Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Agent3.CIPT - PSW.Generic10.AHQ x3 [Closed] [Solved]

Started by BlueMonday495 , Nov 09 2012 12:43 PM

This topic is locked

#1
BlueMonday495

Posted 09 November 2012 - 12:43 PM

Member

Member
14 posts

Hello , well, my computer has been running REALLY slow lately and the explorer.exe process uses around 70.000kb.
It's really, really annoying and AVG doesn't remove the trojans.
C:\DOCUME~1\NICOLS~1\CONFIG~1\Temp\18C.tmp";"Troyano PSW.Generic10.AHQV"
C:\Documents and Settings\Nicolás\Configuración local\Temp\90226.5190738943.htm";"Troyano PSW.Generic10.AHQV
C:\Documents and Settings\Nicolás\Configuración local\Temp\289352.0436706326.htm";"Troyano Agent3.CIPT
C:\Archivos de programa\AVG\AVG2012\avgui.exe (2172)";"Troyano PSW.Generic10.AHQV

If you could help me to remove them, i would really appreciate it, thanks!

Edited by BlueMonday495, 09 November 2012 - 12:46 PM.

#2
Essexboy

Posted 09 November 2012 - 01:21 PM

GeekU Moderator

Retired Staff
69,964 posts

Hi there first I will need to look at your computer

Download OTL to your Desktop
Secondary link

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
Select All Users
Under the Custom Scan box paste this in

netsvcs
BASESERVICES
%SYSTEMDRIVE%\*.exe
/md5start
services.*
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
winsock.*
/md5stop
CREATERESTOREPOINT
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Post both logs

THEN

Download aswMBR.exe ( 4.5mb ) to your desktop.
Double click the aswMBR.exe to run it Click the "Scan" button to start scan

Posted Image

On completion of the scan click save log, save it to your desktop and post in your next reply

#3
BlueMonday495

Posted 13 November 2012 - 08:44 PM

Member

Topic Starter
Member
14 posts

Ok, OTL Scan was fine but my computer refuses to run aswMBR.exe, I mean, I double-click on it but nothing happens. I tried rebooting but still not working.

Here's OTL.txt:
--------------------------------------------------------------------------------------------
OTL logfile created on: 13/11/2012 18:11:50 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Nicolás\Escritorio
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000C0A | Country: España | Language: ESN | Date Format: dd/MM/yyyy

959,17 Mb Total Physical Memory | 309,91 Mb Available Physical Memory | 32,31% Memory free
2,26 Gb Paging File | 1,49 Gb Available in Paging File | 65,82% Paging File free
Paging file location(s): C:\pagefile.sys 1440 2880 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Archivos de programa
Drive C: | 44,71 Gb Total Space | 10,84 Gb Free Space | 24,25% Space Free | Partition Type: NTFS
Drive D: | 104,33 Gb Total Space | 44,12 Gb Free Space | 42,29% Space Free | Partition Type: NTFS

Computer Name: MARCELA-B8AE7CF | User Name: Nicolás | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/11/09 20:47:34 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Nicolás\Escritorio\OTL.exe
PRC - [2012/11/08 15:27:41 | 000,878,480 | ---- | M] (Opera Software) -- C:\Archivos de programa\Opera\opera.exe
PRC - [2012/08/13 03:24:48 | 005,167,736 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Archivos de programa\AVG\AVG2012\avgidsagent.exe
PRC - [2012/07/31 03:37:02 | 002,596,984 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Archivos de programa\AVG\AVG2012\avgtray.exe
PRC - [2012/07/26 03:23:08 | 000,758,392 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Archivos de programa\AVG\AVG2012\avgrsx.exe
PRC - [2012/06/13 03:48:24 | 001,255,544 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Archivos de programa\AVG\AVG2012\avgnsx.exe
PRC - [2012/02/14 04:53:38 | 000,193,288 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Archivos de programa\AVG\AVG2012\avgwdsvc.exe
PRC - [2012/02/14 04:52:38 | 000,338,784 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Archivos de programa\AVG\AVG2012\avgcsrvx.exe
PRC - [2010/07/12 13:32:48 | 000,074,752 | ---- | M] (Nullsoft, Inc.) -- C:\Archivos de programa\Winamp\winampa.exe
PRC - [2010/07/10 09:56:34 | 001,015,808 | -H-- | M] (Ares Development Group) -- C:\Documents and Settings\Nicolás\Mis documentos\Mis historiales de conversación\Ares\Ares.exe
PRC - [2008/04/14 09:00:00 | 001,036,288 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2008/03/14 13:09:56 | 002,938,184 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Archivos de programa\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
PRC - [2008/01/22 20:13:08 | 000,288,072 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Archivos de programa\Toshiba\Bluetooth Toshiba Stack\TosBtHSP.exe
PRC - [2007/10/29 14:30:14 | 000,278,528 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Archivos de programa\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
PRC - [2007/10/04 18:39:42 | 000,077,824 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Archivos de programa\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
PRC - [2007/09/28 16:05:16 | 000,128,360 | ---- | M] (TOSHIBA CORPORATION) -- C:\Archivos de programa\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
PRC - [2007/01/15 16:14:54 | 000,147,456 | ---- | M] (Nero AG) -- C:\Archivos de programa\Archivos comunes\Ahead\Lib\NMBgMonitor.exe
PRC - [2007/01/15 16:13:50 | 001,208,320 | ---- | M] (Nero AG) -- C:\Archivos de programa\Archivos comunes\Ahead\Lib\NMIndexStoreSvr.exe
PRC - [2007/01/15 16:01:56 | 000,266,240 | ---- | M] (Nero AG) -- C:\Archivos de programa\Archivos comunes\Ahead\Lib\NMIndexingService.exe
PRC - [2005/08/05 15:15:04 | 000,061,440 | ---- | M] (Vimicro) -- C:\WINDOWS\VM305_STI.exe
PRC - [2005/03/11 00:33:28 | 000,053,248 | R--- | M] (S3 Graphics, Inc.) -- C:\WINDOWS\system32\VTTimer.exe

========== Modules (No Company Name) ==========

MOD - [2012/11/08 15:28:06 | 000,101,888 | ---- | M] () -- C:\Archivos de programa\Opera\gstreamer\plugins\gstwebmdec.dll
MOD - [2012/11/08 15:28:06 | 000,073,728 | ---- | M] () -- C:\Archivos de programa\Opera\gstreamer\plugins\gstwavparse.dll
MOD - [2012/11/08 15:28:06 | 000,057,344 | ---- | M] () -- C:\Archivos de programa\Opera\gstreamer\plugins\gstautodetect.dll
MOD - [2012/11/08 15:28:06 | 000,038,912 | ---- | M] () -- C:\Archivos de programa\Opera\gstreamer\plugins\gstwaveform.dll
MOD - [2012/11/08 15:28:05 | 000,312,832 | ---- | M] () -- C:\Archivos de programa\Opera\gstreamer\plugins\gstoggdec.dll
MOD - [2012/11/08 15:28:05 | 000,158,208 | ---- | M] () -- C:\Archivos de programa\Opera\gstreamer\plugins\gstffmpegcolorspace.dll
MOD - [2012/11/08 15:28:04 | 000,067,072 | ---- | M] () -- C:\Archivos de programa\Opera\gstreamer\plugins\gstdirectsound.dll
MOD - [2012/11/08 15:28:04 | 000,062,976 | ---- | M] () -- C:\Archivos de programa\Opera\gstreamer\plugins\gstdecodebin2.dll
MOD - [2012/11/08 15:28:03 | 000,096,256 | ---- | M] () -- C:\Archivos de programa\Opera\gstreamer\plugins\gstcoreplugins.dll
MOD - [2012/11/08 15:28:03 | 000,094,208 | ---- | M] () -- C:\Archivos de programa\Opera\gstreamer\plugins\gstaudioresample.dll
MOD - [2012/11/08 15:28:03 | 000,093,696 | ---- | M] () -- C:\Archivos de programa\Opera\gstreamer\plugins\gstaudioconvert.dll
MOD - [2012/11/08 15:28:02 | 000,835,584 | ---- | M] () -- C:\Archivos de programa\Opera\gstreamer\gstreamer.dll
MOD - [2009/02/27 18:35:50 | 000,311,296 | ---- | M] () -- C:\Archivos de programa\Archivos comunes\Adobe\Acrobat\ActiveX\pdfshell.ESP
MOD - [2008/04/14 09:00:00 | 000,014,336 | ---- | M] () -- C:\WINDOWS\system32\msdmo.dll
MOD - [2005/07/22 21:30:18 | 000,065,536 | ---- | M] () -- C:\WINDOWS\system32\TosCommAPI.dll

========== Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- %SystemRoot%\System32\hidserv.dll -- (HidServ)
SRV - [2012/11/02 10:34:58 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Archivos de programa\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012/10/18 21:54:42 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/08/13 03:24:48 | 005,167,736 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Archivos de programa\AVG\AVG2012\avgidsagent.exe -- (AVGIDSAgent)
SRV - [2012/06/14 19:17:46 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Archivos de programa\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012/02/14 04:53:38 | 000,193,288 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Archivos de programa\AVG\AVG2012\avgwdsvc.exe -- (avgwd)
SRV - [2007/09/28 16:05:16 | 000,128,360 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Archivos de programa\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe -- (TOSHIBA Bluetooth Service)
SRV - [2007/01/15 16:01:56 | 000,266,240 | ---- | M] (Nero AG) [On_Demand | Running] -- C:\Archivos de programa\Archivos comunes\Ahead\Lib\NMIndexingService.exe -- (NMIndexingService)
SRV - [2003/07/28 20:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Archivos de programa\Archivos comunes\Microsoft Shared\Source Engine\OSE.EXE -- (ose)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - File not found [Kernel | On_Demand | Unknown] -- -- (a38kzqg6)
DRV - [2012/09/22 17:50:14 | 000,477,240 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\sptd.sys -- (sptd)
DRV - [2012/08/24 15:43:18 | 000,301,920 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avgtdix.sys -- (Avgtdix)
DRV - [2012/07/26 03:21:30 | 000,237,408 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avgldx86.sys -- (Avgldx86)
DRV - [2012/06/18 13:34:38 | 000,015,576 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\pwdrvio.sys -- (pwdrvio)
DRV - [2012/06/18 13:34:38 | 000,010,200 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\pwdspio.sys -- (pwdspio)
DRV - [2012/04/19 04:50:26 | 000,024,896 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\avgidshx.sys -- (AVGIDSHX)
DRV - [2012/01/31 04:46:50 | 000,031,952 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\WINDOWS\system32\drivers\avgrkx86.sys -- (Avgrkx86)
DRV - [2011/12/23 13:32:14 | 000,041,040 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\avgmfx86.sys -- (Avgmfx86)
DRV - [2011/12/23 13:32:08 | 000,017,232 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\avgidsshimx.sys -- (AVGIDSShim)
DRV - [2011/12/23 13:32:06 | 000,024,144 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\avgidsfilterx.sys -- (AVGIDSFilter)
DRV - [2011/12/23 13:32:00 | 000,139,856 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\avgidsdriverx.sys -- (AVGIDSDriver)
DRV - [2008/03/25 16:24:22 | 000,131,712 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\tosrfbd.sys -- (tosrfbd)
DRV - [2008/03/25 13:54:02 | 000,041,472 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\tosporte.sys -- (tosporte)
DRV - [2008/03/19 11:38:24 | 000,074,112 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Tosrfhid.sys -- (Tosrfhid)
DRV - [2008/01/22 20:57:48 | 000,054,144 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\TosRfSnd.sys -- (TosRfSnd)
DRV - [2007/11/29 09:45:44 | 000,036,608 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\tosrfbnp.sys -- (tosrfbnp)
DRV - [2007/10/18 14:25:00 | 000,041,856 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\tosrfusb.sys -- (Tosrfusb)
DRV - [2007/10/02 11:43:22 | 000,064,128 | ---- | M] (TOSHIBA Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\tosrfcom.sys -- (Tosrfcom)
DRV - [2006/09/12 01:27:00 | 004,381,184 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.Sys -- (IntcAzAudAddService)
DRV - [2006/08/02 18:20:42 | 001,466,624 | ---- | M] (Vimicro Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\usbVM305.sys -- (ZSMC0305)
DRV - [2005/10/27 03:01:58 | 000,150,016 | ---- | M] (Windows ® 2000 DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\DDPlayCam.sys -- (DDPlayCam)
DRV - [2005/01/07 05:42:00 | 000,018,612 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\tosrfnds.sys -- (tosrfnds)
DRV - [2004/08/13 07:56:20 | 000,005,810 | R--- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ASACPI.sys -- (MTsensor)
DRV - [2004/03/04 17:25:54 | 000,016,509 | ---- | M] (Palm, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\PalmUSBD.sys -- (PalmUSBD)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ar.yahoo.com/?fr=fp-reg
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ar.yahoo.com/?fr=fp-reg
IE - HKLM\..\SearchScopes,DefaultScope = {44DE20C7-D5E2-4707-A556-23E02777A411}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.c...ferrer:source?}
IE - HKLM\..\SearchScopes\{44DE20C7-D5E2-4707-A556-23E02777A411}: "URL" = http://www.google.co...g}&sourceid=ie7

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-776561741-1647877149-1417001333-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://es.ask.com?o=15446&l=dis
IE - HKU\S-1-5-21-776561741-1647877149-1417001333-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://es.msn.com/
IE - HKU\S-1-5-21-776561741-1647877149-1417001333-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = es
IE - HKU\S-1-5-21-776561741-1647877149-1417001333-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 72 5E 12 C6 6F 2E CB 01 [binary data]
IE - HKU\S-1-5-21-776561741-1647877149-1417001333-1004\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - No CLSID value found
IE - HKU\S-1-5-21-776561741-1647877149-1417001333-1004\..\URLSearchHook: {0974848a-b5bc-49f2-9778-307742b4a55d} - No CLSID value found
IE - HKU\S-1-5-21-776561741-1647877149-1417001333-1004\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-776561741-1647877149-1417001333-1004\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.c...Box&Form=IE8SRC
IE - HKU\S-1-5-21-776561741-1647877149-1417001333-1004\..\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}: "URL" = http://websearch.ask...s}&locale=es_ES
IE - HKU\S-1-5-21-776561741-1647877149-1417001333-1004\..\SearchScopes\{44DE20C7-D5E2-4707-A556-23E02777A411}: "URL" = http://www.google.co...&rlz=1I7RNRZ_es
IE - HKU\S-1-5-21-776561741-1647877149-1417001333-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-776561741-1647877149-1417001333-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "google.com"
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_4_402_287.dll ()
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Archivos de programa\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Archivos de programa\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Archivos de programa\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Archivos de programa\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Documents and Settings\Nicolás\Configuración local\Datos de programa\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Archivos de programa\AVG\AVG2012\Firefox4\ [2012/09/10 14:45:11 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{F53C93F1-07D5-430c-86D4-C9531B27DFAF}: C:\Archivos de programa\AVG\AVG2012\Firefox\DoNotTrack\ [2012/07/25 21:34:05 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Archivos de programa\Mozilla Firefox\components [2012/06/16 20:31:17 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Archivos de programa\Mozilla Firefox\plugins

[2012/06/16 20:33:41 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Nicolás\Datos de programa\Mozilla\Extensions
[2012/06/19 20:18:31 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Nicolás\Datos de programa\Mozilla\Firefox\Profiles\xd60heez.default\extensions
[2012/06/16 20:31:17 | 000,000,000 | ---D | M] (No name found) -- C:\Archivos de programa\Mozilla Firefox\extensions
[2012/06/14 19:19:07 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Archivos de programa\mozilla firefox\components\browsercomps.dll
[2012/06/14 20:41:16 | 000,002,252 | ---- | M] () -- C:\Archivos de programa\mozilla firefox\searchplugins\bing.xml
[2012/06/14 20:41:16 | 000,003,996 | ---- | M] () -- C:\Archivos de programa\mozilla firefox\searchplugins\drae.xml
[2012/06/14 20:41:16 | 000,001,143 | ---- | M] () -- C:\Archivos de programa\mozilla firefox\searchplugins\eBay-es.xml
[2012/06/14 20:41:16 | 000,002,040 | ---- | M] () -- C:\Archivos de programa\mozilla firefox\searchplugins\twitter.xml
[2012/06/14 20:41:16 | 000,001,178 | ---- | M] () -- C:\Archivos de programa\mozilla firefox\searchplugins\wikipedia-es.xml
[2012/06/14 20:41:15 | 000,001,102 | ---- | M] () -- C:\Archivos de programa\mozilla firefox\searchplugins\yahoo-es.xml

========== Chrome ==========

CHR - homepage: http://www.google.com/
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}
CHR - homepage: http://www.google.com/
CHR - plugin: Shockwave Flash (Enabled) = C:\Archivos de programa\Google\Chrome\Application\21.0.1180.89\PepperFlash\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Archivos de programa\Google\Chrome\Application\21.0.1180.89\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_4_402_287.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Archivos de programa\Google\Chrome\Application\21.0.1180.89\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Archivos de programa\Google\Chrome\Application\21.0.1180.89\pdf.dll
CHR - plugin: AVG Internet Security (Enabled) = C:\Documents and Settings\Nicol\u00E1s\Configuraci\u00F3n local\Datos de programa\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla\12.0.0.2210_0\plugins/avgnpss.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Archivos de programa\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.150.3 (Enabled) = C:\Archivos de programa\Java\jre6\bin\new_plugin\npdeploytk.dll
CHR - plugin: Java™ Platform SE 6 U15 (Enabled) = C:\Archivos de programa\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Archivos de programa\Windows Media Player\npdrmv2.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Archivos de programa\Windows Media Player\npwmsdrm.dll
CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Archivos de programa\Windows Media Player\npdsplay.dll
CHR - plugin: Google Update (Enabled) = C:\Archivos de programa\Google\Update\1.3.21.123\npGoogleUpdate3.dll
CHR - plugin: Facebook Video Calling Plugin (Enabled) = C:\Documents and Settings\Nicol\u00E1s\Configuraci\u00F3n local\Datos de programa\Facebook\Video\Skype\npFacebookVideoCalling.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Archivos de programa\Microsoft Silverlight\4.1.10329.0\npctrl.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - Extension: AVG Safe Search = C:\Documents and Settings\Nicolás\Configuración local\Datos de programa\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla\12.0.0.2210_0\
CHR - Extension: AVG Do Not Track = C:\Documents and Settings\Nicolás\Configuración local\Datos de programa\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\12.0.0.2166_0\

