Solved Trojan 0i763f66bz.exe "liquid fabrication"

Marco · Jul 15, 2012

Well, I basically have the same problem that "Bigologre" has, but I'm mexican and although I'm on my level 5 of english, I think that it'll difficult to me to understand all the process of cleaning, but I'll do my best if someone can help me.

the information of my machine is:

Windows 7 Ultimate x64 NTFS 465 GB Service Pack 1
AMD Phenom(tm) II X2 555 Processor 3.20 GHz
2 GB RAM
32 bits System

I had microsoft security essencials, but it came down... I dont know if the virus did something to my AV.

I tried the same that Bigologre, reinstall AV, run, found the trojan, remove option, but it still appears, besides I tried to run my restory system, with the disk, but it doesn't work.

What can I do?

Marco · Jul 15, 2012

Well I run the FRST scan tool, and that's what appears in the .txt file.

Scan result of Farbar Recovery Scan Tool (FRST written by Farbar) Version: 14-07-2012
Ran by SYSTEM at 15-07-2012 01:35:48
Running from J:\
Windows 7 Ultimate Service Pack 1 (X86) OS Language: Spanish Modern Sort
The current controlset is ControlSet001
========================== Registry (Whitelisted) =============
HKLM\...\Run: [BCSSync] "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices [91520 2010-03-13] (Microsoft Corporation)
HKLM\...\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [336384 2011-01-27] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [] [x]
HKLM\...\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\13.0\SharedCOM\RoxWatchTray13.exe" [307184 2010-07-16] (Sonic Solutions)
HKLM\...\Run: [CPMonitor] "C:\Program Files\Roxio 2011\5.0\CPMonitor.exe" [84464 2010-07-14] ()
HKLM\...\Run: [Desktop Disc Tool] "C:\Program Files\Roxio 2011\Roxio Burn\RoxioBurnLauncher.exe" [477680 2010-06-30] ()
HKLM\...\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [843712 2012-01-03] (Adobe Systems Incorporated)
HKLM\...\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey [931200 2012-03-26] (Microsoft Corporation)
HKLM\...\Run: [Monitor] C:\Windows\PixArt\PAC207\Monitor.exe [319488 2006-11-03] (PixArt Imaging Incorporation)
HKU\MarcoACC\...\Run: [Facebook Update] "C:\Users\MarcoACC\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver [137536 2012-01-10] (Facebook Inc.)
HKU\MarcoACC\...\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTAgent.exe" -autorun [4527424 2011-08-17] (DT Soft Ltd)
HKU\MarcoACC\...\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe" -automount [75624 2012-01-05] (Alcohol Soft Development Team)
HKU\MarcoACC\...\Run: [0i763f66bz] C:\Users\MarcoACC\0i763f66bz.exe [42496 2012-06-23] (FaceVsion)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254
================================ Services (Whitelisted) ==================
2 9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269; C:\Program Files\Roxio\BackOnTrack\App\SaibSVC.exe [457200 2009-06-03] ()
2 AMD Reservation Manager; "C:\Program Files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe" [140224 2010-06-17] (Advanced Micro Devices)
2 AxAutoMntSrv; C:\Program Files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe [75624 2012-01-05] (Alcohol Soft Development Team)
2 BOT4Service; "C:\Program Files\Roxio\BackOnTrack\App\BService.exe" [32240 2010-07-14] ()
2 eventlog; C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted [20992 2009-07-14] (Microsoft Corporation)
2 KMService; C:\Windows\system32\srvany.exe [8192 2011-11-03] ()
3 RoxMediaDB13; "C:\Program Files\Common Files\Roxio Shared\13.0\SharedCOM\RoxMediaDB13.exe" [1099248 2010-07-16] (Sonic Solutions)
2 RoxWatch12; "C:\Program Files\Common Files\Roxio Shared\13.0\SharedCOM\RoxWatch13.exe" [354288 2010-07-16] (Sonic Solutions)
2 StarWindServiceAE; C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [370688 2009-12-23] (StarWind Software)
3 NisSrv; "c:\Program Files\Microsoft Security Client\NisSrv.exe" [x]
========================== Drivers (Whitelisted) =============
0 adad81a680e579f; C:\Windows\System32\Drivers\adad81a680e579f.sys [66488 2012-06-23] ()
2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [83872 2012-06-02] ()
1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [232512 2012-06-01] (DT Soft Ltd)
2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [25888 2012-06-02] ()
0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [171064 2012-03-21] (Microsoft Corporation)
3 NVNET; C:\Windows\System32\DRIVERS\nvmf6232.sys [298216 2010-08-12] (NVIDIA Corporation)
3 PAC207; C:\Windows\System32\DRIVERS\PFC027.SYS [507136 2006-12-05] (PixArt Imaging Inc.)
0 SahdIa32; C:\Windows\System32\Drivers\SahdIa32.sys [21488 2009-06-02] (Sonic Solutions)
0 SaibIa32; C:\Windows\System32\Drivers\SaibIa32.sys [15856 2009-06-02] (Sonic Solutions)
1 SaibVd32; C:\Windows\System32\Drivers\SaibVd32.sys [25584 2009-06-02] (Sonic Solutions)
0 sptd; C:\Windows\System32\Drivers\sptd.sys [477240 2012-06-01] (Duplex Secure Ltd.)
3 VGPU; C:\Windows\System32\drivers\rdvgkmd.sys [x]
========================== NetSvcs (Whitelisted) ===========

