Hi liebe Helfende,

ich sitze am Rechner meiner Mitbewohnerin und versuche, ihren PC von einem Trojaner zu kurieren- sofern dies moeglich ist. Windows 95 Professional Service Pack 3. Auf dem System laeuft ESET Smart Security 5.0.93.0 und die Windows Firewall scheint an zu sein. Als die Symptome das erste Mal auftraten, hatte sie mehrere Fenster geoeffnet im Firefox, aber keine auffaelligen Seiten. Bermerkbar macht sich der Trojaner durch blauen Desktop (vor Defogger war er schwarz), keine Icons (weder in Explorer, noch in Startmenue) und sowas wie STRG-ALT-ENTF geht nicht.

Hier sind die Tests:

OTL logfile created on: 21/11/2011 23:09:36 - Run 1
OTL by OldTimer - Version 3.2.31.0     Folder = C:\Documents and Settings\XXXXX\Escritorio
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000C0A | Country: España | Language: ESN | Date Format: dd/MM/yyyy
 
3,47 Gb Total Physical Memory | 2,98 Gb Available Physical Memory | 86,07% Memory free
5,30 Gb Paging File | 4,89 Gb Available in Paging File | 92,17% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Archivos de programa
Drive C: | 232,85 Gb Total Space | 204,00 Gb Free Space | 87,61% Space Free | Partition Type: NTFS
 
Computer Name: SARA | User Name: XXXXX | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2011/11/21 23:08:12 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\XXXXX\Escritorio\OTL.exe
PRC - [2011/08/09 21:39:22 | 000,974,944 | ---- | M] (ESET) -- C:\Archivos de programa\ESET\ESET Smart Security\ekrn.exe
PRC - [2011/08/09 21:39:16 | 003,076,144 | ---- | M] (ESET) -- C:\Archivos de programa\ESET\ESET Smart Security\egui.exe
PRC - [2011/07/29 00:08:12 | 001,259,376 | -H-- | M] () -- C:\Archivos de programa\DivX\DivX Update\DivXUpdate.exe
PRC - [2011/01/05 11:59:50 | 000,037,664 | -H-- | M] (Apple Inc.) -- C:\Archivos de programa\Archivos comunes\Apple\Mobile Device Support\AppleMobileDeviceService.exe
PRC - [2009/06/24 22:21:38 | 000,409,744 | -H-- | M] (Creative Technology Ltd) -- C:\Archivos de programa\Dell Webcam\Dell Webcam Central\WebcamDell2.exe
PRC - [2009/04/28 01:51:40 | 000,049,250 | -H-- | M] (Alps Electric Co., Ltd.) -- C:\Archivos de programa\DellTPad\hidfind.exe
PRC - [2009/04/28 01:51:26 | 000,233,472 | -H-- | M] (Alps Electric Co., Ltd.) -- C:\Archivos de programa\DellTPad\Apoint.exe
PRC - [2009/04/28 01:51:26 | 000,054,568 | -H-- | M] (Alps Electric Co., Ltd.) -- C:\Archivos de programa\DellTPad\ApMsgFwd.exe
PRC - [2009/04/28 01:51:26 | 000,049,152 | -H-- | M] (Alps Electric Co., Ltd.) -- C:\Archivos de programa\DellTPad\ApntEx.exe
PRC - [2008/04/14 13:00:00 | 001,036,288 | -H-- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2011/07/29 00:09:42 | 000,096,112 | -H-- | M] () -- C:\Archivos de programa\DivX\DivX Update\DivXUpdateCheck.dll
MOD - [2011/07/29 00:08:12 | 001,259,376 | -H-- | M] () -- C:\Archivos de programa\DivX\DivX Update\DivXUpdate.exe
MOD - [2010/07/23 02:54:06 | 000,067,872 | -H-- | M] () -- C:\Archivos de programa\Archivos comunes\Apple\Apple Application Support\zlib1.dll
MOD - [2009/02/27 18:35:50 | 000,311,296 | ---- | M] () -- C:\Archivos de programa\Archivos comunes\Adobe\Acrobat\ActiveX\pdfshell.ESP
MOD - [2008/12/12 02:38:02 | 000,143,360 | -H-- | M] () -- C:\WINDOWS\system32\preflib.dll
MOD - [2008/12/12 02:37:28 | 000,753,664 | -H-- | M] () -- C:\WINDOWS\system32\bcm1xsup.dll
MOD - [2008/04/14 13:00:00 | 000,014,336 | -H-- | M] () -- C:\WINDOWS\system32\msdmo.dll
MOD - [2001/10/28 16:42:30 | 000,116,224 | -H-- | M] () -- C:\WINDOWS\system32\pdfcmnnt.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2011/08/09 21:39:22 | 000,974,944 | ---- | M] (ESET) [Auto | Running] -- C:\Archivos de programa\ESET\ESET Smart Security\ekrn.exe -- (ekrn)
SRV - [2011/01/05 11:59:50 | 000,037,664 | -H-- | M] (Apple Inc.) [Auto | Running] -- C:\Archivos de programa\Archivos comunes\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2009/01/16 19:12:22 | 000,074,392 | RH-- | M] (MicroVision Development, Inc.) [On_Demand | Stopped] -- c:\Archivos de programa\Archivos comunes\SureThing Shared\stllssvr.exe -- (stllssvr)
SRV - [2007/07/10 22:39:56 | 000,089,136 | -H-- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Archivos de programa\Archivos comunes\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2011/08/09 20:38:26 | 000,039,824 | ---- | M] (ESET) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\epfwndis.sys -- (Epfwndis)
DRV - [2011/08/09 13:57:10 | 000,154,136 | ---- | M] (ESET) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\eamon.sys -- (eamon)
DRV - [2011/08/04 09:20:38 | 000,147,480 | ---- | M] (ESET) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\epfw.sys -- (epfw)
DRV - [2011/08/04 09:20:38 | 000,061,936 | ---- | M] (ESET) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\epfwtdi.sys -- (epfwtdi)
DRV - [2011/08/04 09:20:36 | 000,118,104 | ---- | M] (ESET) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ehdrv.sys -- (ehdrv)
DRV - [2010/03/25 18:09:38 | 000,114,432 | RH-- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ewusbnet.sys -- (ewusbnet)
DRV - [2010/03/25 18:09:38 | 000,100,736 | RH-- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ewusbfake.sys -- (hwusbfake)
DRV - [2009/11/27 16:20:06 | 000,177,152 | -H-- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp)
DRV - [2009/10/28 17:20:16 | 001,752,064 | -H-- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\CHDAU32.sys -- (CnxtHdAudService)
DRV - [2009/06/15 19:05:16 | 000,143,968 | -H-- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\CtClsFlt.sys -- (CtClsFlt)
DRV - [2009/05/28 16:48:20 | 000,134,144 | -H-- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\CtAudDrv.sys -- (CtAudDrv)
DRV - [2009/05/11 05:09:46 | 000,991,016 | -H-- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btkrnl.sys -- (BTKRNL)
DRV - [2009/05/11 04:45:44 | 000,047,272 | -H-- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btwusb.sys -- (BTWUSB)
DRV - [2009/04/28 01:51:24 | 000,197,680 | -H-- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Apfiltr.sys -- (ApfiltrService)
DRV - [2009/04/26 00:46:06 | 000,133,632 | -H-- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\OA014Ufd.sys -- (OA014Ufd)
DRV - [2009/04/26 00:46:04 | 000,271,904 | -H-- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\OA014Vid.sys -- (OA014Vid)
DRV - [2009/04/26 00:46:02 | 000,148,056 | -H-- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\OA014Afx.sys -- (OA014Afx)
DRV - [2009/04/26 00:00:58 | 000,985,856 | -H-- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DPV.sys -- (HSF_DPV)
DRV - [2009/04/26 00:00:58 | 000,731,264 | -H-- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)
DRV - [2009/04/26 00:00:56 | 000,210,048 | -H-- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWAZL.sys -- (HSFHWAZL)
DRV - [2009/04/25 23:46:54 | 000,164,352 | -H-- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV - [2009/04/05 13:21:30 | 001,952,512 | -H-- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\BCMWL5.SYS -- (BCM43XX)
DRV - [2008/12/12 02:37:44 | 000,033,664 | -H-- | M] (CACE Technologies) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\BCMWLNPF.SYS -- (BCMWLNPF)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www1.euro.dell.com/content/default.aspx?c=es&l=es&s=gen
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Help_Page = hxxp://support.euro.dell.com/support/index.aspx?c=es&l=es&s=gen
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www1.euro.dell.com/content/default.aspx?c=es&l=es&s=gen
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Page_URL = hxxp://g.uk.msn.com/USSMB/15
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.bing.com/sphome.aspx
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = hxxp://g.uk.msn.com/USSMB/15
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/USSMB/15
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.bing.com/sphome.aspx
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page =  hxxp://www.bing.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/USSMB/15
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:50370
 
