Buenas noches: Me apena regresar con un problema al foro, pero necesito ayuda y Uds son especiales en esto. Hace cerca de 2 meses instalé el firewall de ZoneAlarm para probar como iba (deshabilitando el de Windows). Todo bien hasta hace varios dias que el pc comenzó a ponerse lento, bastante lento y observé que el led del HD se quedaba fijo constantemente. Primero chequeé el disco -sin problemas- y luego verifiqué en el Monitor de Recursos qué era lo que desbordaba el HD. Resultó ser que -parece- la instalación del Zone Alarm venía “premiada”: Se me ha instalado un software de Checkpoint con los siguientes servicios corriendo—TESvc [Checkpoint Sandblast Agent Threat Emulation], Remediation Service [Checkpoint Endpoint Remediation], CpSbaUpdater [Checkpoint Sandblast Agent Updater] y CpSbaCipolla [Checkpoint Sandblast Agent Cipolla]. Por supuesto que concientemente no he instalado nada de este programa. No aparece Checkpoint en la lista de programas instalados, pero en C me aparece una carpeta Checkpoint tanto en Program Files como en Program Data. Tambien me han aparecido en las bibliotecas del usuario principal y de acceso público (Docus, Imagenes, música y videos) dos carpetas con nombres “Check-Point Security Folder Do not remove”, “0Check-Point0Security0Data Do not Discard”. He pasado el Farbar Recovery para adelantar el trabajo y aquí les pego los informes, por favor estaré inmensamente agradecido si pueden darme soluciones y desvelar este “misterio” de malware:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 23.08.2018
Ran by Chall (administrator) on CHALL-PC (03-11-2018 09:38:04)
Running from C:\Users\Chall\Desktop\ULTIMATE KILLERS
Loaded Profiles: Chall (Available Profiles: Chall)
Platform: Microsoft Windows 7 Ultimate Service Pack 1 (X86) Language: Inglés (Estados Unidos)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\aswidsagent.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(CANON INC.) C:\Windows\System32\CAP3RSK.EXE
(CANON INC.) C:\Windows\System32\spool\drivers\w32x86\3\CAP3SWK.EXE
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner.exe
() C:\Program Files\CheckPoint\Endpoint Security\TPCommon\Cipolla\SBACipollaSrvHost.exe
(Check Point Software Technologies Ltd.) C:\Program Files\CheckPoint\Endpoint Security\Remediation\RemediationService.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\CompatTelRunner.exe
(Microsoft Corporation) C:\Windows\System32\CompatTelRunner.exe
(Microsoft Corporation) C:\Windows\System32\CompatTelRunner.exe
(Check Point Software Technologies Ltd.) C:\Program Files\CheckPoint\Endpoint Security\Threat Emulation\TESvc.exe
==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvLaunch.exe [242392 2018-10-22] (AVAST Software)
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-21-323702564-4217161790-1439062527-1000\...\Run: [CCleaner Smart Cleaning] => C:\Program Files\CCleaner\CCleaner.exe [14544792 2018-10-23] (Piriform Ltd)
GroupPolicy: Restriction - Chrome <==== ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [122128 2015-08-12] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 80.58.61.254 80.58.61.250
Tcpip\..\Interfaces\{9F8CFC05-B512-4BE1-9087-6DFCE53C001B}: [DhcpNameServer] 80.58.61.254 80.58.61.250
Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <==== ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-323702564-4217161790-1439062527-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-323702564-4217161790-1439062527-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.es/
BHO: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files\Evernote\Evernote\EvernoteIE.dll [2018-03-30] (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
Toolbar: HKU\S-1-5-21-323702564-4217161790-1439062527-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
FireFox:
========
FF Plugin: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xdp -> C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [No File]
FF Plugin: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [No File]
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-10-01] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-10-01] (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.2.6 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2018-08-09] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.8 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2018-08-09] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=3.0.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2018-08-09] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=3.0.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2018-08-09] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=3.0.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2018-08-09] (VideoLAN)