============ One Month Created Files and Folders ==============
2012-07-15 03:34 - 2012-07-15 03:37 - 00000000 ____D C:\2f11bb66e0e6fc595b0932ac133f6495
2012-07-15 01:35 - 2012-07-15 01:35 - 00000000 ____D C:\FRST
2012-07-12 20:33 - 2012-07-12 20:33 - 00000000 ____D C:\Windows\System32\RBAK
2012-07-12 20:21 - 2012-07-15 03:53 - 00000297 ____A C:\Windows\bB
2012-07-10 19:43 - 2012-07-10 19:43 - 00000000 ____D C:\Users\MarcoACC\AppData\Local\{F77B4313-A706-4243-8166-DB5AF68BA564}
2012-07-10 19:43 - 2012-07-10 19:43 - 00000000 ____D C:\Users\MarcoACC\AppData\Local\{3D4AFFDF-F8EC-4207-B732-36E16580D9F4}
2012-06-23 22:09 - 2012-06-23 22:09 - 00066488 ____A C:\Windows\System32\Drivers\adad81a680e579f.sys
2012-06-23 11:09 - 2012-07-15 04:54 - 00000000 __SHD C:\Windows\System32\%APPDATA%
2012-06-23 11:00 - 2012-06-23 11:00 - 00042496 ____A (FaceVsion) C:\Users\MarcoACC\0i763f66bz.exe
2012-06-23 10:59 - 2012-07-14 22:17 - 00000000 ____D C:\Users\MarcoACC\AppData\Roaming\Sun
2012-06-23 10:59 - 2012-06-23 10:59 - 00000000 ____D C:\Windows\Sun
2012-06-16 17:17 - 2012-06-16 17:17 - 00000000 ____D C:\Users\MarcoACC\AppData\Local\Macromedia
============ 3 Months Modified Files ========================
2012-07-15 07:33 - 2009-07-14 05:34 - 00021472 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2012-07-15 07:33 - 2009-07-14 05:34 - 00021472 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2012-07-15 07:30 - 2009-07-14 05:53 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2012-07-15 07:30 - 2009-07-14 05:39 - 00059525 ____A C:\Windows\setupact.log
2012-07-15 07:22 - 2010-11-20 22:01 - 01562174 ____A C:\Windows\System32\PerfStringBackup.INI
2012-07-15 04:48 - 2011-11-03 17:07 - 01942619 ____A C:\Windows\WindowsUpdate.log
2012-07-15 03:53 - 2012-07-12 20:21 - 00000297 ____A C:\Windows\bB
2012-07-12 20:59 - 2012-02-02 16:32 - 00493056 __ASH C:\Users\MarcoACC\Downloads\Thumbs.db
2012-07-12 03:36 - 2012-02-02 04:17 - 00520192 __ASH C:\Users\MarcoACC\Documents\Thumbs.db
2012-07-09 00:23 - 2012-01-31 01:30 - 00113152 __ASH C:\Users\MarcoACC\Desktop\Thumbs.db
2012-07-08 20:31 - 2012-01-10 09:26 - 00000940 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3895268456-3379712286-4068720532-1000UA.job
2012-07-05 08:31 - 2012-01-10 09:26 - 00000918 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3895268456-3379712286-4068720532-1000Core.job
2012-07-04 09:43 - 2009-07-14 03:04 - 00000677 ____A C:\Windows\win.ini
2012-06-23 22:09 - 2012-06-23 22:09 - 00066488 ____A C:\Windows\System32\Drivers\adad81a680e579f.sys
2012-06-23 11:00 - 2012-06-23 11:00 - 00042496 ____A (FaceVsion) C:\Users\MarcoACC\0i763f66bz.exe
2012-06-23 08:07 - 2012-04-18 20:55 - 00426184 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2012-06-23 08:07 - 2011-11-06 20:13 - 00070344 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2012-06-14 06:28 - 2009-07-14 05:33 - 00483760 ____A C:\Windows\System32\FNTCACHE.DAT
2012-06-14 06:17 - 2011-11-03 17:39 - 56731752 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2012-06-14 04:04 - 2012-06-14 04:04 - 00026287 ____A C:\Users\MarcoACC\Documents\Buap mar.htm
2012-06-14 04:02 - 2012-06-14 04:02 - 00017233 ____A C:\Users\MarcoACC\Documents\mar dl mar BUAP.htm
2012-06-13 04:40 - 2009-07-14 05:53 - 00032636 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2012-06-02 22:57 - 2012-06-02 21:03 - 204800000 ____A C:\Users\MarcoACC\Downloads\rld-aop2.r08
2012-06-02 22:24 - 2012-06-02 22:04 - 00083872 ____A C:\Windows\System32\Drivers\atksgt.sys
2012-06-02 22:24 - 2012-06-02 22:04 - 00025888 ____A C:\Windows\System32\Drivers\lirsgt.sys
2012-06-02 22:02 - 2012-06-02 22:02 - 00000976 ____A C:\Users\Public\Desktop\Acrobat.com.lnk
2012-06-02 22:00 - 2012-06-02 22:00 - 00001153 ____A C:\Users\MarcoACC\Desktop\Age of Pirates 2.lnk
2012-06-02 21:36 - 2012-06-02 21:36 - 01313364 ____A (Denis Kozlov ) C:\Users\MarcoACC\Downloads\renamer.exe
2012-06-02 21:36 - 2012-06-02 21:36 - 00000986 ____A C:\Users\MarcoACC\Desktop\ReNamer.lnk
2012-06-02 17:27 - 2012-06-02 15:33 - 204800000 ____A C:\Users\MarcoACC\Downloads\rld-aop2.r07
2012-06-02 11:33 - 2012-06-02 09:39 - 204800000 ____A C:\Users\MarcoACC\Downloads\rld-aop2.r06
2012-06-02 09:39 - 2012-06-02 07:46 - 204800000 ____A C:\Users\MarcoACC\Downloads\rld-aop2.r05
2012-06-02 06:43 - 2012-06-02 04:50 - 204800000 ____A C:\Users\MarcoACC\Downloads\rld-aop2.r04
2012-06-02 03:50 - 2012-06-02 01:56 - 204800000 ____A C:\Users\MarcoACC\Downloads\rld-aop2.r03
2012-06-02 01:55 - 2012-06-02 00:01 - 204800000 ____A C:\Users\MarcoACC\Downloads\rld-aop2.r02
2012-06-01 22:46 - 2012-06-01 20:53 - 204800000 ____A C:\Users\MarcoACC\Downloads\rld-aop2.r01
2012-06-01 20:52 - 2012-06-01 18:09 - 204800000 ____A C:\Users\MarcoACC\Downloads\rld-aop2.r00
2012-06-01 09:35 - 2012-06-01 08:27 - 00000379 ____A C:\Users\MarcoACC\Documents\ax_files.xml
2012-06-01 08:20 - 2012-06-01 08:20 - 00001151 ____A C:\Users\Public\Desktop\Alcohol 120%.lnk
2012-06-01 08:20 - 2010-11-20 22:48 - 00010542 ____A C:\Windows\PFRO.log
2012-06-01 08:19 - 2011-11-19 22:51 - 00477240 ____A (Duplex Secure Ltd.) C:\Windows\System32\Drivers\sptd.sys
2012-06-01 07:52 - 2012-06-01 07:52 - 00232512 ____A (DT Soft Ltd) C:\Windows\System32\Drivers\dtsoftbus01.sys
2012-06-01 07:52 - 2012-06-01 07:52 - 00001891 ____A C:\Users\Public\Desktop\DAEMON Tools Pro.lnk
2012-06-01 06:47 - 2012-06-01 06:07 - 71210681 ____A C:\Users\MarcoACC\Downloads\ptn-aop2.by_REDES..part46.rar
2012-06-01 06:05 - 2012-06-01 05:07 - 104857600 ____A C:\Users\MarcoACC\Downloads\ptn-aop2.by_REDES..part45.rar
2012-06-01 05:00 - 2012-06-01 04:01 - 104857600 ____A C:\Users\MarcoACC\Downloads\ptn-aop2.by_REDES..part44.rar
2012-06-01 03:58 - 2012-06-01 03:00 - 104857600 ____A C:\Users\MarcoACC\Downloads\ptn-aop2.by_REDES..part43.rar
2012-06-01 02:37 - 2012-06-01 01:38 - 104857600 ____A C:\Users\MarcoACC\Downloads\ptn-aop2.by_REDES..part42.rar
2012-06-01 01:35 - 2012-06-01 00:37 - 104857600 ____A C:\Users\MarcoACC\Downloads\ptn-aop2.by_REDES..part41.rar
2012-05-31 22:04 - 2012-05-31 21:05 - 104857600 ____A C:\Users\MarcoACC\Downloads\ptn-aop2.by_REDES..part40.rar
2012-05-31 20:31 - 2012-05-31 19:33 - 104857600 ____A C:\Users\MarcoACC\Downloads\ptn-aop2.by_REDES..part39.rar
2012-05-31 07:19 - 2012-05-31 06:21 - 104857600 ____A C:\Users\MarcoACC\Downloads\ptn-aop2.by_REDES..part38.rar
2012-05-31 06:02 - 2012-05-31 05:04 - 104857600 ____A C:\Users\MarcoACC\Downloads\ptn-aop2.by_REDES..part37.rar
2012-05-31 05:04 - 2012-05-31 03:17 - 104857600 ____A C:\Users\MarcoACC\Downloads\ptn-aop2.by_REDES..part36.rar
2012-05-31 05:03 - 2012-05-30 22:19 - 104857600 ____A C:\Users\MarcoACC\Downloads\ptn-aop2.by_REDES..part35.rar
2012-05-30 22:18 - 2012-05-30 20:57 - 104857600 ____A C:\Users\MarcoACC\Downloads\ptn-aop2.by_REDES..part34.rar
2012-05-30 22:18 - 2012-05-30 16:44 - 104857600 ____A C:\Users\MarcoACC\Downloads\ptn-aop2.by_REDES..part33.rar
2012-05-30 08:10 - 2012-05-30 07:12 - 104857600 ____A C:\Users\MarcoACC\Downloads\ptn-aop2.by_REDES..part32.rar
2012-05-30 06:54 - 2012-05-30 03:09 - 104857600 ____A C:\Users\MarcoACC\Downloads\ptn-aop2.by_REDES..part31.rar
2012-05-30 03:06 - 2012-05-29 23:44 - 104857600 ____A C:\Users\MarcoACC\Downloads\ptn-aop2.by_REDES..part30.rar
2012-05-29 00:11 - 2012-05-29 00:11 - 00007601 ____A C:\Users\MarcoACC\AppData\Local\Resmon.ResmonCfg
2012-05-28 23:42 - 2012-05-28 18:58 - 104857600 ____A C:\Users\MarcoACC\Downloads\ptn-aop2.by_REDES..part29.rar
2012-05-28 23:42 - 2012-05-28 10:13 - 104857600 ____A C:\Users\MarcoACC\Downloads\ptn-aop2.by_REDES..part28.rar
2012-05-28 09:38 - 2012-05-28 08:40 - 104857600 ____A C:\Users\MarcoACC\Downloads\ptn-aop2.by_REDES..part27.rar
2012-05-28 07:41 - 2012-05-28 06:43 - 104857600 ____A C:\Users\MarcoACC\Downloads\ptn-aop2.by_REDES..part26.rar
2012-05-28 06:47 - 2012-05-28 06:47 - 00194885 ____A C:\Users\MarcoACC\Desktop\hjsplit.zip
2012-05-28 06:29 - 2012-05-28 05:31 - 104857600 ____A C:\Users\MarcoACC\Downloads\ptn-aop2.by_REDES..part25.rar
2012-05-28 05:27 - 2012-05-28 04:29 - 104857600 ____A C:\Users\MarcoACC\Downloads\ptn-aop2.by_REDES..part24.rar
2012-05-28 04:28 - 2012-05-28 03:30 - 104857600 ____A C:\Users\MarcoACC\Downloads\ptn-aop2.by_REDES..part23.rar
2012-05-28 03:29 - 2012-05-28 02:31 - 104857600 ____A C:\Users\MarcoACC\Downloads\ptn-aop2.by_REDES..part22.rar
2012-05-28 01:29 - 2012-05-28 00:32 - 104857600 ____A C:\Users\MarcoACC\Downloads\ptn-aop2.by_REDES..part21.rar
2012-05-28 00:29 - 2012-05-27 23:31 - 104857600 ____A C:\Users\MarcoACC\Downloads\ptn-aop2.by_REDES..part20.rar
2012-05-27 23:30 - 2012-05-27 22:33 - 104857600 ____A C:\Users\MarcoACC\Downloads\ptn-aop2.by_REDES..part19.rar
2012-05-27 22:32 - 2012-05-27 21:34 - 104857600 ____A C:\Users\MarcoACC\Downloads\ptn-aop2.by_REDES..part18.rar
2012-05-27 21:29 - 2012-05-27 20:31 - 104857600 ____A C:\Users\MarcoACC\Downloads\ptn-aop2.by_REDES..part17.rar
2012-05-27 19:55 - 2012-05-27 18:57 - 104857600 ____A C:\Users\MarcoACC\Downloads\ptn-aop2.by_REDES..part16.rar
2012-05-27 18:42 - 2012-05-27 17:44 - 104857600 ____A C:\Users\MarcoACC\Downloads\ptn-aop2.by_REDES..part15.rar
2012-05-27 17:21 - 2012-05-27 16:23 - 104857600 ____A C:\Users\MarcoACC\Downloads\ptn-aop2.by_REDES..part14.rar
2012-05-26 21:23 - 2012-05-26 20:25 - 104857600 ____A C:\Users\MarcoACC\Downloads\ptn-aop2.by_REDES..part13.rar
2012-05-26 20:23 - 2012-05-26 19:26 - 104857600 ____A C:\Users\MarcoACC\Downloads\ptn-aop2.by_REDES..part12.rar
2012-05-26 19:24 - 2012-05-26 18:26 - 104857600 ____A C:\Users\MarcoACC\Downloads\ptn-aop2.by_REDES..part11.rar
2012-05-26 18:25 - 2012-05-26 17:27 - 104857600 ____A C:\Users\MarcoACC\Downloads\ptn-aop2.by_REDES..part10.rar
2012-05-26 06:38 - 2012-05-26 05:41 - 104857600 ____A C:\Users\MarcoACC\Downloads\ptn-aop2.by_REDES..part09.rar
2012-05-26 04:57 - 2012-05-26 03:58 - 104857600 ____A C:\Users\MarcoACC\Downloads\ptn-aop2.by_REDES..part08.rar
2012-05-26 02:56 - 2012-05-26 01:59 - 104857600 ____A C:\Users\MarcoACC\Downloads\ptn-aop2.by_REDES..part07.rar
2012-05-26 01:52 - 2012-05-26 00:54 - 104857600 ____A C:\Users\MarcoACC\Downloads\ptn-aop2.by_REDES..part06.rar
2012-05-26 00:36 - 2012-05-25 23:37 - 104857600 ____A C:\Users\MarcoACC\Downloads\ptn-aop2.by_REDES..part05.rar
2012-05-25 23:29 - 2012-05-25 22:31 - 104857600 ____A C:\Users\MarcoACC\Downloads\ptn-aop2.by_REDES..part04.rar
2012-05-25 22:29 - 2012-05-25 21:30 - 104857600 ____A C:\Users\MarcoACC\Downloads\ptn-aop2.by_REDES..part03.rar
2012-05-25 21:30 - 2012-05-25 20:32 - 104857600 ____A C:\Users\MarcoACC\Downloads\ptn-aop2.by_REDES..part02.rar
2012-05-25 20:29 - 2012-05-25 19:31 - 104857600 ____A C:\Users\MarcoACC\Downloads\ptn-aop2.by_REDES..part01.rar
2012-05-21 05:32 - 2012-05-21 01:32 - 00687660 ____A C:\Users\MarcoACC\Documents\Presentacion etica fiscal.pptx
2012-05-21 01:32 - 2012-05-21 01:32 - 00130165 ____A C:\Users\MarcoACC\Documents\Examen Final etica fiscal.pptx
2012-05-18 00:11 - 2012-06-14 06:15 - 12314624 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2012-05-17 23:48 - 2012-06-14 06:15 - 09737728 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2012-05-17 23:45 - 2012-06-14 06:15 - 01800192 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2012-05-17 23:36 - 2012-06-14 06:15 - 01103872 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2012-05-17 23:35 - 2012-06-14 06:15 - 01427968 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2012-05-17 23:35 - 2012-06-14 06:15 - 01129472 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2012-05-17 23:33 - 2012-06-14 06:15 - 00231936 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2012-05-17 23:31 - 2012-06-14 06:15 - 00065024 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2012-05-17 23:29 - 2012-06-14 06:15 - 00716800 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2012-05-17 23:29 - 2012-06-14 06:15 - 00142848 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2012-05-17 23:27 - 2012-06-14 06:15 - 01793024 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2012-05-17 23:25 - 2012-06-14 06:15 - 00073216 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2012-05-17 23:24 - 2012-06-14 06:15 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2012-05-17 23:20 - 2012-06-14 06:15 - 00176640 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2012-05-15 02:05 - 2012-06-14 00:44 - 02343936 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2012-05-14 04:12 - 2011-11-03 17:42 - 00011186 ____A C:\Windows\IE9_main.log
2012-05-02 06:11 - 2011-11-06 21:22 - 00001912 ____A C:\Windows\epplauncher.mif
2012-05-02 05:27 - 2012-05-02 05:27 - 00001064 ____A C:\Users\Public\Desktop\PokerStars.net.lnk
2012-05-01 05:44 - 2012-06-14 00:44 - 00164352 ____A (Microsoft Corporation) C:\Windows\System32\profsvc.dll
2012-04-28 05:41 - 2012-06-14 00:44 - 00919040 ____A (Microsoft Corporation) C:\Windows\System32\rdpcorets.dll
2012-04-28 04:17 - 2012-06-14 00:44 - 00183808 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\rdpwd.sys
2012-04-27 12:22 - 2012-04-27 12:22 - 00151627 ____A C:\Users\MarcoACC\AppData\Roaming\3275.tmp
2012-04-26 21:59 - 2012-04-26 17:45 - 00079006 ____A C:\Users\MarcoACC\Documents\derecho penal marco.pptx
2012-04-26 21:59 - 2012-04-26 17:45 - 00070906 ____A C:\Users\MarcoACC\Documents\LAS FUENTES DEL DERECHO MAGO.pptx
2012-04-26 19:52 - 2012-04-26 19:54 - 00059757 ____A C:\Users\MarcoACC\Documents\EL DELITOEN EL DERECHO PENAL.xmind
2012-04-26 19:52 - 2012-04-26 19:54 - 00046369 ____A C:\Users\MarcoACC\Documents\LAS FUENTES DEL DERECHO.xmind
2012-04-26 17:51 - 2012-04-26 17:51 - 00086091 ____A C:\Users\MarcoACC\AppData\Roaming\1C94.exe
2012-04-26 06:59 - 2012-04-26 06:59 - 00064000 ____A C:\Users\MarcoACC\Downloads\exposiion_de_La_Antijuricidad_y_sus_Causas_de_Justificaci_n.ppt
2012-04-26 06:55 - 2012-04-26 06:55 - 00104960 ____A C:\Users\MarcoACC\Downloads\LEGISLACION-1er-PARCIAL-el-derecho-penal-.ppt
2012-04-26 06:55 - 2012-04-26 06:55 - 00041472 ____A C:\Users\MarcoACC\Downloads\general1.ppt
2012-04-26 06:52 - 2012-04-26 06:52 - 00401920 ____A C:\Users\MarcoACC\Downloads\LAS FUENTES DEL DERECHO.ppt
2012-04-26 05:45 - 2012-06-14 00:44 - 00129536 ____A (Microsoft Corporation) C:\Windows\System32\rdpcorekmts.dll
2012-04-26 05:45 - 2012-06-14 00:44 - 00058880 ____A (Microsoft Corporation) C:\Windows\System32\rdpwsx.dll
2012-04-26 05:41 - 2012-06-14 00:44 - 00008192 ____A (Microsoft Corporation) C:\Windows\System32\rdrmemptylst.exe
2012-04-26 02:53 - 2012-04-26 02:53 - 00009409 ____A C:\Users\MarcoACC\Documents\Mi película.wlmp
2012-04-24 05:36 - 2012-06-14 00:44 - 01158656 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2012-04-24 05:36 - 2012-06-14 00:44 - 00140288 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2012-04-24 05:36 - 2012-06-14 00:44 - 00103936 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2012-04-20 05:41 - 2012-04-20 05:41 - 02746520 ____A C:\Users\MarcoACC\Documents\Lectura de antología.rar

ZeroAccess:
C:\Windows\Installer\{cb2a9c82-7a0d-4a85-73c4-2da29169d354}
C:\Windows\Installer\{cb2a9c82-7a0d-4a85-73c4-2da29169d354}\@
C:\Windows\Installer\{cb2a9c82-7a0d-4a85-73c4-2da29169d354}\L
C:\Windows\Installer\{cb2a9c82-7a0d-4a85-73c4-2da29169d354}\n
C:\Windows\Installer\{cb2a9c82-7a0d-4a85-73c4-2da29169d354}\U
C:\Windows\Installer\{cb2a9c82-7a0d-4a85-73c4-2da29169d354}\U\00000001.@
C:\Windows\Installer\{cb2a9c82-7a0d-4a85-73c4-2da29169d354}\U\80000000.@
C:\Windows\Installer\{cb2a9c82-7a0d-4a85-73c4-2da29169d354}\U\800000cb.@
ZeroAccess:
C:\Users\MarcoACC\AppData\Local\{cb2a9c82-7a0d-4a85-73c4-2da29169d354}
C:\Users\MarcoACC\AppData\Local\{cb2a9c82-7a0d-4a85-73c4-2da29169d354}\@
C:\Users\MarcoACC\AppData\Local\{cb2a9c82-7a0d-4a85-73c4-2da29169d354}\L
C:\Users\MarcoACC\AppData\Local\{cb2a9c82-7a0d-4a85-73c4-2da29169d354}\n
C:\Users\MarcoACC\AppData\Local\{cb2a9c82-7a0d-4a85-73c4-2da29169d354}\U
C:\Users\MarcoACC\AppData\Local\{cb2a9c82-7a0d-4a85-73c4-2da29169d354}\U\00000001.@
C:\Users\MarcoACC\AppData\Local\{cb2a9c82-7a0d-4a85-73c4-2da29169d354}\U\80000000.@
C:\Users\MarcoACC\AppData\Local\{cb2a9c82-7a0d-4a85-73c4-2da29169d354}\U\800000cb.@
========================= Known DLLs (Whitelisted) ============

