Anda di halaman 1dari 5

ComboFix 13-03-11.01 - lcisternas 11-03-2013 13:34:57.2.

4 - x86
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.56.3082.18.2021.696 [GMT -3:00]
Running from: c:\users\lcisternas\Documents\ComboFix.exe
AV: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA
47CD1}
SP: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A05672
3366C}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2013-02-11 to 2013-03-11 )))))))
))))))))))))))))))))))))
.
.
2013-03-11 16:42 . 2013-03-11 16:42
-------d-----wc:\users
\LogMeInRemoteUser\AppData\Local\temp
2013-03-11 16:42 . 2013-03-11 16:42
-------d-----wc:\users
\jadm\AppData\Local\temp
2013-03-11 16:42 . 2013-03-11 16:42
-------d-----wc:\users
\DefaultAppPool\AppData\Local\temp
2013-03-11 16:42 . 2013-03-11 16:42
-------d-----wc:\users
\Default\AppData\Local\temp
2013-03-11 16:42 . 2013-03-11 16:42
-------d-----wc:\users
\comunicaciones\AppData\Local\temp
2013-03-11 16:42 . 2013-03-11 16:42
-------d-----wc:\users
\asoto\AppData\Local\temp
2013-02-18 11:53 . 2013-02-18 11:53
-------d-----wC:\hyper
terminal
2013-02-14 17:58 . 2013-02-14 17:58
-------d-----wc:\users
\lcisternas\AppData\Local\Microsoft Help
2013-02-12 20:07 . 2013-02-12 20:07
-------d-----wc:\progr
am files\Wireshark
2013-02-11 12:24 . 2013-02-11 12:24
-------d-----wc:\users
\lcisternas\AppData\Roaming\Xilisoft
2013-02-11 12:23 . 2013-02-11 12:23
-------d-----wc:\progr
am files\Xilisoft
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))
)))))))))))))))))))))))))))))))
.
2013-02-28 16:02 . 2012-04-02 17:25
691568 ----a-wc:\windows\syste
m32\FlashPlayerApp.exe
2013-02-28 16:02 . 2012-02-07 20:42
71024 ----a-wc:\windows\syste
m32\FlashPlayerCPLApp.cpl
2013-03-11 12:05 . 2013-02-27 01:49
263064 ----a-wc:\program files
\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))
)))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellicon
overlayidentifiers\GDriveBlacklistedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"

[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]
2012-12-17 22:50
556648 ----a-wc:\program files\Google\Drive\go
ogledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellicon
overlayidentifiers\GDriveSharedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]
2012-12-17 22:50
556648 ----a-wc:\program files\Google\Drive\go
ogledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellicon
overlayidentifiers\GDriveSyncedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]
2012-12-17 22:50
556648 ----a-wc:\program files\Google\Drive\go
ogledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellicon
overlayidentifiers\GDriveSyncingOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]
2012-12-17 22:50
556648 ----a-wc:\program files\Google\Drive\go
ogledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2011-01-12 2219184
]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-23 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-23 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-23 150552]
"TrueImageMonitor.exe"="c:\program files\Acronis\TrueImageHome\TrueImageMonitor.
exe" [2010-03-27 5107232]
"Acronis Scheduler2 Service"="c:\program files\Common Files\Acronis\Schedule2\sc
hedhlp.exe" [2010-03-27 362232]
"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2012-05-31 336992]
"vmware-tray"="c:\program files\VMware\VMware Workstation\vmware-tray.exe" [2012
-01-18 103536]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2011-12-09 74752]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe AR
M]
2012-12-03 07:35
946352 ----a-wc:\program files\Common Files\Ad
obe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemo
n]
2012-02-21 01:28
59240 ----a-wc:\program files\Common Files\Ap
ple\Apple Application Support\APSDaemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BlackBer
ryAutoUpdate]