Chrome:
=======
CHR StartupUrls: Default -> "hxxps://www.google.es/"
CHR Profile: C:\Users\Chall\AppData\Local\Google\Chrome\User Data\Default [2018-10-30]
CHR Extension: (Presentaciones) - C:\Users\Chall\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2018-10-01]
CHR Extension: (Documentos) - C:\Users\Chall\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2018-10-01]
CHR Extension: (Google Drive) - C:\Users\Chall\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2018-10-01]
CHR Extension: (YouTube) - C:\Users\Chall\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2018-10-01]
CHR Extension: (Hojas de cálculo) - C:\Users\Chall\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2018-10-01]
CHR Extension: (Documentos de Google sin conexión) - C:\Users\Chall\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2018-10-01]
CHR Extension: (Avast Online Security) - C:\Users\Chall\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2018-10-01]
CHR Extension: (Sistema de pagos de Chrome Web Store) - C:\Users\Chall\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2018-10-01]
CHR Extension: (Gmail) - C:\Users\Chall\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2018-10-01]
CHR Extension: (Chrome Media Router) - C:\Users\Chall\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2018-10-26]
CHR HKLM\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - hxxps://clients2.google.com/service/update2/crx
==================== Services (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R3 aswbIDSAgent; C:\Program Files\AVAST Software\Avast\aswidsagent.exe [6800144 2018-10-22] (AVAST Software)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [325024 2018-10-22] (AVAST Software)
S2 CPEFR; C:\Program Files\CheckPoint\Endpoint Security\EFR\EFRService.exe [2498296 2018-05-30] (Check Point Software Technologies Ltd.)
R2 CpSbaCipolla; C:\Program Files\CheckPoint\Endpoint Security\TPCommon\Cipolla\SBACipollaSrvHost.exe [35064 2018-03-20] ()
R2 CpSbaUpdater; C:\Program Files\CheckPoint\Endpoint Security\TPCommon\Cipolla\SBACipollaSrvHost.exe [35064 2018-03-20] ()
S3 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [5073376 2018-09-19] (Malwarebytes)
R2 RemediationService; C:\Program Files\CheckPoint\Endpoint Security\Remediation\RemediationService.exe [17656 2018-03-22] (Check Point Software Technologies Ltd.)
S4 ss_conn_service; C:\Program Files\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe [752224 2017-01-16] (DEVGURU Co., LTD.)
R2 TESvc; C:\Program Files\CheckPoint\Endpoint Security\Threat Emulation\TESvc.exe [196344 2018-04-23] (Check Point Software Technologies Ltd.)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2014-03-12] (Microsoft Corporation)
===================== Drivers (Whitelisted) ======================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R1 aswArPot; C:\Windows\System32\drivers\aswArPot.sys [167648 2018-10-22] (AVAST Software)
R1 aswbidsdriver; C:\Windows\System32\drivers\aswbidsdriverx.sys [188952 2018-10-22] (AVAST Software)
R0 aswbidsh; C:\Windows\System32\drivers\aswbidshx.sys [165552 2018-10-22] (AVAST Software)
R0 aswblog; C:\Windows\System32\drivers\aswblogx.sys [284424 2018-10-22] (AVAST Software)
R0 aswbuniv; C:\Windows\System32\drivers\aswbunivx.sys [58072 2018-10-22] (AVAST Software)
R1 aswHdsKe; C:\Windows\System32\drivers\aswHdsKe.sys [139008 2018-10-22] (AVAST Software)
S3 aswHwid; C:\Windows\System32\drivers\aswHwid.sys [42912 2018-10-22] (AVAST Software)
R1 aswKbd; C:\Windows\System32\drivers\aswKbd.sys [40864 2018-10-22] (AVAST Software)
R2 aswMonFlt; C:\Windows\System32\drivers\aswMonFlt.sys [135368 2018-10-22] (AVAST Software)
R1 aswRdr; C:\Windows\System32\drivers\aswRdr2.sys [101152 2018-10-22] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\drivers\aswRvrt.sys [72968 2018-10-22] (AVAST Software)
R1 aswSnx; C:\Windows\System32\drivers\aswSnx.sys [784728 2018-10-22] (AVAST Software)
R1 aswSP; C:\Windows\System32\drivers\aswSP.sys [397136 2018-10-22] (AVAST Software)
R2 aswStm; C:\Windows\System32\drivers\aswStm.sys [157112 2018-10-22] (AVAST Software)
R0 aswVmm; C:\Windows\System32\drivers\aswVmm.sys [310880 2018-10-22] (AVAST Software)
S3 dg_ssudbus; C:\Windows\System32\DRIVERS\ssudbus.sys [109184 2017-01-16] (Samsung Electronics Co., Ltd.)