========================= Bamital & volsnap Check ============
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
==================== EXE ASSOCIATION =====================
HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK
========================= Memory info ======================
Percentage of memory in use: 19%
Total physical RAM: 2046.46 MB
Available physical RAM: 1648.6 MB
Total Pagefile: 2046.46 MB
Available Pagefile: 1647.85 MB
Total Virtual: 2047.88 MB
Available Virtual: 1958.28 MB
======================= Partitions =========================
1 Drive c: (Nuevo vol) (Fixed) (Total:465.76 GB) (Free:330.94 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
2 Drive d: (W7T_V2) (CDROM) (Total:4.21 GB) (Free:0 GB) UDF
8 Drive j: (KINGSTON) (Removable) (Total:3.73 GB) (Free:3.72 GB) FAT32
9 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
N£m Disco Estado Tama¤o Disp Din Gpt
---------- ---------- ------- ------- --- ---
Disco 0 En l¡nea 465 GB 1024 KB
Disco 1 No hay med 0 B 0 B
Disco 2 No hay med 0 B 0 B
Disco 3 No hay med 0 B 0 B
Disco 4 No hay med 0 B 0 B
Disco 5 No hay med 0 B 0 B
Disco 6 En l¡nea 3826 MB 0 B
Partitions of Disk 0:
===============
N£m Partici¢n Tipo Tama¤o Desplazamiento
------------- ---------------- ------- ---------------
Partici¢n 1 Principal 465 GB 1024 KB
==================================================================================
Disk: 0
La partici¢n 1 es ahora la partici¢n seleccionada.
Partici¢n 1
Tipo : 07
Oculta : No
Activa : S¡
Desplaz. bytes: 1048576
N£m Volumen Ltr Etiqueta Fs Tipo Tama¤o Estado Info
----------- --- ----------- ----- ---------- ------- --------- --------
* Volumen 1 C Nuevo vol NTFS Partici¢n 465 GB Correcto
==================================================================================
Partitions of Disk 6:
===============
N£m Partici¢n Tipo Tama¤o Desplazamiento
------------- ---------------- ------- ---------------
Partici¢n 1 Principal 3822 MB 4032 KB
==================================================================================
Disk: 6
La partici¢n 1 es ahora la partici¢n seleccionada.
Partici¢n 1
Tipo : 0B
Oculta : No
Activa : S¡
Desplaz. bytes: 4128768
N£m Volumen Ltr Etiqueta Fs Tipo Tama¤o Estado Info
----------- --- ----------- ----- ---------- ------- --------- --------
* Volumen 7 J KINGSTON FAT32 Extra¡ble 3822 MB Correcto
==================================================================================
==========================================================
Last Boot: 2012-07-08 21:30
======================= End Of Log ==========================

Broni · Jul 15, 2012

Download attached fixlist.txt file and save it to the very same USB flash drive you've been using. Plug the drive back in.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

On Vista or Windows 7: Now please enter System Recovery Options.
On Windows XP: Now please boot into the UBCD.
Run FRST/FRST64 and press the Fix button just once and wait.
The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.

Next....

Restart normally.

Please download ComboFix from Here, Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

Never rename Combofix unless instructed.
Close any open browsers.
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
Close any open browsers.
WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
Double click on combofix.exe & follow the prompts.

NOTE1. If Combofix asks you to install Recovery Console, please allow it.
NOTE 2. If Combofix asks you to update the program, always do so.

When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt"

**Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
**Note 2 for AVG and CA Internet Security (Total Defense Internet Security) users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
Use AppRemover to uninstall it: https://www.techspot.com/downloads/5514-appremover.html
We can reinstall it when we're done with CF.
**Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.
**Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.

Make sure, you re-enable your security programs, when you're done with Combofix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

NOTE.
If, for some reason, Combofix refuses to run, try one of the following:

1. Run Combofix from Safe Mode.

2. Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
Do NOT run it yet.
Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.
There are 4 different versions. If one of them won't run then download and try to run the other one.
Vista and Win7 users need to right click Rkill and choose Run as Administrator
You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

* Rkill.com
* Rkill.scr
* Rkill.exe

Double-click on the Rkill icon to run the tool.
If using Vista or Windows 7 right-click on it and choose Run As Administrator.
A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
If not, delete the file, then download and use the one provided in Link 2.
If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
Do not reboot until instructed.
If the tool does not run from any of the links provided, please let me know.

Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

If normal mode still doesn't work, run BOTH tools from safe mode.

In case #2, please post BOTH logs, rKill and Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

Marco · Jul 15, 2012

Thanks for your reply...

After using the fix:

Fix result of Farbar Recovery Tool (FRST written by Farbar) Version: 14-07-2012
Ran by SYSTEM at 2012-07-15 18:00:56 Run:1
Running from J:\

==============================================
HKEY_LOCAL_MACHINE\System\ControlSet001\Control\Session Manager\SubSystems\\Windows No ZeroAccess entry found.
C:\Windows\System32\consrv.dll not found.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ Default Value restored successfully.
HKEY_USERS\MarcoACC\Software\Microsoft\Windows\CurrentVersion\Run\\0i763f66bz Value deleted successfully.
adad81a680e579f service deleted successfully.
C:\Users\MarcoACC\0i763f66bz.exe moved successfully.
C:\Windows\System32\Drivers\adad81a680e579f.sys moved successfully.
C:\Windows\Installer\{cb2a9c82-7a0d-4a85-73c4-2da29169d354} moved successfully.
C:\Users\MarcoACC\AppData\Local\{cb2a9c82-7a0d-4a85-73c4-2da29169d354} moved successfully.

==== End of Fixlog ====

Marco · Jul 15, 2012

I runned combofix, and after... 20 minutes it reboot the pc

ComboFix 12-07-14.01 - MarcoACC 15/07/2012 18:11:51.1.2 - x86
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.52.3082.18.2046.945 [GMT -5:00]
Running from: c:\users\MarcoACC\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SL2CYA68\ComboFix.exe
AV: Microsoft Security Essentials *Enabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}
SP: Microsoft Security Essentials *Enabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\MarcoACC\AppData\Roaming\1C94.exe
c:\users\MarcoACC\AppData\Roaming\3275.tmp
c:\users\MarcoACC\AppData\Roaming\Microsoft\Windows\Recent\Thumbs.db
c:\users\MarcoACC\Documents\~WRL4002.tmp
.
.
((((((((((((((((((((((((( Files Created from 2012-06-15 to 2012-07-15 )))))))))))))))))))))))))))))))
.
.
2012-07-15 23:20 . 2012-07-15 23:20 56200 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{97F4AB15-ACC7-4A2B-9CA1-997000DDA8B5}\offreg.dll
2012-07-15 23:17 . 2012-07-15 23:21 -------- d-----w- c:\users\MarcoACC\AppData\Local\temp
2012-07-15 23:17 . 2012-07-15 23:17 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-07-15 23:06 . 2012-06-02 22:19 53784 ----a-w- c:\windows\system32\wuauclt.exe
2012-07-15 23:06 . 2012-06-02 22:19 45080 ----a-w- c:\windows\system32\wups2.dll
2012-07-15 23:06 . 2012-06-02 22:19 1933848 ----a-w- c:\windows\system32\wuaueng.dll
2012-07-15 23:06 . 2012-06-02 22:12 2422272 ----a-w- c:\windows\system32\wucltux.dll
2012-07-15 23:06 . 2012-06-02 22:19 35864 ----a-w- c:\windows\system32\wups.dll
2012-07-15 23:06 . 2012-06-02 22:19 577048 ----a-w- c:\windows\system32\wuapi.dll
2012-07-15 23:06 . 2012-06-02 22:12 88576 ----a-w- c:\windows\system32\wudriver.dll
2012-07-15 23:05 . 2012-06-02 20:19 171904 ----a-w- c:\windows\system32\wuwebv.dll
2012-07-15 23:05 . 2012-06-02 20:12 33792 ----a-w- c:\windows\system32\wuapp.exe
2012-07-15 06:50 . 2012-07-15 06:50 -------- d-----w- c:\windows\system32\RBAK
2012-07-15 02:34 . 2012-07-15 02:37 -------- d-----w- C:\2f11bb66e0e6fc595b0932ac133f6495
2012-07-15 00:35 . 2012-07-15 00:35 -------- d-----w- C:\FRST
2012-06-23 10:09 . 2012-07-15 03:54 -------- d-sh--w- c:\windows\system32\%APPDATA%
2012-06-23 09:59 . 2012-06-23 09:59 -------- d-----w- c:\windows\Sun
2012-06-16 16:17 . 2012-06-16 16:17 -------- d-----w- c:\users\MarcoACC\AppData\Local\Macromedia
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-06-23 07:07 . 2012-04-18 19:55 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-06-23 07:07 . 2011-11-06 19:13 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-06-02 21:24 . 2012-06-02 21:04 83872 ----a-w- c:\windows\system32\drivers\atksgt.sys
2012-06-02 21:24 . 2012-06-02 21:04 25888 ----a-w- c:\windows\system32\drivers\lirsgt.sys
2012-06-01 07:19 . 2011-11-19 21:51 477240 ----a-w- c:\windows\system32\drivers\sptd.sys
2012-06-01 06:52 . 2012-06-01 06:52 232512 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2012-05-17 22:45 . 2012-06-14 05:15 1800192 ----a-w- c:\windows\system32\jscript9.dll
2012-05-17 22:35 . 2012-06-14 05:15 1129472 ----a-w- c:\windows\system32\wininet.dll
2012-05-17 22:35 . 2012-06-14 05:15 1427968 ----a-w- c:\windows\system32\inetcpl.cpl
2012-05-17 22:29 . 2012-06-14 05:15 142848 ----a-w- c:\windows\system32\ieUnatt.exe
2012-05-17 22:24 . 2012-06-14 05:15 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2012-05-15 01:05 . 2012-06-13 23:44 2343936 ----a-w- c:\windows\system32\win32k.sys
2012-05-01 04:44 . 2012-06-13 23:44 164352 ----a-w- c:\windows\system32\profsvc.dll
2012-04-28 04:41 . 2012-06-13 23:44 919040 ----a-w- c:\windows\system32\rdpcorets.dll
2012-04-28 03:17 . 2012-06-13 23:44 183808 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-04-26 04:45 . 2012-06-13 23:44 58880 ----a-w- c:\windows\system32\rdpwsx.dll
2012-04-26 04:45 . 2012-06-13 23:44 129536 ----a-w- c:\windows\system32\rdpcorekmts.dll
2012-04-26 04:41 . 2012-06-13 23:44 8192 ----a-w- c:\windows\system32\rdrmemptylst.exe
2012-04-24 04:36 . 2012-06-13 23:44 140288 ----a-w- c:\windows\system32\cryptsvc.dll
2012-04-24 04:36 . 2012-06-13 23:44 1158656 ----a-w- c:\windows\system32\crypt32.dll
2012-04-24 04:36 . 2012-06-13 23:44 103936 ----a-w- c:\windows\system32\cryptnet.dll
2012-06-20 00:02 . 2011-11-06 18:39 85472 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]
"Facebook Update"="c:\users\MarcoACC\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2012-01-10 137536]
"DAEMON Tools Pro Agent"="c:\program files\DAEMON Tools Pro\DTAgent.exe" [2011-08-17 4527424]
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe" [2012-01-05 75624]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-01-26 336384]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\13.0\SharedCOM\RoxWatchTray13.exe" [2010-07-16 307184]
"CPMonitor"="c:\program files\Roxio 2011\5.0\CPMonitor.exe" [2010-07-14 84464]
"Desktop Disc Tool"="c:\program files\Roxio 2011\Roxio Burn\RoxioBurnLauncher.exe" [2010-06-30 477680]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"Monitor"="c:\windows\PixArt\PAC207\Monitor.exe" [2006-11-03 319488]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 AxAutoMntSrv;Alcohol Virtual Drive Auto-mount Service;c:\program files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe [x]
R2 RoxWatch12;Roxio Hard Drive Watcher 12;c:\program files\Common Files\Roxio Shared\13.0\SharedCOM\RoxWatch13.exe [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [x]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [x]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [x]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [x]
R3 PAC207;SoC PC-Camera;c:\windows\system32\DRIVERS\PFC027.SYS [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x]
R3 RoxMediaDB13;RoxMediaDB13;c:\program files\Common Files\Roxio Shared\13.0\SharedCOM\RoxMediaDB13.exe [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Servicio de tecnologías de activación de Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 SahdIa32;HDD Filter Driver;c:\windows\System32\Drivers\SahdIa32.sys [x]
S0 SaibIa32;Volume Filter Driver;c:\windows\System32\Drivers\SaibIa32.sys [x]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x]
S1 SaibVd32;Virtual Disk Driver;c:\windows\system32\Drivers\SaibVd32.sys [x]
S2 9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269;Roxio SAIB Service;c:\program files\Roxio\BackOnTrack\App\SaibSVC.exe [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 AMD Reservation Manager;AMD Reservation Manager;c:\program files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe [x]
S2 BOT4Service;BOT4Service;c:\program files\Roxio\BackOnTrack\App\BService.exe [x]
S2 KMService;KMService;c:\windows\system32\srvany.exe [x]
S3 amdiox86;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox86.sys [x]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys [x]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - WS2IFSL
.
Contents of the 'Scheduled Tasks' folder
.
2012-07-05 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3895268456-3379712286-4068720532-1000Core.job
- c:\users\MarcoACC\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-01-10 08:26]
.
2012-07-08 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3895268456-3379712286-4068720532-1000UA.job
- c:\users\MarcoACC\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-01-10 08:26]
.
.
------- Supplementary Scan -------
.
IE: E&xportar a Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.254
DPF: {26ACAE6F-BC95-44B4-9150-61E4D20D5C2E} - hxxp://www.onlinemania.org/mame/galspanic/loadgame_et.cab
FF - ProfilePath - c:\users\MarcoACC\AppData\Roaming\Mozilla\Firefox\Profiles\7c5k5ut4.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.mx/
.
- - - - ORPHANS REMOVED - - - -
.
AddRemove-ComandoMPDDeinstKey - c:\program files\Eidos Interactive\Pyro\Commandos
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-3895268456-3379712286-4068720532-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-3895268456-3379712286-4068720532-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\atieclxx.exe
c:\windows\KMService.exe
c:\windows\system32\conhost.exe
c:\windows\system32\sppsvc.exe
c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\WUDFHost.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\conhost.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
c:\windows\system32\DllHost.exe
.
**************************************************************************
.
Completion time: 2012-07-15 18:25:01 - machine was rebooted
ComboFix-quarantined-files.txt 2012-07-15 23:25
.
Pre-Run: 354,675,105,792 bytes libres
Post-Run: 355,310,432,256 bytes libres
.
- - End Of File - - B08BD86C35672C4F0411E0030802133C

I tried to delete (in fact I deleted AV microsoft security essentials) but it still appears as active when I run combofix, fortunately it still works.