========== FireFox ==========
 
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}:5.3.0.7550
FF - prefs.js..extensions.enabledItems: wrc@avast.com:6.0.1289
FF - prefs.js..network.proxy.http: "127.0.0.1"
FF - prefs.js..network.proxy.http_port: 50370
FF - prefs.js..network.proxy.type: 0
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Archivos de programa\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Archivos de programa\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Archivos de programa\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Archivos de programa\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Archivos de programa\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Archivos de programa\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Components: C:\Archivos de programa\Mozilla Firefox\components [2011/11/11 09:23:52 | 000,000,000 | -H-D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Plugins: C:\Archivos de programa\Mozilla Firefox\plugins [2011/09/29 18:57:36 | 000,000,000 | -H-D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Archivos de programa\ESET\ESET Smart Security\Mozilla Thunderbird [2011/11/17 22:09:18 | 000,000,000 | ---D | M]
 
[2010/06/30 23:32:30 | 000,000,000 | -H-D | M] (No name found) -- C:\Documents and Settings\XXXXX\Datos de programa\Mozilla\Extensions
[2011/09/29 11:51:19 | 000,000,000 | -H-D | M] (No name found) -- C:\Documents and Settings\XXXXX\Datos de programa\Mozilla\Firefox\Profiles\eus662tg.default\extensions
[2010/07/07 18:28:55 | 000,000,000 | -H-D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\XXXXX\Datos de programa\Mozilla\Firefox\Profiles\eus662tg.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/09/29 18:57:38 | 000,000,000 | -H-D | M] (No name found) -- C:\Archivos de programa\Mozilla Firefox\extensions
[2011/06/12 10:13:47 | 000,000,000 | -H-D | M] (Skype extension) -- C:\Archivos de programa\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2011/11/11 09:23:49 | 000,134,104 | -H-- | M] (Mozilla Foundation) -- C:\Archivos de programa\mozilla firefox\components\browsercomps.dll
[2011/09/23 02:46:24 | 000,002,252 | -H-- | M] () -- C:\Archivos de programa\mozilla firefox\searchplugins\bing.xml
[2011/09/23 03:11:33 | 000,003,996 | -H-- | M] () -- C:\Archivos de programa\mozilla firefox\searchplugins\drae.xml
[2011/09/23 03:11:33 | 000,001,143 | -H-- | M] () -- C:\Archivos de programa\mozilla firefox\searchplugins\eBay-es.xml
[2011/09/23 03:11:33 | 000,001,178 | -H-- | M] () -- C:\Archivos de programa\mozilla firefox\searchplugins\wikipedia-es.xml
[2011/09/23 03:11:33 | 000,001,102 | -H-- | M] () -- C:\Archivos de programa\mozilla firefox\searchplugins\yahoo-es.xml
 
O1 HOSTS File: ([2008/04/14 13:00:00 | 000,000,792 | -H-- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Archivos de programa\Archivos comunes\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Windows Live Aplicación auxiliar de inicio de sesión) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Archivos de programa\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O4 - HKLM..\Run: [Adobe ARM] C:\Archivos de programa\Archivos comunes\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Apoint] C:\Archivos de programa\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [Dell Webcam Central] C:\Archivos de programa\Dell Webcam\Dell Webcam Central\WebcamDell2.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [DivXUpdate] C:\Archivos de programa\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [egui] C:\Archivos de programa\ESET\ESET Smart Security\egui.exe (ESET)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Archivos de programa\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Send To Bluetooth - C:\Archivos de programa\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Archivos de programa\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Archivos de programa\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Archivos de programa\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Archivos de programa\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Archivos de programa\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CF5BC955-E8E0-4134-8BAB-4565BCABE89F}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Archivos de programa\Archivos comunes\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Archivos de programa\Archivos comunes\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Archivos de programa\Archivos comunes\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Archivos de programa\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Mi página de inicio actual) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\XXXXX\Configuración local\Datos de programa\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\XXXXX\Configuración local\Datos de programa\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Archivos de programa\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/06/20 20:53:34 | 000,000,000 | -H-- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{7c232236-aecf-11df-82da-78e400442279}\Shell - "" = AutoRun
O33 - MountPoints2\{7c232236-aecf-11df-82da-78e400442279}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{7c232237-aecf-11df-82da-78e400442279}\Shell - "" = AutoRun
O33 - MountPoints2\{7c232237-aecf-11df-82da-78e400442279}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{efc60aec-39c6-11e0-83ca-78e400442279}\Shell - "" = AutoRun
O33 - MountPoints2\{efc60aec-39c6-11e0-83ca-78e400442279}\Shell\AutoRun\command - "" = E:\setup_vmb_lite.exe /checkApplicationPresence
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Generación de gráficos vectoriales (VML)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Reproductor de Windows Media de Microsoft 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Enlace dinámico de datos HTML para Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Paquete para exploración sin conexión
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {405C32CF-9C6F-49B3-9436-3F5FDBE7B3CE} - .NET Framework
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Autoría avanzada
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Ayuda de Internet Explorer
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - Clases Java DirectAnimation
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.7
ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Actualización de seguridad para Windows XP (KB923789)
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Herramientas de instalación de Internet Explorer
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Mejoras en la exploración
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - Acceso al sitio de MSN
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Carpetas Web
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {85AC0FFA-643D-3103-9310-7086ECB0C36C} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - %SystemRoot%\system32\ie4uinit.exe
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install
ActiveX: {8b15971b-5355-4c82-8c07-7e181ea07608} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\fxsocm.inf,Fax.Install.PerUser
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Enlace dinámico de datos HTML
ActiveX: {94de52c8-2d59-4f1b-883e-79663d2d9a8c} - Fax Provider
ActiveX: {ACC563BC-4266-43f0-B6ED-9D38C4202C7E} - 
ActiveX: {BB0DCC5E-7477-3350-B5F5-7CE64E1E83B6} - .NET Framework
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Fuentes principales de Internet Explorer
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Programador de tareas
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Shockwave Flash
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - Ayuda de HTML
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {EFCE7BE0-510E-4932-9475-F44CD90DE16A} - Microsoft .NET Framework 1.1 Security Update (KB2572067)
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
 
NetSvcs: 6to4 -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Iprip -  File not found
NetSvcs: Irmon -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: WmdmPmSp -  File not found
 
