SALUDOS MUCHACHOS , PODRIAN AYUDARME CON LA LECTURA DEL INFORME DE COMBOFIX Y AYUDARME A QUE HACER ?
ComboFix 19-11-04.01 - Henry 25/09/2020 21:16:35.1.2 - x86
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.58.3082.18.3071.2367 [GMT -4,5:30]
Running from: c:\users\Henry\Downloads\ComboFix.exe
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2020-08-26 to 2020-09-26 )))))))))))))))))))))))))))))))
.
.
2020-09-26 02:04 . 2020-09-26 02:04 -------- d-----w- c:\users\Invitado\AppData\Local\temp
2020-09-26 02:04 . 2020-09-26 02:04 -------- d-----w- c:\users\Default\AppData\Local\temp
2020-09-22 19:04 . 2012-08-23 14:44 14848 ----a-w- c:\windows\system32\drivers\rdpvideominiport.sys
2020-09-22 19:03 . 2012-08-23 13:52 12800 ----a-w- c:\windows\system32\RdpGroupPolicyExtension.dll
2020-09-22 19:03 . 2012-08-23 14:48 221184 ----a-w- c:\windows\system32\rdpudd.dll
2020-09-22 19:03 . 2012-08-23 11:12 192000 ----a-w- c:\windows\system32\rdpendp_winip.dll
2020-09-22 19:03 . 2012-08-23 10:08 2739712 ----a-w- c:\windows\system32\rdpcorets.dll
2020-09-22 18:56 . 2013-10-01 23:45 32256 ----a-w- c:\windows\system32\TsUsbGDCoInstaller.dll
2020-09-22 18:56 . 2013-10-02 00:32 12800 ----a-w- c:\windows\system32\TsUsbRedirectionGroupPolicyControl.exe
2020-09-22 18:56 . 2013-10-02 00:42 49152 ----a-w- c:\windows\system32\drivers\TsUsbFlt.sys
2020-09-22 18:55 . 2013-10-02 00:30 14336 ----a-w- c:\windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2020-09-22 18:55 . 2013-10-02 00:14 50176 ----a-w- c:\windows\system32\MsRdpWebAccess.dll
2020-09-22 18:55 . 2013-10-02 00:14 17920 ----a-w- c:\windows\system32\wksprtPS.dll
2020-09-22 18:55 . 2013-10-01 23:58 53248 ----a-w- c:\windows\system32\tsgqec.dll
2020-09-22 18:55 . 2013-10-01 23:08 855552 ----a-w- c:\windows\system32\rdvidcrl.dll
2020-09-22 18:55 . 2013-10-01 23:00 76288 ----a-w- c:\windows\system32\TSWbPrxy.exe
2020-09-22 18:55 . 2013-10-01 22:53 350208 ----a-w- c:\windows\system32\wksprt.exe
2020-09-22 18:55 . 2013-10-01 22:34 1068544 ----a-w- c:\windows\system32\mstsc.exe
2020-09-22 18:55 . 2013-10-01 20:55 5698048 ----a-w- c:\windows\system32\mstscax.dll
2020-09-22 18:53 . 2017-04-27 22:50 3550208 ----a-w- c:\windows\system32\D3DCompiler_47.dll
2020-09-22 18:44 . 2013-01-13 19:53 187392 ----a-w- c:\windows\system32\UIAnimation.dll
2020-09-22 18:40 . 2015-12-16 18:47 69120 ----a-w- c:\windows\system32\nlsbres.dll
2020-09-22 18:40 . 2015-12-16 18:43 6144 ----a-w- c:\windows\system32\kbdgeoqw.dll
2020-09-22 18:40 . 2015-12-16 18:43 6144 ----a-w- c:\windows\system32\KBDAZEL.DLL
2020-09-22 18:39 . 2013-09-25 01:57 792576 ----a-w- c:\windows\system32\TSWorkspace.dll
2020-09-22 18:39 . 2012-08-24 17:05 136560 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
2020-09-22 18:39 . 2012-08-24 17:02 369856 ----a-w- c:\windows\system32\drivers\cng.sys
2020-09-22 18:39 . 2012-08-24 16:57 247808 ----a-w- c:\windows\system32\schannel.dll
2020-09-22 18:39 . 2012-08-24 16:57 220160 ----a-w- c:\windows\system32\ncrypt.dll
2020-09-22 18:39 . 2012-08-24 16:56 1039360 ----a-w- c:\windows\system32\lsasrv.dll
2020-09-22 18:39 . 2012-06-02 04:45 67440 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2020-09-22 18:39 . 2011-11-17 05:29 22528 ----a-w- c:\windows\system32\lsass.exe
2020-09-22 18:39 . 2011-11-17 05:34 15872 ----a-w- c:\windows\system32\sspisrv.dll
2020-09-22 18:39 . 2011-11-17 05:34 100352 ----a-w- c:\windows\system32\sspicli.dll
2020-09-22 18:39 . 2011-11-17 05:34 22016 ----a-w- c:\windows\system32\secur32.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2020-07-17 23:28 . 2020-07-17 23:28 859760 ----a-w- c:\programdata\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe
2020-07-17 20:08 . 2009-07-14 02:05 152576 ----a-w- c:\windows\system32\msclmd.dll
2020-07-11 06:58 . 2020-07-11 06:57 127229528 -c--a-w- c:\windows\system32\MRT-KB890830.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ OneDrive1]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2020-07-17 23:39 329376 ----a-w- c:\users\Henry\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\FileSyncShell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ OneDrive2]
@="{5AB7172C-9C11-405C-8DD5-AF20F3606282}"
[HKEY_CLASSES_ROOT\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}]
2020-07-17 23:39 329376 ----a-w- c:\users\Henry\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\FileSyncShell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ OneDrive3]
@="{A78ED123-AB77-406B-9962-2A5D9D2F7F30}"