O1 HOSTS File: ([2012/02/05 22:15:23 | 000,000,828 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 200.69.192.155 fpatch.theduel.com.br
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Archivos de programa\Archivos comunes\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Archivos de programa\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (AVG Do Not Track) - {31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} - C:\Archivos de programa\AVG\AVG2012\avgdtiex.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Archivos de programa\AVG\AVG2012\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Windows Live Aplicación auxiliar de inicio de sesión) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Archivos de programa\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-776561741-1647877149-1417001333-1004\..\Toolbar\WebBrowser: (no name) - {0974848A-B5BC-49F2-9778-307742B4A55D} - No CLSID value found.
O3 - HKU\S-1-5-21-776561741-1647877149-1417001333-1004\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\S-1-5-21-776561741-1647877149-1417001333-1004\..\Toolbar\WebBrowser: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Archivos de programa\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O4 - HKLM..\Run: [Adobe ARM] C:\Archivos de programa\Archivos comunes\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [AVG_TRAY] C:\Archivos de programa\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [BigDog305] C:\WINDOWS\VM305_STI.EXE (Vimicro)
O4 - HKLM..\Run: [BluetoothAuthenticationAgent] C:\WINDOWS\System32\bthprops.cpl (Microsoft Corporation)
O4 - HKLM..\Run: [FfFUNqDJKfsj.exe] C:\Documents and Settings\All Users\Datos de programa\FfFUNqDJKfsj.exe File not found
O4 - HKLM..\Run: [ITSecMng] C:\Archivos de programa\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe ( TOSHIBA CORPORATION)
O4 - HKLM..\Run: [LanguageShortcut] C:\Archivos de programa\CyberLink\PowerDVD\Language\Language.exe ()
O4 - HKLM..\Run: [NeroFilterCheck] C:\Archivos de programa\Archivos comunes\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [VTTimer] C:\WINDOWS\System32\VTTimer.exe (S3 Graphics, Inc.)
O4 - HKLM..\Run: [WinampAgent] C:\Archivos de programa\Winamp\winampa.exe (Nullsoft, Inc.)
O4 - HKU\S-1-5-21-776561741-1647877149-1417001333-1004..\Run: [AlcoholAutomount] "C:\Archivos de programa\Alcohol Soft\Alcohol 120\axcmd.exe" /automount File not found
O4 - HKU\S-1-5-21-776561741-1647877149-1417001333-1004..\Run: [ares] C:\Documents and Settings\Nicolás\Mis documentos\Mis historiales de conversación\Ares\Ares.exe (Ares Development Group)
O4 - HKU\S-1-5-21-776561741-1647877149-1417001333-1004..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Archivos de programa\Archivos comunes\Ahead\Lib\NMBgMonitor.exe (Nero AG)
O4 - HKU\S-1-5-21-776561741-1647877149-1417001333-1004..\Run: [BitTorrent] "D:\BitTorrent\bittorrent.exe" File not found
O4 - HKU\S-1-5-21-776561741-1647877149-1417001333-1004..\Run: [DAEMON Tools Lite] C:\Archivos de programa\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKU\S-1-5-21-776561741-1647877149-1417001333-1004..\Run: [Facebook Update] C:\Documents and Settings\Nicolás\Configuración local\Datos de programa\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Menú Inicio\Programas\Inicio\Bluetooth Manager.lnk = C:\Archivos de programa\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe (TOSHIBA CORPORATION.)
O4 - Startup: C:\Documents and Settings\Marcela\Menú Inicio\Programas\Inicio\HotSync Manager.lnk = File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-776561741-1647877149-1417001333-1004\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-21-776561741-1647877149-1417001333-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-776561741-1647877149-1417001333-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 0
O9 - Extra Button: AVG Do Not Track - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - C:\Archivos de programa\AVG\AVG2012\avgdtiex.dll (AVG Technologies CZ, s.r.o.)
O9 - Extra Button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Archivos de programa\Bonjour\ExplorerPlugin.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Archivos de programa\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} http://messenger.zon...kr.cab56986.cab (Checkers Class)
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} http://messenger.zon...1/GAME_UNO1.cab (UnoCtrl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zon...nt.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} http://messenger.zon...er.cab56986.cab (Minesweeper Flags Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 200.49.130.40 200.42.4.203
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{ED739DED-857A-4D73-A67C-81AFC3032F9B}: DhcpNameServer = 200.49.130.40 200.42.4.203
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Archivos de programa\Archivos comunes\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Archivos de programa\AVG\AVG2012\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\ARCHIV~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL File not found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Archivos de programa\Archivos comunes\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Archivos de programa\Archivos comunes\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\ARCHIV~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL File not found
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Archivos de programa\Archivos comunes\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Mi página de inicio actual) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\Nicolás\Configuración local\Datos de programa\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Nicolás\Configuración local\Datos de programa\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {93994DE8-8239-4655-B1D1-5F4E91300429} - C:\Archivos de programa\DVD Region+CSS Free\DVDShell.dll (Fengtao Software Inc.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/07/17 17:06:30 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\ARCHIV~1\AVG\AVG2012\avgrsx.exe /sync /restart)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

NetSvcs: 6to4 - File not found
NetSvcs: HidServ - %SystemRoot%\System32\hidserv.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/11/09 20:47:33 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Nicolás\Escritorio\OTL.exe
[2012/11/07 00:43:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menú Inicio\Programas\Skype
[2012/11/07 00:43:48 | 000,000,000 | ---D | C] -- C:\Archivos de programa\Archivos comunes\Skype
[2012/11/07 00:43:47 | 000,000,000 | R--D | C] -- C:\Archivos de programa\Skype
[2012/11/05 00:47:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Nicolás\Escritorio\3688698
[2012/10/30 19:16:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Nicolás\Escritorio\SYSTEM
[2012/10/18 20:11:19 | 009,575,864 | ---- | C] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerInstaller.exe
[2012/10/18 19:49:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menú Inicio\Programas\Google Chrome
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/11/13 18:15:00 | 000,000,492 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{D4BEF01E-AB7A-4D5C-AC06-A937B3810C95}.job
[2012/11/13 18:11:01 | 000,000,838 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/11/13 18:03:02 | 000,001,104 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012/11/13 17:27:00 | 000,001,200 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-776561741-1647877149-1417001333-1003UA.job
[2012/11/13 17:27:00 | 000,001,148 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-776561741-1647877149-1417001333-1003Core.job
[2012/11/13 16:44:32 | 100,115,241 | ---- | M] () -- C:\WINDOWS\System32\drivers\AVG\incavi.avm.prepare
[2012/11/13 16:40:00 | 000,001,100 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012/11/13 16:38:24 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012/11/13 16:38:22 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012/11/12 22:35:02 | 000,001,018 | ---- | M] () -- C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-776561741-1647877149-1417001333-1004UA.job
[2012/11/12 14:37:33 | 100,027,288 | ---- | M] () -- C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2012/11/12 01:55:48 | 000,015,646 | ---- | M] () -- C:\Documents and Settings\Nicolás\Escritorio\romana.jpg
[2012/11/12 01:51:13 | 000,019,308 | ---- | M] () -- C:\Documents and Settings\Nicolás\Escritorio\Dr_ Julio Maiztegui.jpg
[2012/11/12 01:48:59 | 000,008,313 | ---- | M] () -- C:\Documents and Settings\Nicolás\Escritorio\Salvador-Mazza-V.jpg
[2012/11/12 01:35:02 | 000,000,996 | ---- | M] () -- C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-776561741-1647877149-1417001333-1004Core.job
[2012/11/09 20:47:34 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Nicolás\Escritorio\OTL.exe
[2012/11/08 15:04:59 | 000,001,885 | ---- | M] () -- C:\Documents and Settings\All Users\Escritorio\Google Chrome.lnk
[2012/11/07 14:47:19 | 000,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2012/11/07 14:47:16 | 000,092,160 | ---- | M] () -- C:\Documents and Settings\Nicolás\Configuración local\Datos de programa\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/11/07 00:48:35 | 000,002,307 | ---- | M] () -- C:\Documents and Settings\All Users\Escritorio\Skype.lnk
[2012/11/06 16:21:35 | 000,043,029 | ---- | M] () -- C:\Documents and Settings\Nicolás\Escritorio\webcam-toy-foto1.jpg
[2012/11/06 01:12:16 | 000,545,177 | ---- | M] () -- C:\Documents and Settings\Nicolás\Escritorio\Dog Unit.jpg
[2012/11/05 13:50:09 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2012/11/04 20:51:39 | 015,405,624 | ---- | M] () -- C:\Documents and Settings\Nicolás\Escritorio\Francesco_Diaz_Jeff_Rock_-_God_Save_The_Queen_(2011)_[MP3]_NF_3688698.rar
[2012/10/29 06:21:37 | 014,418,579 | ---- | M] () -- C:\Documents and Settings\Nicolás\Escritorio\G6&M3DS-R_M74.zip
[2012/10/25 14:29:01 | 000,499,322 | ---- | M] () -- C:\WINDOWS\System32\perfh00A.dat
[2012/10/25 14:29:01 | 000,435,832 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012/10/25 14:29:01 | 000,087,214 | ---- | M] () -- C:\WINDOWS\System32\perfc00A.dat
[2012/10/25 14:29:01 | 000,068,728 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012/10/24 22:38:50 | 000,000,038 | ---- | M] () -- C:\WINDOWS\AviSplitter.INI
[2012/10/18 21:54:42 | 000,696,760 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe
[2012/10/18 21:54:42 | 000,073,656 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2012/10/18 20:11:19 | 009,575,864 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerInstaller.exe
[2012/10/18 18:31:46 | 000,223,798 | ---- | M] () -- C:\WINDOWS\System32\drivers\AVG\iavichjg.avm
[2012/10/15 16:46:16 | 000,000,765 | ---- | M] () -- C:\Documents and Settings\All Users\Menú Inicio\Programas\Inicio\Bluetooth Manager.lnk
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/11/12 01:55:48 | 000,015,646 | ---- | C] () -- C:\Documents and Settings\Nicolás\Escritorio\romana.jpg
[2012/11/12 01:51:13 | 000,019,308 | ---- | C] () -- C:\Documents and Settings\Nicolás\Escritorio\Dr_ Julio Maiztegui.jpg
[2012/11/12 01:48:59 | 000,008,313 | ---- | C] () -- C:\Documents and Settings\Nicolás\Escritorio\Salvador-Mazza-V.jpg
[2012/11/06 16:21:35 | 000,043,029 | ---- | C] () -- C:\Documents and Settings\Nicolás\Escritorio\webcam-toy-foto1.jpg
[2012/11/06 01:12:16 | 000,545,177 | ---- | C] () -- C:\Documents and Settings\Nicolás\Escritorio\Dog Unit.jpg
[2012/11/04 20:47:00 | 015,405,624 | ---- | C] () -- C:\Documents and Settings\Nicolás\Escritorio\Francesco_Diaz_Jeff_Rock_-_God_Save_The_Queen_(2011)_[MP3]_NF_3688698.rar
[2012/10/29 06:21:33 | 014,418,579 | ---- | C] () -- C:\Documents and Settings\Nicolás\Escritorio\G6&M3DS-R_M74.zip
[2012/10/18 19:49:33 | 000,001,885 | ---- | C] () -- C:\Documents and Settings\All Users\Escritorio\Google Chrome.lnk
[2012/10/18 19:48:00 | 000,000,838 | ---- | C] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/08/15 23:44:00 | 002,872,512 | ---- | C] () -- C:\WINDOWS\System32\pwNative.exe
[2012/08/15 23:43:58 | 000,015,576 | ---- | C] () -- C:\WINDOWS\System32\pwdrvio.sys
[2012/08/15 23:43:58 | 000,010,200 | ---- | C] () -- C:\WINDOWS\System32\pwdspio.sys
[2012/07/24 12:53:56 | 000,921,654 | ---- | C] () -- C:\Documents and Settings\Nicolás\marioferchoo o.bmp
[2012/07/15 18:34:13 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2012/02/05 20:29:47 | 000,000,033 | ---- | C] () -- C:\WINDOWS\GunzLauncher.INI
[2011/10/24 18:28:27 | 000,018,868 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2011/10/14 15:41:09 | 000,000,296 | ---- | C] () -- C:\Documents and Settings\All Users\Datos de programa\~6DSS92c31Apgjk
[2011/10/14 15:41:09 | 000,000,216 | ---- | C] () -- C:\Documents and Settings\All Users\Datos de programa\~6DSS92c31Apgjkr
[2011/10/14 15:41:06 | 000,000,456 | ---- | C] () -- C:\Documents and Settings\All Users\Datos de programa\6DSS92c31Apgjk
[2011/10/11 18:41:48 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/05/09 18:30:21 | 000,000,038 | ---- | C] () -- C:\WINDOWS\AviSplitter.INI
[2011/01/16 18:08:23 | 000,000,151 | ---- | C] () -- C:\WINDOWS\PhotoSnapViewer.INI
[2010/12/19 15:26:36 | 000,000,042 | ---- | C] () -- C:\Documents and Settings\Nicolás\default.pls
[2010/10/15 15:25:39 | 000,092,160 | ---- | C] () -- C:\Documents and Settings\Nicolás\Configuración local\Datos de programa\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

========== ZeroAccess Check ==========

[2011/10/04 18:23:00 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll -- [2010/04/16 13:07:57 | 001,510,400 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2009/02/09 07:52:53 | 000,473,600 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\wbemess.dll -- [2008/04/14 09:00:00 | 000,273,920 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== Custom Scans ==========

========== Base Services ==========
SRV - [2008/04/14 09:00:00 | 000,044,544 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\WINDOWS\system32\alg.exe -- (ALG)
SRV - [2008/04/14 09:00:00 | 000,006,656 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\wuauserv.dll -- (wuauserv)
SRV - [2008/04/14 09:00:00 | 000,409,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\system32\qmgr.dll -- (BITS)
SRV - [2012/07/06 10:58:39 | 000,078,336 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\browser.dll -- (Browser)
SRV - [2008/04/14 09:00:00 | 000,062,464 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\cryptsvc.dll -- (CryptSvc)
SRV - [2008/04/14 09:00:00 | 000,126,976 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\dhcpcsvc.dll -- (Dhcp)
SRV - [2009/04/20 14:18:35 | 000,045,568 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\dnsrslvr.dll -- (Dnscache)
SRV - [2009/02/09 08:23:54 | 000,111,104 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\services.exe -- (Eventlog)
SRV - [2008/04/14 09:00:00 | 000,033,792 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\system32\eapsvc.dll -- (EapHost)
SRV - [2009/07/27 20:17:44 | 000,135,168 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\WINDOWS\system32\shsvcs.dll -- (FastUserSwitchingCompatibility)
SRV - [2008/04/14 09:00:00 | 000,015,872 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\system32\w3ssl.dll -- (HTTPFilter)
SRV - File not found [Disabled | Stopped] -- %SystemRoot%\System32\hidserv.dll -- (HidServ)
SRV - [2008/04/14 09:00:00 | 000,150,528 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\system32\imapi.exe -- (ImapiService)
SRV - [2008/04/14 09:00:00 | 000,013,312 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\lsass.exe -- (PolicyAgent)
SRV - [2008/04/14 09:00:00 | 000,024,064 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\WINDOWS\system32\dmserver.dll -- (dmserver)
SRV - [2008/04/14 09:00:00 | 000,225,792 | ---- | M] (Microsoft Corp., VERITAS Software) [On_Demand | Stopped] -- C:\WINDOWS\System32\dmadmin.exe -- (dmadmin)
SRV - [2008/04/14 09:00:00 | 000,005,120 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\System32\dllhost.exe -- (SwPrv)
SRV - [2008/04/14 09:00:00 | 000,013,312 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\system32\lsass.exe -- (Netlogon)
SRV - [2008/04/14 09:00:00 | 000,198,144 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\WINDOWS\system32\netman.dll -- (Netman)
SRV - [2008/06/20 13:03:30 | 000,248,320 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\WINDOWS\system32\mswsock.dll -- (Nla)
SRV - [2009/02/09 08:23:54 | 000,111,104 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\services.exe -- (PlugPlay)
SRV - [2010/08/17 10:17:06 | 000,058,880 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\spoolsv.exe -- (Spooler)
SRV - [2008/04/14 09:00:00 | 000,013,312 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\lsass.exe -- (ProtectedStorage)
SRV - [2008/04/14 09:00:00 | 000,088,576 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\system32\rasauto.dll -- (RasAuto)
SRV - [2008/04/14 09:00:00 | 000,186,368 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\WINDOWS\system32\rasmans.dll -- (RasMan)
SRV - [2009/02/09 07:52:54 | 000,401,408 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\rpcss.dll -- (RpcSs)
SRV - [2008/04/14 09:00:00 | 000,437,760 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\system32\ntmssvc.dll -- (NtmsSvc)
SRV - [2008/04/14 09:00:00 | 000,018,944 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\seclogon.dll -- (seclogon)
SRV - [2008/04/14 09:00:00 | 000,013,312 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\lsass.exe -- (SamSs)
SRV - [2008/04/14 09:00:00 | 000,080,896 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\wscsvc.dll -- (wscsvc)
SRV - [2010/08/27 02:53:17 | 000,099,840 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\srvsvc.dll -- (LanmanServer)
SRV - [2009/07/27 20:17:44 | 000,135,168 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\shsvcs.dll -- (ShellHWDetection)
SRV - [2008/04/14 09:00:00 | 000,171,520 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\srsvc.dll -- (srservice)
SRV - [2008/04/14 09:00:00 | 000,193,536 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\schedsvc.dll -- (Schedule)
SRV - [2008/04/14 09:00:00 | 000,013,824 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\lmhsvc.dll -- (LmHosts)
SRV - [2008/04/14 09:00:00 | 000,249,856 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\WINDOWS\system32\tapisrv.dll -- (TapiSrv)
SRV - [2008/04/14 09:00:00 | 000,296,960 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\WINDOWS\system32\termsrv.dll -- (TermService)
SRV - [2009/07/27 20:17:44 | 000,135,168 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\shsvcs.dll -- (Themes)
SRV - [2008/04/14 09:00:00 | 000,293,888 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\system32\vssvc.exe -- (VSS)
SRV - [2008/04/14 09:00:00 | 000,042,496 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\audiosrv.dll -- (AudioSrv)
SRV - [2008/04/14 09:00:00 | 000,332,288 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\ipnathlp.dll -- (SharedAccess)
SRV - [2008/04/14 09:00:00 | 000,334,336 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\wiaservc.dll -- (stisvc)
SRV - [2008/04/14 09:00:00 | 000,078,848 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\System32\msiexec.exe -- (MSIServer)
SRV - [2008/04/14 09:00:00 | 000,145,408 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\wbem\wmisvc.dll -- (winmgmt)
SRV - [2009/02/09 07:52:54 | 000,685,056 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\system32\advapi32.dll -- (Wmi)
SRV - [2008/04/14 09:00:00 | 000,133,120 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\system32\dot3svc.dll -- (Dot3svc)
SRV - [2008/04/14 09:00:00 | 000,484,352 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\wzcsvc.dll -- (WZCSVC)
SRV - [2009/06/10 03:15:19 | 000,132,096 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\wkssvc.dll -- (lanmanworkstation)

