Bienvenido: ( Identificarse | Registrarse )      
Foros de Trucos Windows
 
Closed TopicStart new topicStart Poll

Outline · [ Estándar ] · Lineal+

> roProcComms.exe, Uso de CPU varia de 0 a 100%

mmkoala
post Aug 31 2004, 08:21 AM
Publicado: #1


Newbie
*

Grupo: Members
Mensajes: 2
Registrado: 31-August 04
Miembro nº: 16.136



Tengo este problema:
En el sistema operativo W2000 server el uso del CPU varia periodicamente de 0 a 100% cada 10 seg aprox. Culpable parece ser el proceso roProcComms.exe y no puedo encontrar ninguna informacion sobre el. Si termino este proceso, rendimiento se aregla, pero despues de reiniciar el ordenador se inicia de nuevo.
Otro problema que tengo y no se si esta relacionado con el anterior es, que aparece imprevisiblemente el proceso (o varios) log.exe. Su cantidad sigue aumentendo (la cantidad maxima que he visto 319 procesos) hasta que:
1 se llena la memoria y se bloquea el equipo
2 de repente desaparecen y el equipo sige funccionando de manera normal hasta el nuevo ciclo.

sad.gif Muchas gracias por qualquier respuesta


User is offlineProfile CardPM
Go to the top of the page
+Quote Post
jbex
post Aug 31 2004, 03:45 PM
Publicado: #2


El que peca y reza empata
Group Icon

Grupo: Webmaster
Mensajes: 6.383
Registrado: 22-July 03
Desde: Enkartaciones
Miembro nº: 2



Hola mmkoala, lo q sea el roProcComms.exe, no tengo ni idea, lo q si se es q el log.exe, te podrá ser un virus o troyano, etc vamos q no es un servicio normal.
Te aconsejo te chequees con un servicio on-line de antivirus y después te pases el Ad-Aware SE .
Un saludo, jbex.



User is offlineProfile CardPM
Go to the top of the page
+Quote Post
alnitak
post Aug 31 2004, 04:03 PM
Publicado: #3


Carpe Diem
Group Icon

Grupo: Webmaster
Mensajes: 6.398
Registrado: 28-August 03
Desde: Valencia, Venezuela
Miembro nº: 25



Estás infectado por uno o mas bichos.

Intenta primero escanearte con un antivirus y si no te resulta bajate el HijackThis:

http://www.trucoswindows.net/detalles-87-hijackthis.html

Crea una nueva carpeta y salvalo en ella.

Ejecutalo, dale a Scan despues a save log y colocame aqui el contenido del log.

Dale a config, despues a misc tools, cheka la casilla de List empty sections, dale a generate startuplist y colocame tambien el contenido ese log aqui.


User is offlineProfile CardPM
Go to the top of the page
+Quote Post
mmkoala
post Sep 3 2004, 06:50 AM
Publicado: #4


Newbie
*

Grupo: Members
Mensajes: 2
Registrado: 31-August 04
Miembro nº: 16.136



biggrin.gif Muchas gracias por vuestra respuesta, el HijackThis es una maravilla. Creo que he encontrado los molestosos.

El proceso roProcComms.exe pertenece al programa Visual Time de Robotics (comunicacion del servidor con los terminales de fichaje). Ya me puese en contacto con ellos y me han enviado una actualizacion.


El Log.exe parece un programa del UPS para guardar el historial de actividades a un archivo log. Ese archivo tenia, no se porque 105MB. Lo elimine y he cree uno nuevo. Del momento parece que va bien.

He pasado varios Antivirus y no han encontrado nada.
Egualmente te adjunto los logs del HijackThis, pero espero que ya todo esta bien.