S3 ew_usbccgpfilter; C:\Windows\System32\DRIVERS\ew_usbccgpfilter.sys [15360 2018-04-20] (Huawei Technologies Co., Ltd.)
R2 MBAMChameleon; C:\Windows\System32\Drivers\MbamChameleon.sys [173496 2018-10-29] (Malwarebytes)
S3 MBAMSwissArmy; C:\Windows\System32\Drivers\mbamswissarmy.sys [229568 2018-10-29] (Malwarebytes)
S3 PortTalk; C:\Windows\System32\Drivers\PortTalk.sys [3567 2002-01-12] (Beyond Logic hxxp://www.beyondlogic.org) [File not signed]
S3 ssudmdm; C:\Windows\System32\DRIVERS\ssudmdm.sys [147072 2017-01-16] (Samsung Electronics Co., Ltd.)
S3 usbUDisc; C:\Windows\System32\DRIVERS\USBDrv.sys [14936 2013-01-25] (Scott)
R1 vcdrom; D:\Appls\IMG_reader\VCdRom.sys [8576 2001-12-19] (Microsoft Corporation) [File not signed]
S3 catchme; \??\C:\Users\Chall\AppData\Local\Temp\catchme.sys [X] <==== ATTENTION
U5 hw_usbdev; C:\Windows\System32\Drivers\hw_usbdev.sys [102272 2018-04-20] (Huawei Technologies Co., Ltd.)
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2018-11-02 10:41 - 2018-11-03 09:38 - 000000000 ____D C:\FRST
2018-11-01 21:23 - 2018-11-01 21:30 - 000000000 ____D C:\Users\Chall\Desktop\INFOSPYware
2018-11-01 20:01 - 2018-11-01 20:01 - 000000000 ____D C:\KVRT_Data
2018-11-01 11:12 - 2018-11-01 11:12 - 000000000 ____D C:\Windows\Standalone System Sweeper
2018-10-31 16:56 - 2018-10-31 17:21 - 000205016 _____ C:\TDSSKiller.3.1.0.17_31.10.2018_16.56.22_log.txt
2018-10-31 16:38 - 2018-10-31 16:52 - 000002124 _____ C:\Users\Chall\Desktop\Rkill.txt
2018-10-31 15:57 - 2018-11-02 10:43 - 000000000 ____D C:\Users\Chall\Desktop\ULTIMATE KILLERS
2018-10-30 23:17 - 2018-11-02 10:38 - 000104372 _____ C:\Windows\ntbtlog.txt
2018-10-29 20:47 - 2018-10-29 20:47 - 000173496 _____ (Malwarebytes) C:\Windows\system32\Drivers\MbamChameleon.sys
2018-10-29 20:46 - 2018-10-29 20:46 - 000229568 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamswissarmy.sys
2018-10-28 21:46 - 2018-10-28 21:46 - 006985848 _____ (ESET spol. s r.o.) C:\Users\Chall\Downloads\esetonlinescanner_esn (1).exe
2018-10-28 20:29 - 2018-10-28 20:30 - 080022264 _____ (Malwarebytes ) C:\Users\Chall\Downloads\mb3-setup-2005.2005-3.6.1.2711-1.0.463-1.0.6913.exe
2018-10-28 16:30 - 2018-10-28 16:31 - 018072104 _____ (Piriform Ltd) C:\Users\Chall\Downloads\ccsetup548.exe
2018-10-26 14:01 - 2018-10-26 14:01 - 000000000 ____D C:\Users\Chall\AppData\Local\Acronis_International_Gmb
2018-10-26 13:55 - 2018-10-28 16:10 - 000000000 ____D C:\ProgramData\Acronis
2018-10-26 13:44 - 2018-10-26 13:44 - 000000000 _____ C:\Windows\cpepmon.mlf
2018-10-25 11:33 - 2018-10-25 11:33 - 000000000 ____D C:\Users\Chall\AppData\Local\Foxit Reader
2018-10-24 12:21 - 2018-10-24 12:21 - 002969488 _____ (BitTorrent Inc.) C:\Users\Chall\Downloads\uTorrent.exe
2018-10-24 09:49 - 2018-10-24 10:00 - 000000000 ____D C:\Program Files\Solvusoft