MsConfig - State: "system.ini" - 0
MsConfig - State: "win.ini" - 0
MsConfig - State: "bootini" - 2
MsConfig - State: "services" - 0
MsConfig - State: "startup" - 0
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011/11/21 23:08:02 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\XXXX\Escritorio\OTL.exe
[2011/11/21 22:21:02 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\XXXXX\Recent
[2011/11/21 22:08:35 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\XXXXX\Menú Inicio\Programas\System Fix
[2011/11/21 15:36:55 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Menú Inicio\Programas\Déjà Vu X2
[2011/11/21 15:36:38 | 000,000,000 | -H-D | C] -- C:\Archivos de programa\Archivos comunes\ATRIL
[2011/11/21 15:36:37 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Datos de programa\ATRIL
[2011/11/21 15:36:37 | 000,000,000 | -H-D | C] -- C:\Archivos de programa\ATRIL
[2011/11/21 14:45:18 | 000,000,000 | -H-D | C] -- C:\Archivos de programa\Microsoft WSE
[2011/11/21 14:45:12 | 000,000,000 | -H-D | C] -- C:\Archivos de programa\Microsoft CAPICOM 2.1.0.2
[2011/11/17 23:00:36 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\XXXXX\Escritorio\Carnaval
[2011/11/17 22:22:24 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\XXXXX\Mis documentos\antivirus justo
[2011/11/17 22:18:11 | 000,000,000 | -H-D | C] -- C:\WINDOWS\pss
[2011/11/17 22:11:35 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\XXXXX\Datos de programa\ESET
[2011/11/17 22:11:35 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Sara Blackshire\Configuración local\Datos de programa\ESET
[2011/11/17 22:10:00 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\LocalService\Configuración local\Datos de programa\ESET
[2011/11/17 22:09:17 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Menú Inicio\Programas\ESET
[2011/11/17 22:09:16 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Datos de programa\ESET
[2011/11/17 22:09:16 | 000,000,000 | -H-D | C] -- C:\Archivos de programa\ESET
[2011/11/14 20:12:41 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\XXXXX\Configuración local\Datos de programa\WMTools Downloaded Files
[2011/11/04 23:30:05 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\XXXXX\Mis documentos\Institut Français N3
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011/11/21 23:08:12 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\XXXXX\Escritorio\OTL.exe
[2011/11/21 23:06:01 | 000,000,236 | -H-- | M] () -- C:\WINDOWS\tasks\OGALogon.job
[2011/11/21 23:06:00 | 000,001,158 | -H-- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/11/21 23:05:33 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/11/21 23:05:30 | 3720,650,752 | -HS- | M] () -- C:\hiberfil.sys
[2011/11/21 23:03:58 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\XXXXX\defogger_reenable
[2011/11/21 23:01:55 | 000,050,477 | ---- | M] () -- C:\Documents and Settings\XXXXX\Escritorio\Defogger.exe
[2011/11/21 22:10:19 | 000,000,456 | -H-- | M] () -- C:\Documents and Settings\All Users\Datos de programa\rNTc4GTgRKJ29h
[2011/11/21 22:08:38 | 000,000,296 | -H-- | M] () -- C:\Documents and Settings\All Users\Datos de programa\~rNTc4GTgRKJ29h
[2011/11/21 22:08:38 | 000,000,216 | -H-- | M] () -- C:\Documents and Settings\All Users\Datos de programa\~rNTc4GTgRKJ29hr
[2011/11/21 22:08:37 | 000,000,838 | -H-- | M] () -- C:\Documents and Settings\XXXXX\Escritorio\System Fix.lnk
[2011/11/17 22:23:42 | 000,000,211 | RHS- | M] () -- C:\boot.ini
[2011/11/17 16:56:48 | 039,000,004 | -H-- | M] () -- C:\Documents and Settings\XXXXX\Escritorio\maquines termiques.pdf
[2011/11/14 20:12:15 | 000,061,440 | -H-- | M] () -- C:\Documents and Settings\XXXXX\Configuración local\Datos de programa\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/11/14 15:16:29 | 000,228,800 | -H-- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011/11/11 09:25:51 | 000,001,393 | -H-- | M] () -- C:\WINDOWS\imsins.BAK
[2011/10/31 21:41:02 | 000,531,370 | -H-- | M] () -- C:\WINDOWS\System32\perfh00A.dat
[2011/10/31 21:41:02 | 000,443,248 | -H-- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011/10/31 21:41:02 | 000,101,654 | -H-- | M] () -- C:\WINDOWS\System32\perfc00A.dat
[2011/10/31 21:41:02 | 000,072,514 | -H-- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011/10/29 13:18:50 | 000,002,909 | -H-- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2011/10/25 22:50:57 | 000,000,664 | -H-- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011/11/21 23:03:58 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\XXXXX\defogger_reenable
[2011/11/21 23:01:57 | 000,050,477 | ---- | C] () -- C:\Documents and Settings\XXXXX\Escritorio\Defogger.exe
[2011/11/21 22:08:38 | 000,000,216 | -H-- | C] () -- C:\Documents and Settings\All Users\Datos de programa\~rNTc4GTgRKJ29hr
[2011/11/21 22:08:37 | 000,000,838 | -H-- | C] () -- C:\Documents and Settings\XXXXX\Escritorio\System Fix.lnk
[2011/11/21 22:08:37 | 000,000,296 | -H-- | C] () -- C:\Documents and Settings\All Users\Datos de programa\~rNTc4GTgRKJ29h
[2011/11/21 22:08:30 | 000,000,456 | -H-- | C] () -- C:\Documents and Settings\All Users\Datos de programa\rNTc4GTgRKJ29h
[2011/11/17 22:24:14 | 3720,650,752 | -HS- | C] () -- C:\hiberfil.sys
[2011/11/17 16:56:47 | 039,000,004 | -H-- | C] () -- C:\Documents and Settings\XXXXX\Escritorio\maquines termiques.pdf
[2011/08/01 15:46:24 | 000,000,664 | -H-- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/03/21 11:36:00 | 000,116,224 | -H-- | C] () -- C:\WINDOWS\System32\pdfcmnnt.dll
[2011/03/03 23:26:12 | 000,043,784 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2010/07/14 15:42:20 | 000,000,379 | -H-- | C] () -- C:\WINDOWS\ODBC.INI
[2010/07/06 14:48:34 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2010/07/06 14:39:35 | 000,061,440 | -H-- | C] () -- C:\Documents and Settings\XXXXX\Configuración local\Datos de programa\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/07/06 12:52:42 | 000,000,230 | -H-- | C] () -- C:\Documents and Settings\XXXXX\Datos de programa\wklnhst.dat
[2010/06/30 23:32:21 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\nsreg.dat
[2010/06/30 18:07:59 | 000,000,142 | -H-- | C] () -- C:\Documents and Settings\XXXXX\Configuración local\Datos de programa\fusioncache.dat
[2010/06/19 03:06:54 | 000,982,192 | -H-- | C] () -- C:\WINDOWS\System32\igkrng500.bin
[2010/06/19 03:06:54 | 000,417,344 | -H-- | C] () -- C:\WINDOWS\System32\igcompkrng500.bin
[2010/06/19 03:06:49 | 000,077,824 | -H-- | C] () -- C:\WINDOWS\setpwr32.exe
[2010/06/19 03:06:48 | 000,073,728 | -H-- | C] () -- C:\WINDOWS\System32\RtNicProp32.dll
[2010/06/19 01:20:23 | 000,000,061 | -H-- | C] () -- C:\WINDOWS\smscfg.ini
[2010/06/19 01:16:36 | 000,000,075 | RHS- | C] () -- C:\WINDOWS\CT4CET.bin
[2010/06/19 00:32:21 | 000,753,664 | -H-- | C] () -- C:\WINDOWS\System32\bcm1xsup.dll
[2010/06/19 00:32:21 | 000,143,360 | -H-- | C] () -- C:\WINDOWS\System32\preflib.dll
[2010/06/19 00:32:21 | 000,024,064 | -H-- | C] () -- C:\WINDOWS\System32\WLTRYSVC.EXE
[2010/05/05 00:05:44 | 000,001,440 | -H-- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2009/08/03 14:07:42 | 000,676,224 | -H-- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll
[2009/08/03 14:07:42 | 000,230,768 | -H-- | C] () -- C:\WINDOWS\System32\OGAEXEC.exe
[2008/08/15 14:46:30 | 002,854,912 | -H-- | C] () -- C:\WINDOWS\System32\btwicons.dll
[2008/06/20 20:55:49 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2008/06/20 20:51:07 | 000,021,900 | -H-- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2008/06/20 20:50:13 | 000,003,656 | -H-- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2008/06/20 15:39:19 | 000,531,370 | -H-- | C] () -- C:\WINDOWS\System32\perfh00A.dat
[2008/06/20 15:39:19 | 000,317,534 | -H-- | C] () -- C:\WINDOWS\System32\perfi00A.dat
[2008/06/20 15:39:19 | 000,101,654 | -H-- | C] () -- C:\WINDOWS\System32\perfc00A.dat
[2008/06/20 15:39:19 | 000,036,284 | -H-- | C] () -- C:\WINDOWS\System32\perfd00A.dat
[2008/06/20 15:39:08 | 000,004,569 | -H-- | C] () -- C:\WINDOWS\System32\secupd.dat
[2008/06/20 15:39:06 | 000,443,248 | -H-- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2008/06/20 15:39:06 | 000,272,128 | -H-- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2008/06/20 15:39:06 | 000,072,514 | -H-- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2008/06/20 15:39:06 | 000,028,626 | -H-- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2008/06/20 15:39:05 | 000,004,627 | -H-- | C] () -- C:\WINDOWS\System32\oembios.dat
[2008/06/20 15:39:04 | 013,107,200 | -H-- | C] () -- C:\WINDOWS\System32\oembios.bin
[2008/06/20 15:39:04 | 000,000,741 | -H-- | C] () -- C:\WINDOWS\System32\noise.dat
[2008/06/20 15:39:01 | 000,673,088 | -H-- | C] () -- C:\WINDOWS\System32\mlang.dat
[2008/06/20 15:39:01 | 000,046,258 | -H-- | C] () -- C:\WINDOWS\System32\mib.bin
[2008/06/20 15:38:56 | 000,218,003 | -H-- | C] () -- C:\WINDOWS\System32\dssec.dat
[2008/06/20 15:38:53 | 000,001,804 | -H-- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2008/06/20 07:45:49 | 000,004,205 | -H-- | C] () -- C:\WINDOWS\ODBCINST.INI
[2008/06/20 07:44:48 | 000,228,800 | -H-- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2008/05/27 04:23:18 | 000,016,892 | -H-- | C] () -- C:\WINDOWS\System32\gthrctr.ini
[2008/05/27 04:23:16 | 000,023,640 | -H-- | C] () -- C:\WINDOWS\System32\idxcntrs.ini
[2008/05/27 04:23:14 | 000,016,164 | -H-- | C] () -- C:\WINDOWS\System32\gsrvctr.ini
[2008/05/27 03:59:42 | 000,018,904 | -H-- | C] () -- C:\WINDOWS\System32\structuredqueryschematrivial.bin
[2008/05/27 03:59:40 | 000,106,605 | -H-- | C] () -- C:\WINDOWS\System32\structuredqueryschema.bin
[2007/07/10 22:39:58 | 000,005,827 | -H-- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2001/11/14 19:56:00 | 001,802,240 | -H-- | C] () -- C:\WINDOWS\System32\lcppn21.dll
 
