| kikesantana |  |
|
Re: Se me abren paginas de publicidad solas - 2009-07-10 19:46 - Respuesta 3
ComboFix 09-07-09.08 - PC 10/07/2009 11:23.1.2 - NTFSx86 MINIMAL
Microsoft Windows XP Home Edition 5.1.2600.2.1252.34.3082.18.1014.813 [GMT -12:00]
Running from: c:\documents and settings\PC\Escritorio\ComboFix.exe
AV: avast! antivirus 4.8.1335 [VPS 090709-0] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\PC\Datos de programa\bcrypt.html
c:\windows\Installer\1b9062.msp
c:\windows\Installer\68199a.msp
c:\windows\Installer\6c8357.msp
c:\windows\Installer\e08b4.msp
c:\windows\system32\lo2.txtt
.
((((((((((((((((((((((((( Files Created from 2009-06-10 to 2009-07-10 )))))))))))))))))))))))))))))))
.
2009-07-09 10:54 . 2009-07-09 10:54 d-w- c:\windows\system32\wbem\Repository
2009-07-09 10:24 . 2009-07-09 10:24 1453 a-w- c:\windows\system32\backup.zip
2009-07-09 10:20 . 2009-07-09 10:53 d-w- c:\documents and settings\L2MFIX\Datos de programa
2009-07-09 10:20 . 2009-07-09 10:53 d-w- c:\documents and settings\L2MFIX\Configuración local
2009-07-09 10:20 . 2009-07-09 10:53 d-s-w- c:\documents and settings\L2MFIX
2009-07-09 10:20 . 2009-07-09 10:53 d-w- c:\documents and settings\L2MFIX\Plantillas
2009-07-07 13:02 . 2009-07-07 13:02 d-w- c:\archivos de programa\Flag 32 Camp
2009-07-07 13:00 . 2009-07-07 13:00 d-w- c:\archivos de programa\Windows Live SkyDrive
2009-07-07 08:29 . 2009-02-05 21:06 23152 a-w- c:\windows\system32\drivers\aswRdr.sys
2009-07-07 08:29 . 2009-02-05 21:06 51376 a-w- c:\windows\system32\drivers\aswTdi.sys
2009-07-07 08:29 . 2009-02-05 21:05 26944 a-w- c:\windows\system32\drivers\aavmker4.sys
2009-07-07 08:29 . 2009-02-05 21:04 97480 a-w- c:\windows\system32\AvastSS.scr
2009-07-07 08:29 . 2009-02-05 21:07 114768 a-w- c:\windows\system32\drivers\aswSP.sys
2009-07-07 08:29 . 2009-02-05 21:07 20560 a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-07-07 08:29 . 2009-02-05 21:08 93296 a-w- c:\windows\system32\drivers\aswmon.sys
2009-07-07 08:29 . 2009-02-05 21:08 94032 a-w- c:\windows\system32\drivers\aswmon2.sys
2009-07-07 08:28 . 2009-02-05 21:11 1256296 a-w- c:\windows\system32\aswBoot.exe
2009-07-07 08:28 . 2009-07-07 08:28 d-w- c:\archivos de programa\Alwil Software
2009-07-02 11:19 . 2008-06-14 17:59 272512 -cw- c:\windows\system32\dllcache\bthport.sys
2009-07-02 11:08 . 2009-02-09 11:43 2023424 -cw- c:\windows\system32\dllcache\ntkrpamp.exe
2009-07-02 11:08 . 2009-02-09 11:43 2065408 -cw- c:\windows\system32\dllcache\ntkrnlpa.exe
2009-07-02 11:08 . 2009-02-09 11:43 2145280 -cw- c:\windows\system32\dllcache\ntkrnlmp.exe
2009-07-02 11:08 . 2009-02-09 11:43 2188544 -cw- c:\windows\system32\dllcache\ntoskrnl.exe
2009-07-02 11:08 . 2008-10-24 11:10 453632 -cw- c:\windows\system32\dllcache\mrxsmb.sys
2009-07-02 08:19 . 2009-07-10 23:17 794624 a-w- c:\documents and settings\All Users\Datos de programa\live 64 math does\flag once.exe
2009-07-02 08:19 . 2009-07-02 08:19 794624 a-w- c:\documents and settings\PC\Datos de programa\Flag 32 Camp\ksrmcaqs.exe
2009-07-02 08:12 . 2009-07-02 08:12 d-w- c:\archivos de programa\BlueTooth
2009-07-02 08:09 . 2009-07-02 08:09 d-w- c:\archivos de programa\Toshiba
2009-07-02 07:48 . 2005-12-05 22:54 61440 a-w- c:\windows\system32\KPower.dll
2009-07-02 07:48 . 2005-12-05 22:54 307200 a-w- c:\windows\system32\BMAPI.dll
