Publicité
Publicité
Format du document : text/plain
Prévisualisation
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 01.09.2018 03
Ran by Alumno (administrator) on 2CI809B20106E45 (02-09-2018 10:59:09)
Running from D:\Mis Cosas\Descargas
Loaded Profiles: Alumno (Available Profiles: Alumno)
Platform: Microsoft Windows 7 Professional Service Pack 1 (X86) Language: Español (España, internacional)
Internet Explorer Version 9 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Beijing Rising Information Technology Co., Ltd.) C:\Program Files\Rising\RSD\RsMgrSvc.exe
(Atheros Commnucations) C:\Program Files\Bluetooth Suite\AdminService.exe
(Intel Corporation) C:\Program Files\Intel\Device Control Service\DeviceControlService.exe
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE
(Google Inc.) C:\Program Files\Google\Update\1.3.33.17\GoogleCrashHandler.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Atheros Communications) C:\Program Files\Bluetooth Suite\BtvStack.exe
(Atheros Commnucations) C:\Program Files\Bluetooth Suite\AthBtTray.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
() D:\.cache\.b\conigform-windows.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
() C:\Program Files\SATVD-T\SchHD.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Spline Network,Inc.) C:\Program Files\InkSaver\ISApExtSvc32.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Spline Network,Inc.) C:\Program Files\InkSaver\InkSaver.exe
(Brother Industries, Ltd.) C:\Program Files\Browny02\Brother\BrStMonW.exe
(Beijing Rising Information Technology Co., Ltd.) C:\Program Files\Rising\RSD\popwndexe.exe
(Brother Industries, Ltd.) C:\Program Files\BrownyInd\Brother\BrIndicator.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Easy Settings\MovieColorEnhancer.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Easy Settings\SmartSetting.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Easy Settings\dmhkcore.exe
() C:\Program Files\FusionInventory-Agent\perl\bin\perl.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\VS7DEBUG\mdm.exe
(Microsoft Corporation) C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Atheros) C:\Program Files\Bluetooth Suite\Ath_CoexAgent.exe
(Intel Corporation) C:\Program Files\Intel\Bluetooth\obexsrv.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Intel Corporation) C:\Program Files\Intel\Bluetooth\mediasrv.exe
(Brother Industries, Ltd.) C:\Program Files\Browny02\BrYNSvc.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Microsoft Corporation) C:\Windows\System32\cmd.exe
(OEM) C:\Program Files\BatteryInfo\BattInfo.exe
(Microsoft Corporation) C:\Windows\System32\taskmgr.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2193192 2012-02-14] (ELAN Microelectronics Corp.)
HKLM\...\Run: [AtherosBtStack] => C:\Program Files\Bluetooth Suite\BtvStack.exe [609440 2011-12-13] (Atheros Communications)
HKLM\...\Run: [AthBtTray] => C:\Program Files\Bluetooth Suite\AthBtTray.exe [523424 2011-12-13] (Atheros Commnucations)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2325776 2012-01-05] (Synaptics Incorporated)
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files\Intel\Bluetooth\btmshell.dll",TrayApp
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [919008 2012-07-27] (Adobe Systems Incorporated)
HKLM\...\Run: [Agent] => C:\Archivos de programa\Intel Learning Series\Theft Deterrent\Agent.exe [303104 2010-07-19] (Intel)
HKLM\...\Run: [Formulario] => D:\.cache\.b\conigform-windows.exe [5328986 2012-12-04] ()
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-04-30] (Intel Corporation)
HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [931200 2012-03-26] (Microsoft Corporation)
HKLM\...\Run: [SchHD] => C:\Program Files\SATVD-T\SchHD.exe [258048 2010-07-03] ()
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [10967656 2012-03-29] (Realtek Semiconductor)
HKLM\...\Run: [GfxServiceInstall] => C:\Windows\system32\GfxCUIServiceInstall.vbs [131 2011-12-14] ()
HKLM\...\Run: [InkSaver.ApExt32] => C:\Program Files\InkSaver\ISApExtSvc32.exe [50528 2011-08-01] (Spline Network,Inc.)
HKLM\...\Run: [InkSaver] => C:\Program Files\InkSaver\InkSaver.exe [577376 2011-08-01] (Spline Network,Inc.)
HKLM\...\Run: [RSDTRAY] => C:\Program Files\Rising\RSD\popwndexe.exe [160536 2017-06-20] (Beijing Rising Information Technology Co., Ltd.)
HKLM\...\Run: [BrStsMon00] => C:\Program Files\Browny02\Brother\BrStMonW.exe [4513792 2014-05-22] (Brother Industries, Ltd.)
HKLM\...\Run: [BrStsInd00] => C:\Program Files\BrownyInd\Brother\BrIndicator.exe [1885184 2012-12-18] (Brother Industries, Ltd.)