[HKEY_CLASSES_ROOT\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}]
2020-07-17 23:39 329376 ----a-w- c:\users\Henry\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\FileSyncShell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ OneDrive4]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2020-07-17 23:39 329376 ----a-w- c:\users\Henry\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\FileSyncShell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ OneDrive5]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2020-07-17 23:39 329376 ----a-w- c:\users\Henry\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\FileSyncShell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]
@="{8BA85C75-763B-4103-94EB-9470F12FE0F7}"
[HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]
2020-07-17 23:31 1513592 ----a-w- c:\program files\Microsoft Office\root\Office16\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]
@="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}"
[HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]
2020-07-17 23:31 1513592 ----a-w- c:\program files\Microsoft Office\root\Office16\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]
@="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}"
[HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]
2020-07-17 23:31 1513592 ----a-w- c:\program files\Microsoft Office\root\Office16\GROOVEEX.DLL
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BlueStacks Agent"="c:\program files\Bluestacks\HD-Agent.exe" [2016-07-04 970264]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-02-11 61440]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"SPReview"="c:\windows\System32\SPReview\SPReview.exe" [2020-07-17 280576]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R2 MBAMChameleon;MBAMChameleon;c:\windows\System32\Drivers\MbamChameleon.sys [x]
R3 BstHdAndroidSvc;BlueStacks Android Service ;c:\program files\Bluestacks\HD-Service.exe BstHdAndroidSvc Android [x]
R3 BstHdDrv;BlueStacks Hypervisor;c:\program files\Bluestacks\HD-Hypervisor-x86.sys [2016-07-04 139360]
R3 BstHdLogRotatorSvc;BlueStacks Log Rotator Service;c:\program files\Bluestacks\HD-LogRotatorService.exe [2016-07-04 421400]
R3 BstHdPlusAndroidSvc;BlueStacks Plus Android Service ;c:\program files\Bluestacks\HD-Plus-Service.exe BstHdPlusAndroidSvc Android [x]
R3 BstkDrv;BlueStacks Plus Hypervisor;c:\program files\Bluestacks\BstkDrv.sys [2016-07-04 220216]
R3 GoogleChromeElevationService;Google Chrome Elevation Service (GoogleChromeElevationService);c:\program files\Google\Chrome\Application\85.0.4183.102\elevation_service.exe [2020-09-04 1085424]
R3 massfilter_hs;HS HandSet Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter_hs.sys [2012-06-20 17672]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\System32\Drivers\mbamswissarmy.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 14848]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2013-10-02 49152]
S2 ClickToRunSvc;Servicio Hacer clic y ejecutar de Microsoft Office;c:\program files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [2015-08-16 1776216]
S3 yukonw7;Controlador de minipuerto NDIS6.2 para controladora Ethernet de Marvell Yukon;c:\windows\system32\DRIVERS\yk62x86.sys [2009-07-13 311296]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2020-09-08 17:10 2373104 ----a-w- c:\program files\Google\Chrome\Application\85.0.4183.102\Installer\chrmstp.exe
.
.
------- Supplementary Scan -------
.
IE: E&xport to Microsoft Excel - c:\program files\Microsoft Office\Root\Office16\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\program files\Microsoft Office\Root\Office16\ONBttnIE.dll/105
TCP: DhcpNameServer = 192.168.0.1
TCP: Interfaces\{F09ECC45-AE51-4C19-9E7D-DEF15E164CF9}: NameServer = 8.8.8.8,8.8.4.4
Handler: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - c:\program files\Microsoft Office\root\Office16\MSOSB.DLL
Handler: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - c:\program files\Microsoft Office\root\Office16\MSOSB.DLL
Handler: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - c:\program files\Microsoft Office\root\Office16\MSOSB.DLL
Handler: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - c:\program files\Microsoft Office\root\Office16\MSOSB.DLL
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2020-09-25 21:41:44
ComboFix-quarantined-files.txt 2020-09-26 02:11
.
Pre-Run: 117.508.968.448 bytes libres
Post-Run: 117.223.981.056 bytes libres
.
- - End Of File - - 444B19758FC9711C577212E7BE1CF12C
A36C5E4F47E84449FF07ED3517B43A31