2018-10-24 09:49 - 2018-10-24 09:59 - 000000000 ____D C:\Users\Chall\AppData\Roaming\Solvusoft
2018-10-23 20:18 - 2018-10-23 20:18 - 000143505 _____ C:\Users\Chall\Downloads\Extracto_Movimientos_Tarjeta (5).pdf
2018-10-23 20:01 - 2018-10-23 20:01 - 000019696 _____ C:\Users\Chall\Downloads\SEAL_Team_1x15.torrent
2018-10-23 20:00 - 2018-10-23 20:00 - 000022729 _____ C:\Users\Chall\Downloads\SEAL_Team_1x22.torrent
2018-10-23 20:00 - 2018-10-23 20:00 - 000021429 _____ C:\Users\Chall\Downloads\SEAL_Team_1x21.torrent
2018-10-23 20:00 - 2018-10-23 20:00 - 000020065 _____ C:\Users\Chall\Downloads\SEAL_Team_1x20.torrent
2018-10-23 20:00 - 2018-10-23 20:00 - 000019765 _____ C:\Users\Chall\Downloads\SEAL_Team_1x19.torrent
2018-10-23 20:00 - 2018-10-23 20:00 - 000019044 _____ C:\Users\Chall\Downloads\SEAL_Team_1x18.torrent
2018-10-23 19:59 - 2018-10-23 19:59 - 000019894 _____ C:\Users\Chall\Downloads\SEAL_Team_1x13.torrent
2018-10-23 19:59 - 2018-10-23 19:59 - 000019862 _____ C:\Users\Chall\Downloads\SEAL_Team_1x12.torrent
2018-10-23 19:59 - 2018-10-23 19:59 - 000019574 _____ C:\Users\Chall\Downloads\SEAL_Team_1x14.torrent
2018-10-23 19:59 - 2018-10-23 19:59 - 000019497 _____ C:\Users\Chall\Downloads\SEAL_Team_1x17.torrent
2018-10-23 19:59 - 2018-10-23 19:59 - 000019497 _____ C:\Users\Chall\Downloads\SEAL_Team_1x16.torrent
2018-10-23 19:59 - 2018-10-23 19:59 - 000016355 _____ C:\Users\Chall\Downloads\SEAL_Team_1x15_720p.torrent
2018-10-23 19:58 - 2018-10-23 19:58 - 000019923 _____ C:\Users\Chall\Downloads\SEAL_Team_1x11.torrent
2018-10-23 19:58 - 2018-10-23 19:58 - 000019923 _____ C:\Users\Chall\Downloads\SEAL_Team_1x10.torrent
2018-10-23 19:58 - 2018-10-23 19:58 - 000019642 _____ C:\Users\Chall\Downloads\SEAL_Team_1x09.torrent
2018-10-23 19:58 - 2018-10-23 19:58 - 000019502 _____ C:\Users\Chall\Downloads\SEAL_Team_1x08.torrent
2018-10-22 08:37 - 2018-10-22 08:34 - 000040864 _____ (AVAST Software) C:\Windows\system32\Drivers\aswKbd.sys
2018-10-22 08:36 - 2018-10-22 08:34 - 000323288 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2018-10-18 14:16 - 2018-10-18 14:18 - 000000000 ___RD C:\Users\Chall\Desktop\EXPENCES
2018-10-18 10:19 - 2018-10-18 10:21 - 000000777 _____ C:\Users\Chall\Desktop\CALIBRE BOOKS.lnk
2018-10-18 10:05 - 2018-10-18 10:06 - 000000000 ____D C:\Calibre Portable
2018-10-18 09:42 - 2018-10-18 09:42 - 000000000 ____D C:\Users\Chall\AppData\Local\calibre-cache
2018-10-18 09:40 - 2018-10-18 09:42 - 000000000 ____D C:\Users\Chall\AppData\Roaming\calibre
2018-10-17 18:38 - 2001-12-19 10:45 - 000008576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\VCdRom.sys
2018-10-17 18:19 - 2018-10-17 18:19 - 000061064 _____ C:\Users\Chall\Documents\winxpvirtualcdcontrolpanel_21.exe
2018-10-13 09:03 - 2018-10-13 09:03 - 000490553 _____ C:\Users\Chall\Downloads\2018_10_182811000476215.pdf