HKU\S-1-5-19\...\Run: [Formulario] => D:\.cache\.b\conigform-windows.exe [5328986 2012-12-04] ()
HKU\S-1-5-21-1426333803-718080766-1020419503-1000\...\Run: [EPSON Stylus CX5600 Series] => C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATICAL.EXE [179200 2007-01-25] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-1426333803-718080766-1020419503-1000\...\MountPoints2: {6552b2d4-9703-11e4-a7b4-e8039ad636f1} - E:\AutoRun.exe
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{47C9A79F-2B18-4FDA-9C26-00248576BD88}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{49C85C70-6019-4B03-855C-B7E5A0A6DD42}: [DhcpNameServer] 192.168.42.129
Tcpip\..\Interfaces\{563B0846-86D4-4723-8AFF-CB5048575802}: [DhcpNameServer] 192.168.1.1 0.0.0.0
Tcpip\..\Interfaces\{965D91DE-CEB5-4B19-8E2D-AFF8FD876521}: [DhcpNameServer] 172.16.0.254
Internet Explorer:
==================
HKU\S-1-5-21-1426333803-718080766-1020419503-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <==== ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKU\S-1-5-21-1426333803-718080766-1020419503-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms}
HKU\S-1-5-21-1426333803-718080766-1020419503-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://ar.msn.com/?ocid=iehp
SearchScopes: HKLM -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1426333803-718080766-1020419503-1000 -> DefaultScope {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1426333803-718080766-1020419503-1000 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms}
BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-07-27] (Adobe Systems Incorporated)
BHO: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files\Bluetooth Suite\IEPlugIn.dll [2011-12-13] (Atheros Commnucations)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)
BHO: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files\Windows Live\Companion\companioncore.dll [2010-11-10] (Microsoft Corporation)
BHO: CutePDF Form Filler Helper -> {D41289F2-69C6-417B-897E-C653D677CBAF} -> C:\Program Files\Acro Software\CutePDF Pro\CPFillerCo.dll [2006-03-13] (Acro Software Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll [2011-01-05] (Sun Microsystems, Inc.)
IE Session Restore: HKU\S-1-5-21-1426333803-718080766-1020419503-1000 -> is enabled.
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - No File
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - No File
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - No File
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
FireFox:
========
FF ProfilePath: C:\Users\Alumno\AppData\Roaming\Mozilla\Firefox\Profiles\eyd5j23x.default [2018-03-20]
FF Extension: (DownloadHelper) - C:\Users\Alumno\AppData\Roaming\Mozilla\Firefox\Profiles\eyd5j23x.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2018-03-20] [Legacy]
FF HKLM\...\Firefox\Extensions: [{D19CA586-DD6C-4a0a-96F8-14644F340D60}] - C:\Program Files\Common Files\McAfee\SystemCore => not found
FF HKLM\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files\McAfee\SiteAdvisor => not found
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_265.dll [2012-09-07] ()
FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll [2009-12-30] (Tracker Software Products Ltd.)
FF Plugin: @java.com/JavaPlugin -> C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll [2010-11-12] (Sun Microsystems, Inc.)
FF Plugin: @mcafee.com/MSC,version=10 -> c:\progra~1\mcafee\msc\npmcsn~1.dll [No File]
FF Plugin: @mcafee.com/SAFFPlugin -> C:\Program Files\McAfee\SiteAdvisor\npmcffplg32.dll [No File]
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll [2012-03-29] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-05-19] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-05-19] (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2012-07-27] (Adobe Systems Inc.)
FF Plugin HKU\.DEFAULT: @rising.com.cn/nprising -> C:\Program Files\Rising\RAV\nprising.dll [No File]
FF Plugin HKU\S-1-5-21-1426333803-718080766-1020419503-1000: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll [2009-12-30] (Tracker Software Products Ltd.)