2009-07-02 07:22 . 2007-04-16 18:53 188416 a-w- c:\windows\system32\igfxres.dll
2009-07-02 07:14 . 2004-08-20 10:00 14848 -ca-w- c:\windows\system32\dllcache\register.exe
2009-07-02 07:13 . 2004-08-20 10:00 10129408 -ca-w- c:\windows\system32\dllcache\hwxkor.dll
2009-07-02 07:12 . 2004-08-20 10:00 332800 -ca-w- c:\windows\system32\dllcache\aqueue.dll
2009-07-02 07:05 . 2004-08-20 03:42 153600 a-w- c:\windows\system32\irftp.exe
2009-07-02 07:05 . 2004-08-20 03:42 28160 a-w- c:\windows\system32\irmon.dll
2009-07-02 07:05 . 2004-08-20 03:42 8192 a-w- c:\windows\system32\wshirda.dll
2009-07-02 06:56 . 2004-08-20 10:00 24661 -ca-w- c:\windows\system32\dllcache\spxcoins.dll
2009-07-02 06:56 . 2004-08-20 10:00 24661 a-w- c:\windows\system32\spxcoins.dll
2009-07-02 06:56 . 2004-08-20 10:00 13312 -ca-w- c:\windows\system32\dllcache\irclass.dll
2009-07-02 06:56 . 2004-08-20 10:00 13312 a-w- c:\windows\system32\irclass.dll
2009-07-01 11:16 . 2009-07-02 08:19 397312 a-w- c:\documents and settings\PC\Datos de programa\Flag 32 Camp\Bits bolt eq.exe
2009-07-01 11:16 . 2009-07-02 08:19 337408 a-w- c:\documents and settings\PC\Datos de programa\Flag 32 Camp\amok film poll delete.exe
2009-07-01 11:16 . 2009-07-07 13:02 d-w- c:\documents and settings\All Users\Datos de programa\live 64 math does
2009-07-01 11:16 . 2009-07-01 11:16 778240 a-w- c:\documents and settings\PC\Datos de programa\Flag 32 Camp\xqjtbppx.exe
2009-07-01 11:15 . 2009-07-08 02:03 d-w- c:\documents and settings\PC\Datos de programa\Flag 32 Camp
2009-07-01 11:15 . 2009-07-01 11:15 d-w- c:\archivos de programa\Cirle Developement
2009-07-01 06:21 . 2009-07-01 06:21 d-w- c:\archivos de programa\Bonjour
2009-07-01 02:44 . 2009-01-16 22:07 69120 a-w- c:\documents and settings\All Users\Datos de programa\SupportSoft\DellSupportCenter\SYSTEM\data\f9cd5860-4b46-43fa-aa04-46ba9e956204\7e7d3c88-958b-4607-85a7-8c1cc5188887.1\NOTEPAD.EXE
2009-06-30 23:14 . 2009-07-01 23:47 d-w- c:\archivos de programa\RegCleaner
2009-06-29 10:04 . 2009-06-29 10:04 8224 a-w- c:\windows\system32\GDIPFONTCACHEV1.DAT
2009-06-29 09:50 . 2009-07-10 23:09 d-w- c:\documents and settings\PC\Tracing
2009-06-29 09:47 . 2009-06-29 09:47 d-w- c:\archivos de programa\Microsoft Silverlight
2009-06-29 09:46 . 2009-06-29 09:46 d-w- c:\archivos de programa\Microsoft Sync Framework
2009-06-29 09:45 . 2009-06-29 09:45 d-w- c:\archivos de programa\Microsoft SQL Server Compact Edition
2009-06-29 09:42 . 2009-06-29 09:47 d-w- c:\archivos de programa\Microsoft
2009-06-29 09:26 . 2009-06-29 09:26 d-w- c:\archivos de programa\Archivos comunes\Windows Live
2009-06-26 11:49 . 2009-06-29 10:48 d-w- c:\archivos de programa\Registry Easy
2009-06-26 05:59 . 2009-06-26 05:59 d-w- c:\archivos de programa\Overland
2009-06-24 12:14 . 2009-06-24 12:14 21393 a-w- c:\windows\system32\drivers\AegisP.sys
2009-06-24 12:14 . 2009-06-24 12:14 21393 a-w- c:\windows\AegisP.sys
2009-06-24 12:14 . 2009-06-24 12:14 356352 a-w- c:\windows\system32\AegisI5Installer.exe
2009-06-24 12:12 . 2007-08-09 03:28 684032 a-w- c:\windows\system32\NETw4c32.dll
2009-06-24 12:12 . 2007-08-09 03:29 2772992 a-w- c:\windows\system32\NETw4r32.dll
2009-06-24 12:12 . 2007-08-08 20:17 2211456 a-w- c:\windows\system32\drivers\NETw4x32.sys
2009-06-24 12:12 . 2009-06-24 12:12 d-w- c:\documents and settings\Default User\Datos de programa\Intel