I searched the "0i763f66bz.exe" file and it seems that it finally dissapears =), what's next?

Broni · Jul 15, 2012

Combofix log looks good

Any current issues?

Reinstall MSE immediately.
You don't want to be without any AV program.

=======================================

Download Malwarebytes' Anti-Malware (MBAM): http://www.malwarebytes.org/products/malwarebytes_free to your desktop.
NOTE. If you already have MBAM installed, update it before running the scan.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform quick scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

Be sure to restart the computer IF MBAM asks you to do so.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

===============================================

Download OTL to your Desktop.
Alternate download: http://www.itxassociates.com/OT-Tools/OTL.exe

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
Click the Scan All Users checkbox.
Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.

Marco · Jul 15, 2012

I just see your post, and I'm just installing MSE, in this moment it's scanning the pc.

After that I'll continue with the process, thank you =)

Edit: MSE didnt find any troubles

Broni · Jul 16, 2012

Marco · Jul 16, 2012

Malwarebytes Anti-Malware (Trial) 1.62.0.1300
www.malwarebytes.org
Database version: v2012.07.16.02
Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
MarcoACC :: MARCOACC-PC [administrator]
Protection: Enabled
15/07/2012 11:09:39 p.m.
mbam-log-2012-07-15 (23-09-39).txt
Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 207858
Time elapsed: 4 minute(s), 42 second(s)
Memory Processes Detected: 1
C:\Windows\KMService.exe (RiskWare.Tool.CK) -> 1756 -> Delete on reboot.
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 1
C:\Windows\KMService.exe (RiskWare.Tool.CK) -> Delete on reboot.
(end)

Broni · Jul 16, 2012

Still waiting for OTL log.

Marco · Jul 17, 2012

Sorry, I had a tough monday =/

Marco · Jul 17, 2012

OTL Log

OTL logfile created on: 17/07/2012 01:24:57 p.m. - Run 1
OTL by OldTimer - Version 3.2.54.0 Folder = C:\Users\MarcoACC\Downloads
Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 0000080a | Country: México | Language: ESM | Date Format: dd/MM/yyyy

2.00 Gb Total Physical Memory | 1.06 Gb Available Physical Memory | 52.82% Memory free
4.00 Gb Paging File | 2.71 Gb Available in Paging File | 67.91% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 465.76 Gb Total Space | 333.81 Gb Free Space | 71.67% Space Free | Partition Type: NTFS
Drive D: | 4.21 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF

Computer Name: MARCOACC-PC | User Name: MarcoACC | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/07/17 13:24:00 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\MarcoACC\Downloads\OTL.exe
PRC - [2012/07/03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) -- C:\Archivos de programa\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012/07/03 13:46:44 | 000,462,920 | ---- | M] (Malwarebytes Corporation) -- C:\Archivos de programa\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2012/06/02 04:08:27 | 000,748,664 | ---- | M] (Microsoft Corporation) -- C:\Archivos de programa\Internet Explorer\iexplore.exe
PRC - [2012/03/26 17:08:12 | 000,931,200 | ---- | M] (Microsoft Corporation) -- C:\Archivos de programa\Microsoft Security Client\msseces.exe
PRC - [2012/03/26 17:03:40 | 000,011,552 | ---- | M] (Microsoft Corporation) -- c:\Archivos de programa\Microsoft Security Client\MsMpEng.exe
PRC - [2012/01/03 08:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Archivos de programa\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011/08/17 02:29:20 | 004,527,424 | ---- | M] (DT Soft Ltd) -- C:\Archivos de programa\DAEMON Tools Pro\DTAgent.exe
PRC - [2011/08/17 02:28:14 | 003,120,448 | ---- | M] (DT Soft Ltd) -- C:\Archivos de programa\DAEMON Tools Pro\DTShellHlp.exe
PRC - [2011/03/28 21:31:16 | 000,193,920 | ---- | M] (Microsoft Corp.) -- C:\Archivos de programa\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
PRC - [2011/03/28 21:31:14 | 001,713,536 | ---- | M] (Microsoft Corp.) -- C:\Archivos de programa\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
PRC - [2011/02/25 00:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2011/01/26 17:55:54 | 000,393,216 | ---- | M] (AMD) -- C:\Windows\System32\atieclxx.exe
PRC - [2011/01/26 17:55:24 | 000,176,128 | ---- | M] (AMD) -- C:\Windows\System32\atiesrxx.exe
PRC - [2010/11/20 16:29:49 | 001,121,792 | ---- | M] (Microsoft Corporation) -- C:\Archivos de programa\Windows Media Player\wmpnetwk.exe
PRC - [2010/11/20 16:29:41 | 001,174,016 | ---- | M] (Microsoft Corporation) -- C:\Archivos de programa\Windows Sidebar\sidebar.exe
PRC - [2010/11/20 16:29:19 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2010/07/14 05:00:00 | 000,032,240 | ---- | M] () -- C:\Archivos de programa\Roxio\BackOnTrack\App\BService.exe
PRC - [2010/07/13 22:23:50 | 000,084,464 | ---- | M] () -- C:\Archivos de programa\Roxio 2011\5.0\CPMonitor.exe
PRC - [2010/06/30 10:10:20 | 001,399,280 | ---- | M] () -- C:\Archivos de programa\Roxio 2011\Roxio Burn\Roxio Burn.exe
PRC - [2010/06/30 10:10:14 | 000,477,680 | ---- | M] () -- C:\Archivos de programa\Roxio 2011\Roxio Burn\RoxioBurnLauncher.exe
PRC - [2010/06/17 06:23:34 | 000,140,224 | ---- | M] (Advanced Micro Devices) -- C:\Archivos de programa\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe
PRC - [2009/12/23 16:34:20 | 000,370,688 | ---- | M] (StarWind Software) -- C:\Archivos de programa\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
PRC - [2009/06/02 20:05:58 | 000,457,200 | ---- | M] () -- C:\Archivos de programa\Roxio\BackOnTrack\App\SaibSVC.exe
PRC - [2006/11/03 11:01:16 | 000,319,488 | ---- | M] (PixArt Imaging Incorporation) -- C:\Windows\PixArt\Pac207\Monitor.exe

========== Modules (No Company Name) ==========

MOD - [2012/06/14 01:19:52 | 000,240,128 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsFormsIntegra#\f2f8201dd3453250dfd9ed1afce630a0\WindowsFormsIntegration.ni.dll
MOD - [2012/06/14 01:18:45 | 018,686,464 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\ehshell\4403edce7ecc88254b0ff907eda750ea\ehshell.ni.dll
MOD - [2012/06/14 01:18:34 | 002,035,712 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mcstore\3a4e56a8d1075cf0af0619c383b3e592\mcstore.ni.dll
MOD - [2012/06/14 01:18:32 | 006,499,840 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MediaCent#\8ce1d10f94b40f054017865757552f2d\Microsoft.MediaCenter.UI.ni.dll
MOD - [2012/06/14 01:18:29 | 001,009,664 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MediaCent#\7fab1ec8f5ed6a55a8a73b2c590bd7cd\Microsoft.MediaCenter.ni.dll
MOD - [2012/06/14 00:31:28 | 011,833,344 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\a501b7960f6c6e2e39162b83f3303aaa\System.Web.ni.dll
MOD - [2012/06/14 00:31:19 | 014,340,608 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\e717a230496832656b05b515eb9f3bc5\PresentationFramework.ni.dll
MOD - [2012/06/14 00:31:07 | 012,436,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\7b7fbe651c6e72f12099a298654c9594\System.Windows.Forms.ni.dll
MOD - [2012/06/14 00:31:02 | 001,591,808 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\6bb439b3f87736d3248ae27d43e2c0d6\System.Drawing.ni.dll
MOD - [2012/06/14 00:30:59 | 012,237,824 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\14a87218ea49639f38097e278b98a3da\PresentationCore.ni.dll
MOD - [2012/05/10 20:42:35 | 000,107,520 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\MCESidebarCtrl\fde9a39ae93f49dfab5645f4d671acd1\MCESidebarCtrl.ni.dll
MOD - [2012/05/10 20:42:20 | 000,705,024 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MediaCent#\76ffefa57578896c8657b81568b79239\Microsoft.MediaCenter.Sports.ni.dll
MOD - [2012/05/10 20:42:18 | 000,849,920 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MediaCent#\48aa111bdc4a6d74f4cf0c06afe34b2c\Microsoft.MediaCenter.Shell.ni.dll
MOD - [2012/05/10 20:42:14 | 000,364,032 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mcstoredb\541a5bb4d0f8490e506f885a4b435566\mcstoredb.ni.dll
MOD - [2012/05/10 20:42:12 | 003,328,000 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mcepg\f051719a8ebb865540412b9d7506224e\mcepg.ni.dll
MOD - [2012/05/10 20:42:04 | 000,442,880 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiProxy\cbf3a07d3ab873b19f47d6a24f06c796\ehiProxy.ni.dll
MOD - [2012/05/10 20:41:25 | 002,297,856 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\dfd33f59a5803a3c73cf408362e6e0b7\System.Core.ni.dll
MOD - [2012/05/08 22:21:33 | 000,368,128 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\8e56489276063ededde74e597a121df3\PresentationFramework.Aero.ni.dll
MOD - [2012/05/08 22:21:20 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\03dee80574f4ec770b6f77ca030ded6c\System.Runtime.Remoting.ni.dll
MOD - [2012/05/08 22:20:53 | 000,060,928 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationProvider\ca2eff60beb3ba00a529a2d42dceca22\UIAutomationProvider.ni.dll
MOD - [2012/05/08 22:20:45 | 003,347,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\46fce56db7685a586d3eeb7c373e3c1c\WindowsBase.ni.dll
MOD - [2012/05/08 22:20:41 | 005,452,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\ba3d70b651454c7d49b407b93663bfed\System.Xml.ni.dll
MOD - [2012/05/08 22:20:39 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cfa9c506bfb9254c89dace7b83bc9f9d\System.Configuration.ni.dll
MOD - [2012/05/08 22:20:38 | 007,967,232 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dll
MOD - [2012/05/08 22:20:33 | 011,492,864 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll
MOD - [2011/03/17 01:11:16 | 004,297,568 | ---- | M] () -- C:\Archivos de programa\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
MOD - [2011/01/26 18:48:02 | 000,243,712 | ---- | M] () -- C:\Archivos de programa\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
MOD - [2010/11/20 16:29:29 | 000,134,656 | ---- | M] () -- C:\Windows\assembly\GAC_32\mcstoredb\6.1.0.0__31bf3856ad364e35\mcstoredb.dll
MOD - [2010/11/12 18:35:23 | 000,425,984 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_es_b77a5c561934e089\System.Windows.Forms.resources.dll
MOD - [2010/11/12 18:35:21 | 000,307,200 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_es_b77a5c561934e089\mscorlib.resources.dll
MOD - [2010/07/13 22:23:50 | 000,084,464 | ---- | M] () -- C:\Archivos de programa\Roxio 2011\5.0\CPMonitor.exe
MOD - [2010/06/30 10:10:20 | 001,399,280 | ---- | M] () -- C:\Archivos de programa\Roxio 2011\Roxio Burn\Roxio Burn.exe
MOD - [2010/06/30 10:10:14 | 000,477,680 | ---- | M] () -- C:\Archivos de programa\Roxio 2011\Roxio Burn\RoxioBurnLauncher.exe
MOD - [2010/06/30 10:10:10 | 000,645,616 | ---- | M] () -- C:\Archivos de programa\Roxio 2011\Roxio Burn\BBEngineAS.dll
MOD - [2010/06/25 15:11:48 | 000,394,224 | ---- | M] () -- c:\Archivos de programa\Common Files\Roxio Shared\DLLShared\SQLite352.dll