========== LOP Check ==========
 
[2011/11/21 15:36:37 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Datos de programa\ATRIL
[2011/10/29 13:18:53 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Datos de programa\AVAST Software
[2011/11/17 22:14:59 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Datos de programa\AVG2012
[2010/08/02 19:12:55 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Datos de programa\CanonBJ
[2011/10/22 16:29:11 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Datos de programa\Common Files
[2011/07/22 10:17:11 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Datos de programa\Easybits GO
[2011/11/17 22:09:16 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Datos de programa\ESET
[2011/11/17 22:06:49 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Datos de programa\MFAData
[2010/06/19 01:11:55 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Datos de programa\Uninstall
[2011/02/16 16:39:44 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Datos de programa\Vodafone
[2011/02/16 18:27:44 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Datos de programa\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2011/10/22 16:29:24 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\XXXXX\Datos de programa\AVG2012
[2011/01/02 23:50:49 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\XXXXX\Datos de programa\BSW
[2010/08/11 21:05:37 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\XXXXX\Datos de programa\Canon
[2011/11/17 22:11:35 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\XXXXX\Datos de programa\ESET
[2011/07/22 10:17:07 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\XXXXX\Datos de programa\go
[2011/11/21 21:27:20 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\XXXXX\Datos de programa\Spotify
[2010/07/08 16:29:53 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\XXXXX\Datos de programa\Template
[2011/02/16 16:41:36 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\XXXXX\Datos de programa\Vodafone
[2010/06/19 00:27:56 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\XXXXX\Datos de programa\Windows Desktop Search
[2010/06/30 19:08:58 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\XXXXX\Datos de programa\Windows Search
[2011/11/21 23:06:01 | 000,000,236 | -H-- | M] () -- C:\WINDOWS\Tasks\OGALogon.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*. >
[2011/11/21 15:36:37 | 000,000,000 | RH-D | M] -- C:\Archivos de programa
[2010/06/19 03:06:09 | 000,000,000 | RHSD | M] -- C:\Boot
[2010/06/19 03:06:09 | 000,000,000 | -H-D | M] -- C:\BootImage
[2010/06/30 22:18:48 | 000,000,000 | -H-D | M] -- C:\dell
[2010/06/30 18:07:59 | 000,000,000 | -H-D | M] -- C:\Documents and Settings
[2010/06/19 07:10:45 | 000,000,000 | -H-D | M] -- C:\drivers
[2010/10/20 03:16:40 | 000,000,000 | -HSD | M] -- C:\found.000
[2011/08/09 14:28:43 | 000,000,000 | -HSD | M] -- C:\found.001
[2010/06/19 00:24:13 | 000,000,000 | -H-D | M] -- C:\I386
[2010/06/19 01:15:23 | 000,000,000 | -H-D | M] -- C:\Program Files
[2010/06/30 19:08:58 | 000,000,000 | -HSD | M] -- C:\RECYCLER
[2010/06/19 03:06:09 | 000,000,000 | RHSD | M] -- C:\Sources
[2010/06/30 18:07:48 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2011/11/21 23:05:53 | 000,000,000 | -H-D | M] -- C:\WINDOWS
 
< %PROGRAMFILES%\*.exe >
 
Invalid Environment Variable: LOCALAPPDATA
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.manifest /3 >
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]
 
 
< MD5 for: EXPLORER.EXE  >
[2008/04/14 13:00:00 | 001,036,288 | -H-- | M] (Microsoft Corporation) MD5=7522F548A84ABAD8FA516DE5AB3931EF -- C:\WINDOWS\explorer.exe
 
< MD5 for: REGEDIT.EXE  >
[2008/04/13 18:00:00 | 000,152,064 | -H-- | M] (Microsoft Corporation) MD5=F4B9F9AA2F72FAD20D09C3E3FF2BE224 -- C:\Archivos de programa\Dell\DBRM\osmedia\I386\REGEDIT.EXE
[2008/04/14 13:00:00 | 000,152,064 | -H-- | M] (Microsoft Corporation) MD5=F4B9F9AA2F72FAD20D09C3E3FF2BE224 -- C:\I386\REGEDIT.EXE
[2008/04/14 13:00:00 | 000,152,064 | -H-- | M] (Microsoft Corporation) MD5=F4B9F9AA2F72FAD20D09C3E3FF2BE224 -- C:\WINDOWS\regedit.exe
 
< MD5 for: USERINIT.EXE  >
[2008/04/14 13:00:00 | 000,026,624 | -H-- | M] (Microsoft Corporation) MD5=F5B8745B9A90EAF17E30C0574E049AA3 -- C:\WINDOWS\system32\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2008/04/14 13:00:00 | 000,510,976 | -H-- | M] (Microsoft Corporation) MD5=213C80D912880BBF04453D09FFCCB28C -- C:\WINDOWS\system32\winlogon.exe
 
< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Kmode: %SystemRoot%\system32\win32k.sys [2011/09/06 15:09:56 | 001,859,072 | -H-- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-11-11 08:28:06

< End of report >
         

OTL Extras logfile created on: 21/11/2011 23:09:36 - Run 1
OTL by OldTimer - Version 3.2.31.0     Folder = C:\Documents and Settings\XXXXX\Escritorio
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000C0A | Country: España | Language: ESN | Date Format: dd/MM/yyyy
 
3,47 Gb Total Physical Memory | 2,98 Gb Available Physical Memory | 86,07% Memory free
5,30 Gb Paging File | 4,89 Gb Available in Paging File | 92,17% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Archivos de programa
Drive C: | 232,85 Gb Total Space | 204,00 Gb Free Space | 87,61% Space Free | Partition Type: NTFS
 
Computer Name: XXXXX | User Name: XXXXX | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.url [@ = InternetShortcut] -- rundll32.exe shdocvw.dll,OpenURL %l
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Archivos de programa\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
InternetShortcut [open] -- rundll32.exe shdocvw.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"5985:TCP" = 5985:TCP:*:Disabled:Administración remota de Windows 
"80:TCP" = 80:TCP:*:Disabled:Administración remota de Windows - Modo de compatibilidad (HTTP de entrada) 
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Archivos de programa\Spotify\spotify.exe" = C:\Archivos de programa\Spotify\spotify.exe:*:Enabled:Spotify -- (Spotify Ltd)
"C:\Archivos de programa\Skype\Plugin Manager\skypePM.exe" = C:\Archivos de programa\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager
"C:\Archivos de programa\AVG\AVG2012\avgmfapx.exe" = C:\Archivos de programa\AVG\AVG2012\avgmfapx.exe:*:Enabled:Instalador de AVG
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{08E81ABD-79F7-49C2-881F-FD6CB0975693}" = Roxio Creator Data
"{09760D42-E223-42AD-8C3E-55B47D0DDAC3}" = Roxio Creator DE 10.3
"{1479472D-3FF7-450C-BC31-FC4F40405FFD}" = ESET Smart Security
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F54DAFA-9261-4A62-B59D-6C9F26B48FE4}" = Roxio Creator Tools
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Herramienta de carga de Windows Live
"{21DD56B6-A7C1-4EA6-BC53-28A63A4A1820}" = Windows Live Toolbar
"{226CC57A-C344-4AB0-938E-CD1E4AFB3DF2}" = Déjà Vu X2
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216018FF}" = Java(TM) 6 Update 18
"{2A981294-F14C-4F0F-9627-D793270922F8}" = Bonjour
"{2B83A043-BA8C-4164-98AA-29529D0BE756}" = Windows Live Essentials
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{350C9C0A-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{38BB21D5-B0D1-41DA-A0B0-1EFB5EF4AAC2}" = Microsoft Works
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5BF5F9C5-E95B-4AFA-94BE-F2A9CA73B61D}" = Apple Mobile Device Support
"{65D0C510-D7B6-4438-9FC8-E6B91115AB0D}" = Live! Cam Avatar Creator
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{73A4F29F-31AC-4EBD-AA1B-0CC5F18C8F83}" = Roxio Creator Audio
"{7593234B-2AEB-4FC9-B02D-C9B30D86084C}" = Windows Live Asistente para el inicio de sesión
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{84814E6B-2581-46EC-926A-823BD1C670F6}" = WIDCOMM Bluetooth Software
"{85AC0FFA-643D-3103-9310-7086ECB0C36C}" = Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - ESN
"{8924FD04-AFF1-4387-B08B-6A979485F2BD}" = Windows Live Call
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update
"{90110C0A-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90120000-0020-0C0A-0000-0000000FF1CE}" = Paquete de compatibilidad para 2007 Office system
"{90120000-00B2-0C0A-0000-0000000FF1CE}" = Complemento Guardar como PDF o XPS de Microsoft para programas de Microsoft Office 2007
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{914DD274-9C5D-44CA-9AC7-12B8D2D4DA08}" = Windows Live Sync
"{92E4A65F-7007-3357-A69A-167F71A337BD}" = Microsoft .NET Framework 3.5 Language Pack SP1 - esn
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{95120000-00AF-0C0A-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (Spanish)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9850E3EB-69A6-428C-9A23-C64E650809CB}" = Cliente de Windows Rights Management con Service Pack 2
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9C9CEB9D-53FD-49A7-85D2-FE674F72F24E}" = Microsoft Search Enhancement Pack
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = Dell Touchpad
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A7BBE3D6-F19A-40E6-96EC-84E1DC88F262}" = Galería fotográfica de Windows Live
"{AAD47011-8518-4608-9656-951DA35B587B}" = iTunes
"{AC76BA86-7AD7-1034-7B44-A94000000001}" = Adobe Reader 9.4.5 - Español
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B36189B9-A6F2-4536-B97A-BD23DAA29175}" = Dell Backup and Recovery Manager
"{B6A26DE5-F2B5-4D58-9570-4FC760E00FCD}" = Roxio Creator Copy
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Toolbars
"{B8583CB3-8ABE-407E-8BC6-F9A83EAC9133}" = Windows Live Writer
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{BDEDB104-4067-3D5E-81F0-DBEBFE856B45}" = Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - ESN
"{BEC001F9-0451-4396-92D7-E1A4E7854BF3}" = Windows Live Mail
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C4156B59-DD7E-40DF-AF08-E568A27A6409}" = Windows Live Messenger
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D6F879CC-59D6-4D4B-AE9B-D761E48D25ED}" = Skype™ 5.3
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{EC905264-BCFE-423B-9C42-C3A106266790}" = SP2 con compatibilidad hacia atrás con cliente de Windows Rights Management
"{ED439A64-F018-4DD4-8BA5-328D85AB09AB}" = Roxio Creator DE 10.3
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Advanced Audio FX Engine" = Advanced Audio FX Engine
"Broadcom 802.11b Network Adapter" = Herramienta de la tarjeta de red inalámbrica WLAN de Dell
"CCleaner" = CCleaner
"CNXT_AUDIO_HDA" = Conexant HD Audio
"CNXT_MODEM_HDA_HSF" = HDAUDIO Soft Data Fax Modem with SmartCP
"Creative OA014" = Integrated Webcam Driver (1.00.06.0312)  
"Dell Webcam Central" = Dell Webcam Central
"DivX Setup" = Instalación de DivX
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 Language Pack SP1 - esn" = Paquete de idioma de Microsoft .NET Framework 3.5 SP1 - esn
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox 8.0 (x86 es-ES)" = Mozilla Firefox 8.0 (x86 es-ES)
"MP Navigator 3.0" = Canon MP Navigator 3.0
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"SecureW2 EAP Suite" = SecureW2 EAP Suite 2.0.4 for Windows
"Spotify" = Spotify
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"Windows Media Format Runtime" = Windows Media Format Runtime
"WinLiveSuite_Wave3" = Windows Live Essentials
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 20/11/2011 7:30:58 | Computer Name = XXXXX| Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 3529891
 