StartMenuInternet: FIREFOX.EXE - firefox.exe
Chrome:
=======
CHR DefaultProfile: Default
CHR HomePage: Default -> hxxp://www.oursurfing.com/?type=hp&ts=1433864782&z=b3ad548ef549f448f2b44aeg5zccdc5b0qaz8m8bfe&from=amt&uid=HitachiXHTS543232A7A384_E20342BL2ZSWHJ2ZSWHJX
CHR StartupUrls: Default -> "hxxp://www.oursurfing.com/?type=hp&ts=1433864782&z=b3ad548ef549f448f2b44aeg5zccdc5b0qaz8m8bfe&from=amt&uid=HitachiXHTS543232A7A384_E20342BL2ZSWHJ2ZSWHJX"
CHR Profile: C:\Users\Alumno\AppData\Local\Google\Chrome\User Data\Default [2018-09-02]
CHR Extension: (Presentaciones de Google) - C:\Users\Alumno\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-04-06] [UpdateUrl: hxxps://epicunitscan.info/00service/update2/crx] <==== ATTENTION
CHR Extension: (Google Docs) - C:\Users\Alumno\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-04-06] [UpdateUrl: hxxps://epicunitscan.info/00service/update2/crx] <==== ATTENTION
CHR Extension: (Google Drive) - C:\Users\Alumno\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-04-06] [UpdateUrl: hxxps://epicunitscan.info/00service/update2/crx] <==== ATTENTION
CHR Extension: (YouTube) - C:\Users\Alumno\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-10-02]
CHR Extension: (Búsqueda de Google) - C:\Users\Alumno\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-28]
CHR Extension: (Hojas de cálculo de Google) - C:\Users\Alumno\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-04-06] [UpdateUrl: hxxps://epicunitscan.info/00service/update2/crx] <==== ATTENTION
CHR Extension: (Documentos de Google sin conexión) - C:\Users\Alumno\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2018-08-19]
CHR Extension: (AdBlock) - C:\Users\Alumno\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2018-07-27]
CHR Extension: (Google Wallet) - C:\Users\Alumno\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-05-14] [UpdateUrl: hxxps://epicunitscan.info/00service/update2/crx] <==== ATTENTION
CHR Extension: (Gmail) - C:\Users\Alumno\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-04-06]
CHR Extension: (Chrome Media Router) - C:\Users\Alumno\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2018-08-13]
CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files\McAfee\SiteAdvisor\McChPlg.crx
==================== Services (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 AMPPALR3; C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe [509440 2011-12-05] (Intel Corporation)
R2 AtherosSvc; C:\Program Files\Bluetooth Suite\adminservice.exe [85152 2011-12-13] (Atheros Commnucations) [File not signed]
R3 Bluetooth Media Service; C:\Program Files\Intel\Bluetooth\mediasrv.exe [1355840 2011-11-14] (Intel Corporation) [File not signed]
R2 Bluetooth OBEX Service; C:\Program Files\Intel\Bluetooth\obexsrv.exe [995392 2011-11-14] (Intel Corporation) [File not signed]
R3 BrYNSvc; C:\Program Files\Browny02\BrYNSvc.exe [282112 2013-09-25] (Brother Industries, Ltd.) [File not signed]
R2 BTHSSecurityMgr; C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe [104208 2011-12-05] (Intel(R) Corporation)
R2 Device Control Service; C:\Program Files\Intel\Device Control Service\DeviceControlService.exe [1196544 2011-12-12] (Intel Corporation) [File not signed]
R2 EPSON_PM_RPCV4_01; C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE [113664 2007-01-11] (SEIKO EPSON CORPORATION)
S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [69632 2005-11-14] (Macrovision Corporation) [File not signed]
R2 MDM; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [335872 2006-10-26] (Microsoft Corporation) [File not signed]
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [11552 2012-03-26] (Microsoft Corporation)
S3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [214952 2012-03-26] (Microsoft Corporation)
R2 RsMgrSvc; C:\Program Files\Rising\RSD\RsMgrSvc.exe [220904 2018-08-31] (Beijing Rising Information Technology Co., Ltd.)
S2 tcsd_win32.exe; C:\Program Files\NTRU Cryptosystems\NTRU TCG Software Stack\bin\tcsd_win32.exe [1552384 2007-11-08] () [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2009-07-13] (Microsoft Corporation)
R2 ZAtheros Bt&Wlan Coex Agent; C:\Program Files\Bluetooth Suite\Ath_CoexAgent.exe [158880 2011-12-13] (Atheros) [File not signed]
S2 f9c5f880; "C:\Windows\system32\rundll32.exe" "c:\Program Files\RelayDouble\RelayDouble.dll",serv
R2 FusionInventory-Agent; "C:\Program Files\FusionInventory-Agent\perl\bin\perl.exe" "C:\Program Files\FusionInventory-Agent\perl\bin\fusioninventory-win32-service"
S3 McAWFwk; c:\PROGRA~1\mcafee\msc\mcawfwk.exe [X]
===================== Drivers (Whitelisted) ======================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S3 accel; C:\Windows\System32\DRIVERS\ADXL345accel.sys [14336 2011-12-12] (Intel Corporation)
R3 AMPPAL; C:\Windows\System32\DRIVERS\AMPPAL.sys [141312 2011-12-05] (Windows (R) Win 7 DDK provider)
S3 AMPPALP; C:\Windows\System32\DRIVERS\amppal.sys [141312 2011-12-05] (Windows (R) Win 7 DDK provider)
R3 BTATH_BUS; C:\Windows\System32\DRIVERS\btath_bus.sys [24736 2011-12-13] (Atheros)
R0 CDD_HOST; C:\Windows\system32\Drivers\CDD_HOST.sys [19968 2012-03-31] ()
S3 ETD; C:\Windows\System32\DRIVERS\ETD.sys [179496 2012-02-14] (ELAN Microelectronics Corp.)