========== Win32 Services (SafeList) ==========

SRV - [2012/07/03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Archivos de programa\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012/06/19 19:02:17 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Archivos de programa\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012/03/26 17:03:40 | 000,214,952 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- c:\Archivos de programa\Microsoft Security Client\NisSrv.exe -- (NisSrv)
SRV - [2012/03/26 17:03:40 | 000,011,552 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Archivos de programa\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV - [2012/01/05 10:42:34 | 000,075,624 | ---- | M] (Alcohol Soft Development Team) [Auto | Stopped] -- C:\Archivos de programa\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe -- (AxAutoMntSrv)
SRV - [2012/01/03 08:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Archivos de programa\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011/11/03 15:32:45 | 000,008,192 | ---- | M] () [Auto | Stopped] -- C:\Windows\System32\srvany.exe -- (KMService)
SRV - [2011/11/03 11:38:42 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2011/06/12 12:15:00 | 031,125,880 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Microsoft Office\Office14\GROOVE.EXE -- (Microsoft SharePoint Workspace Audit Service)
SRV - [2011/03/28 21:31:14 | 001,713,536 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Archivos de programa\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2011/01/26 17:55:24 | 000,176,128 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2010/11/20 16:29:49 | 001,121,792 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Archivos de programa\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2010/09/22 17:33:04 | 000,051,040 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Archivos de programa\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV - [2010/07/16 07:48:26 | 000,354,288 | ---- | M] (Sonic Solutions) [Auto | Stopped] -- C:\Archivos de programa\Common Files\Roxio Shared\13.0\SharedCOM\RoxWatch13.exe -- (RoxWatch12)
SRV - [2010/07/16 07:48:04 | 001,099,248 | ---- | M] (Sonic Solutions) [On_Demand | Stopped] -- C:\Archivos de programa\Common Files\Roxio Shared\13.0\SharedCOM\RoxMediaDB13.exe -- (RoxMediaDB13)
SRV - [2010/07/14 05:00:00 | 000,032,240 | ---- | M] () [Auto | Running] -- C:\Archivos de programa\Roxio\BackOnTrack\App\BService.exe -- (BOT4Service)
SRV - [2010/06/17 06:23:34 | 000,140,224 | ---- | M] (Advanced Micro Devices) [Auto | Running] -- C:\Archivos de programa\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe -- (AMD Reservation Manager)
SRV - [2010/01/09 22:37:50 | 004,640,000 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Archivos de programa\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)
SRV - [2010/01/09 22:18:00 | 000,149,352 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Archivos de programa\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)
SRV - [2009/12/23 16:34:20 | 000,370,688 | ---- | M] (StarWind Software) [Auto | Running] -- C:\Archivos de programa\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe -- (StarWindServiceAE)
SRV - [2009/07/13 20:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/13 20:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009/07/13 20:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Archivos de programa\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2009/06/02 20:05:58 | 000,457,200 | ---- | M] () [Auto | Running] -- C:\Archivos de programa\Roxio\BackOnTrack\App\SaibSVC.exe -- (9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- System32\drivers\rdvgkmd.sys -- (VGPU)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\MarcoACC\AppData\Local\Temp\catchme.sys -- (catchme)
DRV - File not found [Kernel | On_Demand | Unknown] -- -- (awuf5jx6)
DRV - File not found [Kernel | On_Demand | Unknown] -- -- (avvgrkg3)
DRV - [2012/07/17 13:20:48 | 000,029,904 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{82BC1C4B-0C47-4968-A99F-7833DDE338D6}\MpKslf4018bfc.sys -- (MpKslf4018bfc)
DRV - [2012/07/03 13:46:44 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2012/06/02 16:24:03 | 000,083,872 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt)
DRV - [2012/06/02 16:24:03 | 000,025,888 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)
DRV - [2012/06/01 02:19:06 | 000,477,240 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\sptd.sys -- (sptd)
DRV - [2012/06/01 01:52:42 | 000,232,512 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\System32\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV - [2012/03/20 20:44:12 | 000,074,112 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)
DRV - [2011/01/26 18:36:14 | 007,566,848 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (amdkmdag)
DRV - [2011/01/26 17:13:10 | 000,238,592 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmpag.sys -- (amdkmdap)
DRV - [2010/11/20 16:29:34 | 000,015,872 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV - [2010/11/20 16:29:24 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010/11/20 16:29:03 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)
DRV - [2010/11/20 16:29:03 | 000,112,640 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tsusbhub.sys -- (tsusbhub)
DRV - [2010/11/20 16:29:03 | 000,077,184 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Synth3dVsc.sys -- (Synth3dVsc)
DRV - [2010/11/20 16:29:03 | 000,062,464 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\dmvsc.sys -- (dmvsc)
DRV - [2010/11/20 16:29:03 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2010/11/20 16:29:03 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2010/11/20 16:29:03 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)
DRV - [2010/11/20 16:29:03 | 000,027,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV - [2010/11/20 16:29:03 | 000,025,600 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\terminpt.sys -- (terminpt)
DRV - [2010/11/20 16:29:03 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2010/11/20 16:29:03 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)
DRV - [2010/11/17 07:04:24 | 000,101,392 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AtihdW73.sys -- (AtiHDAudioService)
DRV - [2010/08/12 13:07:48 | 000,298,216 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmf6232.sys -- (NVNET)
DRV - [2010/02/18 10:18:22 | 000,037,944 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\amdiox86.sys -- (amdiox86)
DRV - [2009/07/13 17:02:52 | 000,347,264 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvm62x32.sys -- (NVENETFD)
DRV - [2009/06/02 02:00:00 | 000,025,584 | ---- | M] (Sonic Solutions) [Kernel | System | Running] -- C:\Windows\System32\drivers\SaibVd32.sys -- (SaibVd32)
DRV - [2009/06/02 02:00:00 | 000,021,488 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\SahdIa32.sys -- (SahdIa32)
DRV - [2009/06/02 02:00:00 | 000,015,856 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\SaibIa32.sys -- (SaibIa32)
DRV - [2006/12/05 11:34:42 | 000,507,136 | ---- | M] (PixArt Imaging Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\PFC027.SYS -- (PAC207)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-3895268456-3379712286-4068720532-1000\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKU\S-1-5-21-3895268456-3379712286-4068720532-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://prodigy.msn.com/?ocid=OIE9HP
IE - HKU\S-1-5-21-3895268456-3379712286-4068720532-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = es-MX
IE - HKU\S-1-5-21-3895268456-3379712286-4068720532-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 00 A8 C7 37 5D A0 CC 01 [binary data]
IE - HKU\S-1-5-21-3895268456-3379712286-4068720532-1000\..\SearchScopes,DefaultScope = {13FB06C3-0CEB-43C0-8C91-2A7BD83CE846}
IE - HKU\S-1-5-21-3895268456-3379712286-4068720532-1000\..\SearchScopes\{13FB06C3-0CEB-43C0-8C91-2A7BD83CE846}: "URL" = http://www.bing.com/search?q={searchTerms}&form=BIE9DF&pc=BIE9&src=IE-SearchBox
IE - HKU\S-1-5-21-3895268456-3379712286-4068720532-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.google.com.mx/"
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_257.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: C:\Users\MarcoACC\AppData\Roaming\Move Networks\plugins\071803000001\npqmp071803000001.dll (Move Networks)
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\MarcoACC\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/07/14 22:54:26 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins

[2011/11/04 09:37:42 | 000,000,000 | ---D | M] (No name found) -- C:\Users\MarcoACC\AppData\Roaming\mozilla\Extensions
[2012/07/14 16:17:44 | 000,000,000 | ---D | M] (No name found) -- C:\Users\MarcoACC\AppData\Roaming\mozilla\Firefox\Profiles\7c5k5ut4.default\extensions
[2012/07/14 22:54:06 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Users\MarcoACC\AppData\Roaming\mozilla\Firefox\Profiles\7c5k5ut4.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2011/11/06 13:39:32 | 000,000,000 | ---D | M] (No name found) -- C:\Archivos de programa\Mozilla Firefox\extensions
[2012/04/24 16:58:40 | 000,006,877 | ---- | M] () (No name found) -- C:\USERS\MARCOACC\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7C5K5UT4.DEFAULT\EXTENSIONS\{DCA818C0-ACEF-11E0-9F1C-0800200C9A66}.XPI
[2012/02/11 17:48:09 | 000,709,293 | ---- | M] () (No name found) -- C:\USERS\MARCOACC\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7C5K5UT4.DEFAULT\EXTENSIONS\{DDC359D1-844A-42A7-9AA1-88A850A938A8}.XPI
[2012/06/21 16:46:00 | 000,109,964 | ---- | M] () (No name found) -- C:\USERS\MARCOACC\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7C5K5UT4.DEFAULT\EXTENSIONS\ADBLOCKPOPUPS@JESSEHAKANEN.NET.XPI
[2012/01/23 13:17:03 | 000,012,953 | ---- | M] () (No name found) -- C:\USERS\MARCOACC\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7C5K5UT4.DEFAULT\EXTENSIONS\ANTHONY@GMAIL.COM.XPI
[2012/06/23 05:01:33 | 000,006,723 | ---- | M] () (No name found) -- C:\USERS\MARCOACC\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7C5K5UT4.DEFAULT\EXTENSIONS\XPIRAL@GMAIL.COM.XPI
[2012/06/14 02:14:45 | 000,056,364 | ---- | M] () (No name found) -- C:\USERS\MARCOACC\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7C5K5UT4.DEFAULT\EXTENSIONS\YESPOPUPSV1@PATHETICCOCKROACH.COM.XPI
[2012/06/19 19:02:18 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/04/18 01:04:11 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/04/18 01:04:11 | 000,002,456 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\mercadolibre-mx.xml
[2012/04/18 01:04:11 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-es.xml
[2012/04/18 01:04:11 | 000,001,102 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-mx.xml

O1 HOSTS File: ([2012/07/15 18:21:21 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Archivos de programa\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Archivos de programa\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (Windows Live Messenger Companion Helper) - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Archivos de programa\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Archivos de programa\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O4 - HKLM..\Run: [BCSSync] C:\Program Files\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation)
O4 - HKLM..\Run: [CPMonitor] C:\Program Files\Roxio 2011\5.0\CPMonitor.exe ()
O4 - HKLM..\Run: [Desktop Disc Tool] C:\Program Files\Roxio 2011\Roxio Burn\RoxioBurnLauncher.exe ()
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [Monitor] C:\Windows\PixArt\Pac207\Monitor.exe (PixArt Imaging Incorporation)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [RoxWatchTray] C:\Program Files\Common Files\Roxio Shared\13.0\SharedCOM\RoxWatchTray13.exe (Sonic Solutions)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKU\S-1-5-21-3895268456-3379712286-4068720532-1000..\Run: [AlcoholAutomount] C:\Program Files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe (Alcohol Soft Development Team)
O4 - HKU\S-1-5-21-3895268456-3379712286-4068720532-1000..\Run: [DAEMON Tools Pro Agent] C:\Program Files\DAEMON Tools Pro\DTAgent.exe (DT Soft Ltd)
O4 - HKU\S-1-5-21-3895268456-3379712286-4068720532-1000..\Run: [Facebook Update] C:\Users\MarcoACC\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3895268456-3379712286-4068720532-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3895268456-3379712286-4068720532-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-21-3895268456-3379712286-4068720532-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: E&xportar a Microsoft Excel - C:\Archivos de programa\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Archivos de programa\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0\bin\NPJPI150.dll (Sun Microsystems, Inc.)
O9 - Extra Button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Archivos de programa\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Archivos de programa\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Archivos de programa\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Archivos de programa\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O16 - DPF: {26ACAE6F-BC95-44B4-9150-61E4D20D5C2E} http://www.onlinemania.org/mame/galspanic/loadgame_et.cab (Activex Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://javadl-esd.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab (Java Plug-in 1.5.0)
O16 - DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab (Java Plug-in 1.5.0)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F1D477BC-64C2-426F-85B1-418599416E35}: DhcpNameServer = 192.168.1.254
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Archivos de programa\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Archivos de programa\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Archivos de programa\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Archivos de programa\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Archivos de programa\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Archivos de programa\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Archivos de programa\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 16:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2009/11/01 06:24:04 | 000,000,043 | R--- | M] () - D:\autorun.inf -- [ UDF ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2012/07/15 23:08:29 | 000,000,000 | ---D | C] -- C:\Users\MarcoACC\AppData\Roaming\Malwarebytes
[2012/07/15 23:07:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012/07/15 23:07:51 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012/07/15 23:07:51 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012/07/15 22:54:16 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Client
[2012/07/15 18:24:46 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2012/07/15 18:17:05 | 000,000,000 | ---D | C] -- C:\Users\MarcoACC\AppData\Local\temp
[2012/07/15 18:17:04 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2012/07/15 18:10:13 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2012/07/15 18:10:13 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2012/07/15 18:10:13 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2012/07/15 18:08:45 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012/07/15 18:08:19 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2012/07/15 01:50:21 | 000,000,000 | ---D | C] -- C:\Windows\System32\RBAK
[2012/07/14 21:34:47 | 000,000,000 | ---D | C] -- C:\2f11bb66e0e6fc595b0932ac133f6495
[2012/07/14 19:35:45 | 000,000,000 | ---D | C] -- C:\FRST
[2012/07/10 13:43:13 | 000,000,000 | ---D | C] -- C:\Users\MarcoACC\AppData\Local\{F77B4313-A706-4243-8166-DB5AF68BA564}
[2012/07/10 13:43:03 | 000,000,000 | ---D | C] -- C:\Users\MarcoACC\AppData\Local\{3D4AFFDF-F8EC-4207-B732-36E16580D9F4}
[2012/06/23 05:09:40 | 000,000,000 | -HSD | C] -- C:\Windows\System32\%APPDATA%
[2012/06/23 04:59:50 | 000,000,000 | ---D | C] -- C:\Windows\Sun
[2012/06/23 04:59:50 | 000,000,000 | ---D | C] -- C:\Users\MarcoACC\AppData\Roaming\Sun
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/07/17 13:20:37 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/07/17 13:20:35 | 1609,404,416 | -HS- | M] () -- C:\hiberfil.sys
[2012/07/16 19:05:08 | 000,020,800 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/07/16 19:05:08 | 000,020,800 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/07/15 23:07:56 | 000,001,080 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/07/15 22:55:01 | 000,001,912 | ---- | M] () -- C:\Windows\epplauncher.mif
[2012/07/15 22:54:26 | 000,705,702 | ---- | M] () -- C:\Windows\System32\perfh00A.dat
[2012/07/15 22:54:26 | 000,617,910 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012/07/15 22:54:26 | 000,138,600 | ---- | M] () -- C:\Windows\System32\perfc00A.dat
[2012/07/15 22:54:26 | 000,107,190 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012/07/15 22:51:02 | 000,483,760 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012/07/15 18:21:21 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2012/07/15 02:07:22 | 000,000,356 | ---- | M] () -- C:\Windows\bB
[2012/07/08 14:31:01 | 000,000,940 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3895268456-3379712286-4068720532-1000UA.job
[2012/07/05 02:31:00 | 000,000,918 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3895268456-3379712286-4068720532-1000Core.job
[2012/07/03 13:46:44 | 000,022,344 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/07/15 23:07:56 | 000,001,080 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/07/15 22:54:33 | 000,001,924 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
[2012/07/15 18:10:13 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2012/07/15 18:10:13 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2012/07/15 18:10:13 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2012/07/15 18:10:13 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2012/07/15 18:10:13 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012/07/12 14:21:15 | 000,000,356 | ---- | C] () -- C:\Windows\bB
[2012/06/02 16:04:04 | 000,083,872 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys
[2012/06/02 16:04:04 | 000,025,888 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys
[2012/05/28 18:11:18 | 000,007,601 | ---- | C] () -- C:\Users\MarcoACC\AppData\Local\Resmon.ResmonCfg
[2012/02/16 07:11:47 | 000,003,584 | ---- | C] () -- C:\Users\MarcoACC\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/11/19 17:03:40 | 000,000,065 | ---- | C] () -- C:\Windows\WININIT.INI
[2011/11/10 20:47:17 | 000,010,240 | ---- | C] () -- C:\Windows\System32\vidx16.dll
[2011/11/06 14:08:15 | 000,165,376 | ---- | C] () -- C:\Windows\System32\unrar.dll
[2011/11/06 14:08:15 | 000,000,038 | ---- | C] () -- C:\Windows\avisplitter.ini
[2011/11/06 14:08:14 | 000,790,528 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2011/11/06 14:08:14 | 000,134,144 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2011/11/06 14:08:14 | 000,108,032 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
[2011/11/06 12:18:05 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2011/11/06 12:13:25 | 000,003,113 | ---- | C] () -- C:\Windows\System32\atipblag.dat
[2011/11/03 15:33:28 | 000,008,192 | ---- | C] () -- C:\Windows\System32\srvany.exe
[2011/11/03 12:23:51 | 000,011,164 | ---- | C] () -- C:\Windows\System32\drivers\nvphy.bin
[2010/12/17 11:00:44 | 000,227,587 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
[2010/11/20 19:30:05 | 000,705,702 | ---- | C] () -- C:\Windows\System32\perfh00A.dat
[2010/11/20 19:30:05 | 000,341,432 | ---- | C] () -- C:\Windows\System32\perfi00A.dat
[2010/11/20 19:30:05 | 000,138,600 | ---- | C] () -- C:\Windows\System32\perfc00A.dat
[2010/11/20 19:30:05 | 000,041,390 | ---- | C] () -- C:\Windows\System32\perfd00A.dat
[2010/11/20 16:29:34 | 000,080,896 | ---- | C] () -- C:\Windows\System32\RDVGHelper.exe
[2010/11/20 16:29:26 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe

========== LOP Check ==========

[2012/07/14 22:54:08 | 000,000,000 | ---D | M] -- C:\Users\MarcoACC\AppData\Roaming\DAEMON Tools Pro
[2012/07/14 22:54:06 | 000,000,000 | ---D | M] -- C:\Users\MarcoACC\AppData\Roaming\Tibia
[2012/07/05 02:31:00 | 000,000,918 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3895268456-3379712286-4068720532-1000Core.job
[2012/07/08 14:31:01 | 000,000,940 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3895268456-3379712286-4068720532-1000UA.job
[2012/06/12 22:40:49 | 000,032,636 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

< End of report >

Marco · Jul 17, 2012

Extras Log

OTL Extras logfile created on: 17/07/2012 01:24:57 p.m. - Run 1
OTL by OldTimer - Version 3.2.54.0 Folder = C:\Users\MarcoACC\Downloads
Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 0000080a | Country: México | Language: ESM | Date Format: dd/MM/yyyy

2.00 Gb Total Physical Memory | 1.06 Gb Available Physical Memory | 52.82% Memory free
4.00 Gb Paging File | 2.71 Gb Available in Paging File | 67.91% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 465.76 Gb Total Space | 333.81 Gb Free Space | 71.67% Space Free | Partition Type: NTFS
Drive D: | 4.21 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF

Computer Name: MARCOACC-PC | User Name: MarcoACC | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0294BB2F-6178-459D-8C46-8D1C40D6AD6B}" = rport=445 | protocol=6 | dir=out | app=system |
"{057550CC-1C7E-4C7B-A2F8-3A8DDC978C8C}" = lport=138 | protocol=17 | dir=in | app=system |
"{08E024BB-596A-4DFF-A430-159062EB67CE}" = lport=10243 | protocol=6 | dir=in | app=system |
"{19A5737B-0BEE-43C8-BCD3-3CC714AA4FD3}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{25B9D31D-64EC-44F5-900B-17177C3E5D3C}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{295EF879-34FC-4A05-A484-51AA1443280E}" = lport=445 | protocol=6 | dir=in | app=system |
"{2FA65B31-3A9D-4C20-AFC6-469495F0EF44}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{4084E937-EAAA-47EE-9520-7BE7CE434C09}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{4BF5EB07-06A2-40E2-B5B6-244EF5C49A0F}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{5456EA1E-AF45-48BD-9C96-AB99A6CCF1D9}" = lport=139 | protocol=6 | dir=in | app=system |
"{6364B77A-8796-4078-B3CC-5963A3E70B4F}" = rport=139 | protocol=6 | dir=out | app=system |
"{6EFD3216-D4DB-448C-81DA-E8838C66FFD2}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{7C7BD74E-D59D-40F9-8481-A74C4729E9DD}" = rport=138 | protocol=17 | dir=out | app=system |
"{86444BB3-291D-4D31-A046-BB4AA3243C28}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{AF8150A9-8B4A-4262-900E-D368942052B3}" = lport=2869 | protocol=6 | dir=in | app=system |
"{BE10AB93-C4A6-464B-BE93-069E778BFF99}" = rport=10243 | protocol=6 | dir=out | app=system |
"{C232D951-55E7-4D04-9346-F88A07FC0B22}" = lport=137 | protocol=17 | dir=in | app=system |
"{C428A183-FD79-40B5-990D-895328F43AC8}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{CF0676E6-E2EC-438A-9741-7029DEBD00CE}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{F534D21D-02A4-4E48-A237-A3745ED5E6D3}" = rport=137 | protocol=17 | dir=out | app=system |
"{F9C1EEE5-72B7-40C6-BC7C-64E9DF7DEB39}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{003C7A18-60D9-4C89-94D8-DE42C1AA1D76}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{02A4D600-582A-4C14-ADFE-C125CF0CB18F}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{1473D86F-6F04-46A3-9153-CD04272511DC}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{4849799C-D8E9-4360-8F9A-6B5F2BCC7EA4}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{56E808A1-BFD0-4B79-B567-B9FA848D697F}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{61FB8AD2-C831-45AB-9DFB-D685C3A8300D}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{62F27534-2769-4D2F-B42F-E96E62F64F44}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{65901CFC-D156-4C8F-90EA-C26D256CA195}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{68F6992D-6E9D-4F14-88EC-3E0B8BEC7EFF}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{8642AF85-31DC-4BB3-8E9D-1E478C224084}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{A5589677-56C4-46C1-A86B-1F0B5425786F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{AB3FBA72-52C3-4476-9A38-230DBE05659B}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{BC7833D1-AE4B-4CAB-BDD5-6EA587E5C763}" = protocol=6 | dir=out | app=system |
"{CE504808-152F-4073-8BB9-0F8E7C4D30C6}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{D3648D1D-2BA3-4973-9B7E-EDC907B6E342}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{E8715BB0-E132-4617-B344-62E03BFE2C1C}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{E926E57D-011D-4F63-BCC5-FFCFDC28D091}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{EFA98652-B437-42AA-B7D3-EFFD71ED4ECD}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{F7DCF881-DB9D-4779-8D1C-CCCBAC7C73FF}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01501EBA-EC35-4F9F-8889-3BE346E5DA13}" = MSXML4 Parser
"{04668DF2-D32F-4555-9C7E-35523DCD6544}" = Control ActiveX de Windows Live Mesh para conexiones remotas
"{0805B720-5CD0-143C-E569-149D546A92FA}" = CCC Help Chinese Traditional
"{0A1651F1-7E0F-4613-93FE-967F5BC3C1B7}" = Windows Live Remote Service Resources
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0D261C88-454B-46FE-B43B-640E621BDA11}" = Windows Live Mail
"{0F842B77-56EA-4AAF-8295-81A022350B5E}" = Microsoft Security Client
"{19A4A990-5343-4FF7-B3B5-6F046C091EDF}" = Windows Live Remote Client
"{1A1F62AB-B8D6-1769-923D-365F963D51F9}" = WMV9/VC-1 Video Playback
"{1DBC906E-DF47-4E7C-A72A-7081AD22EACC}" = LastChaos LatinoAmerica
"{1E6A4185-C2E8-1AB7-6C05-806C015FFE7E}" = CCC Help Czech
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{227E8782-B2F4-4E97-B0EE-49DE9CC1C0C0}" = Windows Live Remote Service
"{2E443D29-FB41-07FB-21E9-852D477570BE}" = CCC Help English
"{2F8BA3FD-1FA9-4279-B696-712ABB12F09F}" = SmartSound Quicktracks 5
"{3248F0A8-6813-11D6-A77B-00B0D0150000}" = J2SE Runtime Environment 5.0
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{362D5167-9716-44BE-89FD-BF9EB6EF814B}" = DawnOfWar
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{4433FF9E-AF21-4E41-B296-4E13BF4D52F5}" = Roxio Creator 2011 Pro
"{451D691A-D425-01D3-B1C7-0A3161878ECE}" = CCC Help Hungarian
"{46D19CDC-934A-B652-FC86-C2D4732C6D09}" = AMD Fuel
"{47FDE7DF-E065-EBF3-5CA1-44BB75F05F6A}" = CCC Help Japanese
"{48C0DC5E-820A-44F2-890E-29B68EDD3C78}" = Windows Live Writer
"{4C6B0067-4399-7F36-4C34-18D861D7662E}" = CCC Help French
"{4CA9839A-F660-4F7F-BD45-F466512ECE20}" = LegionArena
"{50779A29-834E-4E36-BBEB-B7CABC67A825}" = Microsoft Security Client ES-ES Language Pack
"{5A4B0298-6C1A-E615-BE09-D65A63AAB2ED}" = Catalyst Control Center Graphics Previews Common
"{5C8BC258-A629-4DF2-97D0-E106C2A9B1BD}" = Windows Live Remote Client Resources
"{5D273F60-0525-48BA-A5FB-D0CAA4A952AE}" = Windows Live Movie Maker
"{5FD89EA1-99C2-40EE-BBF5-20F8991ED756}" = Catalyst Control Center - Branding
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{729B89D0-946A-407E-A121-343BD3320C40}" = Roxio BackOnTrack
"{7388C4A0-45C6-E068-8A72-81B260AC5587}" = Lastchaos_Downloader
"{77477AEA-5757-47D8-8B33-939F43D82218}" = Windows Live UX Platform Language Pack
"{77CDA026-3860-4C95-8233-34F3CEF121FB}" = Roxio Creator 2011 Pro
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{78A96B4C-A643-4D0F-98C2-A8E16A6669F9}" = Windows Live Messenger Companion Core
"{78DAE910-CA72-450E-AD22-772CB1A00678}" = Windows Live Mesh
"{7A497FCE-53D2-8D70-C497-CD5585953F62}" = CCC Help Spanish
"{7CAC6A44-C3DE-4153-ACA6-7524602C789E}" = Facebook Video Calling 1.2.0.159
"{7D1C7B9F-2744-4388-B128-5C75B8BCCC84}" = Windows Live Essentials
"{7D481DFF-88C5-4685-B0EA-D167F0B46CF1}" = Microsoft Antimalware Service ES-ES Language Pack
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{86DDDAAD-AEB9-42E5-BE01-0E8FABD2BB29}" = Roxio Video Capture USB
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8FF3891F-01B5-4A71-BFCD-20761890471C}" = Windows Live Messenger
"{90140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0015-0C0A-0000-0000000FF1CE}" = Microsoft Office Access MUI (Spanish) 2010
"{90140000-0015-0C0A-0000-0000000FF1CE}_Office14.PROPLUS_{AA321CAB-5896-46B1-B18E-3EE82C88ABF1}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0C0A-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Spanish) 2010
"{90140000-0016-0C0A-0000-0000000FF1CE}_Office14.PROPLUS_{AA321CAB-5896-46B1-B18E-3EE82C88ABF1}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0C0A-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Spanish) 2010
"{90140000-0018-0C0A-0000-0000000FF1CE}_Office14.PROPLUS_{AA321CAB-5896-46B1-B18E-3EE82C88ABF1}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0C0A-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Spanish) 2010
"{90140000-0019-0C0A-0000-0000000FF1CE}_Office14.PROPLUS_{AA321CAB-5896-46B1-B18E-3EE82C88ABF1}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0C0A-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Spanish) 2010
"{90140000-001A-0C0A-0000-0000000FF1CE}_Office14.PROPLUS_{AA321CAB-5896-46B1-B18E-3EE82C88ABF1}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0C0A-0000-0000000FF1CE}" = Microsoft Office Word MUI (Spanish) 2010
"{90140000-001B-0C0A-0000-0000000FF1CE}_Office14.PROPLUS_{AA321CAB-5896-46B1-B18E-3EE82C88ABF1}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0403-0000-0000000FF1CE}" = Microsoft Office Proof (Catalan) 2010
"{90140000-001F-0403-0000-0000000FF1CE}_Office14.PROPLUS_{F030E098-C2CC-4056-971E-4D3AB0F55517}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUS_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUS_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0416-0000-0000000FF1CE}" = Microsoft Office Proof (Portuguese (Brazil)) 2010
"{90140000-001F-0416-0000-0000000FF1CE}_Office14.PROPLUS_{A7200E61-DC93-42E0-BB74-EE59021016EA}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-042D-0000-0000000FF1CE}" = Microsoft Office Proof (Basque) 2010
"{90140000-001F-042D-0000-0000000FF1CE}_Office14.PROPLUS_{C6E07E58-897F-4686-A498-764B9D404F09}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0456-0000-0000000FF1CE}" = Microsoft Office Proof (Galician) 2010
"{90140000-001F-0456-0000-0000000FF1CE}_Office14.PROPLUS_{6CA060C9-FAFB-4A51-B533-A6AEE1A325BE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2010
"{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PROPLUS_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0C0A-0000-0000000FF1CE}" = Microsoft Office Proofing (Spanish) 2010
"{90140000-002C-0C0A-0000-0000000FF1CE}_Office14.PROPLUS_{DBE2E9A2-A47F-42A9-A1CF-3B6665A9714A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0044-0C0A-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (Spanish) 2010
"{90140000-0044-0C0A-0000-0000000FF1CE}_Office14.PROPLUS_{AA321CAB-5896-46B1-B18E-3EE82C88ABF1}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0C0A-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Spanish) 2010
"{90140000-006E-0C0A-0000-0000000FF1CE}_Office14.PROPLUS_{7FF53332-4A24-4F40-946E-C58B6326063C}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0C0A-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (Spanish) 2010
"{90140000-00A1-0C0A-0000-0000000FF1CE}_Office14.PROPLUS_{AA321CAB-5896-46B1-B18E-3EE82C88ABF1}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00BA-0C0A-0000-0000000FF1CE}" = Microsoft Office Groove MUI (Spanish) 2010
"{90140000-00BA-0C0A-0000-0000000FF1CE}_Office14.PROPLUS_{AA321CAB-5896-46B1-B18E-3EE82C88ABF1}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{939C80FA-96C9-44A6-B318-8E7D8BD8481B}" = Messenger Companion
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9569E6BC-326A-432F-97AB-35263A327BF1}" = Roxio Burn - Secure
"{95B012AD-3A4A-31D7-9167-5D07D2A71F47}" = Microsoft .NET Framework 4 Client Profile ESN Language Pack
"{9A5F1282-D6F8-4F04-B73E-D9286924E9AC}" = Roxio Creator 2011 Pro
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{9F717571-FEE8-45CD-8B03-5B2D06AD28F7}" = Roxio Creator 2011 Content
"{A41A708E-3BE6-4561-855D-44027C1CF0F8}" = Windows Live Photo Common
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A9024A22-FB0E-4DDC-AB93-44D686F7F491}" = Roxio CinePlayer
"{A982D950-FAB9-744E-41BE-285082FF86C2}" = CCC Help Italian
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AC76BA86-7AD7-1034-7B44-AA1000000001}" = Adobe Reader X (10.1.3) - Español
"{AF844339-2F8A-4593-81B3-9F4C54038C4E}" = Windows Live MIME IFilter
"{B39A18D0-296E-2B41-4CCC-58AF0B772F8E}" = CCC Help Greek
"{B83FC356-B7C0-441F-8A4D-D71E088E7974}" = NVIDIA PhysX
"{B8A2869E-30CA-40C5-9CF8-BD7354E57EF8}" = SmartSound Common Data
"{BD3EAE4D-862D-4D41-8BB5-F5C2CFFE6022}" = Roxio BackOnTrackPE
"{C6150D8A-86ED-41D3-87BB-F3BB51B0B77F}" = Windows Live ID Sign-in Assistant
"{CA212D9E-EDFB-B0D8-B1D5-05ED5838F6B7}" = ccc-core-static
"{CADDE354-C78C-46CB-A006-E2B178EFC271}" = Rise Of Legends
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D95A0957-F389-C180-9660-B48E41FD83D4}" = ATI Catalyst Install Manager
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E1D8FD24-8CC4-9038-0B15-ADBB922DA352}" = CCC Help Danish
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{E727A662-AF9F-4DEE-81C5-F4A1686F3DFC}" = Windows Live Writer Resources
"{E85A4EFC-82F2-4CEE-8A8E-62FDAD353A66}" = Galería fotográfica de Windows Live
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F7725A3F-32F6-85C9-1EFA-92C482B35363}" = ATI AVIVO Codecs
"{FB45F14F-E6F9-796D-86A3-C096B5BEF842}" = CCC Help German
"{FE23D063-934D-4829-A0D8-00634CE79B4A}" = Adobe AIR
"{FE33F0E4-33DD-E7E9-78CB-507306FD0463}" = Catalyst Control Center InstallProxy
"{FFAC39DA-CF79-434B-A6E0-4055689667D9}" = Roxio CinePlayer Decoder Pack
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"Age of Pirates 2: City of Abandoned Ships_is1" = Age of Pirates 2: City of Abandoned Ships ver.1.3.0
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"DAEMON Tools Pro" = DAEMON Tools Pro
"Divine Divinity" = Divine Divinity
"Divinity II - Ego Draconis_is1" = Divinity II - Ego Draconis
"InstallShield_{2F8BA3FD-1FA9-4279-B696-712ABB12F09F}" = SmartSound Quicktracks 5
"InstallShield_{362D5167-9716-44BE-89FD-BF9EB6EF814B}" = DawnOfWar
"InstallShield_{B8A2869E-30CA-40C5-9CF8-BD7354E57EF8}" = SmartSound Common Data
"InstallShield_{CADDE354-C78C-46CB-A006-E2B178EFC271}" = Rise Of Legends
"KLiteCodecPack_is1" = K-Lite Mega Codec Pack 6.6.0
"lastchaos.ClientDownload" = Lastchaos_Downloader
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.62.0.1300
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile ESN Language Pack" = Paquete de idioma de Microsoft .NET Framework 4 Client Profile ESN
"Microsoft Security Client" = Microsoft Security Essentials
"Mozilla Firefox 13.0.1 (x86 es-MX)" = Mozilla Firefox 13.0.1 (x86 es-MX)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NVIDIA Drivers" = NVIDIA Drivers
"Office14.PROPLUS" = Microsoft Office Professional Plus 2010
"PokerStars" = PokerStars
"PokerStars.net" = PokerStars.net
"ReNamer_is1" = ReNamer
"RiseOfNations 1.0" = Microsoft Rise Of Nations
"RiseofNationsExpansion 1.0" = Rise of Nations Thrones and Patriots
"Tibia_is1" = Tibia
"WinLiveSuite" = Windows Live Essentials
"WinRAR archiver" = Compresor WinRAR
"WMV9_VCM" = Microsoft Windows Media Video 9 VCM
"Zoo Tycoon 2" = Zoo Tycoon 2