Logfile of HijackThis v1.98.2
Scan saved at 10:05:32, on 01/09/2004
Platform: Windows 2000 SP2 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\termsrv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\llssrv.exe
C:\WINNT\system32\MGE\RunSC.exe
C:\WINNT\system32\MGE\PCtl.exe
C:\Archivos de programa\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\MGE\BIL.EXE
C:\WINNT\system32\MGE\CILRS232.EXE
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\Dfssvc.exe
C:\WINNT\System32\inetsrv\inetinfo.exe
E:\Robotics\VISUAL~1\Procs\roProcComms.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\Smtray.exe
C:\WINNT\System32\internat.exe
C:\Archivos de programa\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\LOGWIN32\EXES\LOGWIN32.EXE
C:\WINNT\system32\ntvdm.exe
E:\Robotics\VISUAL~1\System\VTConsole.exe
C:\HT\HijackThis.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://localhost/iisHelp/iis/misc/default.asp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [PMXInit] C:\WINNT\System32\pmxinit.exe -SetupRunOnce
O4 - HKLM\..\Run: [Smapp] Smtray.exe
O4 - HKLM\..\RunOnce: [PMXInit] C:\WINNT\System32\pmxinit.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - Startup: Panel de Control Logic Win.LNK = C:\LOGWIN32\EXES\LOGWIN32.EXE
O4 - Startup: Protección Red.LNK = C:\LOGWIN32\EXES\logred95.exe
O4 - Global Startup: Opciones de inicio de VisualTime.lnk = E:\Robotics\VisualTime\System\VTLauncher.exe
O4 - Global Startup: Service Manager.lnk = C:\Archivos de programa\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O16 - DPF: {8AE2688B-025F-4F98-B164-4FA711A631C2} (lcAplisLWNet.lcAplisNet) - https://soporte.logiccontrol.es/web/lcLWNet.CAB
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1EC0A99D-AAB5-40A4-B148-5E0D64E1939B}: NameServer = 80.58.0.33,80.58.32.97

**************************************************************

StartupList report, 01/09/2004, 10:06:01
StartupList version: 1.52.2
Started from : C:\HT\HijackThis.EXE
Detected: Windows 2000 SP2 (WinNT 5.00.2195)
Detected: Internet Explorer v6.00 (6.00.2600.0000)
* Using default options
* Including empty and uninteresting sections
==================================================

Running processes:

C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\termsrv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\llssrv.exe
C:\WINNT\system32\MGE\RunSC.exe
C:\WINNT\system32\MGE\PCtl.exe
C:\Archivos de programa\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\MGE\BIL.EXE
C:\WINNT\system32\MGE\CILRS232.EXE
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\Dfssvc.exe
C:\WINNT\System32\inetsrv\inetinfo.exe
E:\Robotics\VISUAL~1\Procs\roProcComms.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\Smtray.exe
C:\WINNT\System32\internat.exe
C:\Archivos de programa\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\LOGWIN32\EXES\LOGWIN32.EXE
C:\WINNT\system32\ntvdm.exe
E:\Robotics\VISUAL~1\System\VTConsole.exe
C:\HT\HijackThis.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[C:\Documents and Settings\paco\Menú Inicio\Programas\Inicio]
Panel de Control Logic Win.LNK = C:\LOGWIN32\EXES\LOGWIN32.EXE
Protección Red.LNK = C:\LOGWIN32\EXES\logred95.exe

Shell folders AltStartup:
*Folder not found*

User shell folders Startup:
*Folder not found*

User shell folders AltStartup:
*Folder not found*

Shell folders Common Startup:
[C:\Documents and Settings\All Users\Menú Inicio\Programas\Inicio]
Opciones de inicio de VisualTime.lnk = E:\Robotics\VisualTime\System\VTLauncher.exe
Service Manager.lnk = C:\Archivos de programa\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe

Shell folders Common AltStartup:
*Folder not found*

User shell folders Common Startup:
*Folder not found*

User shell folders Alternate Common Startup:
*Folder not found*

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINNT\system32\userinit.exe,

[HKLM\Software\Microsoft\Windows\CurrentVersion\Winlogon]
*Registry key not found*

[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
*Registry value not found*

[HKCU\Software\Microsoft\Windows\CurrentVersion\Winlogon]
*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

PMXInit = C:\WINNT\System32\pmxinit.exe -SetupRunOnce
Smapp = Smtray.exe

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce

PMXInit = C:\WINNT\System32\pmxinit.exe

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

internat.exe = internat.exe

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run

*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

[OptionalComponents]
*No values found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*

--------------------------------------------------

File association entry for .EXE:
HKEY_CLASSES_ROOT\exefile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .COM:
HKEY_CLASSES_ROOT\comfile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .BAT:
HKEY_CLASSES_ROOT\batfile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .PIF:
HKEY_CLASSES_ROOT\piffile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .SCR:
HKEY_CLASSES_ROOT\scrfile\shell\open\command