2018-10-10 18:19 - 2018-10-10 18:19 - 004638800 _____ C:\Users\Chall\Downloads\286410-IRAN.pdf
2018-10-10 12:49 - 2018-10-10 12:50 - 000000000 ____D C:\Users\Chall\Documents\Jama -como hacer
2018-10-09 20:41 - 2018-10-25 14:53 - 000000000 ____D C:\Users\Chall\AppData\Roaming\MPC-HC
2018-10-09 20:25 - 2018-10-09 20:38 - 000000000 ____D C:\ProgramData\Vso
2018-10-09 20:25 - 2018-10-09 20:25 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VSO
2018-10-09 20:25 - 2018-10-09 20:25 - 000000000 ____D C:\Program Files\VSO
2018-10-09 20:24 - 2018-10-09 20:25 - 000000000 ____D C:\Users\Chall\AppData\Roaming\VSO
2018-10-09 20:24 - 2018-10-09 20:23 - 002225624 _____ C:\Users\Chall\Documents\WebInstall_vmp.exe
2018-10-09 20:23 - 2018-10-09 20:23 - 002225624 _____ C:\Users\Chall\Downloads\WebInstall_vmp.exe
2018-10-08 20:53 - 2018-10-08 20:53 - 000000000 ____D C:\Program Files\GRETECH
2018-10-08 16:39 - 2018-10-30 21:39 - 000000000 ____D C:\Users\Chall\AppData\Roaming\vlc
2018-10-08 16:27 - 2018-10-08 16:27 - 040210008 _____ C:\Users\Chall\Downloads\vlc-3.0.4-win32 (2).exe
2018-10-08 14:29 - 2018-10-08 14:30 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2018-10-07 20:27 - 2018-10-07 20:27 - 000000000 ____D C:\Program Files\MPC-HC
2018-10-07 19:50 - 2018-10-07 19:49 - 018737949 _____ C:\Users\Chall\Documents\MPC-HC.1.7.13.x86.zip
2018-10-07 12:29 - 2018-10-10 07:44 - 000000000 ____D C:\Program Files\DVDVideoSoft
2018-10-07 12:29 - 2018-10-10 07:43 - 000000000 ____D C:\Program Files\Common Files\DVDVideoSoft
2018-10-07 12:29 - 2018-10-07 12:29 - 000000000 ____D C:\ProgramData\DigitalWave.ApplicationUpdater_files
2018-10-07 12:29 - 2018-10-07 12:29 - 000000000 ____D C:\Program Files\FreeCodecPack
2018-10-07 12:28 - 2018-10-10 07:43 - 000000000 ____D C:\Users\Chall\AppData\Roaming\DVDVideoSoft
2018-10-06 22:41 - 2018-10-06 22:41 - 004047008 _____ (SOSVirus) C:\Users\Chall\Downloads\UsbFix_11.002.exe
2018-10-06 08:04 - 2018-10-06 08:04 - 000000000 ___SD C:\Users\Public\Documents\0Check-Point0Security0DataDo NotDiscard
2018-10-06 08:04 - 2018-10-06 08:04 - 000000000 ___SD C:\Users\Chall\Documents\ Check Point Security FolderDo not Remove
2018-10-05 21:22 - 2018-10-15 07:53 - 000000000 ____D C:\Program Files\UsbFix
2018-10-05 21:11 - 2018-10-05 21:12 - 000000000 ____D C:\Users\Chall\Downloads\FightersNEW
2018-10-05 20:56 - 2018-10-05 20:56 - 000415378 _____ C:\Users\Chall\Downloads\04-10-2018_Facturacion_AB5ZU0010011.pdf
2018-10-05 15:31 - 2018-10-05 15:31 - 006985848 _____ (ESET spol. s r.o.) C:\Users\Chall\Downloads\esetonlinescanner_esn.exe
2018-10-05 15:15 - 2018-10-05 15:15 - 000000000 ____D C:\Users\Chall\AppData\Local\mbamtray
2018-10-05 15:15 - 2018-10-05 15:15 - 000000000 ____D C:\Users\Chall\AppData\Local\mbam