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-3895268456-3379712286-4068720532-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{4237FF56-4BD0-481E-BD44-C1A8DDA9C753}MarcoACC_is1" = WinDS PRO 2010.11 (MarcoACC)
"Move Media Player" = Move Media Player

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 15/07/2012 03:11:43 a.m. | Computer Name = MarcoACC-PC | Source = SideBySide | ID = 16842785
Description = Error al generar el contexto de activación para "C:\Windows\System32\systemcpl.dll".
No
se encontró el ensamblado dependiente Microsoft.Windows.Common-Controls,language="*",processorArchitecture="*",publicKeyToken="436865772d574741",type="win32",version="6.0.0.0".
Use
sxstrace.exe para obtener un diagnóstico detallado.

Error - 15/07/2012 06:57:34 p.m. | Computer Name = MarcoACC-PC | Source = WinMgmt | ID = 10
Description =

Error - 15/07/2012 07:03:23 p.m. | Computer Name = MarcoACC-PC | Source = WinMgmt | ID = 10
Description =

Error - 15/07/2012 07:21:01 p.m. | Computer Name = MarcoACC-PC | Source = WinMgmt | ID = 10
Description =

Error - 15/07/2012 07:51:21 p.m. | Computer Name = MarcoACC-PC | Source = SideBySide | ID = 16842785
Description = Error al generar el contexto de activación para "C:\Windows\System32\systemcpl.dll".
No
se encontró el ensamblado dependiente Microsoft.Windows.Common-Controls,language="*",processorArchitecture="*",publicKeyToken="436865772d574741",type="win32",version="6.0.0.0".
Use
sxstrace.exe para obtener un diagnóstico detallado.

Error - 15/07/2012 11:52:36 p.m. | Computer Name = MarcoACC-PC | Source = WinMgmt | ID = 10
Description =

Error - 15/07/2012 11:53:46 p.m. | Computer Name = MarcoACC-PC | Source = SideBySide | ID = 16842785
Description = Error al generar el contexto de activación para "C:\Windows\System32\systemcpl.dll".
No
se encontró el ensamblado dependiente Microsoft.Windows.Common-Controls,language="*",processorArchitecture="*",publicKeyToken="436865772d574741",type="win32",version="6.0.0.0".
Use
sxstrace.exe para obtener un diagnóstico detallado.

Error - 16/07/2012 12:20:15 a.m. | Computer Name = MarcoACC-PC | Source = WinMgmt | ID = 10
Description =

Error - 16/07/2012 07:32:51 p.m. | Computer Name = MarcoACC-PC | Source = WinMgmt | ID = 10
Description =

Error - 17/07/2012 02:22:25 p.m. | Computer Name = MarcoACC-PC | Source = WinMgmt | ID = 10
Description =

[ Media Center Events ]
Error - 13/12/2011 06:37:50 p.m. | Computer Name = MarcoACC-PC | Source = MCUpdate | ID = 0
Description = 04:37:49 p.m. - Error al conectarse a Internet. 04:37:49 p.m. -
No se puede establecer contacto con el servidor..

Error - 21/03/2012 09:52:29 p.m. | Computer Name = MarcoACC-PC | Source = MCUpdate | ID = 0
Description = 07:52:29 p.m. - Error al conectarse a Internet. 07:52:29 p.m. -
No se puede establecer contacto con el servidor..

Error - 21/03/2012 09:52:39 p.m. | Computer Name = MarcoACC-PC | Source = MCUpdate | ID = 0
Description = 07:52:35 p.m. - Error al conectarse a Internet. 07:52:35 p.m. -
No se puede establecer contacto con el servidor..

Error - 21/03/2012 10:52:44 p.m. | Computer Name = MarcoACC-PC | Source = MCUpdate | ID = 0
Description = 08:52:44 p.m. - Error al conectarse a Internet. 08:52:44 p.m. -
No se puede establecer contacto con el servidor..

Error - 21/03/2012 10:52:50 p.m. | Computer Name = MarcoACC-PC | Source = MCUpdate | ID = 0
Description = 08:52:49 p.m. - Error al conectarse a Internet. 08:52:49 p.m. -
No se puede establecer contacto con el servidor..

Error - 21/03/2012 11:52:54 p.m. | Computer Name = MarcoACC-PC | Source = MCUpdate | ID = 0
Description = 09:52:54 p.m. - Error al conectarse a Internet. 09:52:54 p.m. -
No se puede establecer contacto con el servidor..

Error - 21/03/2012 11:53:00 p.m. | Computer Name = MarcoACC-PC | Source = MCUpdate | ID = 0
Description = 09:52:59 p.m. - Error al conectarse a Internet. 09:52:59 p.m. -
No se puede establecer contacto con el servidor..

Error - 22/03/2012 12:53:04 a.m. | Computer Name = MarcoACC-PC | Source = MCUpdate | ID = 0
Description = 10:53:04 p.m. - Error al conectarse a Internet. 10:53:04 p.m. -
No se puede establecer contacto con el servidor..

Error - 22/03/2012 12:53:10 a.m. | Computer Name = MarcoACC-PC | Source = MCUpdate | ID = 0
Description = 10:53:09 p.m. - Error al conectarse a Internet. 10:53:09 p.m. -
No se puede establecer contacto con el servidor..

Error - 26/04/2012 06:50:45 p.m. | Computer Name = MarcoACC-PC | Source = MCUpdate | ID = 0
Description = 05:50:37 p.m. - No se pudo recuperar ClientUpdate (Error: Se ha terminado
la conexión: No se puede establecer una relación de confianza para el canal seguro
SSL/TLS.)

[ System Events ]
Error - 15/07/2012 07:11:39 p.m. | Computer Name = MarcoACC-PC | Source = Service Control Manager | ID = 7030
Description = El servicio PEVSystemStart ha sido marcado como servicio interactivo.
Sin embargo, el sistema está configurado para no permitir servicios interactivos.
Este servicio puede tener un funcionamiento incorrecto.

Error - 15/07/2012 07:12:45 p.m. | Computer Name = MarcoACC-PC | Source = Service Control Manager | ID = 7031
Description = El servicio KMService terminó inesperadamente. Esto se ha repetido
1 veces. Se realizará la siguiente acción correctora en 60000 milisegundos: Reiniciar
el servicio.

Error - 15/07/2012 07:14:56 p.m. | Computer Name = MarcoACC-PC | Source = Service Control Manager | ID = 7030
Description = El servicio PEVSystemStart ha sido marcado como servicio interactivo.
Sin embargo, el sistema está configurado para no permitir servicios interactivos.
Este servicio puede tener un funcionamiento incorrecto.

Error - 15/07/2012 07:15:32 p.m. | Computer Name = MarcoACC-PC | Source = Service Control Manager | ID = 7031
Description = El servicio KMService terminó inesperadamente. Esto se ha repetido
1 veces. Se realizará la siguiente acción correctora en 60000 milisegundos: Reiniciar
el servicio.

Error - 15/07/2012 07:19:17 p.m. | Computer Name = MarcoACC-PC | Source = EventLog | ID = 6008
Description = El cierre anterior del sistema a las 06:18:27 p.m. del ?15/?07/?2012
resultó inesperado.