< %SYSTEMDRIVE%\*.exe >

< MD5 for: EXPLORER.EXE >
[2008/04/14 09:00:00 | 001,036,288 | ---- | M] (Microsoft Corporation) MD5=7522F548A84ABAD8FA516DE5AB3931EF -- C:\WINDOWS\explorer.exe
[2008/04/14 09:00:00 | 001,036,288 | ---- | M] (Microsoft Corporation) MD5=7522F548A84ABAD8FA516DE5AB3931EF -- C:\WINDOWS\system32\dllcache\explorer.exe

< MD5 for: SERVICES >
[2008/04/14 09:00:00 | 000,007,666 | ---- | M] () MD5=D20F9371F8481B6133AF3940227B5BB7 -- C:\WINDOWS\system32\drivers\etc\services

< MD5 for: SERVICES.EXE >
[2009/02/09 08:23:54 | 000,111,104 | ---- | M] (Microsoft Corporation) MD5=953DF7327510DF0DE048B8E80E504EF9 -- C:\WINDOWS\system32\dllcache\services.exe
[2009/02/09 08:23:54 | 000,111,104 | ---- | M] (Microsoft Corporation) MD5=953DF7327510DF0DE048B8E80E504EF9 -- C:\WINDOWS\system32\services.exe
[2009/02/09 08:16:53 | 000,111,104 | ---- | M] (Microsoft Corporation) MD5=AA6E1769469F9D15603A619FC1FB9E18 -- C:\WINDOWS\$hf_mig$\KB956572\SP3QFE\services.exe
[2008/04/14 09:00:00 | 000,109,056 | ---- | M] (Microsoft Corporation) MD5=D658A8C2FC7B2AD53D1259741A09EE04 -- C:\WINDOWS\$NtUninstallKB956572$\services.exe

< MD5 for: SERVICES.MOCHIADS.COM.SOL >
[2012/06/02 20:57:49 | 000,000,391 | ---- | M] () MD5=74D0BFBB8CDB4057F20490084BFF9B56 -- C:\Documents and Settings\Jorge\Datos de programa\Macromedia\Flash Player\#SharedObjects\XPBU4C8A\mochiads.com\services.mochiads.com.sol

< MD5 for: SERVICES.MSC >
[2008/04/14 09:00:00 | 000,033,077 | ---- | M] () MD5=5D1E2E70F1D65D9BF7A5AE52ED79577A -- C:\WINDOWS\system32\services.msc

< MD5 for: SVCHOST.EXE >
[2008/04/14 09:00:00 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=4F2340F0BD5B6365C38E74DD391919A8 -- C:\WINDOWS\system32\dllcache\svchost.exe
[2008/04/14 09:00:00 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=4F2340F0BD5B6365C38E74DD391919A8 -- C:\WINDOWS\system32\svchost.exe

< MD5 for: USERINIT.EXE >
[2008/04/14 09:00:00 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=F5B8745B9A90EAF17E30C0574E049AA3 -- C:\WINDOWS\system32\dllcache\userinit.exe
[2008/04/14 09:00:00 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=F5B8745B9A90EAF17E30C0574E049AA3 -- C:\WINDOWS\system32\userinit.exe

< MD5 for: WINLOGON.EXE >
[2008/04/14 09:00:00 | 000,510,976 | ---- | M] (Microsoft Corporation) MD5=213C80D912880BBF04453D09FFCCB28C -- C:\WINDOWS\system32\dllcache\winlogon.exe
[2008/04/14 09:00:00 | 000,510,976 | ---- | M] (Microsoft Corporation) MD5=213C80D912880BBF04453D09FFCCB28C -- C:\WINDOWS\system32\winlogon.exe

< MD5 for: WINSOCK.DLL >
[2008/04/14 09:00:00 | 000,002,864 | ---- | M] (Microsoft Corporation) MD5=68485C5EF0E2EFCEBF21BBB1042B823B -- C:\WINDOWS\system32\dllcache\winsock.dll
[2008/04/14 09:00:00 | 000,002,864 | ---- | M] (Microsoft Corporation) MD5=68485C5EF0E2EFCEBF21BBB1042B823B -- C:\WINDOWS\system32\winsock.dll

========== Alternate Data Streams ==========

@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Datos de programa\TEMP:B80659FA

< End of report >
-----------------------------------------------------------------------------------------------------------------------

This is the Extra.txt file:
-----------------------------------------------------------------------------------------------------------------------
OTL Extras logfile created on: 13/11/2012 18:11:50 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Nicolás\Escritorio
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000C0A | Country: España | Language: ESN | Date Format: dd/MM/yyyy

959,17 Mb Total Physical Memory | 309,91 Mb Available Physical Memory | 32,31% Memory free
2,26 Gb Paging File | 1,49 Gb Available in Paging File | 65,82% Paging File free
Paging file location(s): C:\pagefile.sys 1440 2880 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Archivos de programa
Drive C: | 44,71 Gb Total Space | 10,84 Gb Free Space | 24,25% Space Free | Partition Type: NTFS
Drive D: | 104,33 Gb Total Space | 44,12 Gb Free Space | 42,29% Space Free | Partition Type: NTFS

Computer Name: MARCELA-B8AE7CF | User Name: Nicolás | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = htmlfile] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome
.url [@ = InternetShortcut] -- rundll32.exe shdocvw.dll,OpenURL %l

[HKEY_USERS\S-1-5-21-776561741-1647877149-1417001333-1004\SOFTWARE\Classes\<extension>]
.html [@ = htmlfile] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome
InternetShortcut [open] -- rundll32.exe shdocvw.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Winamp.Bookmark] -- "C:\Archivos de programa\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Archivos de programa\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Archivos de programa\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
"C:\Archivos de programa\Windows Live\Messenger\wlcsdk.exe" = C:\Archivos de programa\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call
"C:\Archivos de programa\Windows Live\Messenger\msnmsgr.exe" = C:\Archivos de programa\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger -- (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
"C:\Archivos de programa\Windows Live\Messenger\wlcsdk.exe" = C:\Archivos de programa\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call
"C:\Archivos de programa\Windows Live\Messenger\msnmsgr.exe" = C:\Archivos de programa\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger -- (Microsoft Corporation)
"C:\Archivos de programa\Opera\opera.exe" = C:\Archivos de programa\Opera\opera.exe:*:Enabled:Opera Internet Browser -- (Opera Software)
"D:\Ares\Ares.exe" = D:\Ares\Ares.exe:*:Enabled:Ares p2p for windows
"D:\BitTorrent\bittorrent.exe" = D:\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent
"C:\Archivos de programa\Java\jre6\bin\javaw.exe" = C:\Archivos de programa\Java\jre6\bin\javaw.exe:*:Enabled:Java™ Platform SE binary -- (Sun Microsystems, Inc.)
"D:\Mis Documentos\eMule\emule.exe" = D:\Mis Documentos\eMule\emule.exe:*:Enabled:eMule
"C:\Documents and Settings\Nicolás\Mis documentos\Mis historiales de conversación\Ares\Ares.exe" = C:\Documents and Settings\Nicolás\Mis documentos\Mis historiales de conversación\Ares\Ares.exe:*:Enabled:Ares p2p for windows -- (Ares Development Group)
"C:\Archivos de programa\Yahoo!\Messenger\YahooMessenger.exe" = C:\Archivos de programa\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger
"C:\Documents and Settings\Nicolás\Escritorio\GTA Vice City\gta-vc.exe" = C:\Documents and Settings\Nicolás\Escritorio\GTA Vice City\gta-vc.exe:*:Enabled:gta-vc
"C:\Archivos de programa\Google\Google Earth\client\googleearth.exe" = C:\Archivos de programa\Google\Google Earth\client\googleearth.exe:*:Enabled:Google Earth
"C:\Archivos de programa\Java\jre6\bin\java.exe" = C:\Archivos de programa\Java\jre6\bin\java.exe:*:Enabled:Java™ Platform SE binary -- (Sun Microsystems, Inc.)
"C:\WINDOWS\system32\dpvsetup.exe" = C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test -- (Microsoft Corporation)
"C:\Documents and Settings\Marcela\Configuración local\Temp\Update_3f21.exe" = C:\Documents and Settings\Marcela\Configuración local\Temp\Update_3f21.exe:*:Enabled:InstallCore™
"C:\Documents and Settings\Marcela\Configuración local\Temp\ICReinstall\Update_3f21.exe" = C:\Documents and Settings\Marcela\Configuración local\Temp\ICReinstall\Update_3f21.exe:*:Enabled:InstallCore™
"C:\Archivos de programa\Bonjour\mDNSResponder.exe" = C:\Archivos de programa\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour -- (Apple Inc.)
"C:\Documents and Settings\Nicolás\Escritorio\Warcraft III\war3.exe" = C:\Documents and Settings\Nicolás\Escritorio\Warcraft III\war3.exe:*:Enabled:Warcraft III
"C:\Archivos de programa\Prysmax Gunz\theduel.exe" = C:\Archivos de programa\Prysmax Gunz\theduel.exe:*:Enabled:Gunz
"D:\Wow\World of Warcraft\Launcher.exe" = D:\Wow\World of Warcraft\Launcher.exe:*:Enabled:Blizzard Launcher
"D:\Wow\World of Warcraft\WoW-x.x.x.x-4.0.0.12911-EU-Downloader.exe" = D:\Wow\World of Warcraft\WoW-x.x.x.x-4.0.0.12911-EU-Downloader.exe:*:Enabled:Blizzard Downloader
"D:\Wow\World of Warcraft\Launcher.patch.exe" = D:\Wow\World of Warcraft\Launcher.patch.exe:*:Enabled:Blizzard Launcher
"D:\Wow\World of Warcraft\BackgroundDownloader.exe" = D:\Wow\World of Warcraft\BackgroundDownloader.exe:*:Enabled:BackgroundDownloader.exe
"C:\Documents and Settings\Nicolás\Mis documentos\Juegos\Warcraft III\war3.exe" = C:\Documents and Settings\Nicolás\Mis documentos\Juegos\Warcraft III\war3.exe:*:Enabled:Warcraft III -- (Blizzard Entertainment)
"C:\Archivos de programa\Steam\Steam.exe" = C:\Archivos de programa\Steam\Steam.exe:*:Enabled:Steam
"C:\Archivos de programa\Steam\SteamApps\common\dota 2 beta\dota.exe" = C:\Archivos de programa\Steam\SteamApps\common\dota 2 beta\dota.exe:*:Enabled:Dota 2
"C:\WINDOWS\system32\rundll32.exe" = C:\WINDOWS\system32\rundll32.exe:*:Disabled:Ejecutar un archivo DLL como una aplicación -- (Microsoft Corporation)
"C:\Archivos de programa\Opera\pluginwrapper\opera_plugin_wrapper.exe" = C:\Archivos de programa\Opera\pluginwrapper\opera_plugin_wrapper.exe:*:Enabled:Opera Internet Browser - Plugin wrapper
"C:\Archivos de programa\AVG\AVG2012\avgmfapx.exe" = C:\Archivos de programa\AVG\AVG2012\avgmfapx.exe:*:Enabled:Instalador de AVG -- (AVG Technologies CZ, s.r.o.)
"C:\Archivos de programa\AVG\AVG2012\avgnsx.exe" = C:\Archivos de programa\AVG\AVG2012\avgnsx.exe:*:Enabled:Online Shield -- (AVG Technologies CZ, s.r.o.)
"C:\Archivos de programa\AVG\AVG2012\avgdiagex.exe" = C:\Archivos de programa\AVG\AVG2012\avgdiagex.exe:*:Enabled:AVG Diagnóstico 2012 -- (AVG Technologies CZ, s.r.o.)
"C:\Archivos de programa\AVG\AVG2012\avgemcx.exe" = C:\Archivos de programa\AVG\AVG2012\avgemcx.exe:*:Enabled:Analizador de correo personal -- (AVG Technologies CZ, s.r.o.)
"C:\Archivos de programa\uTorrent\uTorrent.exe" = C:\Archivos de programa\uTorrent\uTorrent.exe:*:Enabled:µTorrent -- (BitTorrent, Inc.)
"C:\Documents and Settings\Nicolás\Configuración local\Datos de programa\Facebook\Video\Skype\FacebookVideoCalling.exe" = C:\Documents and Settings\Nicolás\Configuración local\Datos de programa\Facebook\Video\Skype\FacebookVideoCalling.exe:*:Enabled:Facebook Video Calling Plugin -- (Skype Limited)
"C:\Archivos de programa\Skype\Phone\Skype.exe" = C:\Archivos de programa\Skype\Phone\Skype.exe:*:Enabled:Skype -- (Skype Technologies S.A.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{05D996FA-ADCB-4D23-BA3C-A7C184A8FAC6}_is1" = MiniTool Partition Wizard Home Edition 7.5
"{06A1BE8A-4CA4-4A39-B9E4-E815AA8FE05C}" = Sony Noise Reduction Plug-In 2.0h
"{1E76EB6E-E390-11DF-95DB-005056C00008}" = MSVCRT Redists
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Herramienta de carga de Windows Live
"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216015FF}" = Java™ 6 Update 15
"{2987EE84-C4EE-4FF5-8160-32DE00D6ABC6}" = GTA2
"{2B83A043-BA8C-4164-98AA-29529D0BE756}" = Windows Live Essentials
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{350C9C0A-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{38580E5E-AF78-4536-AD1E-6A62661372C5}" = AVG 2012
"{43002AE2-4093-49E0-A03D-990EE184C568}" = Lyrics Plugin for Windows Media Player
"{5E1375CB-6792-4464-8715-CC3EC83D48FA}" = VirtualDJ Home FREE
"{61879398-F35C-4628-AC95-2B84B859FE93}" = nrg2iso
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7593234B-2AEB-4FC9-B02D-C9B30D86084C}" = Windows Live Asistente para el inicio de sesión
"{8924FD04-AFF1-4387-B08B-6A979485F2BD}" = Windows Live Call
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A25392D-C5D2-4E79-A2BD-C15DDC5B0959}" = Bonjour
"{90110C0A-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9660B18F-EC12-11DF-B006-0013D3D69929}" = Sound Forge Pro 10.0
"{9A3D392C-B0BB-400A-A761-4B1497911034}" = Nero 7 Ultra Edition
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1034-7B44-A95000000001}" = Adobe Reader 9.5.2 - Español
"{B69C390B-826F-473C-86EB-7AD4950818C3}" = AVG 2012
"{B92C5909-1D37-4C51-8397-A28BB28E5DC3}" = Facebook Video Calling 1.2.0.287
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C4156B59-DD7E-40DF-AF08-E568A27A6409}" = Windows Live Messenger
"{CD89BDD5-E758-42D5-B34B-C149F88CE515}" = Look 316
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}" = Bluetooth Stack for Windows by Toshiba
"{D90AFDE3-3E67-407A-ACA8-F0BAAD012F08}" = Safari
"{DC35AABA-EA0A-41C1-8462-F60A201DFF9B}" = Noise Reduction Plug-in 2.0i
"{EA17F4FC-FDBF-4CF8-A529-2D983132D053}" = Skype™ 6.0
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F1E906E7-1120-428D-A124-4938C306427E}" = Palm Desktop
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Ares" = Ares 2.1.6
"ASIO4ALL" = ASIO4ALL
"AVG" = AVG 2012
"BSPlayer1" = BSPlayer
"BSPlayerf" = BS.Player FREE
"DAEMON Tools Lite" = DAEMON Tools Lite
"dec2bed684e304717a7d1fb481af4f01" = Jewel Quest® Solitaire
"Deckadance" = Deckadance
"DVD Region+CSS Free_is1" = DVD Region+CSS Free 5.9.8.5
"Express FX 1" = Sonic Foundry Express FX 1
"ExpressFX 2" = Sonic Foundry Express FX 2
"FL Studio 10" = FL Studio 10
"gen_msn_adv" = gen_msn_adv 1.1
"Google Chrome" = Google Chrome
"ie8" = Windows Internet Explorer 8
"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Platform Device Manager
"JDownloader" = JDownloader
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Messenger Plus! Live" = Messenger Plus! Live
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox 13.0.1 (x86 es-ES)" = Mozilla Firefox 13.0.1 (x86 es-ES)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NeroVision!UninstallKey" = Nero Digital
"Opera 12.10.1652" = Opera 12.10
"Ricochet Infinity en Español" = Ricochet Infinity en Español
"uTorrent" = µTorrent
"VIA/S3G UniChrome Family Win2K/XP/Server2003 Display" = VIA/S3G Display Driver
"Winamp" = Winamp
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Reproductor de Windows Media 11
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = Compresor WinRAR
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XFX 1" = Sonic Foundry XFX 1 Plug-In Pack
"XFX 2" = Sonic Foundry XFX 2 Plug-In Pack
"XFX 3" = Sonic Foundry XFX 3 Plug-In Pack
"XP Codec Pack" = XP Codec Pack

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-776561741-1647877149-1417001333-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 08/11/2012 13:41:18 | Computer Name = MARCELA-B8AE7CF | Source = Application Error | ID = 1000
Description = Aplicación con errores: skype.exe, versión: 6.0.73.123, módulo con
error: unknown, versión 0.0.0.0, dirección de error 0x00000204.