2009-06-24 12:12 . 2009-06-24 12:12 d-w- c:\documents and settings\NetworkService\Datos de programa\Intel
2009-06-24 12:10 . 2009-06-24 12:10 d-w- c:\documents and settings\All Users\Datos de programa\Intel
2009-06-24 12:10 . 2009-06-24 12:10 d-w- c:\documents and settings\PC\Datos de programa\Intel
2009-06-23 00:06 . 2009-07-07 13:32 d-w- c:\windows\system32\CatRoot_bak
2009-06-19 10:53 . 2009-06-19 10:53 d-w- c:\documents and settings\PC\Datos de programa\Logitech
2009-06-19 10:51 . 2005-12-21 04:53 13440 a-w- c:\windows\system32\drivers\L8042Kbd.SYS
2009-06-19 10:51 . 2005-12-21 04:54 69376 a-w- c:\windows\system32\drivers\LMOUKE.sys
2009-06-19 10:51 . 2005-12-21 04:53 55424 a-w- c:\windows\system32\drivers\L8042MOU.SYS
2009-06-19 10:51 . 2006-03-11 04:27 65536 a-w- c:\windows\system32\KemXML.dll
2009-06-19 10:51 . 2006-03-11 04:24 86016 a-w- c:\windows\system32\KemWnd.dll
2009-06-19 10:51 . 2006-03-11 04:24 143360 a-w- c:\windows\system32\kemutb.dll
2009-06-19 10:51 . 2006-03-11 04:24 90112 a-w- c:\windows\system32\KemUtil.dll
2009-06-19 10:51 . 2009-06-19 10:51 d-w- c:\archivos de programa\Archivos comunes\Logitech
2009-06-19 10:51 . 2009-06-19 10:51 d-w- c:\archivos de programa\SetPoint
2009-06-14 20:02 . 2004-08-20 10:00 16384 -ca-w- c:\windows\system32\dllcache\isignup.exe
2009-06-14 20:01 . 2004-08-20 10:00 32768 -ca-w- c:\windows\system32\dllcache\icwdl.dll
2009-06-14 20:01 . 2004-08-20 10:00 86016 -ca-w- c:\windows\system32\dllcache\icwconn2.exe
2009-06-14 20:01 . 2004-08-20 10:00 218112 -ca-w- c:\windows\system32\dllcache\icwconn1.exe
2009-06-14 20:01 . 2004-08-20 10:00 20480 -ca-w- c:\windows\system32\dllcache\inetwiz.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-07 13:02 . 2008-12-12 19:32 d-w- c:\archivos de programa\Messenger Plus! Live
2009-07-07 12:24 . 2004-08-20 10:00 83656 a-w- c:\windows\system32\perfc00A.dat
2009-07-07 12:24 . 2004-08-20 10:00 470008 a-w- c:\windows\system32\perfh00A.dat
2009-07-07 09:09 . 2008-12-12 19:28 d-w- c:\archivos de programa\Windows Live
2009-07-07 08:23 . 2008-12-12 18:37 d-a-w- c:\documents and settings\All Users\Datos de programa\TEMP
2009-07-02 07:58 . 2008-12-12 17:08 d-w- c:\archivos de programa\Modem Helper
2009-07-02 07:09 . 2008-12-12 15:15 23720 a-w- c:\windows\system32\emptyregdb.dat
2009-07-01 06:23 . 2009-04-18 03:33 d-w- c:\archivos de programa\iTunes
2009-07-01 06:23 . 2008-12-15 06:32 d-w- c:\archivos de programa\iPod
2009-07-01 06:23 . 2009-04-18 03:29 d-w- c:\archivos de programa\Archivos comunes\Apple
2009-07-01 06:20 . 2008-12-15 06:33 d-w- c:\archivos de programa\QuickTime
2009-07-01 03:53 . 2008-12-12 15:25 45056 a-r- c:\documents and settings\PC\Datos de programa\Microsoft\Installer\{2764CA82-DFB9-4498-AF85-719340BF5305}\NewShortcut1_2764CA82DFB94498AF85719340BF5305.exe
2009-07-01 03:53 . 2008-12-12 15:25 10134 a-r- c:\documents and settings\PC\Datos de programa\Microsoft\Installer\{2764CA82-DFB9-4498-AF85-719340BF5305}\ARPPRODUCTICON.exe
2009-06-29 10:44 . 2008-12-12 18:56 d-w- c:\archivos de programa\Enigma Software Group
2009-06-19 10:51 . 2008-12-12 16:43 dhw- c:\archivos de programa\InstallShield Installation Information
2009-06-18 05:50 . 2008-12-12 19:17 d-w- c:\archivos de programa\RealMedia
2009-06-14 20:50 . 2009-01-22 05:27 43520 a-w- c:\windows\system32\CmdLineExt03.dll
2009-06-09 16:50 . 2009-04-27 00:59 d-w- c:\archivos de programa\shARES