Error - 15/07/2012 07:19:49 p.m. | Computer Name = MarcoACC-PC | Source = Service Control Manager | ID = 7009
Description = Se agotó el tiempo de espera (30000 ms) para la conexión con el servicio
Roxio Hard Drive Watcher 12.

Error - 15/07/2012 11:51:38 p.m. | Computer Name = MarcoACC-PC | Source = Service Control Manager | ID = 7009
Description = Se agotó el tiempo de espera (30000 ms) para la conexión con el servicio
Roxio Hard Drive Watcher 12.

Error - 16/07/2012 12:19:01 a.m. | Computer Name = MarcoACC-PC | Source = Service Control Manager | ID = 7009
Description = Se agotó el tiempo de espera (30000 ms) para la conexión con el servicio
Roxio Hard Drive Watcher 12.

Error - 16/07/2012 07:31:39 p.m. | Computer Name = MarcoACC-PC | Source = Service Control Manager | ID = 7009
Description = Se agotó el tiempo de espera (30000 ms) para la conexión con el servicio
Roxio Hard Drive Watcher 12.

Error - 17/07/2012 02:21:16 p.m. | Computer Name = MarcoACC-PC | Source = Service Control Manager | ID = 7009
Description = Se agotó el tiempo de espera (30000 ms) para la conexión con el servicio
Roxio Hard Drive Watcher 12.

< End of report >

Marco · Jul 17, 2012

What did the log mean with the error's of the end, and of the middle?

Welll, I surely don't know enough about machines =(

Broni · Jul 17, 2012

Don't worry about those.
Every computer has some errors listed.

Any current issues?

==================================

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following

Code:

:OTL
DRV - File not found [Kernel | On_Demand | Unknown] -- -- (awuf5jx6)
DRV - File not found [Kernel | On_Demand | Unknown] -- -- (avvgrkg3)
[2012/07/14 19:35:45 | 000,000,000 | ---D | C] -- C:\FRST

:Commands
[purity]
[emptytemp]
[emptyjava]
[emptyflash]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot the PC when it is done
You will get a log that shows the results of the fix. Please post it.

===========================================

Last scans....

1. Download Security Check from HERE, and save it to your Desktop.

Double-click SecurityCheck.exe
Follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.

2. Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.

Make sure the following options are checked:
- Internet Services
- Windows Firewall
- System Restore
- Security Center
- Windows Update
- Windows Defender
Press "Scan".
It will create a log (FSS.txt) in the same directory the tool is run.
Please copy and paste the log to your reply.

3. Download Temp File Cleaner (TFC)
Alternate download: http://www.itxassociates.com/OT-Tools/TFC.exe

Double click on TFC.exe to run the program.
Click on Start button to begin cleaning process.
TFC will close all running programs, and it may ask you to restart computer.

4. Please run a free online scan with the ESET Online Scanner

Disable your antivirus program
Tick the box next to YES, I accept the Terms of Use
Click Start
Accept any security warnings from your browser.
Check Scan archives
Click Start
ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
When the scan completes, click on List of found threats
Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
NOTE. If Eset won't find any threats, it won't produce any log.

Marco · Jul 18, 2012

All processes killed
========== OTL ==========
Error: No service named awuf5jx6 was found to stop!
Service\Driver key awuf5jx6 not found.
Error: No service named avvgrkg3 was found to stop!
Service\Driver key avvgrkg3 not found.
C:\FRST\Quarantine\{cb2a9c82-7a0d-4a85-73c4-2da29169d354}\{cb2a9c82-7a0d-4a85-73c4-2da29169d354}\U folder moved successfully.
C:\FRST\Quarantine\{cb2a9c82-7a0d-4a85-73c4-2da29169d354}\{cb2a9c82-7a0d-4a85-73c4-2da29169d354}\L folder moved successfully.
C:\FRST\Quarantine\{cb2a9c82-7a0d-4a85-73c4-2da29169d354}\{cb2a9c82-7a0d-4a85-73c4-2da29169d354} folder moved successfully.
C:\FRST\Quarantine\{cb2a9c82-7a0d-4a85-73c4-2da29169d354}\U folder moved successfully.
C:\FRST\Quarantine\{cb2a9c82-7a0d-4a85-73c4-2da29169d354}\L folder moved successfully.
C:\FRST\Quarantine\{cb2a9c82-7a0d-4a85-73c4-2da29169d354} folder moved successfully.
C:\FRST\Quarantine folder moved successfully.
C:\FRST\Logs folder moved successfully.
C:\FRST\Hives folder moved successfully.
C:\FRST folder moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 56475 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: MarcoACC
->Temp folder emptied: 773380 bytes
->Temporary Internet Files folder emptied: 699159009 bytes
->Java cache emptied: 97473 bytes
->FireFox cache emptied: 64330561 bytes
->Flash cache emptied: 24054316 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 13031 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 54192 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 752.00 mb

[EMPTYJAVA]

User: All Users

User: Default

User: Default User

User: MarcoACC
->Java cache emptied: 0 bytes

User: Public

Total Java Files Cleaned = 0.00 mb

[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: MarcoACC
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.54.0 log created on 07172012_235937
Files\Folders moved on Reboot...
PendingFileRenameOperations files...
Registry entries deleted on Reboot...

Marco · Jul 18, 2012

Results of screen317's Security Check version 0.99.24
Windows 7 Service Pack 1 x86 (UAC is disabled!)
Internet Explorer 9
``````````````````````````````
Antivirus/Firewall Check:
Microsoft Security Essentials
[size=1]WMI entry may not exist for antivirus; attempting automatic update.[/size]
```````````````````````````````
Anti-malware/Other Utilities Check:
Adobe Flash Player 11.3.300.257
Adobe Reader X (10.1.3)
Mozilla Firefox (x86 es-MX..)
````````````````````````````````
Process Check:
objlist.exe by Laurent
Windows Defender MSMpEng.exe
Malwarebytes' Anti-Malware mbamservice.exe
Malwarebytes' Anti-Malware mbamgui.exe
Microsoft Security Essentials msseces.exe
``````````End of Log````````````

Marco · Jul 18, 2012

Farbar Service Scanner Version: 08-07-2012
Ran by MarcoACC (administrator) on 18-07-2012 at 01:07:21
Running from "C:\Users\MarcoACC\Desktop"
Microsoft Windows 7 Ultimate Service Pack 1 (X86)
Boot Mode: Normal
****************************************************************
Internet Services:
============
Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo IP is accessible.
Yahoo.com is accessible.

Windows Firewall:
=============
Firewall Disabled Policy:
==================

System Restore:
============
System Restore Disabled Policy:
========================

Action Center:
============
Windows Update:
============
Windows Autoupdate Disabled Policy:
============================

Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is set to Demand. The default start type is Auto.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.

Windows Defender Disabled Policy:
==========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware"=DWORD:1

File Check:
========
C:\Windows\system32\nsisvc.dll => MD5 is legit
C:\Windows\system32\Drivers\nsiproxy.sys => MD5 is legit
C:\Windows\system32\dhcpcore.dll => MD5 is legit
C:\Windows\system32\Drivers\afd.sys => MD5 is legit
C:\Windows\system32\Drivers\tdx.sys => MD5 is legit
C:\Windows\system32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\system32\dnsrslvr.dll => MD5 is legit
C:\Windows\system32\mpssvc.dll => MD5 is legit
C:\Windows\system32\bfe.dll => MD5 is legit
C:\Windows\system32\Drivers\mpsdrv.sys => MD5 is legit
C:\Windows\system32\SDRSVC.dll => MD5 is legit
C:\Windows\system32\vssvc.exe => MD5 is legit
C:\Windows\system32\wscsvc.dll => MD5 is legit
C:\Windows\system32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\system32\wuaueng.dll => MD5 is legit
C:\Windows\system32\qmgr.dll => MD5 is legit
C:\Windows\system32\es.dll => MD5 is legit
C:\Windows\system32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit

**** End of log ****

Marco · Jul 18, 2012

Getting user folders.

Stopping running processes.

Emptying Temp folders.

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: MarcoACC
->Temp folder emptied: 770 bytes
->Temporary Internet Files folder emptied: 3793792 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 492 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 2898 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50189074 bytes

Emptying RecycleBin. Do not interrupt.

RecycleBin emptied: 0 bytes
Process complete!

Total Files Cleaned = 51.00 mb

Marco · Jul 18, 2012

ESET Scan

C:\Mis documentos LICENCIATURAS\DIPLOMAS\SoftonicDownloader39076.exe a variant of Win32/SoftonicDownloader.A application cleaned by deleting - quarantined

C:\Qoobox\Quarantine\C\Users\MarcoACC\AppData\Roaming\1C94.exe.vir Win32/StartPage.NYK trojan cleaned by deleting - quarantined

C:\Qoobox\Quarantine\C\Users\MarcoACC\AppData\Roaming\3275.tmp.vir Win32/Dorkbot.B worm cleaned by deleting - quarantined

C:\Windows\Setup\Scripts\temp\KMService.exe a variant of Win32/HackKMS.A application cleaned by deleting - quarantined

C:\_OTL\MovedFiles\07172012_235937\C_FRST\Quarantine\0i763f66bz.exe Win32/Wigon.OW trojan cleaned by deleting - quarantined

C:\_OTL\MovedFiles\07172012_235937C_FRST\Quarantine\adad81a680e579f.sys Win32/SpamTool.Tedroo.AU trojan cleaned by deleting - quarantined

C:\_OTL\MovedFiles\07172012_235937\C_FRST\Quarantine\{cb2a9c82-7a0d-4a85-73c4-2da29169d354}\n Win32/Sirefef.EV trojan cleaned by deleting - quarantined

C:\_OTL\MovedFiles\07172012_235937\C_FRST\Quarantine\{cb2a9c82-7a0d-4a85-73c4-2da29169d354}\U\80000000.@ a variant of Win32/Sirefef.FA trojan cleaned by deleting - quarantined

C:\_OTL\MovedFiles\07172012_235937\C_FRST\Quarantine\{cb2a9c82-7a0d-4a85-73c4-2da29169d354}\U\800000cb.@ probably a variant of Win32/Agent.TEO trojan cleaned by deleting - quarantined

C:\_OTL\MovedFiles\07172012_235937\C_FRST\Quarantine\{cb2a9c82-7a0d-4a85-73c4-2da29169d354}\{cb2a9c82-7a0d-4a85-73c4-2da29169d354}\n Win32/Sirefef.EV trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\07172012_235937\C_FRST\Quarantine\{cb2a9c82-7a0d-4a85-73c4-2da29169d354}\{cb2a9c82-7a0d-4a85-73c4-2da29169d354}\U\80000000.@ a variant of Win32/Sirefef.FA trojan cleaned by deleting - quarantined

C:\_OTL\MovedFiles\07172012_235937\C_FRST\Quarantine\{cb2a9c82-7a0d-4a85-73c4-2da29169d354}\{cb2a9c82-7a0d-4a85-73c4-2da29169d354}\U\800000cb.@ probably a variant of Win32/Agent.TEO trojan cleaned by deleting - quarantined

Broni · Jul 18, 2012

Your computer is clean

1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following:

Code:

:OTL
:Commands
[purity]
[emptytemp]
[EMPTYFLASH]
[emptyjava]
[CLEARALLRESTOREPOINTS]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot the PC when it is done
Post resulting log.

2. Now, we'll remove all tools, we used during our cleaning process

Clean up with OTL:

Double-click OTL.exe to start the program.
Close all other programs apart from OTL as this step will require a reboot
On the OTL main screen, press the CLEANUP button
Say Yes to the prompt and then allow the program to reboot your computer.

If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

3. Make sure, Windows Updates are current.

4. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

7. Run Temporary File Cleaner (TFC) weekly.

8. Download and install Secunia Personal Software Inspector (PSI): https://www.techspot.com/downloads/4898-secunia-personal-software-inspector-psi.html. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

10. (Windows XP only) Run defrag at your convenience.

11. When installing\updating ANY program, make sure you always select "Custom " installation, so you can UN-check any possible "drive-by-install" (foistware), like toolbars etc., which may try to install along with the legitimate program. Do NOT click "Next" button without looking at any given page.

12. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

13. Please, let me know, how your computer is doing.

Marco · Jul 19, 2012

All processes killed
========== OTL ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: MarcoACC
->Temp folder emptied: 1495 bytes
->Temporary Internet Files folder emptied: 19600641 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 492 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 14474 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 19.00 mb

[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: MarcoACC
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb

[EMPTYJAVA]

User: All Users

User: Default

User: Default User

User: MarcoACC
->Java cache emptied: 0 bytes

User: Public

Total Java Files Cleaned = 0.00 mb

Restore point Set: OTL Restore Point

OTL by OldTimer - Version 3.2.54.0 log created on 07192012_133407
Files\Folders moved on Reboot...
PendingFileRenameOperations files...
Registry entries deleted on Reboot...

Marco · Jul 19, 2012

Thank you very much for all your help the pc is working great, as before

I'm installing secunia and WOT now

I'll say in FB that this is a great site and that you guy's are awesome.

Please forgive my weak english I'm trying to improve it

Broni · Jul 19, 2012

Way to go!!
Good luck and stay safe

Solved Trojan 0i763f66bz.exe "liquid fabrication"

Posts: 17 +0

Posts: 17 +0

Posts: 56,041 +516

Attachments

Posts: 17 +0

Posts: 17 +0

Posts: 56,041 +516

Posts: 17 +0

Posts: 56,041 +516

Posts: 17 +0

Posts: 56,041 +516

Posts: 17 +0

Posts: 17 +0

Posts: 17 +0

Posts: 17 +0

Posts: 56,041 +516

Posts: 17 +0

Posts: 17 +0

Posts: 17 +0

Posts: 17 +0

Posts: 17 +0

Posts: 56,041 +516

Posts: 17 +0

Posts: 17 +0

Posts: 56,041 +516

Similar threads