Error - 20/11/2011 18:10:18 | Computer Name = XXXXX| Source = PerfNet | ID = 2004
Description = No se puede abrir el servicio Servidor. No se devolverán datos  de rendimiento
 del servidor. El código de error devuelto está en los datos DWORD 0.
 
Error - 21/11/2011 8:10:09 | Computer Name = XXXXX| Source = PerfNet | ID = 2004
Description = No se puede abrir el servicio Servidor. No se devolverán datos  de rendimiento
 del servidor. El código de error devuelto está en los datos DWORD 0.
 
Error - 21/11/2011 13:42:43 | Computer Name = XXXXX| Source = PerfNet | ID = 2004
Description = No se puede abrir el servicio Servidor. No se devolverán datos  de rendimiento
 del servidor. El código de error devuelto está en los datos DWORD 0.
 
Error - 21/11/2011 17:07:26 | Computer Name = XXXXX| Source = Windows Search Service | ID = 3013
Description = No se puede actualizar la entrada <C:\DOCUMENTS AND SETTINGS\XXXXX 
BLACKSHIRE\RECENT\DESKTOP.INI> en el mapa hash.  Contexto: aplicación , catálogo SystemIndex

Detalles:
	Uno
 de los dispositivos vinculados al sistema no funciona.   (0x8007001f) 
 
Error - 21/11/2011 17:20:20 | Computer Name = XXXXX| Source = PerfNet | ID = 2004
Description = No se puede abrir el servicio Servidor. No se devolverán datos  de rendimiento
 del servidor. El código de error devuelto está en los datos DWORD 0.
 
Error - 21/11/2011 17:47:22 | Computer Name = XXXXX | Source = Windows Search Service | ID = 3013
Description = No se puede actualizar la entrada <C:\DOCUMENTS AND SETTINGS\XXXXX 
BLACKSHIRE\RECENT\DESKTOP.INI> en el mapa hash.  Contexto: aplicación , catálogo SystemIndex

Detalles:
	Uno
 de los dispositivos vinculados al sistema no funciona.   (0x8007001f) 
 
Error - 21/11/2011 17:50:00 | Computer Name = XXXXX | Source = Windows Search Service | ID = 3013
Description = No se puede actualizar la entrada <C:\DOCUMENTS AND SETTINGS\XXXXX 
BLACKSHIRE\RECENT\DESKTOP.INI> en el mapa hash.  Contexto: aplicación , catálogo SystemIndex

Detalles:
	Uno
 de los dispositivos vinculados al sistema no funciona.   (0x8007001f) 
 
Error - 21/11/2011 17:50:18 | Computer Name = XXXXX | Source = Windows Search Service | ID = 3013
Description = No se puede actualizar la entrada <C:\DOCUMENTS AND SETTINGS\XXXXX 
BLACKSHIRE\RECENT\DESKTOP.INI> en el mapa hash.  Contexto: aplicación , catálogo SystemIndex

Detalles:
	Uno
 de los dispositivos vinculados al sistema no funciona.   (0x8007001f) 
 
Error - 21/11/2011 18:05:38 | Computer Name = XXXXX | Source = PerfNet | ID = 2004
Description = No se puede abrir el servicio Servidor. No se devolverán datos  de rendimiento
 del servidor. El código de error devuelto está en los datos DWORD 0.
 
[ System Events ]
Error - 17/11/2011 17:21:59 | Computer Name = XXXXX | Source = Service Control Manager | ID = 7001
Description = El servicio Cliente DHCP depende del servicio NetBios a través de 
Tcpip, el cual no pudo iniciarse debido al siguiente error:   %%31
 
Error - 17/11/2011 17:21:59 | Computer Name = XXXXX | Source = Service Control Manager | ID = 7001
Description = El servicio Cliente DNS depende del servicio Controlador de protocolo
 TCP/IP, el cual no pudo iniciarse debido al siguiente error:   %%31
 
Error - 17/11/2011 17:21:59 | Computer Name = XXXXX | Source = Service Control Manager | ID = 7001
Description = El servicio Ayuda de NetBIOS sobre TCP/IP depende del servicio AFD,
 el cual no pudo iniciarse debido al siguiente error:   %%31
 
Error - 17/11/2011 17:21:59 | Computer Name = XXXXX | Source = Service Control Manager | ID = 7001
Description = El servicio Apple Mobile Device depende del servicio Controlador de
 protocolo TCP/IP, el cual no pudo iniciarse debido al siguiente error:   %%31
 
Error - 17/11/2011 17:21:59 | Computer Name = XXXXXX | Source = Service Control Manager | ID = 7001
Description = El servicio Servicio Bonjour depende del servicio Controlador de protocolo
 TCP/IP, el cual no pudo iniciarse debido al siguiente error:   %%31
 
Error - 17/11/2011 17:21:59 | Computer Name = XXXXX | Source = Service Control Manager | ID = 7001
Description = El servicio Servicios IPSEC depende del servicio Controlador IPSEC,
 el cual no pudo iniciarse debido al siguiente error:   %%31
 
Error - 17/11/2011 17:21:59 | Computer Name = XXXXX | Source = Service Control Manager | ID = 7026
Description = El controlador de inicialización siguiente no se cargó correctamente:
   AFD  ehdrv  epfwtdi  Fips  intelppm  IPSec  MRxSmb  NetBIOS  NetBT  RasAcd  Rdbss  Tcpip
 
Error - 17/11/2011 17:22:12 | Computer Name = XXXXX | Source = DCOM | ID = 10005
Description = DCOM ha obtenido un error "%1084" al intentar iniciar el servicio 
StiSvc con argumentos ""  para ejecutar el servidor:  {A1F4E726-8CF1-11D1-BF92-0060081ED811}
 
Error - 17/11/2011 17:23:44 | Computer Name = XXXXX | Source = DCOM | ID = 10005
Description = DCOM ha obtenido un error "%1084" al intentar iniciar el servicio 
EventSystem con argumentos ""  para ejecutar el servidor:  {1BE1F766-5536-11D1-B726-00C04FB926AF}
 
Error - 19/11/2011 8:44:22 | Computer Name = XXXXX | Source = Dhcp | ID = 1000
Description = Su equipo ha perdido la concesión de su dirección IP 192.168.1.10 
en la  tarjeta de red con dirección de red 78E400442279.
 