2009-06-06 01:57 . 2009-06-06 01:57 75048 a-w- c:\documents and settings\All Users\Datos de programa\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe
2009-06-05 19:12 . 2009-06-05 19:12 d-w- c:\archivos de programa\Conduit
2009-06-05 19:12 . 2009-06-05 19:12 d-w- c:\archivos de programa\Babylon
2009-05-07 15:43 . 2004-08-20 10:00 346112 a-w- c:\windows\system32\localspl.dll
2009-04-29 04:52 . 2006-03-04 03:35 662016 a-w- c:\windows\system32\wininet.dll
2009-04-29 04:52 . 2004-08-20 10:00 81920 a-w- c:\windows\system32\ieencode.dll
2009-04-19 20:10 . 2004-08-20 10:00 1846784 a-w- c:\windows\system32\win32k.sys
2009-04-15 15:17 . 2004-08-20 10:00 584192 a-w- c:\windows\system32\rpcrt4.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9c905b42-976e-43c1-bc30-fc5937017909}]
2009-06-09 16:57 2094616 a-w- c:\archivos de programa\shARES\tbshA1.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ares"="c:\archivos de programa\Ares\Ares.exe" [2008-12-13 882176]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\archivos de programa\QuickTime\QTTask.exe" [2009-05-27 413696]
"iTunesHelper"="c:\archivos de programa\iTunes\iTunesHelper.exe" [2009-06-06 292136]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-04-16 135168]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-04-16 155648]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-04-16 131072]
"Dell QuickSet"="c:\archivos de programa\Dell\QuickSet\quickset.exe" [2007-05-14 1191936]
"SynTPEnh"="c:\archivos de programa\Synaptics\SynTP\SynTPEnh.exe" [2006-03-08 761947]
"MATH DOES FIRST MODE"="c:\documents and settings\All Users\Datos de programa\live 64 math does\flag once.exe" [2009-07-10 794624]
"avast!"="c:\archiv~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2004-08-20 110592]
"SigmatelSysTrayApp"="stsystra.exe" - c:\windows\stsystra.exe [2006-03-25 282624]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-20 15360]
c:\documents and settings\All Users\Men£ Inicio\Programas\Inicio\
Bluetooth Manager.lnk - c:\archivos de programa\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2005-11-18 1724416]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Archivos de programa\\Archivos comunes\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Archivos de programa\\Pinnacle\\Studio 11\\programs\\RM.exe"=
"c:\\Archivos de programa\\Pinnacle\\Studio 11\\programs\\Studio.exe"=
"c:\\Archivos de programa\\Pinnacle\\Studio 11\\programs\\PMSRegisterFile.exe"=
"c:\\Archivos de programa\\Pinnacle\\Studio 11\\programs\\umi.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Archivos de programa\\Bonjour\\mDNSResponder.exe"=
"c:\\Archivos de programa\\iTunes\\iTunes.exe"=
"c:\\Archivos de programa\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Archivos de programa\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Archivos de programa\\Ares\\Ares.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:*:Disabled:Adobe CSI CS4
S1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [06/07/2009 08:29 p.m. 114768]
S1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [10/06/2008 12:56 p.m. 34312]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [06/07/2009 08:29 p.m. 20560]
S2 ekrn;Eset Service;"c:\archivos de programa\ESET\ESET NOD32 Antivirus\ekrn.exe" > c:\archivos de programa\ESET\ESET NOD32 Antivirus\ekrn.exe [?]