(Default) = "%1" /S

--------------------------------------------------

File association entry for .HTA:
HKEY_CLASSES_ROOT\htafile\shell\open\command

(Default) = C:\WINNT\System32\mshta.exe "%1" %*

--------------------------------------------------

File association entry for .TXT:
HKEY_CLASSES_ROOT\txtfile\shell\open\command

(Default) = %SystemRoot%\system32\NOTEPAD.EXE %1

--------------------------------------------------

Enumerating ICQ Agent Autostart apps:
HKCU\Software\Mirabilis\ICQ\Agent\Apps

*Registry key not found*

--------------------------------------------------

Load/Run keys from C:\WINNT\WIN.INI:

load=*INI section not found*
run=*INI section not found*

Load/Run keys from Registry:

HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\Windows: load=
HKCU\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=

--------------------------------------------------

Shell & screensaver key from C:\WINNT\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=*Registry value not found*
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------


Enumerating Browser Helper Objects:

*No BHO's found*

--------------------------------------------------

Enumerating Task Scheduler jobs:

Cofinox Initial.job
CofinoxBackUp.job
daily backup.job

--------------------------------------------------

Enumerating Download Program Files:

[DirectAnimation Java Classes]
CODEBASE = file://C:\WINNT\Java\classes\dajava.cab
OSD = C:\WINNT\Downloaded Program Files\DirectAnimation Java Classes.osd

[Microsoft XML Parser for Java]
CODEBASE = file://C:\WINNT\Java\classes\xmldso.cab
OSD = C:\WINNT\Downloaded Program Files\Microsoft XML Parser for Java.osd

[lcAplisLWNet.lcAplisNet]
InProcServer32 = C:\WINNT\Downloaded Program Files\lcLWNet.ocx
CODEBASE = https://soporte.logiccontrol.es/web/lcLWNet.CAB

[ActiveScan Installer Class]
InProcServer32 = C:\WINNT\Downloaded Program Files\asinst.dll
CODEBASE = http://www.pandasoftware.com/activescan/as5/asinst.cab

[Shockwave Flash Object]
InProcServer32 = C:\WINNT\System32\macromed\flash\Flash.ocx
CODEBASE = http://download.macromedia.com/pub/shockwa...ash/swflash.cab

--------------------------------------------------

Enumerating Winsock LSP files:

NameSpace #1: C:\WINNT\System32\rnr20.dll
NameSpace #2: C:\WINNT\System32\winrnr.dll
Protocol #1: C:\WINNT\system32\msafd.dll
Protocol #2: C:\WINNT\system32\msafd.dll
Protocol #3: C:\WINNT\system32\msafd.dll
Protocol #4: C:\WINNT\system32\rsvpsp.dll
Protocol #5: C:\WINNT\system32\rsvpsp.dll
Protocol #6: C:\WINNT\system32\msafd.dll
Protocol #7: C:\WINNT\system32\msafd.dll
Protocol #8: C:\WINNT\system32\msafd.dll
Protocol #9: C:\WINNT\system32\msafd.dll
Protocol #10: C:\WINNT\system32\msafd.dll
Protocol #11: C:\WINNT\system32\msafd.dll

--------------------------------------------------

Enumerating Windows NT logon/logoff scripts:
*No scripts set to run*

Windows NT checkdisk command:
BootExecute = autocheck autochk *

Windows NT 'Wininit.ini':
PendingFileRenameOperations: *Registry value not found*

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

Network.ConnectionTray: C:\WINNT\system32\NETSHELL.dll
WebCheck: C:\WINNT\System32\webcheck.dll
SysTray: stobject.dll

--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

*Registry key not found*

--------------------------------------------------

End of report, 15.410 bytes
Report generated in 2,093 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only


Muchas gracias y un saludo

mmkoala
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
alnitak
post Sep 3 2004, 08:32 PM
Publicado: #5


Carpe Diem
Group Icon

Grupo: Webmaster
Mensajes: 6.398
Registrado: 28-August 03
Desde: Valencia, Venezuela
Miembro nº: 25



Hay muchos procesos que no conozco para nada corriendo en tu sistema, si estás muy seguro sobre lo que es el log.exe pues mejor pq hay keyloggers que utilizan ese mismo nombre pero en otras carpetas.

En fin que queda todo a tu criterio pero no me parece muy normal que aparezcan tantos procesos log.exe y vamos que algo debe andar mal o eso me parece.
User is offlineProfile CardPM
Go to the top of the page
+Quote Post

 
Closed TopicTopic OptionsStart new topic

Google
Web www.trucoswindows.net