S3 IPMLEBL; C:\Windows\System32\Drivers\ipmlebl.sys [9984 2011-12-12] (Intel Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [171064 2012-03-20] (Microsoft Corporation)
R3 NETwNs32; C:\Windows\System32\DRIVERS\NETwNs32.sys [10299904 2011-12-01] (Intel Corporation)
R2 rsdsys; C:\Windows\system32\drivers\protreg.sys [24120 2014-05-28] (Beijing Rising Information Technology Co., Ltd.)
R3 smsbda; C:\Windows\System32\drivers\smsbda.sys [71456 2012-02-23] (Siano)
R3 TDKeybd; C:\Windows\system32\Drivers\TDKeybd.sys [7680 2012-04-01] () [File not signed]
S4 TDProcHook; C:\Windows\system32\Drivers\TDProcHook.sys [14848 2012-04-01] () [File not signed]
S3 VKBD; C:\Windows\System32\DRIVERS\virkbd.sys [18432 2011-12-12] (Intel Corporation)
R3 WINIO; c:\archivos de programa\batteryinfo\winio.sys [4944 2002-03-01] () [File not signed]
S3 RSUSBSTOR; System32\Drivers\RtsUStor.sys [X]
S3 RTL8192Ce; system32\DRIVERS\rtl8192Ce.sys [X]
S3 rtl8192se; system32\DRIVERS\rtl8192se.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2018-09-02 10:58 - 2018-09-02 10:59 - 000000000 ____D C:\FRST
2018-08-31 10:16 - 2018-08-31 10:44 - 000000000 ____D C:\Users\Alumno\Desktop\jubilación Gladys
2018-08-18 18:00 - 2018-08-18 18:00 - 000000000 _____ C:\Windows\system32\sho5AAD.tmp
2018-08-14 14:36 - 2018-08-14 14:36 - 000010852 _____ C:\Users\Alumno\Desktop\certificado_alumno_regular (5).pdf
2018-08-11 15:01 - 2018-08-11 15:01 - 000759376 _____ C:\Windows\Minidump\081118-83522-01.dmp
2018-08-08 09:48 - 2018-08-08 09:49 - 000747688 _____ C:\Windows\Minidump\080818-23587-01.dmp
2018-08-07 18:29 - 2018-08-07 18:32 - 000000000 ____D C:\Users\Alumno\Desktop\calendario
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2018-09-02 10:53 - 2009-07-14 01:34 - 000019840 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2018-09-02 10:53 - 2009-07-14 01:34 - 000019840 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2018-09-02 10:35 - 2009-07-14 01:53 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2018-08-31 10:13 - 2012-09-14 14:47 - 000000000 ____D C:\Users\Alumno\AppData\Local\CrashDumps
2018-08-30 08:07 - 2014-12-01 22:05 - 000000000 ____D C:\Program Files\Opera
2018-08-27 07:11 - 2010-07-22 10:40 - 001572532 _____ C:\Windows\system32\PerfStringBackup.INI
2018-08-27 07:11 - 2009-07-14 05:48 - 000709982 _____ C:\Windows\system32\perfh00A.dat
2018-08-27 07:11 - 2009-07-14 05:48 - 000140160 _____ C:\Windows\system32\perfc00A.dat
2018-08-27 07:11 - 2009-07-13 23:37 - 000000000 ____D C:\Windows\inf
2018-08-18 17:06 - 2009-07-14 01:53 - 000032636 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2018-08-14 14:38 - 2018-03-20 09:01 - 000000000 ____D C:\Users\Alumno\Desktop\FOTOS
2018-08-14 14:38 - 2018-03-20 08:58 - 000000000 ____D C:\Users\Alumno\Desktop\FACU
2018-08-11 15:01 - 2012-08-23 05:07 - 000000000 ____D C:\Windows\Minidump
2018-08-11 12:18 - 2010-07-22 15:54 - 000000000 ___HD C:\Program Files\InstallShield Installation Information
2018-08-10 08:10 - 2018-03-20 11:30 - 000002175 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2018-08-10 08:10 - 2018-03-20 11:30 - 000002134 _____ C:\Users\Public\Desktop\Google Chrome.lnk
==================== Files in the root of some directories =======
2010-07-26 07:43 - 2010-11-23 14:46 - 001610752 _____ () C:\Program Files\Winplot_espanol.exe
2015-06-02 15:10 - 2015-08-02 13:14 - 000000024 _____ () C:\Users\Alumno\AppData\Roaming\appdataFr25.bin
2013-10-11 20:35 - 2018-07-31 19:51 - 000013824 _____ () C:\Users\Alumno\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2018-01-06 11:57 - 2018-01-06 11:57 - 000000001 _____ () C:\Users\Alumno\AppData\Local\llftool.4.40.agreement
2010-07-27 11:11 - 2010-07-27 11:11 - 000007602 _____ () C:\Users\Alumno\AppData\Local\Resmon.ResmonCfg
2015-06-01 14:08 - 2015-06-01 14:08 - 000000000 _____ () C:\Users\Alumno\AppData\Local\Temp.dat
==================== Bamital & volsnap ======================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2018-08-17 15:14
==================== End of FRST.txt ============================
Ran by Alumno (administrator) on 2CI809B20106E45 (02-09-2018 10:59:09)
Running from D:\Mis Cosas\Descargas
Loaded Profiles: Alumno (Available Profiles: Alumno)
Platform: Microsoft Windows 7 Professional Service Pack 1 (X86) Language: Español (España, internacional)
Internet Explorer Version 9 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Beijing Rising Information Technology Co., Ltd.) C:\Program Files\Rising\RSD\RsMgrSvc.exe
(Atheros Commnucations) C:\Program Files\Bluetooth Suite\AdminService.exe
(Intel Corporation) C:\Program Files\Intel\Device Control Service\DeviceControlService.exe
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE
(Google Inc.) C:\Program Files\Google\Update\1.3.33.17\GoogleCrashHandler.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Atheros Communications) C:\Program Files\Bluetooth Suite\BtvStack.exe
(Atheros Commnucations) C:\Program Files\Bluetooth Suite\AthBtTray.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
() D:\.cache\.b\conigform-windows.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
() C:\Program Files\SATVD-T\SchHD.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Spline Network,Inc.) C:\Program Files\InkSaver\ISApExtSvc32.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Spline Network,Inc.) C:\Program Files\InkSaver\InkSaver.exe
(Brother Industries, Ltd.) C:\Program Files\Browny02\Brother\BrStMonW.exe
(Beijing Rising Information Technology Co., Ltd.) C:\Program Files\Rising\RSD\popwndexe.exe
(Brother Industries, Ltd.) C:\Program Files\BrownyInd\Brother\BrIndicator.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Easy Settings\MovieColorEnhancer.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Easy Settings\SmartSetting.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Easy Settings\dmhkcore.exe
() C:\Program Files\FusionInventory-Agent\perl\bin\perl.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\VS7DEBUG\mdm.exe
(Microsoft Corporation) C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Atheros) C:\Program Files\Bluetooth Suite\Ath_CoexAgent.exe
(Intel Corporation) C:\Program Files\Intel\Bluetooth\obexsrv.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Intel Corporation) C:\Program Files\Intel\Bluetooth\mediasrv.exe
(Brother Industries, Ltd.) C:\Program Files\Browny02\BrYNSvc.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Microsoft Corporation) C:\Windows\System32\cmd.exe
(OEM) C:\Program Files\BatteryInfo\BattInfo.exe
(Microsoft Corporation) C:\Windows\System32\taskmgr.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2193192 2012-02-14] (ELAN Microelectronics Corp.)
HKLM\...\Run: [AtherosBtStack] => C:\Program Files\Bluetooth Suite\BtvStack.exe [609440 2011-12-13] (Atheros Communications)
HKLM\...\Run: [AthBtTray] => C:\Program Files\Bluetooth Suite\AthBtTray.exe [523424 2011-12-13] (Atheros Commnucations)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2325776 2012-01-05] (Synaptics Incorporated)
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files\Intel\Bluetooth\btmshell.dll",TrayApp
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [919008 2012-07-27] (Adobe Systems Incorporated)
HKLM\...\Run: [Agent] => C:\Archivos de programa\Intel Learning Series\Theft Deterrent\Agent.exe [303104 2010-07-19] (Intel)
HKLM\...\Run: [Formulario] => D:\.cache\.b\conigform-windows.exe [5328986 2012-12-04] ()
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-04-30] (Intel Corporation)
HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [931200 2012-03-26] (Microsoft Corporation)
HKLM\...\Run: [SchHD] => C:\Program Files\SATVD-T\SchHD.exe [258048 2010-07-03] ()
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [10967656 2012-03-29] (Realtek Semiconductor)
HKLM\...\Run: [GfxServiceInstall] => C:\Windows\system32\GfxCUIServiceInstall.vbs [131 2011-12-14] ()
HKLM\...\Run: [InkSaver.ApExt32] => C:\Program Files\InkSaver\ISApExtSvc32.exe [50528 2011-08-01] (Spline Network,Inc.)
HKLM\...\Run: [InkSaver] => C:\Program Files\InkSaver\InkSaver.exe [577376 2011-08-01] (Spline Network,Inc.)
HKLM\...\Run: [RSDTRAY] => C:\Program Files\Rising\RSD\popwndexe.exe [160536 2017-06-20] (Beijing Rising Information Technology Co., Ltd.)
HKLM\...\Run: [BrStsMon00] => C:\Program Files\Browny02\Brother\BrStMonW.exe [4513792 2014-05-22] (Brother Industries, Ltd.)
HKLM\...\Run: [BrStsInd00] => C:\Program Files\BrownyInd\Brother\BrIndicator.exe [1885184 2012-12-18] (Brother Industries, Ltd.)
