Quiero saber lo que hace este archivo

[luis.krash2]

Hola, en la red hay un tipo que se hace llamar stretchmame32 y ha crackeado el psrockola anteriormente, le mande un email a su correo stretchmame32qhotmail.com pidiendole que crackeara la nueva version de ese programa para rockolas, me mando un software falso que me apago la computadora y me deshabilito el administrador de tareas, oculto el cmd.exe, equipo, la unidad c, panel de control... en fin me queria pedir dinero para desbloquearme el dinero, pero tmb tengo ubuntu, asi que no tengo de que preocuparme, solo quiero saber que hace el programa, ya que no se si me ha robado informacion o si solo oculta las aplicaciones. este es el link que me mando, no lo corran en windows o les pasara lo mismo xP

http://www.4shared.com/rar/69dRTapB/psrockola3.html  es el archivo generador.exe el que genera el caos

[apuromafo CLS]

a lo mas se me ocurre que uses esto
http://anubis.iseclab.org/

si quieres depurarlo solo en maquina virtual animate, para que no te infecte, metes una maquina virtual mas sandbox..., y cuidado que muchos troyanos copian la configuracion de red...

[3mp3z@ndo]

Aqui te dejo las modificaciones que te ha hecho en el registro:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce "*activateSMBL" = C:\boot.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "activateBL" = C:\boot.exe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer "ClearRecentDocsOnExit" = [REG_DWORD, value: 00000001]
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer "ForceClassicControlPanel" = [REG_DWORD, value: 00000001]
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer "NoControlPanel" = [REG_DWORD, value: 00000001]
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer "NoDesktop" = [REG_DWORD, value: 00000001]
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer "NoDesktopCleanupWizard" = [REG_DWORD, value: 00000001]
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer "NoDrives" = [REG_DWORD, value: 03FFFFFF]
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer "NoDriveTypeAutoRun" = [REG_DWORD, value: 00000091]
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer "NoFavoritesMenu" = [REG_DWORD, value: 00000001]
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer "NoFind" = [REG_DWORD, value: 00000001]
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer "NoFolderOptions" = [REG_DWORD, value: 00000001]
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer "NoInternetIcon" = [REG_DWORD, value: 00000001]
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer "NoNetHood" = [REG_DWORD, value: 00000001]
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer "NoNetworkConnections" = [REG_DWORD, value: 00000001]
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer "NoRecentDocsHistory" = [REG_DWORD, value: 00000001]
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer "NoRecentDocsMenu" = [REG_DWORD, value: 00000001]
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer "NoRun" = [REG_DWORD, value: 00000001]
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer "NoSaveSettings" = [REG_DWORD, value: 00000001]
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer "NoSMConfigurePrograms" = [REG_DWORD, value: 00000001]
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer "NoSMHelp" = [REG_DWORD, value: 00000001]
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer "NoSMMyDocs" = [REG_DWORD, value: 00000001]
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer "NoSMMyPictures" = [REG_DWORD, value: 00000001]
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer "NoStartMenuMorePrograms" = [REG_DWORD, value: 00000001]
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer "NoStartMenuMyMusic" = [REG_DWORD, value: 00000001]
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer "NoStartMenuMyNetworkPlaces" = [REG_DWORD, value: 00000001]
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer "NoUserNameInStartMenu" = [REG_DWORD, value: 00000001]
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer "StartMenuLogOff" = [REG_DWORD, value: 00000001]
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum "{20D04FE0-3AEA-1069-A2D8-08002B30309D}" = [REG_DWORD, value: 00000001]
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum "{450D8FBA-AD25-11D0-98A8-0800361B1103}" = [REG_DWORD, value: 00000001]
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum "{645FF040-5081-101B-9F08-00AA002F954E}" = [REG_DWORD, value: 00000001]
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableTaskMgr" = [REG_DWORD, value: 00000001]
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableRegistryTools" = [REG_DWORD, value: 00000001]

Puedes crearte un .reg para restablecer el registro

Un saludo