2009-11-20 02:29
623960 ----a-wc:\program files\Common Files\Re
search In Motion\Auto Update\RIMAutoUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google U
pdate]
2012-07-10 13:22
116648 ----atwc:\users\lcisternas\AppData\Loca
l\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\itype]
2011-08-10 19:39
1313640 ----a-wc:\program files\Microsoft Intel
liType Pro\itype.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesAirM
essage]
2012-11-01 16:16
577536 ----a-wc:\program files\Samsung\Kies\Ki
esAirMessage.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesPrel
oad]
2012-12-03 14:35
967608 ----a-wc:\program files\Samsung\Kies\Ki
es.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesTray
Agent]
2012-12-03 14:35
309688 ----a-wc:\program files\Samsung\Kies\Ki
esTrayAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAX
PnP]
2009-05-18 17:28
1314816 ----a-wc:\program files\Analog Devices\
Core\smax4pnp.exe
.
R2 VMwareHostd;VMware Workstation Server;c:\program files\VMware\VMware Workstat
ion\vmware-hostd.exe [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [x]
R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\neta
apl.sys [x]
R3 pneteth;PdaNet Broadband;c:\windows\system32\DRIVERS\pneteth.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\dri
vers\rdpvideominiport.sys [x]
R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32
\DRIVERS\ssadbus.sys [x]
R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadm
dfl.sys [x]
R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm
.sys [x]
R3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);c:\windows\system32
\DRIVERS\ssadserd.sys [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\te
rminpt.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD
.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\
VBoxNetAdp.sys [x]
R3 VBoxNetFlt;VirtualBox Bridged Networking Service;c:\windows\system32\DRIVERS\
VBoxNetFlt.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]

S0 tdrpman258;Acronis Try&Decide and Restore Points filter (build 258);c:\window


s\system32\DRIVERS\tdrpm258.sys [x]
S0 vmci;VMware VMCI Bus Driver;c:\windows\system32\DRIVERS\vmci.sys [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [x]
S2 afcdpsrv;Acronis Nonstop Backup service;c:\program files\Common Files\Acronis
\CDP\afcdpsrv.exe [x]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [x]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [x]
S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [x]
S2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [x]
S2 OCS Inventory Service;OCS Inventory Service;c:\program files\OCS Inventory Ag
ent\OcsService.exe [x]
S2 SSPORT;SSPORT;c:\windows\system32\Drivers\SSPORT.sys [x]
S2 VMUSBArbService;VMware USB Arbitration Service;c:\program files\Common Files\
VMware\USB\vmware-usbarbitrator.exe [x]
S2 vstor2-mntapi10-shared;Vstor2 MntApi 1.0 Driver (shared);c:\windows\system32\
drivers\vstor2-mntapi10-shared.sys [x]
S3 afcdp;afcdp;c:\windows\system32\DRIVERS\afcdp.sys [x]
S3 EuMusDesignVirtualAudioCableWdm_lcs;Breakaway Pipeline (WDM);c:\windows\syste
m32\DRIVERS\vaclcskd.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ
Pml Driver HPZ12 Net Driver HPZ12
.
Contents of the 'Scheduled Tasks' folder
.
2013-03-11 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-02 16
:02]
.
2013-03-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-09-12 20:55]
.
2013-03-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-09-12 20:55]
.
2013-03-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1123561945-1417001333-8
39522115-3134Core.job
- c:\users\lcisternas\AppData\Local\Google\Update\GoogleUpdate.exe [2012-07-10 1
3:22]
.
2013-03-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1123561945-1417001333-8
39522115-3134UA.job
- c:\users\lcisternas\AppData\Local\Google\Update\GoogleUpdate.exe [2012-07-10 1
3:22]
.
.
------- Supplementary Scan ------.
uInternet Settings,ProxyServer = proxy.azurian.cl:3128
uInternet Settings,ProxyOverride = *.azurian.cl;192.168.0.*;192.168.4.*;192.168.
6.*;localhost;192.168.3.92;<local>
LSP: %SystemRoot%\system32\vsocklib.dll
Trusted Zone: netacad.net\auth
Trusted Zone: samsungsetup.com\www
TCP: DhcpNameServer = 192.168.0.11 192.168.0.13
FF - ProfilePath - c:\users\lcisternas\AppData\Roaming\Mozilla\Firefox\Profiles\
1yxyp0dd.default\
FF - prefs.js: browser.search.selectedEngine - AVG Secure Search

FF - prefs.js: network.proxy.ftp - proxy.azurian.cl


FF - prefs.js: network.proxy.ftp_port - 3128
FF - prefs.js: network.proxy.http - proxy.azurian.cl
FF - prefs.js: network.proxy.http_port - 3128
FF - prefs.js: network.proxy.socks - proxy.azurian.cl
FF - prefs.js: network.proxy.socks_port - 3128
FF - prefs.js: network.proxy.ssl - proxy.azurian.cl
FF - prefs.js: network.proxy.ssl_port - 3128
FF - prefs.js: network.proxy.type - 1
.
.
--------------------- LOCKED REGISTRY KEYS --------------------.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC108002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC108002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2013-03-11 13:44:21
ComboFix-quarantined-files.txt 2013-03-11 16:44
ComboFix2.txt 2013-02-18 16:28
.
Pre-Run: 189.097.078.784 bytes libres
Post-Run: 189.056.499.712 bytes libres
.
- - End Of File - - EA6377C06D39B03419785C2907772B06