Error - 08/11/2012 15:01:09 | Computer Name = MARCELA-B8AE7CF | Source = Application Error | ID = 1000
Description = Aplicación con errores: skype.exe, versión: 6.0.73.123, módulo con
error: unknown, versión 0.0.0.0, dirección de error 0x00000204.

Error - 09/11/2012 8:34:22 | Computer Name = MARCELA-B8AE7CF | Source = Application Error | ID = 1000
Description = Aplicación con errores: safari.exe, versión: 3.525.28.1, módulo con
error: npswf32_11_4_402_287.dll, versión 11.4.402.287, dirección de error 0x0005c2e2.

Error - 09/11/2012 12:45:51 | Computer Name = MARCELA-B8AE7CF | Source = Application Error | ID = 1000
Description = Aplicación con errores: skype.exe, versión: 6.0.73.123, módulo con
error: unknown, versión 0.0.0.0, dirección de error 0x00000204.

Error - 09/11/2012 13:43:35 | Computer Name = MARCELA-B8AE7CF | Source = Application Error | ID = 1000
Description = Aplicación con errores: skype.exe, versión: 6.0.73.123, módulo con
error: unknown, versión 0.0.0.0, dirección de error 0x00000204.

Error - 09/11/2012 14:56:29 | Computer Name = MARCELA-B8AE7CF | Source = Application Error | ID = 1000
Description = Aplicación con errores: skype.exe, versión: 6.0.73.123, módulo con
error: unknown, versión 0.0.0.0, dirección de error 0x00000204.

Error - 10/11/2012 11:34:21 | Computer Name = MARCELA-B8AE7CF | Source = Application Error | ID = 1000
Description = Aplicación con errores: skype.exe, versión: 6.0.73.123, módulo con
error: unknown, versión 0.0.0.0, dirección de error 0x00000204.

Error - 11/11/2012 22:22:21 | Computer Name = MARCELA-B8AE7CF | Source = Application Error | ID = 1000
Description = Aplicación con errores: skype.exe, versión: 6.0.73.123, módulo con
error: unknown, versión 0.0.0.0, dirección de error 0x00000204.

Error - 12/11/2012 13:40:03 | Computer Name = MARCELA-B8AE7CF | Source = Application Error | ID = 1000
Description = Aplicación con errores: skype.exe, versión: 6.0.73.123, módulo con
error: unknown, versión 0.0.0.0, dirección de error 0x00000204.

Error - 13/11/2012 15:41:06 | Computer Name = MARCELA-B8AE7CF | Source = Application Error | ID = 1000
Description = Aplicación con errores: skype.exe, versión: 6.0.73.123, módulo con
error: unknown, versión 0.0.0.0, dirección de error 0x00000204.

[ System Events ]
Error - 10/11/2012 13:56:21 | Computer Name = MARCELA-B8AE7CF | Source = NtServicePack | ID = 921877
Description = Windows XP Se ha producido un error en la instalación de KB2724197.
Error
interno.

Error - 10/11/2012 13:56:22 | Computer Name = MARCELA-B8AE7CF | Source = Windows Update Agent | ID = 20
Description = Error de instalación: error de Windows al instalar la siguiente actualización,
error 0x8007054f: Actualización de seguridad para Windows XP (KB2724197).

Error - 12/11/2012 1:22:58 | Computer Name = MARCELA-B8AE7CF | Source = NtServicePack | ID = 921877
Description = Windows XP Se ha producido un error en la instalación de KB2676562.
Error
interno.

Error - 12/11/2012 1:23:00 | Computer Name = MARCELA-B8AE7CF | Source = Windows Update Agent | ID = 20
Description = Error de instalación: error de Windows al instalar la siguiente actualización,
error 0x8007054f: Actualización de seguridad para Windows XP (KB2676562).

Error - 12/11/2012 1:23:02 | Computer Name = MARCELA-B8AE7CF | Source = NtServicePack | ID = 921877
Description = Windows XP Se ha producido un error en la instalación de KB2724197.
Error
interno.

Error - 12/11/2012 1:23:03 | Computer Name = MARCELA-B8AE7CF | Source = Windows Update Agent | ID = 20
Description = Error de instalación: error de Windows al instalar la siguiente actualización,
error 0x8007054f: Actualización de seguridad para Windows XP (KB2724197).

Error - 12/11/2012 23:47:53 | Computer Name = MARCELA-B8AE7CF | Source = NtServicePack | ID = 921877
Description = Windows XP Se ha producido un error en la instalación de KB2676562.
Error
interno.

Error - 12/11/2012 23:47:54 | Computer Name = MARCELA-B8AE7CF | Source = Windows Update Agent | ID = 20
Description = Error de instalación: error de Windows al instalar la siguiente actualización,
error 0x8007054f: Actualización de seguridad para Windows XP (KB2676562).

Error - 12/11/2012 23:47:56 | Computer Name = MARCELA-B8AE7CF | Source = NtServicePack | ID = 921877
Description = Windows XP Se ha producido un error en la instalación de KB2724197.
Error
interno.

Error - 12/11/2012 23:47:57 | Computer Name = MARCELA-B8AE7CF | Source = Windows Update Agent | ID = 20
Description = Error de instalación: error de Windows al instalar la siguiente actualización,
error 0x8007054f: Actualización de seguridad para Windows XP (KB2724197).

< End of report >

#4
Essexboy

Posted 14 November 2012 - 08:11 AM

GeekU Moderator

Retired Staff
69,964 posts

OK lets tidy some of this up.. If TDSSKiller does not run are you able to burn a CD and have access to a USB drive ?

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following

:OTL
IE - HKU\S-1-5-21-776561741-1647877149-1417001333-1004\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - No CLSID value found
IE - HKU\S-1-5-21-776561741-1647877149-1417001333-1004\..\URLSearchHook: {0974848a-b5bc-49f2-9778-307742b4a55d} - No CLSID value found
O3 - HKU\S-1-5-21-776561741-1647877149-1417001333-1004\..\Toolbar\WebBrowser: (no name) - {0974848A-B5BC-49F2-9778-307742B4A55D} - No CLSID value found.
O3 - HKU\S-1-5-21-776561741-1647877149-1417001333-1004\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O4 - HKLM..\Run: [FfFUNqDJKfsj.exe] C:\Documents and Settings\All Users\Datos de programa\FfFUNqDJKfsj.exe File not found
[2011/10/14 15:41:09 | 000,000,296 | ---- | C] () -- C:\Documents and Settings\All Users\Datos de programa\~6DSS92c31Apgjk
[2011/10/14 15:41:09 | 000,000,216 | ---- | C] () -- C:\Documents and Settings\All Users\Datos de programa\~6DSS92c31Apgjkr
[2011/10/14 15:41:06 | 000,000,456 | ---- | C] () -- C:\Documents and Settings\All Users\Datos de programa\6DSS92c31Apgjk

:Commands
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot the PC when it is done
Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

THEN

Download the latest version of TDSSKiller from here and save it to your Desktop.

Doubleclick on TDSSKiller.exe to run the application
Then click on Change parameters.
Check the boxes beside Verify Driver Digital Signature and Detect TDLFS file system, then click OK.
Click the Start Scan button.
If a suspicious object is detected, the default action will be Skip, click on Continue.
If malicious objects are found, they will show in the Scan results and offer three (3) options.
Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.
Get the report by selecting Reports
Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.

Please copy and paste its contents on your next reply.

#5
BlueMonday495

Posted 15 November 2012 - 03:13 PM

Member

Topic Starter
Member
14 posts

Thank you very much for replying.
Here's the OTL's logfile:

OTL logfile created on: 15/11/2012 17:54:52 - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Nicolás\Escritorio
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000C0A | Country: España | Language: ESN | Date Format: dd/MM/yyyy

959,17 Mb Total Physical Memory | 267,64 Mb Available Physical Memory | 27,90% Memory free
2,26 Gb Paging File | 1,56 Gb Available in Paging File | 69,03% Paging File free
Paging file location(s): C:\pagefile.sys 1440 2880 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Archivos de programa
Drive C: | 44,71 Gb Total Space | 15,11 Gb Free Space | 33,79% Space Free | Partition Type: NTFS
Drive D: | 104,33 Gb Total Space | 47,96 Gb Free Space | 45,97% Space Free | Partition Type: NTFS

Computer Name: MARCELA-B8AE7CF | User Name: Nicolás | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/11/09 20:47:34 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Nicolás\Escritorio\OTL.exe
PRC - [2012/11/08 15:27:41 | 000,878,480 | ---- | M] (Opera Software) -- C:\Archivos de programa\Opera\opera.exe
PRC - [2012/08/13 03:24:48 | 005,167,736 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Archivos de programa\AVG\AVG2012\avgidsagent.exe
PRC - [2012/07/31 03:37:02 | 002,596,984 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Archivos de programa\AVG\AVG2012\avgtray.exe
PRC - [2012/07/26 03:23:08 | 000,758,392 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Archivos de programa\AVG\AVG2012\avgrsx.exe
PRC - [2012/06/13 03:48:24 | 001,255,544 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Archivos de programa\AVG\AVG2012\avgnsx.exe
PRC - [2012/02/14 04:53:38 | 000,193,288 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Archivos de programa\AVG\AVG2012\avgwdsvc.exe
PRC - [2012/02/14 04:52:38 | 000,338,784 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Archivos de programa\AVG\AVG2012\avgcsrvx.exe
PRC - [2010/07/12 13:32:48 | 000,074,752 | ---- | M] (Nullsoft, Inc.) -- C:\Archivos de programa\Winamp\winampa.exe
PRC - [2010/07/10 09:56:34 | 001,015,808 | -H-- | M] (Ares Development Group) -- C:\Documents and Settings\Nicolás\Mis documentos\Mis historiales de conversación\Ares\Ares.exe
PRC - [2008/04/14 09:00:00 | 001,036,288 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2008/03/14 13:09:56 | 002,938,184 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Archivos de programa\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
PRC - [2008/01/22 20:13:08 | 000,288,072 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Archivos de programa\Toshiba\Bluetooth Toshiba Stack\TosBtHSP.exe
PRC - [2007/10/29 14:30:14 | 000,278,528 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Archivos de programa\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
PRC - [2007/10/04 18:39:42 | 000,077,824 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Archivos de programa\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
PRC - [2007/09/28 16:05:16 | 000,128,360 | ---- | M] (TOSHIBA CORPORATION) -- C:\Archivos de programa\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
PRC - [2007/09/28 16:03:46 | 000,075,136 | ---- | M] ( TOSHIBA CORPORATION) -- C:\Archivos de programa\Toshiba\Bluetooth Toshiba Stack\ItSecMng.exe
PRC - [2007/01/15 16:14:54 | 000,147,456 | ---- | M] (Nero AG) -- C:\Archivos de programa\Archivos comunes\Ahead\Lib\NMBgMonitor.exe
PRC - [2007/01/15 16:13:50 | 001,208,320 | ---- | M] (Nero AG) -- C:\Archivos de programa\Archivos comunes\Ahead\Lib\NMIndexStoreSvr.exe
PRC - [2007/01/15 16:01:56 | 000,266,240 | ---- | M] (Nero AG) -- C:\Archivos de programa\Archivos comunes\Ahead\Lib\NMIndexingService.exe
PRC - [2005/08/05 15:15:04 | 000,061,440 | ---- | M] (Vimicro) -- C:\WINDOWS\VM305_STI.exe
PRC - [2005/03/11 00:33:28 | 000,053,248 | R--- | M] (S3 Graphics, Inc.) -- C:\WINDOWS\system32\VTTimer.exe

========== Modules (No Company Name) ==========

MOD - [2012/11/08 15:28:06 | 000,101,888 | ---- | M] () -- C:\Archivos de programa\Opera\gstreamer\plugins\gstwebmdec.dll
MOD - [2012/11/08 15:28:06 | 000,073,728 | ---- | M] () -- C:\Archivos de programa\Opera\gstreamer\plugins\gstwavparse.dll
MOD - [2012/11/08 15:28:06 | 000,057,344 | ---- | M] () -- C:\Archivos de programa\Opera\gstreamer\plugins\gstautodetect.dll
MOD - [2012/11/08 15:28:06 | 000,038,912 | ---- | M] () -- C:\Archivos de programa\Opera\gstreamer\plugins\gstwaveform.dll
MOD - [2012/11/08 15:28:05 | 000,312,832 | ---- | M] () -- C:\Archivos de programa\Opera\gstreamer\plugins\gstoggdec.dll
MOD - [2012/11/08 15:28:05 | 000,158,208 | ---- | M] () -- C:\Archivos de programa\Opera\gstreamer\plugins\gstffmpegcolorspace.dll
MOD - [2012/11/08 15:28:04 | 000,067,072 | ---- | M] () -- C:\Archivos de programa\Opera\gstreamer\plugins\gstdirectsound.dll
MOD - [2012/11/08 15:28:04 | 000,062,976 | ---- | M] () -- C:\Archivos de programa\Opera\gstreamer\plugins\gstdecodebin2.dll
MOD - [2012/11/08 15:28:03 | 000,096,256 | ---- | M] () -- C:\Archivos de programa\Opera\gstreamer\plugins\gstcoreplugins.dll
MOD - [2012/11/08 15:28:03 | 000,094,208 | ---- | M] () -- C:\Archivos de programa\Opera\gstreamer\plugins\gstaudioresample.dll
MOD - [2012/11/08 15:28:03 | 000,093,696 | ---- | M] () -- C:\Archivos de programa\Opera\gstreamer\plugins\gstaudioconvert.dll
MOD - [2012/11/08 15:28:02 | 000,835,584 | ---- | M] () -- C:\Archivos de programa\Opera\gstreamer\gstreamer.dll
MOD - [2012/10/18 21:54:42 | 009,814,968 | ---- | M] () -- C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_4_402_287.dll
MOD - [2008/04/14 09:00:00 | 000,014,336 | ---- | M] () -- C:\WINDOWS\system32\msdmo.dll
MOD - [2006/08/24 13:17:52 | 000,004,096 | ---- | M] () -- D:\Messenger Plus! Live\Detoured.dll
MOD - [2005/07/22 21:30:18 | 000,065,536 | ---- | M] () -- C:\WINDOWS\system32\TosCommAPI.dll

========== Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- %SystemRoot%\System32\hidserv.dll -- (HidServ)
SRV - [2012/11/02 10:34:58 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Archivos de programa\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012/10/18 21:54:42 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/08/13 03:24:48 | 005,167,736 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Archivos de programa\AVG\AVG2012\avgidsagent.exe -- (AVGIDSAgent)
SRV - [2012/06/14 19:17:46 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Archivos de programa\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012/02/14 04:53:38 | 000,193,288 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Archivos de programa\AVG\AVG2012\avgwdsvc.exe -- (avgwd)
SRV - [2007/09/28 16:05:16 | 000,128,360 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Archivos de programa\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe -- (TOSHIBA Bluetooth Service)
SRV - [2007/01/15 16:01:56 | 000,266,240 | ---- | M] (Nero AG) [On_Demand | Running] -- C:\Archivos de programa\Archivos comunes\Ahead\Lib\NMIndexingService.exe -- (NMIndexingService)
SRV - [2003/07/28 20:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Archivos de programa\Archivos comunes\Microsoft Shared\Source Engine\OSE.EXE -- (ose)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - File not found [Kernel | On_Demand | Unknown] -- -- (atmbwvh8)
DRV - [2012/09/22 17:50:14 | 000,477,240 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\sptd.sys -- (sptd)
DRV - [2012/08/24 15:43:18 | 000,301,920 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avgtdix.sys -- (Avgtdix)
DRV - [2012/07/26 03:21:30 | 000,237,408 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avgldx86.sys -- (Avgldx86)
DRV - [2012/06/18 13:34:38 | 000,015,576 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\pwdrvio.sys -- (pwdrvio)
DRV - [2012/06/18 13:34:38 | 000,010,200 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\pwdspio.sys -- (pwdspio)
DRV - [2012/04/19 04:50:26 | 000,024,896 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\avgidshx.sys -- (AVGIDSHX)
DRV - [2012/01/31 04:46:50 | 000,031,952 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\WINDOWS\system32\drivers\avgrkx86.sys -- (Avgrkx86)
DRV - [2011/12/23 13:32:14 | 000,041,040 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\avgmfx86.sys -- (Avgmfx86)
DRV - [2011/12/23 13:32:08 | 000,017,232 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\avgidsshimx.sys -- (AVGIDSShim)
DRV - [2011/12/23 13:32:06 | 000,024,144 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\avgidsfilterx.sys -- (AVGIDSFilter)
DRV - [2011/12/23 13:32:00 | 000,139,856 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\avgidsdriverx.sys -- (AVGIDSDriver)
DRV - [2008/03/25 16:24:22 | 000,131,712 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\tosrfbd.sys -- (tosrfbd)
DRV - [2008/03/25 13:54:02 | 000,041,472 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\tosporte.sys -- (tosporte)
DRV - [2008/03/19 11:38:24 | 000,074,112 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Tosrfhid.sys -- (Tosrfhid)
DRV - [2008/01/22 20:57:48 | 000,054,144 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\TosRfSnd.sys -- (TosRfSnd)
DRV - [2007/11/29 09:45:44 | 000,036,608 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\tosrfbnp.sys -- (tosrfbnp)
DRV - [2007/10/18 14:25:00 | 000,041,856 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\tosrfusb.sys -- (Tosrfusb)
DRV - [2007/10/02 11:43:22 | 000,064,128 | ---- | M] (TOSHIBA Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\tosrfcom.sys -- (Tosrfcom)
DRV - [2006/09/12 01:27:00 | 004,381,184 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.Sys -- (IntcAzAudAddService)
DRV - [2006/08/02 18:20:42 | 001,466,624 | ---- | M] (Vimicro Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\usbVM305.sys -- (ZSMC0305)
DRV - [2005/10/27 03:01:58 | 000,150,016 | ---- | M] (Windows ® 2000 DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\DDPlayCam.sys -- (DDPlayCam)
DRV - [2005/01/07 05:42:00 | 000,018,612 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\tosrfnds.sys -- (tosrfnds)
DRV - [2004/08/13 07:56:20 | 000,005,810 | R--- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ASACPI.sys -- (MTsensor)
DRV - [2004/03/04 17:25:54 | 000,016,509 | ---- | M] (Palm, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\PalmUSBD.sys -- (PalmUSBD)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ar.yahoo.com/?fr=fp-reg
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ar.yahoo.com/?fr=fp-reg
IE - HKLM\..\SearchScopes,DefaultScope = {44DE20C7-D5E2-4707-A556-23E02777A411}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.c...ferrer:source?}
IE - HKLM\..\SearchScopes\{44DE20C7-D5E2-4707-A556-23E02777A411}: "URL" = http://www.google.co...g}&sourceid=ie7

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://es.ask.com?o=15446&l=dis
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://es.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = es
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 72 5E 12 C6 6F 2E CB 01 [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.c...Box&Form=IE8SRC
IE - HKCU\..\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}: "URL" = http://websearch.ask...s}&locale=es_ES
IE - HKCU\..\SearchScopes\{44DE20C7-D5E2-4707-A556-23E02777A411}: "URL" = http://www.google.co...&rlz=1I7RNRZ_es
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "google.com"
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_4_402_287.dll ()
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Archivos de programa\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Archivos de programa\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Archivos de programa\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Archivos de programa\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Documents and Settings\Nicolás\Configuración local\Datos de programa\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Archivos de programa\AVG\AVG2012\Firefox4\ [2012/09/10 14:45:11 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{F53C93F1-07D5-430c-86D4-C9531B27DFAF}: C:\Archivos de programa\AVG\AVG2012\Firefox\DoNotTrack\ [2012/07/25 21:34:05 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Archivos de programa\Mozilla Firefox\components [2012/06/16 20:31:17 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Archivos de programa\Mozilla Firefox\plugins

[2012/06/16 20:33:41 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Nicolás\Datos de programa\Mozilla\Extensions
[2012/06/19 20:18:31 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Nicolás\Datos de programa\Mozilla\Firefox\Profiles\xd60heez.default\extensions
[2012/06/16 20:31:17 | 000,000,000 | ---D | M] (No name found) -- C:\Archivos de programa\Mozilla Firefox\extensions
[2012/06/14 19:19:07 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Archivos de programa\mozilla firefox\components\browsercomps.dll
[2012/06/14 20:41:16 | 000,002,252 | ---- | M] () -- C:\Archivos de programa\mozilla firefox\searchplugins\bing.xml
[2012/06/14 20:41:16 | 000,003,996 | ---- | M] () -- C:\Archivos de programa\mozilla firefox\searchplugins\drae.xml
[2012/06/14 20:41:16 | 000,001,143 | ---- | M] () -- C:\Archivos de programa\mozilla firefox\searchplugins\eBay-es.xml
[2012/06/14 20:41:16 | 000,002,040 | ---- | M] () -- C:\Archivos de programa\mozilla firefox\searchplugins\twitter.xml
[2012/06/14 20:41:16 | 000,001,178 | ---- | M] () -- C:\Archivos de programa\mozilla firefox\searchplugins\wikipedia-es.xml
[2012/06/14 20:41:15 | 000,001,102 | ---- | M] () -- C:\Archivos de programa\mozilla firefox\searchplugins\yahoo-es.xml

========== Chrome ==========

CHR - homepage: http://www.google.com/
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}
CHR - homepage: http://www.google.com/
CHR - plugin: Shockwave Flash (Enabled) = C:\Archivos de programa\Google\Chrome\Application\21.0.1180.89\PepperFlash\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Archivos de programa\Google\Chrome\Application\21.0.1180.89\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_4_402_287.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Archivos de programa\Google\Chrome\Application\21.0.1180.89\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Archivos de programa\Google\Chrome\Application\21.0.1180.89\pdf.dll
CHR - plugin: AVG Internet Security (Enabled) = C:\Documents and Settings\Nicol\u00E1s\Configuraci\u00F3n local\Datos de programa\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla\12.0.0.2210_0\plugins/avgnpss.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Archivos de programa\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.150.3 (Enabled) = C:\Archivos de programa\Java\jre6\bin\new_plugin\npdeploytk.dll
CHR - plugin: Java™ Platform SE 6 U15 (Enabled) = C:\Archivos de programa\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Archivos de programa\Windows Media Player\npdrmv2.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Archivos de programa\Windows Media Player\npwmsdrm.dll
CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Archivos de programa\Windows Media Player\npdsplay.dll
CHR - plugin: Google Update (Enabled) = C:\Archivos de programa\Google\Update\1.3.21.123\npGoogleUpdate3.dll
CHR - plugin: Facebook Video Calling Plugin (Enabled) = C:\Documents and Settings\Nicol\u00E1s\Configuraci\u00F3n local\Datos de programa\Facebook\Video\Skype\npFacebookVideoCalling.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Archivos de programa\Microsoft Silverlight\4.1.10329.0\npctrl.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - Extension: AVG Safe Search = C:\Documents and Settings\Nicolás\Configuración local\Datos de programa\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla\12.0.0.2210_0\
CHR - Extension: AVG Do Not Track = C:\Documents and Settings\Nicolás\Configuración local\Datos de programa\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\12.0.0.2166_0\

O1 HOSTS File: ([2012/02/05 22:15:23 | 000,000,828 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 200.69.192.155 fpatch.theduel.com.br
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Archivos de programa\Archivos comunes\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Archivos de programa\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (AVG Do Not Track) - {31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} - C:\Archivos de programa\AVG\AVG2012\avgdtiex.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Archivos de programa\AVG\AVG2012\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Windows Live Aplicación auxiliar de inicio de sesión) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Archivos de programa\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Archivos de programa\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O4 - HKLM..\Run: [Adobe ARM] C:\Archivos de programa\Archivos comunes\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [AVG_TRAY] C:\Archivos de programa\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [BigDog305] C:\WINDOWS\VM305_STI.EXE (Vimicro)
O4 - HKLM..\Run: [BluetoothAuthenticationAgent] C:\WINDOWS\System32\bthprops.cpl (Microsoft Corporation)
O4 - HKLM..\Run: [ITSecMng] C:\Archivos de programa\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe ( TOSHIBA CORPORATION)
O4 - HKLM..\Run: [LanguageShortcut] C:\Archivos de programa\CyberLink\PowerDVD\Language\Language.exe ()
O4 - HKLM..\Run: [NeroFilterCheck] C:\Archivos de programa\Archivos comunes\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [VTTimer] C:\WINDOWS\System32\VTTimer.exe (S3 Graphics, Inc.)
O4 - HKLM..\Run: [WinampAgent] C:\Archivos de programa\Winamp\winampa.exe (Nullsoft, Inc.)
O4 - HKCU..\Run: [AlcoholAutomount] "C:\Archivos de programa\Alcohol Soft\Alcohol 120\axcmd.exe" /automount File not found
O4 - HKCU..\Run: [ares] C:\Documents and Settings\Nicolás\Mis documentos\Mis historiales de conversación\Ares\Ares.exe (Ares Development Group)
O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Archivos de programa\Archivos comunes\Ahead\Lib\NMBgMonitor.exe (Nero AG)
O4 - HKCU..\Run: [BitTorrent] "D:\BitTorrent\bittorrent.exe" File not found
O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Archivos de programa\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKCU..\Run: [Facebook Update] C:\Documents and Settings\Nicolás\Configuración local\Datos de programa\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Menú Inicio\Programas\Inicio\Bluetooth Manager.lnk = C:\Archivos de programa\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe (TOSHIBA CORPORATION.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 0
O9 - Extra Button: AVG Do Not Track - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - C:\Archivos de programa\AVG\AVG2012\avgdtiex.dll (AVG Technologies CZ, s.r.o.)
O9 - Extra Button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Archivos de programa\Bonjour\ExplorerPlugin.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Archivos de programa\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} http://messenger.zon...kr.cab56986.cab (Checkers Class)
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} http://messenger.zon...1/GAME_UNO1.cab (UnoCtrl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zon...nt.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} http://messenger.zon...er.cab56986.cab (Minesweeper Flags Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 200.49.130.40 200.42.4.203
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{ED739DED-857A-4D73-A67C-81AFC3032F9B}: DhcpNameServer = 200.49.130.40 200.42.4.203
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Archivos de programa\Archivos comunes\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Archivos de programa\AVG\AVG2012\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\ARCHIV~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL File not found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Archivos de programa\Archivos comunes\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Archivos de programa\Archivos comunes\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\ARCHIV~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL File not found
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Archivos de programa\Archivos comunes\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Mi página de inicio actual) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\Nicolás\Configuración local\Datos de programa\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Nicolás\Configuración local\Datos de programa\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {93994DE8-8239-4655-B1D1-5F4E91300429} - C:\Archivos de programa\DVD Region+CSS Free\DVDShell.dll (Fengtao Software Inc.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/07/17 17:06:30 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\ARCHIV~1\AVG\AVG2012\avgrsx.exe /sync /restart)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2012/11/15 17:55:12 | 002,213,976 | ---- | C] (Kaspersky Lab ZAO) -- C:\Documents and Settings\Nicolás\Escritorio\tdsskiller.exe
[2012/11/15 17:44:38 | 000,000,000 | ---D | C] -- C:\_OTL
[2012/11/13 18:41:33 | 004,732,416 | ---- | C] (AVAST Software) -- C:\Documents and Settings\Nicolás\Mis documentos\aswMBR.exe
[2012/11/09 20:47:33 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Nicolás\Escritorio\OTL.exe
[2012/11/07 00:43:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menú Inicio\Programas\Skype
[2012/11/07 00:43:48 | 000,000,000 | ---D | C] -- C:\Archivos de programa\Archivos comunes\Skype
[2012/11/07 00:43:47 | 000,000,000 | R--D | C] -- C:\Archivos de programa\Skype
[2012/11/05 00:47:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Nicolás\Escritorio\3688698
[2012/10/30 19:16:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Nicolás\Escritorio\SYSTEM
[2012/10/18 19:49:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menú Inicio\Programas\Google Chrome

========== Files - Modified Within 30 Days ==========

[2012/11/15 17:55:19 | 002,213,976 | ---- | M] (Kaspersky Lab ZAO) -- C:\Documents and Settings\Nicolás\Escritorio\tdsskiller.exe
[2012/11/15 17:55:00 | 000,000,492 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{D4BEF01E-AB7A-4D5C-AC06-A937B3810C95}.job
[2012/11/15 17:50:08 | 000,001,100 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012/11/15 17:49:58 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012/11/15 17:27:00 | 000,001,200 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-776561741-1647877149-1417001333-1003UA.job
[2012/11/15 17:27:00 | 000,001,148 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-776561741-1647877149-1417001333-1003Core.job
[2012/11/15 17:11:01 | 000,000,838 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/11/15 17:03:02 | 000,001,104 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012/11/15 16:50:08 | 100,345,739 | ---- | M] () -- C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2012/11/14 16:35:04 | 000,001,018 | ---- | M] () -- C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-776561741-1647877149-1417001333-1004UA.job
[2012/11/14 01:35:02 | 000,000,996 | ---- | M] () -- C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-776561741-1647877149-1417001333-1004Core.job
[2012/11/13 18:44:28 | 004,732,416 | ---- | M] (AVAST Software) -- C:\Documents and Settings\Nicolás\Mis documentos\aswMBR.exe
[2012/11/13 16:38:24 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012/11/12 01:55:48 | 000,015,646 | ---- | M] () -- C:\Documents and Settings\Nicolás\Escritorio\romana.jpg
[2012/11/12 01:51:13 | 000,019,308 | ---- | M] () -- C:\Documents and Settings\Nicolás\Escritorio\Dr_ Julio Maiztegui.jpg
[2012/11/12 01:48:59 | 000,008,313 | ---- | M] () -- C:\Documents and Settings\Nicolás\Escritorio\Salvador-Mazza-V.jpg
[2012/11/09 20:47:34 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Nicolás\Escritorio\OTL.exe
[2012/11/08 15:04:59 | 000,001,885 | ---- | M] () -- C:\Documents and Settings\All Users\Escritorio\Google Chrome.lnk
[2012/11/07 14:47:19 | 000,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2012/11/07 14:47:16 | 000,092,160 | ---- | M] () -- C:\Documents and Settings\Nicolás\Configuración local\Datos de programa\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/11/07 00:48:35 | 000,002,307 | ---- | M] () -- C:\Documents and Settings\All Users\Escritorio\Skype.lnk
[2012/11/06 16:21:35 | 000,043,029 | ---- | M] () -- C:\Documents and Settings\Nicolás\Escritorio\webcam-toy-foto1.jpg
[2012/11/06 01:12:16 | 000,545,177 | ---- | M] () -- C:\Documents and Settings\Nicolás\Escritorio\Dog Unit.jpg
[2012/11/05 13:50:09 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2012/11/04 20:51:39 | 015,405,624 | ---- | M] () -- C:\Documents and Settings\Nicolás\Escritorio\Francesco_Diaz_Jeff_Rock_-_God_Save_The_Queen_(2011)_[MP3]_NF_3688698.rar
[2012/10/29 06:21:37 | 014,418,579 | ---- | M] () -- C:\Documents and Settings\Nicolás\Escritorio\G6&M3DS-R_M74.zip
[2012/10/25 14:29:01 | 000,499,322 | ---- | M] () -- C:\WINDOWS\System32\perfh00A.dat
[2012/10/25 14:29:01 | 000,435,832 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012/10/25 14:29:01 | 000,087,214 | ---- | M] () -- C:\WINDOWS\System32\perfc00A.dat
[2012/10/25 14:29:01 | 000,068,728 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012/10/24 22:38:50 | 000,000,038 | ---- | M] () -- C:\WINDOWS\AviSplitter.INI
[2012/10/18 18:31:46 | 000,223,798 | ---- | M] () -- C:\WINDOWS\System32\drivers\AVG\iavichjg.avm

========== Files Created - No Company Name ==========

[2012/11/12 01:55:48 | 000,015,646 | ---- | C] () -- C:\Documents and Settings\Nicolás\Escritorio\romana.jpg
[2012/11/12 01:51:13 | 000,019,308 | ---- | C] () -- C:\Documents and Settings\Nicolás\Escritorio\Dr_ Julio Maiztegui.jpg
[2012/11/12 01:48:59 | 000,008,313 | ---- | C] () -- C:\Documents and Settings\Nicolás\Escritorio\Salvador-Mazza-V.jpg
[2012/11/06 16:21:35 | 000,043,029 | ---- | C] () -- C:\Documents and Settings\Nicolás\Escritorio\webcam-toy-foto1.jpg
[2012/11/06 01:12:16 | 000,545,177 | ---- | C] () -- C:\Documents and Settings\Nicolás\Escritorio\Dog Unit.jpg
[2012/11/04 20:47:00 | 015,405,624 | ---- | C] () -- C:\Documents and Settings\Nicolás\Escritorio\Francesco_Diaz_Jeff_Rock_-_God_Save_The_Queen_(2011)_[MP3]_NF_3688698.rar
[2012/10/29 06:21:33 | 014,418,579 | ---- | C] () -- C:\Documents and Settings\Nicolás\Escritorio\G6&M3DS-R_M74.zip
[2012/10/18 19:49:33 | 000,001,885 | ---- | C] () -- C:\Documents and Settings\All Users\Escritorio\Google Chrome.lnk
[2012/10/18 19:48:00 | 000,000,838 | ---- | C] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/08/15 23:44:00 | 002,872,512 | ---- | C] () -- C:\WINDOWS\System32\pwNative.exe
[2012/08/15 23:43:58 | 000,015,576 | ---- | C] () -- C:\WINDOWS\System32\pwdrvio.sys
[2012/08/15 23:43:58 | 000,010,200 | ---- | C] () -- C:\WINDOWS\System32\pwdspio.sys
[2012/07/24 12:53:56 | 000,921,654 | ---- | C] () -- C:\Documents and Settings\Nicolás\marioferchoo o.bmp
[2012/07/15 18:34:13 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2012/02/05 20:29:47 | 000,000,033 | ---- | C] () -- C:\WINDOWS\GunzLauncher.INI
[2011/10/24 18:28:27 | 000,018,868 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2011/10/11 18:41:48 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/05/09 18:30:21 | 000,000,038 | ---- | C] () -- C:\WINDOWS\AviSplitter.INI
[2011/01/16 18:08:23 | 000,000,151 | ---- | C] () -- C:\WINDOWS\PhotoSnapViewer.INI
[2010/12/19 15:26:36 | 000,000,042 | ---- | C] () -- C:\Documents and Settings\Nicolás\default.pls
[2010/10/15 15:25:39 | 000,092,160 | ---- | C] () -- C:\Documents and Settings\Nicolás\Configuración local\Datos de programa\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