 
< End of report >
         

GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2011-11-22 09:42:25
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST925041 rev.0004
Running: 14lwopfy.exe; Driver: C:\DOCUME~1\SARABL~1\CONFIG~1\Temp\fxtdypow.sys


---- System - GMER 1.0.15 ----

SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                          ZwAssignProcessToJobObject [0xA11294B0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                          ZwCreateThread [0xA11297F0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                          ZwDebugActiveProcess [0xA1129AB0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                          ZwDuplicateObject [0xA11295D0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                          ZwLoadDriver [0xA11298B0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                          ZwOpenProcess [0xA1129350]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                          ZwOpenThread [0xA1129410]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                          ZwProtectVirtualMemory [0xA1129570]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                          ZwQueueApcThread [0xA1129630]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                          ZwSetContextThread [0xA1129530]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                          ZwSetInformationThread [0xA11294F0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                          ZwSetSecurityObject [0xA1129670]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                          ZwSetSystemInformation [0xA1129870]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                          ZwSuspendProcess [0xA11293B0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                          ZwSuspendThread [0xA1129430]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                          ZwSystemDebugControl [0xA1129830]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                          ZwTerminateProcess [0xA1129370]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                          ZwTerminateThread [0xA1129470]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                          ZwWriteVirtualMemory [0xA11295F0]

---- Kernel code sections - GMER 1.0.15 ----

.text           ntkrnlpa.exe!ZwCallbackReturn + 2FD8                                                                      80504874 12 Bytes  [B0, 93, 12, A1, 30, 94, 12, ...]
init            C:\WINDOWS\system32\Drivers\OA014Afx.sys                                                                  entry point in "init" section [0xA178F310]
init            C:\WINDOWS\system32\Drivers\CtAudDrv.sys                                                                  entry point in "init" section [0xA1768D50]

---- User code sections - GMER 1.0.15 ----

.text           C:\Archivos de programa\ESET\ESET Smart Security\ekrn.exe[2236] kernel32.dll!SetUnhandledExceptionFilter  7C84495D 4 Bytes  [C2, 04, 00, 00]
.text           C:\WINDOWS\system32\SearchIndexer.exe[2600] kernel32.dll!WriteFile                                        7C810E27 7 Bytes  JMP 00585C0C C:\WINDOWS\system32\MSSRCH.DLL (mssrch.dll/Microsoft Corporation)

---- Devices - GMER 1.0.15 ----

AttachedDevice  \FileSystem\Ntfs \Ntfs                                                                                    eamon.sys (Amon monitor/ESET)
AttachedDevice  \Driver\Tcpip \Device\Ip                                                                                  epfwtdi.sys (ESET Personal Firewall TDI filter/ESET)
AttachedDevice  \Driver\Tcpip \Device\Tcp                                                                                 epfwtdi.sys (ESET Personal Firewall TDI filter/ESET)
AttachedDevice  \Driver\Tcpip \Device\Udp                                                                                 epfwtdi.sys (ESET Personal Firewall TDI filter/ESET)
AttachedDevice  \Driver\Tcpip \Device\RawIp                                                                               epfwtdi.sys (ESET Personal Firewall TDI filter/ESET)

Device          \FileSystem\Fastfat \Fat                                                                                  98E2FD20

AttachedDevice  \FileSystem\Fastfat \Fat                                                                                  eamon.sys (Amon monitor/ESET)

---- EOF - GMER 1.0.15 ----
         

Vielen vielen Dank fuer jegliche Hilfe,

Felix

hiho
achtung!
falls du deinen benutzernamen ersetzt hast, musst du ihn im script einfügen bitte, sonst klappts nicht

gibts eig nen grund warum das windows nicht auf deutsch ist?

dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user.
wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts.


• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.

:OTL
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
[2011/11/21 22:08:35 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\XXXXX\Menú Inicio\Programas\System Fix
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2011/11/21 22:10:19 | 000,000,456 | -H-- | M] () -- C:\Documents and Settings\All Users\Datos de programa\rNTc4GTgRKJ29h
[2011/11/21 22:08:38 | 000,000,296 | -H-- | M] () -- C:\Documents and Settings\All Users\Datos de programa\~rNTc4GTgRKJ29h
[2011/11/21 22:08:38 | 000,000,216 | -H-- | M] () -- C:\Documents and Settings\All Users\Datos de programa\~rNTc4GTgRKJ29hr
[2011/11/21 22:08:37 | 000,000,838 | -H-- | M] () -- C:\Documents and Settings\XXXXX\Escritorio\System Fix.lnk
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

:Files
:Commands
[Reboot]
         

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.
pc sollte normal starten

lade unhide:
http://filepony.de/download-unhide/
doppelklicken, dateien werden sichtbar

rechtsklick desktop, eigenschaften, bild auswählen.

Hi Markus,

danke fuer die Hilfe. Ich habe OTL und unhide durchlaufen lassen. Leider habe ich nach OTL keinen Log vorgefunden, vielleicht weil sich der PC beim Runterfahren aufgehaengt hat.
nach OTL war der Desktop wieder sichtbar fuer alle Dateien, die ich nach dem Auftreten des Virus drauf gemacht hatte. Nach Unhide sehe ich wieder alles.

Wie gesagt, kein Log leider, hoffe, das ist nicht weiter schlimm. Gibt es weitere Schritte, denen ich folgen sollte?

Gruesse,
Felix

p.s. Spanisch, da meine Mitbewohnerin Spanierin ist und ich das fuer sie mache

ok.
dann mal weiter:
combofix:

Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.

Bitte downloade dir Combofix.exe und speichere es unbedingt auf deinem Desktop.

• Besuche folgende Seite für Downloadlinks und Anweisungen für dieses
  Tool
  
  Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  
• Hinweis:
  Gehe sicher das all deine Anti Virus und Anti Malware Programme abgeschalten sind, damit diese Combofix nicht bei der Arbeit stören.
  
• Poste bitte die C:\Combofix.txt in deiner nächsten Antwort.

Hi!

Scheint alles erfolgreich verlaufen zu sein!

Hier ist der Combofix Log:

ComboFix 11-11-23.01 - Sara Blackshire 23/11/2011  22:15:23.1.2 - x86
Microsoft Windows XP Professional  5.1.2600.3.1252.34.3082.18.3548.2861 [GMT 1:00]
Running from: c:\documents and settings\Sara Blackshire\Escritorio\ComboFix.exe
AV: ESET Smart Security 5.0 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: AVG Firewall *Disabled* {8decf618-9569-4340-b34a-d78d28969b66}
FW: ESET Personal firewall *Disabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
 * Created a new restore point
.
.
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Sara Blackshire\Datos de programa\Microsoft\Internet Explorer\Quick Launch\System Fix.lnk
c:\documents and settings\Sara Blackshire\Datos de programa\Microsoft\stor.cfg
.
.
(((((((((((((((((((((((((   Files Created from 2011-10-23 to 2011-11-23  )))))))))))))))))))))))))))))))
.
.
2011-11-22 19:56 . 2011-11-22 19:56	--------	d-----w-	C:\_OTL
2011-11-21 14:36 . 2011-11-21 14:36	--------	d-----w-	c:\archivos de programa\Archivos comunes\ATRIL
2011-11-21 14:36 . 2011-11-21 14:36	--------	d-----w-	c:\documents and settings\All Users\Datos de programa\ATRIL
2011-11-21 14:36 . 2011-11-21 14:36	--------	d-----w-	c:\archivos de programa\ATRIL
2011-11-21 13:45 . 2011-11-21 13:45	--------	d-----w-	c:\archivos de programa\Microsoft WSE
2011-11-21 13:45 . 2011-11-21 13:45	--------	d-----w-	c:\archivos de programa\Microsoft CAPICOM 2.1.0.2
2011-11-17 21:11 . 2011-11-17 21:11	--------	d-----w-	c:\documents and settings\Sara Blackshire\Datos de programa\ESET
2011-11-17 21:11 . 2011-11-17 21:11	--------	d-----w-	c:\documents and settings\Sara Blackshire\Configuración local\Datos de programa\ESET
2011-11-17 21:10 . 2011-11-17 21:10	--------	d-----w-	c:\documents and settings\LocalService\Configuración local\Datos de programa\ESET
2011-11-17 21:09 . 2011-11-17 21:09	--------	d-----w-	c:\documents and settings\All Users\Datos de programa\ESET
2011-11-17 21:09 . 2011-11-17 21:09	--------	d-----w-	c:\archivos de programa\ESET
2011-11-14 19:12 . 2011-11-14 23:44	--------	d-----w-	c:\documents and settings\Sara Blackshire\Configuración local\Datos de programa\WMTools Downloaded Files
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-18 09:09 . 2011-06-22 19:42	414368	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2011-10-10 14:22 . 2008-06-20 19:51	692736	----a-w-	c:\windows\system32\inetcomm.dll
2011-09-28 07:06 . 2008-06-20 14:38	605184	----a-w-	c:\windows\system32\crypt32.dll
2011-09-26 09:41 . 2008-07-30 07:59	613888	----a-w-	c:\windows\system32\uiautomationcore.dll
2011-09-26 09:41 . 2008-06-20 14:39	22528	----a-w-	c:\windows\system32\oleaccrc.dll
2011-09-26 09:41 . 2008-06-20 14:39	220160	----a-w-	c:\windows\system32\oleacc.dll
2011-09-06 14:09 . 2008-06-20 14:39	1859072	----a-w-	c:\windows\system32\win32k.sys
2011-09-05 13:55 . 2008-06-20 14:39	669696	----a-w-	c:\windows\system32\wininet.dll
2011-09-05 13:55 . 2008-06-20 14:39	61952	----a-w-	c:\windows\system32\tdc.ocx
2011-09-05 13:55 . 2008-06-20 14:38	81920	----a-w-	c:\windows\system32\ieencode.dll
2011-09-05 13:54 . 2008-06-20 14:38	371200	----a-w-	c:\windows\system32\html.iec
2011-11-11 08:23 . 2011-09-29 17:57	134104	----a-w-	c:\archivos de programa\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\archivos de programa\Skype\Phone\Skype.exe" [2011-06-15 15141768]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\archivos de programa\DellTPad\Apoint.exe" [2009-04-28 233472]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-04-26 134656]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-04-26 166912]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-04-26 135680]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2008-12-12 2220032]
"Dell Webcam Central"="c:\archivos de programa\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" [2009-06-24 409744]
"QuickTime Task"="c:\archivos de programa\QuickTime\QTTask.exe" [2010-11-29 421888]
"iTunesHelper"="c:\archivos de programa\iTunes\iTunesHelper.exe" [2011-01-25 421160]
"Adobe Reader Speed Launcher"="c:\archivos de programa\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-06-08 37296]
"Adobe ARM"="c:\archivos de programa\Archivos comunes\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"DivXUpdate"="c:\archivos de programa\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376]
"egui"="c:\archivos de programa\ESET\ESET Smart Security\egui.exe" [2011-08-09 3076144]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\All Users\Menú Inicio\Programas\Inicio\
Bluetooth.lnk - c:\archivos de programa\WIDCOMM\Bluetooth Software\BTTray.exe [2008-8-15 604776]
Windows Search.lnk - c:\archivos de programa\Windows Desktop Search\WindowsSearch.exe [2008-5-27 123904]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\archivos de programa\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Archivos de programa\\Spotify\\spotify.exe"=
"c:\\Archivos de programa\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Archivos de programa\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Archivos de programa\\Bonjour\\mDNSResponder.exe"=
"c:\\Archivos de programa\\iTunes\\iTunes.exe"=
"c:\\Archivos de programa\\Skype\\Phone\\Skype.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Administración remota de Windows 
.
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [04/08/2011 9:20 118104]
R2 ekrn;ESET Service;c:\archivos de programa\ESET\ESET Smart Security\ekrn.exe [09/08/2011 21:39 974944]
R3 CtAudDrv;Provides advanced audio effects for audio devices.;c:\windows\system32\drivers\CtAudDrv.sys [19/06/2010 1:15 134144]
R3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\drivers\CtClsFlt.sys [19/06/2010 1:15 143968]
R3 OA014Afx;Provides a software interface to control audio effects of OA014 camera.;c:\windows\system32\drivers\OA014Afx.sys [19/06/2010 3:06 148056]
R3 OA014Ufd;Creative Camera OA014 Upper Filter Driver;c:\windows\system32\drivers\OA014Ufd.sys [19/06/2010 3:06 133632]
R3 OA014Vid;Creative Camera OA014 Function Driver;c:\windows\system32\drivers\OA014Vid.sys [19/06/2010 3:06 271904]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\drivers\RtsUStor.sys [19/06/2010 3:06 164352]
S3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\drivers\ewusbnet.sys [16/02/2011 16:42 114432]
S3 hwusbfake;Huawei DataCard USB Fake;c:\windows\system32\drivers\ewusbfake.sys [16/02/2011 16:48 100736]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [20/06/2008 15:39 14336]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM	REG_MULTI_SZ   	WINRM
.
Contents of the 'Scheduled Tasks' folder
.
2011-08-31 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\archivos de programa\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]
.
2011-11-23 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAEXEC.exe [2009-08-03 13:07]
.
.
------- Supplementary Scan -------
.
mStart Page = hxxp://www1.euro.dell.com/content/default.aspx?c=es&l=es&s=gen
uInternet Settings,ProxyServer = http=127.0.0.1:50370
IE: E&xportar a Microsoft Excel - c:\archiv~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\archivos de programa\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send To Bluetooth - c:\archivos de programa\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\documents and settings\Sara Blackshire\Datos de programa\Mozilla\Firefox\Profiles\eus662tg.default\
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 50370
FF - prefs.js: network.proxy.type - 0
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2011-11-23 22:21
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...  
.
scanning hidden autostart entries ... 
.
scanning hidden files ...  
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\€–€|ÿÿÿÿÀ•€|ù•9~*]
"A0C0110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(836)
c:\windows\System32\BCMLogon.dll
.
Completion time: 2011-11-23  22:22:27
ComboFix-quarantined-files.txt  2011-11-23 21:22
.
Pre-Run: 219.103.617.024 bytes libres
Post-Run: 219.774.259.200 bytes libres
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - 09149A9FC4F4B70FABD0404443290DA0
         

jo sieht gut aus.

malwarebytes:
Downloade Dir bitte Malwarebytes

• Installiere
  das Programm in den vorgegebenen Pfad.
  Vista und Win7 User mit Rechtsklick "als Administrator starten"
• Starte Malwarebytes, klicke auf Aktualisierung --> Suche
  nach Aktualisierung
• Wenn das Update beendet wurde, aktiviere vollständiger Scan durchführen und drücke auf Scannen.
• Wenn der Scan beendet
  ist, klicke auf Ergebnisse anzeigen.
• Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
• Poste
  das Logfile, welches sich in Notepad öffnet, hier in den Thread.
• Nachträglich kannst du den Bericht unter "Log Dateien" finden.

Hi Markus!

hier ist die Log File:

www.malwarebytes.org

Database version: 8234

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

24/11/2011 22:20:29
mbam-log-2011-11-24 (22-20-29).txt

Scan type: Full scan (C:\|)
Objects scanned: 246330
Time elapsed: 41 minute(s), 53 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 3

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\Engine.LoginManager (Rogue.AntiSpyKit) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer (PUM.Bad.Proxy) -> Value: ProxyServer -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\documents and settings\sara blackshire\datos de programa\Sun\Java\deployment\cache\6.0\42\756c04aa-712456ae (Rogue.FakeHDD) -> Quarantined and deleted successfully.
c:\system volume information\_restore{86e94e2e-fc01-48b1-b211-3bc57437ffbf}\RP216\A0057085.exe (Rogue.FakeHDD) -> Quarantined and deleted successfully.
c:\system volume information\_restore{86e94e2e-fc01-48b1-b211-3bc57437ffbf}\RP216\A0057086.exe (Rogue.FakeHDD) -> Quarantined and deleted successfully.
         

Danke!

sieht gut aus.

lade den CCleaner standard:
CCleaner Download - CCleaner 3.12.1572
falls der CCleaner
bereits instaliert, überspringen.
instalieren, öffnen, extras, liste der instalierten programme, als txt speichern. öffnen.
hinter, jedes von dir benötigte programm, schreibe notwendig.
hinter, jedes, von dir nicht benötigte, unnötig.
hinter, dir unbekannte, unbekannt.
liste posten.

"Extras" habe ich nicht gefunden. Anstatt dessen ist die Liste aus "Tools" und "Save to txt file".

Necessary
Unnecessary
Unknown
Unknown but i think necessary

hat meine Mitbewohnerin hinter die Programm geschrieben. Hoffe, damit ist alles klar. Gruesse!