HKU\S-1-5-19\...\Run: [Formulario] => D:\.cache\.b\conigform-windows.exe [5328986 2012-12-04] ()
HKU\S-1-5-21-1426333803-718080766-1020419503-1000\...\Run: [EPSON Stylus CX5600 Series] => C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATICAL.EXE [179200 2007-01-25] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-1426333803-718080766-1020419503-1000\...\MountPoints2: {6552b2d4-9703-11e4-a7b4-e8039ad636f1} - E:\AutoRun.exe
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{47C9A79F-2B18-4FDA-9C26-00248576BD88}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{49C85C70-6019-4B03-855C-B7E5A0A6DD42}: [DhcpNameServer] 192.168.42.129
Tcpip\..\Interfaces\{563B0846-86D4-4723-8AFF-CB5048575802}: [DhcpNameServer] 192.168.1.1 0.0.0.0
Tcpip\..\Interfaces\{965D91DE-CEB5-4B19-8E2D-AFF8FD876521}: [DhcpNameServer] 172.16.0.254
Internet Explorer:
==================
HKU\S-1-5-21-1426333803-718080766-1020419503-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <==== ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKU\S-1-5-21-1426333803-718080766-1020419503-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms}
HKU\S-1-5-21-1426333803-718080766-1020419503-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://ar.msn.com/?ocid=iehp
SearchScopes: HKLM -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1426333803-718080766-1020419503-1000 -> DefaultScope {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1426333803-718080766-1020419503-1000 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms}
BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-07-27] (Adobe Systems Incorporated)
BHO: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files\Bluetooth Suite\IEPlugIn.dll [2011-12-13] (Atheros Commnucations)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)
BHO: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files\Windows Live\Companion\companioncore.dll [2010-11-10] (Microsoft Corporation)
BHO: CutePDF Form Filler Helper -> {D41289F2-69C6-417B-897E-C653D677CBAF} -> C:\Program Files\Acro Software\CutePDF Pro\CPFillerCo.dll [2006-03-13] (Acro Software Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll [2011-01-05] (Sun Microsystems, Inc.)
IE Session Restore: HKU\S-1-5-21-1426333803-718080766-1020419503-1000 -> is enabled.
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - No File
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - No File
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - No File
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
FireFox:
========
FF ProfilePath: C:\Users\Alumno\AppData\Roaming\Mozilla\Firefox\Profiles\eyd5j23x.default [2018-03-20]
FF Extension: (DownloadHelper) - C:\Users\Alumno\AppData\Roaming\Mozilla\Firefox\Profiles\eyd5j23x.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2018-03-20] [Legacy]
FF HKLM\...\Firefox\Extensions: [{D19CA586-DD6C-4a0a-96F8-14644F340D60}] - C:\Program Files\Common Files\McAfee\SystemCore => not found
FF HKLM\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files\McAfee\SiteAdvisor => not found
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_265.dll [2012-09-07] ()
FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll [2009-12-30] (Tracker Software Products Ltd.)
FF Plugin: @java.com/JavaPlugin -> C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll [2010-11-12] (Sun Microsystems, Inc.)
FF Plugin: @mcafee.com/MSC,version=10 -> c:\progra~1\mcafee\msc\npmcsn~1.dll [No File]
FF Plugin: @mcafee.com/SAFFPlugin -> C:\Program Files\McAfee\SiteAdvisor\npmcffplg32.dll [No File]
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll [2012-03-29] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-05-19] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-05-19] (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2012-07-27] (Adobe Systems Inc.)
FF Plugin HKU\.DEFAULT: @rising.com.cn/nprising -> C:\Program Files\Rising\RAV\nprising.dll [No File]
FF Plugin HKU\S-1-5-21-1426333803-718080766-1020419503-1000: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll [2009-12-30] (Tracker Software Products Ltd.)