2018-10-05 15:14 - 2018-10-29 20:44 - 000129248 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbae.sys
2018-10-05 15:14 - 2018-10-05 15:14 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2018-10-05 03:38 - 2018-11-01 11:21 - 000000000 ____D C:\Kaspersky Rescue Disk 10.0
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2018-11-03 09:04 - 2017-08-02 13:40 - 000020880 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2018-11-03 09:04 - 2017-08-02 13:40 - 000020880 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2018-11-03 08:41 - 2009-07-14 04:53 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2018-11-01 00:11 - 2018-02-22 21:34 - 000007670 _____ C:\Users\Chall\AppData\Local\resmon.resmoncfg
2018-10-31 17:44 - 2017-08-02 12:51 - 000006188 _____ C:\Windows\system32\PerfStringBackup.TMP
2018-10-31 17:44 - 2009-07-14 02:37 - 000000000 ____D C:\Windows\inf
2018-10-31 09:21 - 2018-08-14 15:30 - 000000000 ____D C:\ProgramData\CheckPoint
2018-10-30 23:19 - 2018-08-14 15:36 - 000000000 ____D C:\Program Files\CheckPoint
2018-10-30 23:06 - 2018-01-22 12:12 - 000000000 ____D C:\Users\Chall\Desktop\TECHIES
2018-10-30 21:06 - 2018-04-08 16:07 - 000000000 ____D C:\Users\Chall\Documents\FIGHTERS
2018-10-28 21:47 - 2017-08-31 18:13 - 000000000 ____D C:\Users\Chall\AppData\Local\ESET
2018-10-28 20:27 - 2018-08-13 09:45 - 000000000 ____D C:\ProgramData\SecTaskMan
2018-10-28 16:35 - 2017-07-29 20:12 - 000000000 ____D C:\Program Files\CCleaner
2018-10-28 16:26 - 2017-07-28 09:12 - 000000000 ____D C:\Users\Chall
2018-10-28 16:22 - 2018-08-27 15:37 - 000000000 ____D C:\Users\Chall\AppData\Roaming\Foxit Software
2018-10-28 16:20 - 2018-08-27 15:38 - 000000000 ____D C:\ProgramData\Foxit Software
2018-10-28 16:10 - 2018-08-14 15:56 - 000000000 ____D C:\ProgramData\Package Cache
2018-10-26 14:24 - 2017-09-09 11:25 - 000000000 ____D C:\Users\Chall\AppData\Local\CrashDumps
2018-10-26 07:39 - 2018-10-01 16:30 - 000002131 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2018-10-25 14:53 - 2018-02-18 20:28 - 000000000 ____D C:\Windows\Minidump
2018-10-25 14:53 - 2017-10-13 17:38 - 000000000 ____D C:\Users\Chall\AppData\Roaming\uTorrent
2018-10-24 12:27 - 2018-08-06 10:00 - 000000000 ____D C:\Users\Chall\Downloads\APPL's
2018-10-24 09:50 - 2009-07-14 02:04 - 000000466 _____ C:\Windows\win.ini
2018-10-23 20:18 - 2018-01-11 20:57 - 000000000 ____D C:\Users\Chall\Documents\3-BBVA-Extractos Mensuales
2018-10-23 09:23 - 2017-07-28 18:28 - 000000000 ____D C:\Windows\system32\MRT
2018-10-23 09:20 - 2017-07-28 09:11 - 133674168 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2018-10-22 08:35 - 2017-11-10 11:43 - 000167648 _____ (AVAST Software) C:\Windows\system32\Drivers\aswArPot.sys