========== ZeroAccess Check ==========

[2011/10/04 18:23:00 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll -- [2010/04/16 13:07:57 | 001,510,400 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2009/02/09 07:52:53 | 000,473,600 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\wbemess.dll -- [2008/04/14 09:00:00 | 000,273,920 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2012/11/09 15:55:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Datos de programa\AVG2012
[2011/11/11 15:33:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Datos de programa\avg9
[2011/03/14 20:10:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Datos de programa\Common Files
[2012/09/22 17:39:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Datos de programa\DAEMON Tools Lite
[2012/08/16 01:43:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Datos de programa\InstallMate
[2010/11/12 15:11:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Datos de programa\Messenger Plus!
[2012/11/15 16:50:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Datos de programa\MFAData
[2012/08/16 01:43:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Datos de programa\Premium
[2011/11/11 15:24:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Datos de programa\TEMP
[2010/12/10 14:59:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Nicolás\Datos de programa\alot
[2011/11/13 19:42:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Nicolás\Datos de programa\AVG2012
[2010/12/02 15:58:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Nicolás\Datos de programa\BSplayer
[2010/10/15 16:15:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Nicolás\Datos de programa\BSplayer Pro
[2012/07/02 01:51:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Nicolás\Datos de programa\cacaoweb
[2012/09/22 17:50:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Nicolás\Datos de programa\DAEMON Tools Lite
[2012/02/27 10:31:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Nicolás\Datos de programa\Deckadance19
[2010/07/28 13:20:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Nicolás\Datos de programa\Opera
[2011/02/04 18:27:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Nicolás\Datos de programa\PriceGong
[2011/10/04 19:01:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Nicolás\Datos de programa\Publish Providers
[2012/08/16 01:42:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Nicolás\Datos de programa\SendSpace
[2012/07/30 11:59:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Nicolás\Datos de programa\SongManager
[2011/10/04 19:01:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Nicolás\Datos de programa\Sony
[2010/08/01 12:22:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Nicolás\Datos de programa\TOSHIBA
[2012/11/07 23:43:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Nicolás\Datos de programa\uTorrent
[2012/08/27 19:52:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Nicolás\Datos de programa\YCanPDF

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 88 bytes -> C:\Documents and Settings\Nicolás\Mis documentos\aswMBR.exe:SummaryInformation
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Datos de programa\TEMP:B80659FA

< End of report >

------------------------------------------------------------------------

By the way, I cannot open Tdsskiller.exe neither, but I can burn a DVD, and I do have access to a USB Drive.
Thank you again!

#6
Essexboy

Posted 15 November 2012 - 04:10 PM

GeekU Moderator

Retired Staff
69,964 posts

Please print these instruction out so that you know what you are doing

Download OTLPENet.exe to your desktop
Download Listpart and save it to a flash drive.
Ensure that you have a blank CD in the drive
Double click OTLPENet.exe and this will then open imgburn to burn the file to CD
Reboot your system using the boot CD you just created.
Note : If you do not know how to set your computer to boot from CD follow the steps here
As the CD needs to detect your hardware and load the operating system, I would recommend a nice cup of tea whilst it loads
Your system should now display a Reatogo desktop.
Note : as you are running from CD it is not exactly speedy
Insert the flash drive with Listparts on it
Locate the flash drive and run Listparts
The tool will start to run.
Press Scan button.
It will make a log (results.txt) on the flash drive. Please copy and paste it to your reply.
.

#7
Essexboy

Posted 22 November 2012 - 04:23 PM

GeekU Moderator

Retired Staff
69,964 posts

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.

#8
Essexboy

Posted 20 December 2012 - 08:05 AM

GeekU Moderator

Retired Staff
69,964 posts

User returned

#9
BlueMonday495

Posted 20 December 2012 - 09:41 AM

Member

Topic Starter
Member
14 posts

Here s Listparts log
ListParts by Farbar Version: 30-10-2012
Ran by SYSTEM (administrator) on 20-12-2012 at 12:33:02
Windows XP (X86)
Running From: E:\
Language: 0409
************************************************************

========================= Memory info ======================

Percentage of memory in use: 17%
Total physical RAM: 959.17 MB
Available physical RAM: 787.58 MB
Total Pagefile: 858.73 MB
Available Pagefile: 769.87 MB
Total Virtual: 2047.88 MB
Available Virtual: 2009.38 MB

======================= Partitions =========================

1 Drive b: (RAMDisk) (Fixed) (Total:0.06 GB) (Free:0.04 GB) NTFS
2 Drive c: (Programas) (Fixed) (Total:44.71 GB) (Free:14.35 GB) NTFS ==>[Drive with boot components (Windows XP)]
3 Drive d: (Mis Documentos) (Fixed) (Total:104.33 GB) (Free:41.58 GB) NTFS
4 Drive e: (PENDRIVE) (Removable) (Total:3.72 GB) (Free:3.72 GB) FAT32
5 Drive x: (ReatogoPE) (CDROM) (Total:0.43 GB) (Free:0 GB) CDFS

Disk ### Status Size Free Dyn Gpt
-------- ---------- ------- ------- --- ---
Disk 0 Online 149 GB 0 B

Partitions of Disk 0:
===============

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Primary 45 GB 32 KB
Partition 2 Extended 104 GB 45 GB
Partition 3 Logical 104 GB 45 GB
======================================================================================================

Disk: 0
Partition 1
Type : 07
Hidden: No
Active: Yes

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 1 C Programas NTFS Partition 45 GB Healthy
======================================================================================================

Disk: 0
Partition 3
Type : 07
Hidden: No
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 2 D Mis Documen NTFS Partition 104 GB Healthy
======================================================================================================

****** End Of Log ******

Thanks for re-opening the thread!

Sorry, why can't I open TdssKiller and OTL?

Edited by BlueMonday495, 20 December 2012 - 09:47 AM.

#10
Essexboy

Posted 20 December 2012 - 09:48 AM

GeekU Moderator

Retired Staff
69,964 posts

Your partitions an MBR appear to be clean which is good news
How is the computer behaving now, are you still getting the alerts ?

Download and Install Combofix

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

Double click on ComboFix.exe & follow the prompts.
Accept the disclaimer and allow to update if it asks
When finished, it shall produce a log for you.
Please include the C:\ComboFix.txt in your next reply.

Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.

Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

#11
BlueMonday495

Posted 20 December 2012 - 12:20 PM

Member

Topic Starter
Member
14 posts

Well, here's Combofix.txt:

ComboFix 12-12-20.02 - Nicolás 20/12/2012 14:10:06.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.34.3082.18.959.315 [GMT -3:00]
Running from: c:\documents and settings\Nicolßs\Escritorio\ComboFix.exe
AV: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\archivos de programa\WinRAR\setup.s
c:\docume~1\NICOLS~1\CONFIG~1\Temp\65.tmp
c:\documents and settings\All Users\Datos de programa\TEMP
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\avgmfapx.exe
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\avgmfarx.dll
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\avgntdumpx.exe
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\avgrunasx.exe
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\compat.ini
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\htmlayout.dll
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\incavi.avm
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\license_cz.htm
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\license_da.htm
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\license_es.htm
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\license_fr.htm
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\license_ge.htm
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\license_hu.htm
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\license_id.htm
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\license_in.htm
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\license_it.htm
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\license_jp.htm
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\license_ko.htm
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\license_ms.htm
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\license_nl.htm
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\license_pb.htm
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\license_pl.htm
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\license_pt.htm
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\license_ru.htm
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\license_sc.htm
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\license_sk.htm
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\license_sp.htm
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\license_tr.htm
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\license_us.htm
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\license_zh.htm
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\license_zt.htm
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\mfaconf.txt
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\mfacz.lns
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\mfada.lns
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\mfaes.lns
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\mfafr.lns
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\mfage.lns
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\mfahu.lns
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\mfaid.lns
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\mfain.lns
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\mfait.lns
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\mfajp.lns
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\mfako.lns
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\mfams.lns
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\mfanl.lns
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\mfapb.lns
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\mfapl.lns
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\mfapt.lns
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\mfaru.lns
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\mfasc.lns
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\mfask.lns
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\mfasp.lns
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\mfatr.lns
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\mfaus.lns
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\mfavera.txt
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\mfaverx.txt
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\mfazh.lns
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\mfazt.lns
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\setup.exe
c:\documents and settings\All Users\Datos de programa\TEMP\AVG\setup.ini
c:\documents and settings\Marcela\Datos de programa\PriceGong
c:\documents and settings\Marcela\Datos de programa\PriceGong\Data\1.xml
c:\documents and settings\Marcela\Datos de programa\PriceGong\Data\a.xml
c:\documents and settings\Marcela\Datos de programa\PriceGong\Data\b.xml
c:\documents and settings\Marcela\Datos de programa\PriceGong\Data\c.xml
c:\documents and settings\Marcela\Datos de programa\PriceGong\Data\d.xml
c:\documents and settings\Marcela\Datos de programa\PriceGong\Data\e.xml
c:\documents and settings\Marcela\Datos de programa\PriceGong\Data\f.xml
c:\documents and settings\Marcela\Datos de programa\PriceGong\Data\g.xml
c:\documents and settings\Marcela\Datos de programa\PriceGong\Data\h.xml
c:\documents and settings\Marcela\Datos de programa\PriceGong\Data\i.xml
c:\documents and settings\Marcela\Datos de programa\PriceGong\Data\J.xml
c:\documents and settings\Marcela\Datos de programa\PriceGong\Data\k.xml
c:\documents and settings\Marcela\Datos de programa\PriceGong\Data\l.xml
c:\documents and settings\Marcela\Datos de programa\PriceGong\Data\m.xml
c:\documents and settings\Marcela\Datos de programa\PriceGong\Data\mru.xml
c:\documents and settings\Marcela\Datos de programa\PriceGong\Data\n.xml
c:\documents and settings\Marcela\Datos de programa\PriceGong\Data\o.xml
c:\documents and settings\Marcela\Datos de programa\PriceGong\Data\p.xml
c:\documents and settings\Marcela\Datos de programa\PriceGong\Data\q.xml
c:\documents and settings\Marcela\Datos de programa\PriceGong\Data\r.xml
c:\documents and settings\Marcela\Datos de programa\PriceGong\Data\s.xml
c:\documents and settings\Marcela\Datos de programa\PriceGong\Data\t.xml
c:\documents and settings\Marcela\Datos de programa\PriceGong\Data\u.xml
c:\documents and settings\Marcela\Datos de programa\PriceGong\Data\v.xml
c:\documents and settings\Marcela\Datos de programa\PriceGong\Data\w.xml
c:\documents and settings\Marcela\Datos de programa\PriceGong\Data\x.xml
c:\documents and settings\Marcela\Datos de programa\PriceGong\Data\y.xml
c:\documents and settings\Marcela\Datos de programa\PriceGong\Data\z.xml
c:\documents and settings\Nicolás\Configuración local\Temp\65.tmp
c:\documents and settings\Nicolás\Recent\Thumbs.db
c:\windows\VM305Cap.exe
.
.
((((((((((((((((((((((((( Files Created from 2012-11-20 to 2012-12-20 )))))))))))))))))))))))))))))))
.
.
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-12-12 23:11 . 2012-05-09 18:15 697272 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-12-12 23:11 . 2012-02-06 02:18 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-12-12 23:11 . 2012-10-18 23:11 16363960 ----a-w- c:\windows\system32\FlashPlayerInstaller.exe
2012-11-13 11:55 . 2008-04-14 12:00 1866496 ----a-w- c:\windows\system32\win32k.sys
2012-11-06 00:41 . 2008-04-14 12:00 290560 ----a-w- c:\windows\system32\atmfd.dll
2012-11-02 02:03 . 2008-04-14 12:00 375296 ----a-w- c:\windows\system32\dpnet.dll
2012-11-01 12:12 . 2008-04-14 12:00 916992 ----a-w- c:\windows\system32\wininet.dll
2012-11-01 12:12 . 2008-04-14 12:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
2012-11-01 12:12 . 2008-04-14 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
2012-11-01 00:35 . 2008-04-14 12:00 385024 ----a-w- c:\windows\system32\html.iec
2012-10-02 18:04 . 2008-04-14 12:00 58368 ----a-w- c:\windows\system32\synceng.dll
2012-09-22 20:50 . 2010-09-13 20:56 477240 ----a-w- c:\windows\system32\drivers\sptd.sys
2012-06-14 22:19 . 2012-06-16 23:31 85472 ----a-w- c:\archivos de programa\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
2010-10-18 10:26 3908192 ----a-w- c:\archivos de programa\ConduitEngine\ConduitEngine.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\archivos de programa\ConduitEngine\ConduitEngine.dll" [2010-10-18 3908192]
.
[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\archivos de programa\ConduitEngine\ConduitEngine.dll" [2010-10-18 3908192]
.
[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\archivos de programa\Archivos comunes\Ahead\Lib\NMBgMonitor.exe" [2007-01-15 147456]
"ares"="c:\documents and settings\Nicolás\Mis documentos\Mis historiales de conversación\Ares\Ares.exe" [2010-07-10 1015808]
"Facebook Update"="c:\documents and settings\Nicolás\Configuración local\Datos de programa\Facebook\Update\FacebookUpdate.exe" [2012-08-14 138096]
"DAEMON Tools Lite"="c:\archivos de programa\DAEMON Tools Lite\DTLite.exe" [2012-04-11 3672384]
"Skype"="c:\archivos de programa\Skype\Phone\Skype.exe" [2012-11-02 17878192]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VTTimer"="VTTimer.exe" [2005-03-11 53248]
"RTHDCPL"="RTHDCPL.EXE" [2006-09-12 16264192]
"SkyTel"="SkyTel.EXE" [2006-05-16 2879488]
"NeroFilterCheck"="c:\archivos de programa\Archivos comunes\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"RemoteControl"="c:\archivos de programa\CyberLink\PowerDVD\PDVDServ.exe" [2005-12-08 30208]
"LanguageShortcut"="c:\archivos de programa\CyberLink\PowerDVD\Language\Language.exe" [2006-05-18 49152]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]
"BigDog305"="c:\windows\VM305_STI.EXE" [2005-08-05 61440]
"WinampAgent"="c:\archivos de programa\Winamp\winampa.exe" [2010-07-12 74752]
"AVG_TRAY"="c:\archivos de programa\AVG\AVG2012\avgtray.exe" [2012-07-31 2596984]
"Adobe Reader Speed Launcher"="c:\archivos de programa\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-07-31 38872]
"Adobe ARM"="c:\archivos de programa\Archivos comunes\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-11 919008]
"ITSecMng"="c:\archivos de programa\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe" [2007-09-28 75136]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\Marcela\Menú Inicio\Programas\Inicio\
HotSync Manager.lnk - d:\palm\HOTSYNC.EXE [N/A]
.
c:\documents and settings\All Users\Menú Inicio\Programas\Inicio\
Bluetooth Manager.lnk - c:\archivos de programa\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2008-3-14 2938184]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{93994DE8-8239-4655-B1D1-5F4E91300429}"= "c:\archiv~1\DVDREG~1\DVDShell.dll" [2004-10-09 49152]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\archiv~1\AVG\AVG2012\avgrsx.exe /sync /restart
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Archivos de programa\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Archivos de programa\\Opera\\opera.exe"=
"c:\\Archivos de programa\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Documents and Settings\\Nicolás\\Mis documentos\\Mis historiales de conversación\\Ares\\Ares.exe"=
"c:\\Archivos de programa\\Java\\jre6\\bin\\java.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Archivos de programa\\Bonjour\\mDNSResponder.exe"=
"c:\\Documents and Settings\\Nicolás\\Mis documentos\\Juegos\\Warcraft III\\war3.exe"=
"c:\\Archivos de programa\\AVG\\AVG2012\\avgmfapx.exe"=
"c:\\Archivos de programa\\AVG\\AVG2012\\avgnsx.exe"=
"c:\\Archivos de programa\\AVG\\AVG2012\\avgdiagex.exe"=
"c:\\Archivos de programa\\AVG\\AVG2012\\avgemcx.exe"=
"c:\\Archivos de programa\\uTorrent\\uTorrent.exe"=
"c:\\Documents and Settings\\Nicolás\\Configuración local\\Datos de programa\\Facebook\\Video\\Skype\\FacebookVideoCalling.exe"=
"c:\\Archivos de programa\\Skype\\Phone\\Skype.exe"=
.
R0 AVGIDSHX;AVGIDSHX;c:\windows\system32\drivers\avgidshx.sys [19/04/2012 4:50 24896]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [13/09/2011 6:30 31952]
R0 sptd;sptd;\SystemRoot\\SystemRoot\System32\Drivers\sptd.sys --> \SystemRoot\\SystemRoot\System32\Drivers\sptd.sys [?]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [07/10/2011 6:23 237408]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [11/07/2011 1:14 301920]
R2 avgwd;WatchDog de AVG;c:\archivos de programa\AVG\AVG2012\avgwdsvc.exe [14/02/2012 4:53 193288]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\avgidsdriverx.sys [23/12/2011 13:32 139856]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\avgidsfilterx.sys [23/12/2011 13:32 24144]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\avgidsshimx.sys [23/12/2011 13:32 17232]
R3 ZSMC0305;Look 316;c:\windows\system32\drivers\usbVM305.sys [19/07/2010 18:47 1466624]
S2 AVGIDSAgent;AVGIDSAgent;c:\archivos de programa\AVG\AVG2012\avgidsagent.exe [13/08/2012 3:24 5167736]
S2 SkypeUpdate;Skype Updater;c:\archivos de programa\Skype\Updater\Updater.exe [02/11/2012 10:34 160944]
S3 DDPlayCam;DDPlay Virtual Camera;c:\windows\system32\drivers\DDPlayCam.sys [02/03/2006 3:08 150016]
S3 pwdrvio;pwdrvio;c:\windows\system32\pwdrvio.sys [15/08/2012 23:43 15576]
S3 pwdspio;pwdspio;c:\windows\system32\pwdspio.sys [15/08/2012 23:43 10200]
.
Contents of the 'Scheduled Tasks' folder
.
2012-12-20 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-09 23:11]
.
2012-10-13 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\archivos de programa\Apple Software Update\SoftwareUpdate.exe [2008-07-30 15:34]
.
2012-12-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\archivos de programa\Google\Update\GoogleUpdate.exe [2010-07-23 21:02]
.
2012-12-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\archivos de programa\Google\Update\GoogleUpdate.exe [2010-07-23 21:02]
.
2012-12-20 c:\windows\Tasks\User_Feed_Synchronization-{D4BEF01E-AB7A-4D5C-AC06-A937B3810C95}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 07:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://es.ask.com?o=15446&l=dis
mStart Page = hxxp://ar.yahoo.com/?fr=fp-reg
uInternet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
uInternet Settings,ProxyOverride = *.local
IE: E&xportar a Microsoft Excel - c:\archiv~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: DhcpNameServer = 200.49.130.40 200.42.4.203
FF - ProfilePath - c:\documents and settings\Nicolás\Datos de programa\Mozilla\Firefox\Profiles\xd60heez.default\
FF - prefs.js: browser.startup.homepage - google.com
.
- - - - ORPHANS REMOVED - - - -
.
WebBrowser-{39DEDEEC-9EEF-49A9-A8AE-A90FB869BAA3} - (no file)
HKCU-Run-BitTorrent - d:\bittorrent\bittorrent.exe
HKCU-Run-AlcoholAutomount - c:\archivos de programa\Alcohol Soft\Alcohol 120\axcmd.exe
AddRemove-dec2bed684e304717a7d1fb481af4f01 - c:\archivos de programa\RealArcade\Installer\bin\gameinstaller.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-12-20 14:53
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
BigDog305 = c:\windows\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305)???????????????????0?????????@??????????????
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_135_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_135_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\€–€|ÿÿÿÿÀ•€|ù•9~*]
"A0C0110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
Completion time: 2012-12-20 15:10:37
ComboFix-quarantined-files.txt 2012-12-20 18:10
.
Pre-Run: 15.450.968.064 bytes libres
Post-Run: 15.948.611.584 bytes libres
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - EE087F3BC330484B737AF116F6DC69D0