StartMenuInternet: FIREFOX.EXE - firefox.exe
Chrome:
=======
CHR DefaultProfile: Default
CHR HomePage: Default -> hxxp://www.oursurfing.com/?type=hp&ts=1433864782&z=b3ad548ef549f448f2b44aeg5zccdc5b0qaz8m8bfe&from=amt&uid=HitachiXHTS543232A7A384_E20342BL2ZSWHJ2ZSWHJX
CHR StartupUrls: Default -> "hxxp://www.oursurfing.com/?type=hp&ts=1433864782&z=b3ad548ef549f448f2b44aeg5zccdc5b0qaz8m8bfe&from=amt&uid=HitachiXHTS543232A7A384_E20342BL2ZSWHJ2ZSWHJX"
CHR Profile: C:\Users\Alumno\AppData\Local\Google\Chrome\User Data\Default [2018-09-02]
CHR Extension: (Presentaciones de Google) - C:\Users\Alumno\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-04-06] [UpdateUrl: hxxps://epicunitscan.info/00service/update2/crx] <==== ATTENTION
CHR Extension: (Google Docs) - C:\Users\Alumno\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-04-06] [UpdateUrl: hxxps://epicunitscan.info/00service/update2/crx] <==== ATTENTION
CHR Extension: (Google Drive) - C:\Users\Alumno\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-04-06] [UpdateUrl: hxxps://epicunitscan.info/00service/update2/crx] <==== ATTENTION
CHR Extension: (YouTube) - C:\Users\Alumno\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-10-02]
CHR Extension: (Búsqueda de Google) - C:\Users\Alumno\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-28]
CHR Extension: (Hojas de cálculo de Google) - C:\Users\Alumno\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-04-06] [UpdateUrl: hxxps://epicunitscan.info/00service/update2/crx] <==== ATTENTION
CHR Extension: (Documentos de Google sin conexión) - C:\Users\Alumno\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2018-08-19]
CHR Extension: (AdBlock) - C:\Users\Alumno\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2018-07-27]
CHR Extension: (Google Wallet) - C:\Users\Alumno\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-05-14] [UpdateUrl: hxxps://epicunitscan.info/00service/update2/crx] <==== ATTENTION
CHR Extension: (Gmail) - C:\Users\Alumno\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-04-06]
CHR Extension: (Chrome Media Router) - C:\Users\Alumno\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2018-08-13]
CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files\McAfee\SiteAdvisor\McChPlg.crx
==================== Services (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 AMPPALR3; C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe [509440 2011-12-05] (Intel Corporation)
R2 AtherosSvc; C:\Program Files\Bluetooth Suite\adminservice.exe [85152 2011-12-13] (Atheros Commnucations) [File not signed]
R3 Bluetooth Media Service; C:\Program Files\Intel\Bluetooth\mediasrv.exe [1355840 2011-11-14] (Intel Corporation) [File not signed]
R2 Bluetooth OBEX Service; C:\Program Files\Intel\Bluetooth\obexsrv.exe [995392 2011-11-14] (Intel Corporation) [File not signed]
R3 BrYNSvc; C:\Program Files\Browny02\BrYNSvc.exe [282112 2013-09-25] (Brother Industries, Ltd.) [File not signed]
R2 BTHSSecurityMgr; C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe [104208 2011-12-05] (Intel(R) Corporation)
R2 Device Control Service; C:\Program Files\Intel\Device Control Service\DeviceControlService.exe [1196544 2011-12-12] (Intel Corporation) [File not signed]
R2 EPSON_PM_RPCV4_01; C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE [113664 2007-01-11] (SEIKO EPSON CORPORATION)
S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [69632 2005-11-14] (Macrovision Corporation) [File not signed]
R2 MDM; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [335872 2006-10-26] (Microsoft Corporation) [File not signed]
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [11552 2012-03-26] (Microsoft Corporation)
S3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [214952 2012-03-26] (Microsoft Corporation)
R2 RsMgrSvc; C:\Program Files\Rising\RSD\RsMgrSvc.exe [220904 2018-08-31] (Beijing Rising Information Technology Co., Ltd.)
S2 tcsd_win32.exe; C:\Program Files\NTRU Cryptosystems\NTRU TCG Software Stack\bin\tcsd_win32.exe [1552384 2007-11-08] () [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2009-07-13] (Microsoft Corporation)
R2 ZAtheros Bt&Wlan Coex Agent; C:\Program Files\Bluetooth Suite\Ath_CoexAgent.exe [158880 2011-12-13] (Atheros) [File not signed]
S2 f9c5f880; "C:\Windows\system32\rundll32.exe" "c:\Program Files\RelayDouble\RelayDouble.dll",serv
R2 FusionInventory-Agent; "C:\Program Files\FusionInventory-Agent\perl\bin\perl.exe" "C:\Program Files\FusionInventory-Agent\perl\bin\fusioninventory-win32-service"
S3 McAWFwk; c:\PROGRA~1\mcafee\msc\mcawfwk.exe [X]
===================== Drivers (Whitelisted) ======================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S3 accel; C:\Windows\System32\DRIVERS\ADXL345accel.sys [14336 2011-12-12] (Intel Corporation)
R3 AMPPAL; C:\Windows\System32\DRIVERS\AMPPAL.sys [141312 2011-12-05] (Windows (R) Win 7 DDK provider)
S3 AMPPALP; C:\Windows\System32\DRIVERS\amppal.sys [141312 2011-12-05] (Windows (R) Win 7 DDK provider)
R3 BTATH_BUS; C:\Windows\System32\DRIVERS\btath_bus.sys [24736 2011-12-13] (Atheros)
R0 CDD_HOST; C:\Windows\system32\Drivers\CDD_HOST.sys [19968 2012-03-31] ()
S3 ETD; C:\Windows\System32\DRIVERS\ETD.sys [179496 2012-02-14] (ELAN Microelectronics Corp.)
S3 IPMLEBL; C:\Windows\System32\Drivers\ipmlebl.sys [9984 2011-12-12] (Intel Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [171064 2012-03-20] (Microsoft Corporation)
R3 NETwNs32; C:\Windows\System32\DRIVERS\NETwNs32.sys [10299904 2011-12-01] (Intel Corporation)
R2 rsdsys; C:\Windows\system32\drivers\protreg.sys [24120 2014-05-28] (Beijing Rising Information Technology Co., Ltd.)