S3 ewdmaudn;ewdmaudn;\??\c:\docume~1\PC\CONFIG~1\Temp\ewdmaudn.sys > c:\docume~1\PC\CONFIG~1\Temp\ewdmaudn.sys [?]
S3 Pcll8xmetice;Pcll8xmetice; [x]
- Other Services/Drivers In Memory -
*NewlyCreated* - MDMXSDK
*NewlyCreated* - PARPORT
.
Contents of the 'Scheduled Tasks' folder
2009-07-10 c:\windows\Tasks\AF41F395918A69C5.job
- c:\docume~1\pc\datosd~1\flag32~1\Bits bolt eq.exe [2009-07-01 08:19]
2009-07-01 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\archivos de programa\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]
.
.
- Supplementary Scan -
.
uStart Page = hxxp://www.sonico.com/
uInternet Settings,ProxyServer = 192.168.1.1:3128
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xportar a Microsoft Excel - c:\archiv~1\MICROS~3\Office10\EXCEL.EXE/3000
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-10 11:33
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
**************************************************************************
.
- LOCKED REGISTRY KEYS -
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:c8,28,51,af,b0,29,a3,98,bd,6a,88,8d,30,
af,cb,4e,c8,28,51,af,b0,29,a3,98,d7,9a,46,b0,d5,76,0b,38,e2,63,26,f1,3f,c8,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:6a,9c,d6,61,af,45,84,18,71,3f,69,5a,34,
fb,13,ac,71,3b,04,66,8b,46,0d,96,a2,89,49,29,2d,ec,bd,7b,6a,9c,d6,61,af,45,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:7a,45,05,fd,91,e8,6f,31,0d,e1,26,0d,a6,
9c,a6,95,25,da,ec,7e,55,20,c9,26,23,dc,21,7d,aa,95,33,69,ff,7c,85,e0,43,d4,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:86,8c,21,01,be,91,eb,e7,30,c9,62,ff,6d,
ab,63,59,3e,1e,9e,e0,57,5a,93,61,72,d0,fd,3a,41,13,24,76,86,8c,21,01,be,91,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:cd,44,cd,b9,a6,33,6c,cd,67,72,91,c9,75,
55,8d,ed,cd,44,cd,b9,a6,33,6c,cd,2a,60,1c,32,1f,44,09,be,f5,1d,4d,73,a8,13,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:b0,18,ed,a7,3f,8d,37,a4,fc,0e,ad,c4,8a,
63,f4,c1,b0,18,ed,a7,3f,8d,37,a4,05,04,cf,cf,bf,20,72,a6,df,20,58,62,78,6b,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:31,77,e1,ba,b1,f8,68,02,37,f1,69,23,1b,
80,77,55,31,77,e1,ba,b1,f8,68,02,67,46,bd,f2,40,f1,41,f6,fb,a7,78,e6,12,2f,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:01,3a,48,fc,e8,04,4a,f1,23,2b,20,05,5a,
52,60,79,83,6c,56,8b,a0,85,96,ab,1d,76,ca,7f,d9,e0,a7,cb,01,3a,48,fc,e8,04,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:f6,0f,4e,58,98,5b,89,c9,d4,e1,20,b9,be,
85,4a,24,51,fa,6e,91,28,9e,14,cc,be,ef,13,fd,7c,b0,69,f5,f6,0f,4e,58,98,5b,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:b1,cd,45,5a,a8,c4,f8,b9,89,78,5f,22,0b,
ac,3e,3f,b1,cd,45,5a,a8,c4,f8,b9,aa,d5,1a,1e,6d,37,89,9f,3d,ce,ea,26,2d,45,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:e3,0e,66,d5,eb,bc,2f,6b,e6,59,72,4d,52,
ca,71,9c,e3,0e,66,d5,eb,bc,2f,6b,06,cf,91,93,cb,07,b4,04,2a,b7,cc,b5,b9,7f,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:fa,ea,66,7f,d4,3b,6b,70,2b,36,39,99,cb,
83,ed,3c,fa,ea,66,7f,d4,3b,6b,70,af,b5,8e,06,f7,fb,71,2f,6c,43,2d,1e,aa,22,\
.
- DLLs Loaded Under Running Processes -
- - - - - - - > 'winlogon.exe'(264)
c:\archivos de programa\Archivos comunes\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
.
Completion time: 2009-07-10 11:39
ComboFix-quarantined-files.txt 2009-07-10 23:38
Pre-Run: 69,268,410,368 bytes libres
Post-Run: 69,351,567,360 bytes libres
276 - E O F - 2009-07-10 23:09
| |
|
|
