - Extra 'Tools' menuitem: &Google Gears Settings - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.1.54.0\gears.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Enviar a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Enviar a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: Send to Mindjet MindManager - {531B9DC0-D8EE-4c76-A6EE-6C1E50569655} - (no file)
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Send to Mindjet MindManager - {941E1A34-C6AF-4baa-A973-224F9C3E04BF} - C:\Program Files\Mindjet\MindManager 7\Mm7InternetExplorer.dll
O9 - Extra button: Add to EverNote - {A5ABA0BB-F195-40d8-A5E9-0801153E6597} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Add to EverNote - {A5ABA0BB-F195-40d8-A5E9-0801153E6597} - (no file) (HKCU)
O13 - Gopher Prefix:
O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} (asusTek_sysctrl Class) - http://support.asus.com/common/asusTek_sys_ctrl.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/spanish/kavwebscan_unicode.cab
O16 - DPF: {15589FA1-C456-11CE-BF01-00AA0055595A} - http://w4s2.work4sure.com/c/ge/w4sgeen9.exe
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.es/scan_es/scan8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\ARCHIV~1\Google\GOOGLE~2\GOEC62~1.DLL,C:\PROGRA~1\KASPER~1\KASPER~1.0\r3hook.dll,C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files\ATK Hotkey\ASLDRSrv.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: DVD-RAM_Service - Matsu!!!!a Electric Industrial Co., Ltd. - C:\Windows\System32\DVDRAMSV.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate) - Google Inc. - C:\Program Files\Google\Update\1.0.103.0\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Security Platform Management Service (IFXSpMgtSrv) - Infineon Technologies AG - C:\Windows\system32\IFXSPMGT.exe
O23 - Service: Trusted Platform Core Service (IFXTCS) - Infineon Technologies AG - C:\Windows\system32\IFXTCS.exe
O23 - Service: lxcf_device - - C:\Windows\system32\lxcfcoms.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Notebook Hardware Control Service - http://www.pbus-167.com - C:\Program Files\Notebook Hardware Control\nhcservice.exe
O23 - Service: Personal Secure Drive Service (PersonalSecureDriveService) - Infineon Technologies AG - C:\Windows\system32\IfxPsdSv.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: spmgr - Unknown owner - C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe

--
End of file - 16051 bytes

Thanks for your time!!!!!

Forum Information

Currently it is Wednesday, January 07, 2009 1:28 PM (GMT +1)
There are a total of 65.903 posts in 16.171 threads.
In the last 3 days there were 22 new threads and 107 reply posts. View Active Threads