p.s. habe die txt Datei angehaengt, da dort das Format besser ist

Adobe Flash Player 11 ActiveX	Adobe Systems Incorporated	24/11/2011		11.1.102.55							NECESARY
Adobe Flash Player 11 Plugin	Adobe Systems Incorporated	24/11/2011		11.1.102.55							NECESARY
Adobe Reader 9.4.5 - Español	Adobe Systems Incorporated	19/07/2011	173,6 MB	9.4.5							NECESARY
Advanced Audio FX Engine	Creative Technology Ltd	23/11/2011		1.12.05									UNKNOWN
Apple Application Support	Apple Inc.	16/02/2011	54,4 MB	1.4.1										NECESARY
Apple Mobile Device Support	Apple Inc.	16/02/2011	21,7 MB	3.3.1.3										NECESARY
Apple Software Update	Apple Inc.	10/09/2010	2,16 MB	2.1.1.116										NECESARY
Bonjour	Apple Inc.	16/02/2011	1,10 MB	2.0.4.0													UNKNOWN
Canon MP Navigator 3.0		24/11/2011														NECESARY
CCleaner	Piriform	26/11/2011		3.12												NECESARY
Cliente de Windows Rights Management con Service Pack 2	Microsoft	18/06/2010		5.2.95							UNKNOWN
Compatibility Pack for the 2007 Office system	Microsoft Corporation	17/09/2011	91,4 MB	12.0.6514.5001						NECESARY
Complemento Guardar como PDF o XPS de Microsoft para programas de Microsoft Office 2007	Microsoft Corporation	14/07/2010	0,13 MB	12.0.4518.1014	NECESARY
Conexant HD Audio	Conexant	24/11/2011		3.73.0.50										UNKNOWN
Dell Backup and Recovery Manager	Dell, Inc.	18/06/2010		1.2.3									NECESARY
Dell Touchpad	ALPS ELECTRIC CO., LTD.	24/11/2011		7.2.101.220										NECESARY
Dell Webcam Central	Creative Technology Ltd	26/11/2011		1.40.05										NECESARY
Déjà Vu X2	ATRIL Language Engineering, S.L.	21/11/2011	101,1 MB	8.00.0505							UNNECESARY
ESET Smart Security	ESET, spol. s r.o.	17/11/2011	71,1 MB	5.0.93.0									NECESARY
HDAUDIO Soft Data Fax Modem with SmartCP	Conexant Systems	24/11/2011		7.80.2.50						UNKNOWN
Herramienta de carga de Windows Live	Microsoft Corporation	18/06/2010	0,22 MB	14.0.8014.1029							NECESARY
Herramienta de la tarjeta de red inalámbrica WLAN de Dell	Dell Inc.	24/11/2011		4.170.77.18					NECESARY
Instalación de DivX	DivX, LLC	24/11/2011		2.6.0.34										UNNECESARY
Integrated Webcam Driver (1.00.06.0312)	Creative Technology Ltd.	24/11/2011		1.00.06.0312						NECESARY
Intel(R) Graphics Media Accelerator Driver	Intel Corporation	24/11/2011									NECESARY
iTunes	Apple Inc.	16/02/2011	144,7 MB	10.1.2.17											NECESARY
Java(TM) 6 Update 18	Sun Microsystems, Inc.	18/06/2010	97,1 MB	6.0.180										NECESARY
Live! Cam Avatar Creator	Creative Technology Ltd	18/06/2010		4.6.3009.1								NECESARY
Malwarebytes' Anti-Malware version 1.51.2.1300	Malwarebytes Corporation	24/11/2011		1.51.2.1300					UNKNOWN BUT I THINK NECESARY
Microsoft .NET Framework 1.1		14/10/2011													UNKNOWN BUT I THINK NECESARY
Microsoft .NET Framework 2.0 Service Pack 2	Microsoft Corporation	14/10/2011	185,2 MB	2.2.30729					UNKNOWN BUT I THINK NECESARY
Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - ESN	Microsoft Corporation	18/06/2010	6,23 MB	2.2.30729				UNKNOWN BUT I THINK NECESARY
Microsoft .NET Framework 3.0 Service Pack 2	Microsoft Corporation	30/06/2010	209 MB	3.2.30729						UNKNOWN BUT I THINK NECESARY
Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - ESN	Microsoft Corporation	18/06/2010	22,8 MB	3.2.30729				UNKNOWN BUT I THINK NECESARY
Microsoft .NET Framework 3.5 SP1	Microsoft Corporation	10/10/2010										UNKNOWN BUT I THINK NECESARY
Microsoft National Language Support Downlevel APIs	Microsoft Corporation	19/06/2010								UNKNOWN BUT I THINK NECESARY
Microsoft Office File Validation Add-In	Microsoft Corporation	17/09/2011	11,2 MB	14.0.5130.5003							UNKNOWN BUT I THINK NECESARY
Microsoft Office PowerPoint Viewer 2007 (Spanish)	Microsoft Corporation	17/09/2011	130,3 MB	12.0.6425.1000				NECESARY
Microsoft Office Professional Edition 2003	Microsoft Corporation	11/11/2011	895 MB	11.0.8173.0						NECESARY
Microsoft Silverlight	Microsoft Corporation	14/10/2011	199,9 MB	4.0.60831.0								UNKNOWN
Microsoft SQL Server 2005 Compact Edition [ENU]	Microsoft Corporation	18/06/2010	1,74 MB	3.1.0000						UNKNOWN
Microsoft Sync Framework Runtime Native v1.0 (x86)	Microsoft Corporation	27/01/2011	2,29 MB	1.0.1215.0					UNKNOWN BUT I THINK NECESARY
Microsoft Sync Framework Services Native v1.0 (x86)	Microsoft Corporation	27/01/2011	1,45 MB	1.0.1215.0					UNKNOWN BUT I THINK NECESARY
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053	Microsoft Corporation	09/07/2010	0,11 MB	8.0.50727.4053			UNKNOWN
Microsoft Visual C++ 2005 Redistributable	Microsoft Corporation	18/06/2011	5,28 MB	8.0.61001						UNKNOWN
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148	Microsoft Corporation	27/09/2011	10,2 MB	9.0.30729.4148				UNKNOWN
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161	Microsoft Corporation	29/09/2011	10,2 MB	9.0.30729.6161				UNKNOWN
Microsoft Works	Microsoft Corporation	16/12/2010	2,62 MB	9.7.0621										UNKNOWN
Microsoft WSE 3.0 Runtime	Microsoft Corp.	21/11/2011	0,92 MB	3.0.5305.0									UNKNOWN
Mozilla Firefox 8.0 (x86 es-ES)	Mozilla	24/11/2011		8.0											NECESARY
MSXML 4.0 SP2 (KB954430)	Microsoft Corporation	18/06/2010	2,70 MB	4.20.9870.0								UNKNOWN BUT I THINK NECESARY
MSXML 4.0 SP2 (KB973688)	Microsoft Corporation	18/06/2010	1,39 MB	4.20.9876.0								UNKNOWN BUT I THINK NECESARY
MSXML 4.0 SP3 Parser (KB973685)	Microsoft Corporation	18/06/2010	2,94 MB	4.30.2107.0								UNKNOWN BUT I THINK NECESARY
MSXML 6.0 Parser (KB927977)	Microsoft Corporation	20/06/2008	1,50 MB	6.00.3890.0								UNKNOWN BUT I THINK NECESARY
Paquete de compatibilidad para 2007 Office system	Microsoft Corporation	17/09/2011	149,4 MB	12.0.6425.1000				NECESARY
Paquete de idioma de Microsoft .NET Framework 3.5 SP1 - esn	Microsoft Corporation	24/11/2011							UNKNOWN BUT I THINK NECESARY
PDFCreator	Frank Heindörfer, Philip Chinery	21/03/2011		1.2.0									NECESARY
QuickTime	Apple Inc.	16/02/2011	73,7 MB	7.69.80.9											NECESARY
Revisión para Windows XP (KB969084)	Microsoft Corporation	18/06/2010		3								UNKNOWN
Roxio Creator DE 10.3	Roxio	18/06/2010		10.3												UNKNOWN
SecureW2 EAP Suite 2.0.4 for Windows		24/11/2011												UNKNOWN
Security Update for Windows Search 4 - KB963093	Microsoft Corporation	18/06/2010									NECESARY
Skype Toolbars	Skype Technologies S.A.	22/07/2011	12,2 MB	5.3.7555										UNNECESARY
Skype™ 5.3	Skype Technologies S.A.	22/07/2011	16,6 MB	5.3.120											NECESARY
SP2 con compatibilidad hacia atrás con cliente de Windows Rights Management	Microsoft	18/06/2010		5.2.95				UNKNOWN
Spotify		24/11/2011		0.4.3														NECESARY
WIDCOMM Bluetooth Software	Dell	18/06/2010	18,0 MB	5.5.0.3208										NECESARY
Windows Live Asistente para el inicio de sesión	Microsoft Corporation	18/06/2010	1,93 MB	5.000.818.5						NECESARY
Windows Live Essentials	Microsoft Corporation	27/01/2011		14.0.8117.0416									NECESARY
Windows Live Sync	Microsoft Corporation	27/01/2011	2,79 MB	14.0.8117.416									NECESARY
Windows Management Framework Core	Microsoft Corporation	18/06/2010										NECESARY
Windows Search 4.0	Microsoft Corporation	18/06/2010		04.00.6001.503									NECESARY
         

Hi Markus!

Kann das Laptop jetzt wiede rnormal benutzt werden oder muss ich noch was wichtiges machen? Sorry für den Push, aber war mir nicht sicher, da zuletzt keine Antwort folgte.

Grüße!!

sorry hab irgendwie das posting übersehen
deinstaliere:
Adobe Reader 9.4.5
adobe reader:
Adobe - Adobe Reader herunterladen - Alle Versionen
haken bei mcafee security scan raus nehmen

bitte auch mal den adobe reader wie folgt konfigurieren:
adobe reader öffnen, bearbeiten, voreinstellungen.
allgemein:
nur zertifizierte zusatz module verwenden, anhaken.
internet:
hier sollte alles deaktiviert werden, es ist sehr unsicher pdfs automatisch zu öffnen, zu downloaden etc.
es ist immer besser diese direkt abzuspeichern da man nur so die kontrolle hat was auf dem pc vor geht.
bei javascript den haken bei java script verwenden raus nehmen
bei updater, automatisch instalieren wählen.
übernehmen /ok

deinstaliere:
Bonjour
Déjà Vu
Java
Download der kostenlosen Java-Software
downloade java jre
deinstaliere:
Skype Toolbars

bereinige mit dem ccleaner