2018-10-22 08:35 - 2017-07-28 13:21 - 000397136 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2018-10-22 08:35 - 2017-07-28 13:21 - 000310880 _____ (AVAST Software) C:\Windows\system32\Drivers\aswVmm.sys
2018-10-22 08:35 - 2017-07-28 13:21 - 000157112 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2018-10-22 08:35 - 2017-07-28 13:21 - 000135368 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2018-10-22 08:35 - 2017-07-28 13:21 - 000101152 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2018-10-22 08:35 - 2017-07-28 13:21 - 000072968 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRvrt.sys
2018-10-22 08:35 - 2017-07-28 13:21 - 000042912 _____ (AVAST Software) C:\Windows\system32\Drivers\aswHwid.sys
2018-10-22 08:34 - 2017-07-28 13:21 - 000784728 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2018-10-22 08:33 - 2017-12-22 11:00 - 000139008 _____ (AVAST Software) C:\Windows\system32\Drivers\aswHdsKe.sys
2018-10-22 08:33 - 2017-07-28 13:21 - 000284424 _____ (AVAST Software) C:\Windows\system32\Drivers\aswblogx.sys
2018-10-22 08:33 - 2017-07-28 13:21 - 000188952 _____ (AVAST Software) C:\Windows\system32\Drivers\aswbidsdriverx.sys
2018-10-22 08:33 - 2017-07-28 13:21 - 000165552 _____ (AVAST Software) C:\Windows\system32\Drivers\aswbidshx.sys
2018-10-22 08:33 - 2017-07-28 13:21 - 000058072 _____ (AVAST Software) C:\Windows\system32\Drivers\aswbunivx.sys
2018-10-19 17:58 - 2017-07-29 18:37 - 000000000 ____D C:\Users\Chall\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2018-10-19 17:58 - 2017-07-29 18:37 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2018-10-19 17:57 - 2017-07-29 18:37 - 000000000 ____D C:\Program Files\WinRAR
2018-10-14 19:58 - 2017-08-28 14:48 - 000000000 ____D C:\Users\Chall\AppData\Roaming\dvdcss
2018-10-12 10:40 - 2009-07-14 04:53 - 000032560 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2018-10-08 16:48 - 2018-05-22 12:06 - 000000886 _____ C:\Users\Chall\Desktop\H-THE BRAVE.lnk
2018-10-07 11:49 - 2017-07-29 20:10 - 000000000 ____D C:\Users\Chall\Downloads\Appls
2018-10-05 15:14 - 2018-08-29 12:54 - 000000000 ____D C:\ProgramData\Malwarebytes
2018-10-04 17:25 - 2018-07-20 14:57 - 000000000 ____D C:\Program Files\Hard Disk Sentinel
==================== Files in the root of some directories =======
2018-04-23 19:06 - 2018-04-23 19:06 - 000000337 _____ () C:\Users\Chall\AppData\Local\Perfmon.PerfmonCfg
2018-02-22 21:34 - 2018-11-01 00:11 - 000007670 _____ () C:\Users\Chall\AppData\Local\resmon.resmoncfg
==================== Bamital & volsnap ======================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2018-10-25 12:05
==================== End of FRST.txt ============================
NOTA: Tengo un segundo informe adicional que creó FSRT pero no me cabe en el mensaje, ¿como se los envio? Muchas Gracias por adelantado, esperando vuestro contacto les saluda…Rebin