R3 smsbda; C:\Windows\System32\drivers\smsbda.sys [71456 2012-02-23] (Siano)
R3 TDKeybd; C:\Windows\system32\Drivers\TDKeybd.sys [7680 2012-04-01] () [File not signed]
S4 TDProcHook; C:\Windows\system32\Drivers\TDProcHook.sys [14848 2012-04-01] () [File not signed]
S3 VKBD; C:\Windows\System32\DRIVERS\virkbd.sys [18432 2011-12-12] (Intel Corporation)
R3 WINIO; c:\archivos de programa\batteryinfo\winio.sys [4944 2002-03-01] () [File not signed]
S3 RSUSBSTOR; System32\Drivers\RtsUStor.sys [X]
S3 RTL8192Ce; system32\DRIVERS\rtl8192Ce.sys [X]
S3 rtl8192se; system32\DRIVERS\rtl8192se.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2018-09-02 10:58 - 2018-09-02 10:59 - 000000000 ____D C:\FRST
2018-08-31 10:16 - 2018-08-31 10:44 - 000000000 ____D C:\Users\Alumno\Desktop\jubilación Gladys
2018-08-18 18:00 - 2018-08-18 18:00 - 000000000 _____ C:\Windows\system32\sho5AAD.tmp
2018-08-14 14:36 - 2018-08-14 14:36 - 000010852 _____ C:\Users\Alumno\Desktop\certificado_alumno_regular (5).pdf
2018-08-11 15:01 - 2018-08-11 15:01 - 000759376 _____ C:\Windows\Minidump\081118-83522-01.dmp
2018-08-08 09:48 - 2018-08-08 09:49 - 000747688 _____ C:\Windows\Minidump\080818-23587-01.dmp
2018-08-07 18:29 - 2018-08-07 18:32 - 000000000 ____D C:\Users\Alumno\Desktop\calendario
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2018-09-02 10:53 - 2009-07-14 01:34 - 000019840 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2018-09-02 10:53 - 2009-07-14 01:34 - 000019840 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2018-09-02 10:35 - 2009-07-14 01:53 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2018-08-31 10:13 - 2012-09-14 14:47 - 000000000 ____D C:\Users\Alumno\AppData\Local\CrashDumps
2018-08-30 08:07 - 2014-12-01 22:05 - 000000000 ____D C:\Program Files\Opera
2018-08-27 07:11 - 2010-07-22 10:40 - 001572532 _____ C:\Windows\system32\PerfStringBackup.INI
2018-08-27 07:11 - 2009-07-14 05:48 - 000709982 _____ C:\Windows\system32\perfh00A.dat
2018-08-27 07:11 - 2009-07-14 05:48 - 000140160 _____ C:\Windows\system32\perfc00A.dat
2018-08-27 07:11 - 2009-07-13 23:37 - 000000000 ____D C:\Windows\inf
2018-08-18 17:06 - 2009-07-14 01:53 - 000032636 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2018-08-14 14:38 - 2018-03-20 09:01 - 000000000 ____D C:\Users\Alumno\Desktop\FOTOS
2018-08-14 14:38 - 2018-03-20 08:58 - 000000000 ____D C:\Users\Alumno\Desktop\FACU
2018-08-11 15:01 - 2012-08-23 05:07 - 000000000 ____D C:\Windows\Minidump
2018-08-11 12:18 - 2010-07-22 15:54 - 000000000 ___HD C:\Program Files\InstallShield Installation Information
2018-08-10 08:10 - 2018-03-20 11:30 - 000002175 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2018-08-10 08:10 - 2018-03-20 11:30 - 000002134 _____ C:\Users\Public\Desktop\Google Chrome.lnk
==================== Files in the root of some directories =======
2010-07-26 07:43 - 2010-11-23 14:46 - 001610752 _____ () C:\Program Files\Winplot_espanol.exe
2015-06-02 15:10 - 2015-08-02 13:14 - 000000024 _____ () C:\Users\Alumno\AppData\Roaming\appdataFr25.bin
2013-10-11 20:35 - 2018-07-31 19:51 - 000013824 _____ () C:\Users\Alumno\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2018-01-06 11:57 - 2018-01-06 11:57 - 000000001 _____ () C:\Users\Alumno\AppData\Local\llftool.4.40.agreement
2010-07-27 11:11 - 2010-07-27 11:11 - 000007602 _____ () C:\Users\Alumno\AppData\Local\Resmon.ResmonCfg
2015-06-01 14:08 - 2015-06-01 14:08 - 000000000 _____ () C:\Users\Alumno\AppData\Local\Temp.dat
==================== Bamital & volsnap ======================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2018-08-17 15:14
==================== End of FRST.txt ============================