I don't see any change, I mean, still being slow, explorer.exe use a huge amount of resources and there are a lot of svchost.exe using too many resources too. I don't really know what to do.

#12
Essexboy

Posted 20 December 2012 - 12:37 PM

GeekU Moderator

Retired Staff
69,964 posts

Could you now retry TDSSKiller and OTL please

#13
BlueMonday495

Posted 20 December 2012 - 01:06 PM

Member

Topic Starter
Member
14 posts

TdssKiller still not working, do I run OTL anyway?

#14
Essexboy

Posted 20 December 2012 - 01:14 PM

GeekU Moderator

Retired Staff
69,964 posts

In that case I feel we will need to run a deep AV scan

Download AVPTool from Here to your desktop

Run the programme you have just downloaded to your desktop ( it will be randomly named )

First we will run a virus scan
On the first tab select all elements down to Computer and then select start scan
Once it has finished select report and post that.
Posted Image

Do not close AVPTool or it will self uninstall, if it does uninstall - - then just rerun the setup file on your desktop

Now an analysis scan
Select the Manual Disinfection tab
Press the Gather System Information button
Once done Open the last report saved folder then attach the zip file to your next post zip
The file is located at C:\Users\your name\Desktop\Virus Removal Tool\setup_9.0.0.722_05.01.2011_20-34\LOG\avptool_sysinfo.zip

Posted Image

#15
BlueMonday495

Posted 26 December 2012 - 10:33 AM

Member

Topic Starter
Member
14 posts

Here's the virus scan (I've uploaded it because it is too large to post it) http://www.2shared.c...puKPe/Scan.html

And this is the Analysis Scan:

Gathering system information: completed 6 minutes ago (events: 269, time: 00:03:18)
26/12/2012 12:47:44 Task completed Gathering system information
26/12/2012 12:47:43 Main script of analysis
26/12/2012 12:47:43 Deleting service/driver: ujc2otez
26/12/2012 12:47:43 Delete file:C:\WINDOWS\system32\Drivers\utc2otez.sys
26/12/2012 12:47:43 [microprogram of healing]> registry key deleted HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\utc2otez
26/12/2012 12:47:43 Deleting service/driver: utc2otez
26/12/2012 12:47:43 System Analysis - complete
26/12/2012 12:45:42 System Analysis in progress
26/12/2012 12:45:39 >> Disable removable media autorun
26/12/2012 12:45:39 >> Disable CD/DVD autorun
26/12/2012 12:45:39 >> Disable autorun from network drives
26/12/2012 12:45:39 >> Disable HDD autorun
26/12/2012 12:45:34 >> Security: sending Remote Assistant queries is enabled
26/12/2012 12:45:34 >> Security: anonymous user access is enabled
26/12/2012 12:45:33 >> Security: administrative shares (C$, D$ ...) are enabled
26/12/2012 12:45:33 >> Security: disk drives' autorun is enabled
26/12/2012 12:45:33 > Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)!
26/12/2012 12:45:33 >> Services: potentially dangerous service allowed: RDSessMgr (Administrador de sesión de Ayuda de escritorio remoto)
26/12/2012 12:45:33 >> Services: potentially dangerous service allowed: mnmsrvc (Escritorio remoto compartido de NetMeeting)
26/12/2012 12:45:33 >> Services: potentially dangerous service allowed: Schedule (Programador de tareas)
26/12/2012 12:45:33 >> Services: potentially dangerous service allowed: TlntSvr (Telnet)
26/12/2012 12:45:33 >> Services: potentially dangerous service allowed: SSDPSRV (Servicio de descubrimientos SSDP)
26/12/2012 12:45:33 >> Services: potentially dangerous service allowed: TermService (Servicios de Terminal Server)
26/12/2012 12:45:33 >> Services: potentially dangerous service allowed: RemoteRegistry (Registro remoto)
26/12/2012 12:44:39 Checking - complete
26/12/2012 12:44:39 \FileSystem\ntfs[IRP_MJ_PNP] = 863931E8 -> hook not defined
26/12/2012 12:44:39 \FileSystem\ntfs[IRP_MJ_SET_SECURITY] = 863931E8 -> hook not defined
26/12/2012 12:44:39 \FileSystem\ntfs[IRP_MJ_QUERY_SECURITY] = 863931E8 -> hook not defined
26/12/2012 12:44:39 \FileSystem\ntfs[IRP_MJ_LOCK_CONTROL] = 863931E8 -> hook not defined
26/12/2012 12:44:39 \FileSystem\ntfs[IRP_MJ_DEVICE_CONTROL] = 863931E8 -> hook not defined
26/12/2012 12:44:39 \FileSystem\ntfs[IRP_MJ_FILE_SYSTEM_CONTROL] = 863931E8 -> hook not defined
26/12/2012 12:44:39 \FileSystem\ntfs[IRP_MJ_DIRECTORY_CONTROL] = 863931E8 -> hook not defined
26/12/2012 12:44:39 \FileSystem\ntfs[IRP_MJ_SET_VOLUME_INFORMATION] = 863931E8 -> hook not defined
26/12/2012 12:44:39 \FileSystem\ntfs[IRP_MJ_QUERY_VOLUME_INFORMATION] = 863931E8 -> hook not defined
26/12/2012 12:44:39 \FileSystem\ntfs[IRP_MJ_SET_EA] = 863931E8 -> hook not defined
26/12/2012 12:44:39 \FileSystem\ntfs[IRP_MJ_QUERY_EA] = 863931E8 -> hook not defined
26/12/2012 12:44:39 \FileSystem\ntfs[IRP_MJ_SET_INFORMATION] = 863931E8 -> hook not defined
26/12/2012 12:44:39 \FileSystem\ntfs[IRP_MJ_QUERY_INFORMATION] = 863931E8 -> hook not defined
26/12/2012 12:44:39 \FileSystem\ntfs[IRP_MJ_WRITE] = 863931E8 -> hook not defined
26/12/2012 12:44:39 \FileSystem\ntfs[IRP_MJ_CLOSE] = 863931E8 -> hook not defined
26/12/2012 12:44:39 \FileSystem\ntfs[IRP_MJ_CREATE] = 863931E8 -> hook not defined
26/12/2012 12:44:39 Driver loaded successfully
26/12/2012 12:44:39 1.5 Checking of IRP handlers
26/12/2012 12:44:39 Checking not performed: extended monitoring driver (AVZPM) is not installed
26/12/2012 12:44:39 1.4 Searching for masking processes and drivers
26/12/2012 12:44:38 Checking IDT and SYSENTER - complete
26/12/2012 12:44:38 Disable callback OK
26/12/2012 12:44:38 CmpCallCallBacks = 00145638
26/12/2012 12:44:38 Analysis for CPU 2
26/12/2012 12:44:38 Analysis for CPU 1
26/12/2012 12:44:38 1.3 Checking IDT and SYSENTER
26/12/2012 12:44:38 Functions checked: 284, intercepted: 61, restored: 64
26/12/2012 12:44:37 >>> Function restored successfully !
26/12/2012 12:44:37 Function IoIsOperationSynchronous (804EAFCE) - machine code modification Method of JmpTo. jmp B3DFC3AC \SystemRoot\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:37 >>> Function restored successfully !
26/12/2012 12:44:37 Function IoAllocateIrp (804EAFBD) - machine code modification Method not defined., embedding from byte 15
26/12/2012 12:44:36 >>> Function restored successfully !
26/12/2012 12:44:36 Function FsRtlCheckLockForReadAccess (804F45B3) - machine code modification Method of JmpTo. jmp B3DFBFD0 \SystemRoot\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:36 >>> Hook code blocked
26/12/2012 12:44:36 >>> Function restored successfully !
26/12/2012 12:44:36 Function NtWriteVirtualMemory (115) intercepted (805875EF->B3E09B52), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:36 >>> Hook code blocked
26/12/2012 12:44:36 >>> Function restored successfully !
26/12/2012 12:44:36 Function NtUnmapViewOfSection (10B) intercepted (8057A7A9->B3E0D552), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:36 >>> Hook code blocked
26/12/2012 12:44:36 >>> Function restored successfully !
26/12/2012 12:44:36 Function NtTerminateThread (102) intercepted (80584966->B3E099C8), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:36 >>> Hook code blocked
26/12/2012 12:44:36 >>> Function restored successfully !
26/12/2012 12:44:36 Function NtTerminateProcess (101) intercepted (8058E8B1->B3E09A68), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:36 >>> Hook code blocked
26/12/2012 12:44:36 >>> Function restored successfully !
26/12/2012 12:44:36 Function NtSystemDebugControl (FF) intercepted (80651A75->B3E0CA3E), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:36 >>> Hook code blocked
26/12/2012 12:44:36 >>> Function restored successfully !
26/12/2012 12:44:36 Function NtSuspendThread (FE) intercepted (80637BAF->B3E0DA2A), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:36 >>> Hook code blocked
26/12/2012 12:44:36 >>> Function restored successfully !
26/12/2012 12:44:36 Function NtSuspendProcess (FD) intercepted (80637C93->B3E0D8F0), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:36 >>> Hook code blocked
26/12/2012 12:44:36 >>> Function restored successfully !
26/12/2012 12:44:36 Function NtSetValueKey (F7) intercepted (80580088->B3E08816), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:36 >>> Hook code blocked
26/12/2012 12:44:36 >>> Function restored successfully !
26/12/2012 12:44:36 Function NtSetSystemInformation (F0) intercepted (805BFDB1->B3E0D7FE), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:36 >>> Hook code blocked
26/12/2012 12:44:36 >>> Function restored successfully !
26/12/2012 12:44:36 Function NtSetSecurityObject (ED) intercepted (805E8694->B3E0CDAA), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:36 >>> Hook code blocked
26/12/2012 12:44:36 >>> Function restored successfully !
26/12/2012 12:44:36 Function NtSetInformationToken (E6) intercepted (805B0A10->B3E0C154), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:36 >>> Hook code blocked
26/12/2012 12:44:36 >>> Function restored successfully !
26/12/2012 12:44:36 Function NtSetContextThread (D5) intercepted (80635EFB->B3E09E38), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:36 >>> Hook code blocked
26/12/2012 12:44:36 >>> Function restored successfully !
26/12/2012 12:44:36 Function NtSecureConnectPort (D2) intercepted (80587E0A->B3E0AB0E), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:36 >>> Hook code blocked
26/12/2012 12:44:36 >>> Function restored successfully !
26/12/2012 12:44:36 Function NtSaveKey (CF) intercepted (80656E3E->B3E07EAE), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:36 >>> Hook code blocked
26/12/2012 12:44:36 >>> Function restored successfully !
26/12/2012 12:44:36 Function NtResumeThread (CE) intercepted (805853B0->B3E0DBC8), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:36 >>> Hook code blocked
26/12/2012 12:44:36 >>> Function restored successfully !
26/12/2012 12:44:36 Function NtRestoreKey (CC) intercepted (80656D3D->B3E0828E), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:36 >>> Hook code blocked
26/12/2012 12:44:36 >>> Function restored successfully !
26/12/2012 12:44:36 Function NtRequestWaitReplyPort (C8) intercepted (8057D13B->B3E0C8B4), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:36 >>> Hook code blocked
26/12/2012 12:44:36 >>> Function restored successfully !
26/12/2012 12:44:36 Function NtReplyWaitReceivePort (C3) intercepted (80576817->B3E0B6F2), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:36 >>> Hook code blocked
26/12/2012 12:44:36 >>> Function restored successfully !
26/12/2012 12:44:36 Function NtReplyPort (C2) intercepted (805862F8->B3E0B82C), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:36 >>> Hook code blocked
26/12/2012 12:44:36 >>> Function restored successfully !
26/12/2012 12:44:36 Function NtReplaceKey (C1) intercepted (806571A8->B3E07F16), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:36 >>> Hook code blocked
26/12/2012 12:44:36 >>> Function restored successfully !
26/12/2012 12:44:36 Function NtRenameKey (C0) intercepted (8065684C->B3E08C2C), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:36 >>> Hook code blocked
26/12/2012 12:44:36 >>> Function restored successfully !
26/12/2012 12:44:36 Function NtQueueApcThread (B4) intercepted (8059FC75->B3E0CFA0), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:36 >>> Hook code blocked
26/12/2012 12:44:36 >>> Function restored successfully !
26/12/2012 12:44:36 Function NtQueryValueKey (B1) intercepted (80572F19->B3E0899C), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:36 >>> Hook code blocked
26/12/2012 12:44:36 >>> Function restored successfully !
26/12/2012 12:44:36 Function NtQuerySection (A7) intercepted (80587073->B3E0D6AE), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:36 >>> Hook code blocked
26/12/2012 12:44:36 >>> Function restored successfully !
26/12/2012 12:44:36 Function NtQueryMultipleValueKey (A1) intercepted (806563CF->B3E08D72), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:36 >>> Hook code blocked
26/12/2012 12:44:36 >>> Function restored successfully !
26/12/2012 12:44:36 Function NtQueryKey (A0) intercepted (8057EC02->B3E0913A), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:36 >>> Hook code blocked
26/12/2012 12:44:36 >>> Function restored successfully !
26/12/2012 12:44:36 Function NtOpenThread (80) intercepted (80596743->B3E097BE), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:36 >>> Hook code blocked
26/12/2012 12:44:36 >>> Function restored successfully !
26/12/2012 12:44:36 Function NtOpenSemaphore (7E) intercepted (805AD95A->B3E0B4C8), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:36 >>> Hook code blocked
26/12/2012 12:44:36 >>> Function restored successfully !
26/12/2012 12:44:36 Function NtOpenSection (7D) intercepted (80579192->B3E0D10E), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:36 >>> Hook code blocked
26/12/2012 12:44:36 >>> Function restored successfully !
26/12/2012 12:44:36 Function NtOpenProcess (7A) intercepted (8057F93A->B3E098CC), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:36 >>> Hook code blocked
26/12/2012 12:44:36 >>> Function restored successfully !
26/12/2012 12:44:36 Function NtOpenMutant (78) intercepted (8058413B->B3E0B288), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:36 >>> Hook code blocked
26/12/2012 12:44:36 >>> Function restored successfully !
26/12/2012 12:44:36 Function NtOpenKey (77) intercepted (80572BDF->B3E086C0), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:36 >>> Hook code blocked
26/12/2012 12:44:36 >>> Function restored successfully !
26/12/2012 12:44:36 Function NtOpenFile (74) intercepted (8057A095->B3E0A016), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:36 >>> Hook code blocked
26/12/2012 12:44:36 >>> Function restored successfully !
26/12/2012 12:44:36 Function NtOpenEvent (72) intercepted (80589D61->B3E0B3A8), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:36 >>> Hook code blocked
26/12/2012 12:44:36 >>> Function restored successfully !
26/12/2012 12:44:36 Function NtNotifyChangeMultipleKeys (70) intercepted (80596B9C->B5BC80D4), hook C:\WINDOWS\system32\DRIVERS\avgidsshimx.sys, driver recognized as trusted
26/12/2012 12:44:35 >>> Hook code blocked
26/12/2012 12:44:35 >>> Function restored successfully !
26/12/2012 12:44:35 Function NtNotifyChangeKey (6F) intercepted (80596D8A->B3E091CE), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:35 >>> Hook code blocked
26/12/2012 12:44:35 >>> Function restored successfully !
26/12/2012 12:44:35 Function NtMapViewOfSection (6C) intercepted (8057AC21->B3E0D374), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:35 >>> Hook code blocked
26/12/2012 12:44:35 >>> Function restored successfully !
26/12/2012 12:44:35 Function NtLoadKey2 (63) intercepted (805B83E6->B3E084EE), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:35 >>> Hook code blocked
26/12/2012 12:44:35 >>> Function restored successfully !
26/12/2012 12:44:35 Function NtLoadKey (62) intercepted (805B8287->B3E084DC), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:35 >>> Hook code blocked
26/12/2012 12:44:35 >>> Function restored successfully !
26/12/2012 12:44:35 Function NtLoadDriver (61) intercepted (805B52F0->B3E0CC0C), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:35 >>> Hook code blocked
26/12/2012 12:44:35 >>> Function restored successfully !
26/12/2012 12:44:35 Function NtFsControlFile (54) intercepted (80582AF2->B3E0A500), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:35 >>> Hook code blocked
26/12/2012 12:44:35 >>> Function restored successfully !
26/12/2012 12:44:35 Function NtEnumerateValueKey (49) intercepted (80590232->B3E090A2), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:35 >>> Hook code blocked
26/12/2012 12:44:35 >>> Function restored successfully !
26/12/2012 12:44:35 Function NtEnumerateKey (47) intercepted (8057F002->B3E0900A), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:35 >>> Hook code blocked
26/12/2012 12:44:35 >>> Function restored successfully !
26/12/2012 12:44:35 Function NtDuplicateObject (44) intercepted (8057F18D->B3E0DD26), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:35 >>> Hook code blocked
26/12/2012 12:44:35 >>> Function restored successfully !
26/12/2012 12:44:35 Function NtDeviceIoControlFile (42) intercepted (80588CB6->B3E0A6F2), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:35 >>> Hook code blocked
26/12/2012 12:44:35 >>> Function restored successfully !
26/12/2012 12:44:35 Function NtDeleteValueKey (41) intercepted (805991E8->B3E08EBE), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:35 >>> Hook code blocked
26/12/2012 12:44:35 >>> Function restored successfully !
26/12/2012 12:44:35 Function NtDeleteKey (3F) intercepted (8059A5C9->B3E08B0A), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:35 >>> Hook code blocked
26/12/2012 12:44:35 >>> Function restored successfully !
26/12/2012 12:44:35 Function NtDebugActiveProcess (39) intercepted (80663211->B3E0CB1A), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:35 >>> Hook code blocked
26/12/2012 12:44:35 >>> Function restored successfully !
26/12/2012 12:44:35 Function NtCreateWaitablePort (38) intercepted (805B68AC->B3E0B162), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:35 >>> Hook code blocked
26/12/2012 12:44:35 >>> Function restored successfully !
26/12/2012 12:44:35 Function NtCreateThread (35) intercepted (80584D39->B3E09C1C), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:35 >>> Hook code blocked
26/12/2012 12:44:35 >>> Function restored successfully !
26/12/2012 12:44:35 Function NtCreateSemaphore (33) intercepted (8057FD03->B3E0B432), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:35 >>> Hook code blocked
26/12/2012 12:44:35 >>> Function restored successfully !
26/12/2012 12:44:35 Function NtCreateSection (32) intercepted (8056DB66->B3E09426), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:35 >>> Hook code blocked
26/12/2012 12:44:35 >>> Function restored successfully !
26/12/2012 12:44:35 Function NtCreatePort (2E) intercepted (805A13A0->B3E0B0CC), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:35 >>> Hook code blocked
26/12/2012 12:44:35 >>> Function restored successfully !
26/12/2012 12:44:35 Function NtCreateNamedPipeFile (2C) intercepted (80588FBA->B3E0927E), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:35 >>> Hook code blocked
26/12/2012 12:44:35 >>> Function restored successfully !
26/12/2012 12:44:35 Function NtCreateMutant (2B) intercepted (8058408D->B3E0B1F8), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:35 >>> Hook code blocked
26/12/2012 12:44:35 >>> Function restored successfully !
26/12/2012 12:44:35 Function NtCreateKey (29) intercepted (80578AB4->B3E08500), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:35 >>> Hook code blocked
26/12/2012 12:44:35 >>> Function restored successfully !
26/12/2012 12:44:35 Function NtCreateFile (25) intercepted (80573DFB->B3E0A270), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:35 >>> Hook code blocked
26/12/2012 12:44:35 >>> Function restored successfully !
26/12/2012 12:44:35 Function NtCreateEvent (23) intercepted (805744F6->B3E0B312), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:35 >>> Hook code blocked
26/12/2012 12:44:35 >>> Function restored successfully !
26/12/2012 12:44:35 Function NtConnectPort (1F) intercepted (80590E53->B3E0ADC8), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:35 >>> Hook code blocked
26/12/2012 12:44:35 >>> Function restored successfully !
26/12/2012 12:44:35 Function NtClose (19) intercepted (8056F8D7->B3E09F94), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:35 >>> Hook code blocked
26/12/2012 12:44:35 >>> Function restored successfully !
26/12/2012 12:44:35 Function NtAdjustPrivilegesToken (0B) intercepted (8059741F->B3E09690), hook C:\WINDOWS\system32\DRIVERS\8266592drv.sys, driver recognized as trusted
26/12/2012 12:44:35 KiST = 804E48D0 (284)
26/12/2012 12:44:35 SDT = 80562520
26/12/2012 12:44:35 Kernel ntoskrnl.exe found in memory at address 804D7000
26/12/2012 12:44:35 SDT found (RVA=08B520)
26/12/2012 12:44:35 Driver loaded successfully
26/12/2012 12:44:30 1.2 Searching for kernel-mode API hooks
26/12/2012 12:44:29 Analysis: netapi32.dll, export table found in section .text
26/12/2012 12:44:29 Analysis: urlmon.dll, export table found in section .text
26/12/2012 12:44:29 Analysis: rasapi32.dll, export table found in section .text
26/12/2012 12:44:29 Analysis: wininet.dll, export table found in section .text
26/12/2012 12:44:29 Analysis: ws2_32.dll, export table found in section .text
26/12/2012 12:44:29 Analysis: advapi32.dll, export table found in section .text
26/12/2012 12:44:29 Analysis: user32.dll, export table found in section .text
26/12/2012 12:44:29 Analysis: ntdll.dll, export table found in section .text
26/12/2012 12:44:29 IAT modification detected: GetProcAddress - 00B80390<>7C80AE40
26/12/2012 12:44:29 IAT modification detected: LoadLibraryA - 00B80320<>7C801D7B
26/12/2012 12:44:29 IAT modification detected: LoadLibraryW - 00B802B0<>7C80AEEB
26/12/2012 12:44:29 IAT modification detected: CreateProcessW - 00B801D0<>7C802336
26/12/2012 12:44:29 IAT modification detected: GetModuleFileNameW - 00B80160<>7C80B475
26/12/2012 12:44:29 IAT modification detected: FreeLibrary - 00B800F0<>7C80AC7E
26/12/2012 12:44:29 IAT modification detected: GetModuleFileNameA - 00B80080<>7C80B56F
26/12/2012 12:44:29 IAT modification detected: CreateProcessA - 00B80010<>7C80236B
26/12/2012 12:44:29 Analysis: kernel32.dll, export table found in section .text
26/12/2012 12:44:29 1.1 Searching for user-mode API hooks
26/12/2012 12:44:28 System Restore: enabled
26/12/2012 12:44:28 Windows version: Microsoft Windows XP, Build=2600, SP="Service Pack 3"
26/12/2012 12:44:27 Main script of analysis
26/12/2012 12:44:25 Task started Gathering system information
Gathering system information: completed 1 minute ago (events: 98, time: 00:02:03)
26/12/2012 12:51:55 Task completed Gathering system information
26/12/2012 12:51:55 Main script of analysis
26/12/2012 12:51:55 Deleting service/driver: ujc2otez
26/12/2012 12:51:55 Delete file:C:\WINDOWS\system32\Drivers\utc2otez.sys
26/12/2012 12:51:55 [microprogram of healing]> registry key deleted HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\utc2otez
26/12/2012 12:51:55 Deleting service/driver: utc2otez
26/12/2012 12:51:55 System Analysis - complete
26/12/2012 12:50:56 System Analysis in progress
26/12/2012 12:50:53 >> Disable removable media autorun
26/12/2012 12:50:53 >> Disable CD/DVD autorun
26/12/2012 12:50:53 >> Disable autorun from network drives
26/12/2012 12:50:52 >> Disable HDD autorun
26/12/2012 12:50:48 >> Security: sending Remote Assistant queries is enabled
26/12/2012 12:50:47 >> Security: anonymous user access is enabled
26/12/2012 12:50:47 >> Security: administrative shares (C$, D$ ...) are enabled
26/12/2012 12:50:47 >> Security: disk drives' autorun is enabled
26/12/2012 12:50:47 > Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)!
26/12/2012 12:50:47 >> Services: potentially dangerous service allowed: RDSessMgr (Administrador de sesión de Ayuda de escritorio remoto)
26/12/2012 12:50:47 >> Services: potentially dangerous service allowed: mnmsrvc (Escritorio remoto compartido de NetMeeting)
26/12/2012 12:50:47 >> Services: potentially dangerous service allowed: Schedule (Programador de tareas)
26/12/2012 12:50:47 >> Services: potentially dangerous service allowed: TlntSvr (Telnet)
26/12/2012 12:50:47 >> Services: potentially dangerous service allowed: SSDPSRV (Servicio de descubrimientos SSDP)
26/12/2012 12:50:47 >> Services: potentially dangerous service allowed: TermService (Servicios de Terminal Server)
26/12/2012 12:50:47 >> Services: potentially dangerous service allowed: RemoteRegistry (Registro remoto)
26/12/2012 12:49:58 Checking - complete
26/12/2012 12:49:58 \FileSystem\ntfs[IRP_MJ_PNP] = 863931E8 -> hook not defined
26/12/2012 12:49:58 \FileSystem\ntfs[IRP_MJ_SET_SECURITY] = 863931E8 -> hook not defined
26/12/2012 12:49:58 \FileSystem\ntfs[IRP_MJ_QUERY_SECURITY] = 863931E8 -> hook not defined
26/12/2012 12:49:58 \FileSystem\ntfs[IRP_MJ_LOCK_CONTROL] = 863931E8 -> hook not defined
26/12/2012 12:49:58 \FileSystem\ntfs[IRP_MJ_DEVICE_CONTROL] = 863931E8 -> hook not defined
26/12/2012 12:49:58 \FileSystem\ntfs[IRP_MJ_FILE_SYSTEM_CONTROL] = 863931E8 -> hook not defined
26/12/2012 12:49:58 \FileSystem\ntfs[IRP_MJ_DIRECTORY_CONTROL] = 863931E8 -> hook not defined
26/12/2012 12:49:58 \FileSystem\ntfs[IRP_MJ_SET_VOLUME_INFORMATION] = 863931E8 -> hook not defined
26/12/2012 12:49:58 \FileSystem\ntfs[IRP_MJ_QUERY_VOLUME_INFORMATION] = 863931E8 -> hook not defined
26/12/2012 12:49:58 \FileSystem\ntfs[IRP_MJ_SET_EA] = 863931E8 -> hook not defined
26/12/2012 12:49:58 \FileSystem\ntfs[IRP_MJ_QUERY_EA] = 863931E8 -> hook not defined
26/12/2012 12:49:58 \FileSystem\ntfs[IRP_MJ_SET_INFORMATION] = 863931E8 -> hook not defined
26/12/2012 12:49:58 \FileSystem\ntfs[IRP_MJ_QUERY_INFORMATION] = 863931E8 -> hook not defined
26/12/2012 12:49:58 \FileSystem\ntfs[IRP_MJ_WRITE] = 863931E8 -> hook not defined
26/12/2012 12:49:58 \FileSystem\ntfs[IRP_MJ_CLOSE] = 863931E8 -> hook not defined
26/12/2012 12:49:58 \FileSystem\ntfs[IRP_MJ_CREATE] = 863931E8 -> hook not defined
26/12/2012 12:49:58 Driver loaded successfully
26/12/2012 12:49:58 1.5 Checking of IRP handlers
26/12/2012 12:49:58 Checking not performed: extended monitoring driver (AVZPM) is not installed
26/12/2012 12:49:58 1.4 Searching for masking processes and drivers
26/12/2012 12:49:57 Checking IDT and SYSENTER - complete
26/12/2012 12:49:57 Disable callback - óæå íåéòèðàëèçîâàíû
26/12/2012 12:49:57 CmpCallCallBacks = 00145638
26/12/2012 12:49:57 Analysis for CPU 2
26/12/2012 12:49:57 Analysis for CPU 1
26/12/2012 12:49:57 1.3 Checking IDT and SYSENTER
26/12/2012 12:49:57 Functions checked: 284, intercepted: 6, restored: 6
26/12/2012 12:49:56 >>> Hook code blocked
26/12/2012 12:49:56 >>> Function restored successfully !
26/12/2012 12:49:56 Function NtWriteVirtualMemory (115) intercepted (805875EF->B5BC7F56), hook C:\WINDOWS\system32\DRIVERS\avgidsshimx.sys, driver recognized as trusted
26/12/2012 12:49:56 >>> Hook code blocked
26/12/2012 12:49:56 >>> Function restored successfully !
26/12/2012 12:49:56 Function NtTerminateThread (102) intercepted (80584966->B5BC7EBA), hook C:\WINDOWS\system32\DRIVERS\avgidsshimx.sys, driver recognized as trusted
26/12/2012 12:49:56 >>> Hook code blocked
26/12/2012 12:49:56 >>> Function restored successfully !
26/12/2012 12:49:56 Function NtTerminateProcess (101) intercepted (8058E8B1->B5BC7E1E), hook C:\WINDOWS\system32\DRIVERS\avgidsshimx.sys, driver recognized as trusted
26/12/2012 12:49:56 >>> Hook code blocked
26/12/2012 12:49:56 >>> Function restored successfully !
26/12/2012 12:49:56 Function NtOpenProcess (7A) intercepted (8057F93A->B5BC7D76), hook C:\WINDOWS\system32\DRIVERS\avgidsshimx.sys, driver recognized as trusted
26/12/2012 12:49:56 >>> the hook code is already blocked
26/12/2012 12:49:56 >>> Function restored successfully !
26/12/2012 12:49:56 Function NtNotifyChangeMultipleKeys (70) intercepted (80596B9C->B5BC80D4), hook C:\WINDOWS\system32\DRIVERS\avgidsshimx.sys, driver recognized as trusted
26/12/2012 12:49:55 >>> Hook code blocked
26/12/2012 12:49:55 >>> Function restored successfully !
26/12/2012 12:49:55 Function NtNotifyChangeKey (6F) intercepted (80596D8A->B5BC8004), hook C:\WINDOWS\system32\DRIVERS\avgidsshimx.sys, driver recognized as trusted
26/12/2012 12:49:55 KiST = 804E48D0 (284)
26/12/2012 12:49:55 SDT = 80562520
26/12/2012 12:49:55 Kernel ntoskrnl.exe found in memory at address 804D7000
26/12/2012 12:49:55 SDT found (RVA=08B520)
26/12/2012 12:49:55 Driver loaded successfully
26/12/2012 12:49:55 1.2 Searching for kernel-mode API hooks
26/12/2012 12:49:55 Analysis: netapi32.dll, export table found in section .text
26/12/2012 12:49:55 Analysis: urlmon.dll, export table found in section .text
26/12/2012 12:49:55 Analysis: rasapi32.dll, export table found in section .text
26/12/2012 12:49:55 Analysis: wininet.dll, export table found in section .text
26/12/2012 12:49:55 Analysis: ws2_32.dll, export table found in section .text
26/12/2012 12:49:55 Analysis: advapi32.dll, export table found in section .text
26/12/2012 12:49:55 Analysis: user32.dll, export table found in section .text
26/12/2012 12:49:54 Analysis: ntdll.dll, export table found in section .text
26/12/2012 12:49:54 IAT modification detected: GetProcAddress - 00B80390<>7C80AE40
26/12/2012 12:49:54 IAT modification detected: LoadLibraryA - 00B80320<>7C801D7B
26/12/2012 12:49:54 IAT modification detected: LoadLibraryW - 00B802B0<>7C80AEEB
26/12/2012 12:49:54 IAT modification detected: CreateProcessW - 00B801D0<>7C802336
26/12/2012 12:49:54 IAT modification detected: GetModuleFileNameW - 00B80160<>7C80B475
26/12/2012 12:49:54 IAT modification detected: FreeLibrary - 00B800F0<>7C80AC7E
26/12/2012 12:49:54 IAT modification detected: GetModuleFileNameA - 00B80080<>7C80B56F
26/12/2012 12:49:54 IAT modification detected: CreateProcessA - 00B80010<>7C80236B
26/12/2012 12:49:54 Analysis: kernel32.dll, export table found in section .text
26/12/2012 12:49:54 1.1 Searching for user-mode API hooks
26/12/2012 12:49:54 System Restore: enabled
26/12/2012 12:49:54 Windows version: Microsoft Windows XP, Build=2600, SP="Service Pack 3"
26/12/2012 12:49:53 Main script of analysis
26/12/2012 12:49:52 Task started Gathering system information

I didn't find any folder in C:\Users\your name\Desktop\Virus Removal Tool\setup_9.0.0.722_05.01.2011_20-34\LOG\avptool_sysinfo.zip both scan were saved manually.