pc mucho más lento que antes (SOLUCIONADO)

[juls]

Estos días estoy notando que al abrir explorer o firefox tarda muchisimo en cargarse las paginas, he pasado ciertos programas antiespias y he limpiado con ccleaner y no se resuelve el problema. Les agradeceria que revisaran mi log de hijackthis por si hubiera algo que no debería.muchas gracias.



Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 14:29:13, on 27/06/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16674)

Boot mode: Normal



Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Common Files\Symantec Shared\ccProxy.exe

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\arservice.exe

C:\WINDOWS\eHome\ehRecvr.exe

C:\WINDOWS\eHome\ehSched.exe

C:\Program Files\iPod\bin\iPodSrv.exe

C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe

C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\dllhost.exe

C:\WINDOWS\ehome\ehtray.exe

C:\WINDOWS\ARPWRMSG.EXE

C:\WINDOWS\eHome\ehmsas.exe

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\eMule\emule.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe



R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.es

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://es.yahoo.com

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://es.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://es.search.yahoo.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)

O2 - BHO: Aplicación auxiliar de vínculos de Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Aplicación auxiliar de inicio de sesión - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll

O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll

O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe

O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe

O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICIO LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Servicio de red')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: Recorte de pantalla e Inicio rápido de OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab

O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll

O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://picasaweb.google.com/s/v/31.41/uploader2.cab

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab

O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab

O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/ES-ES/a-UNO1/GAME_UNO1.cab

O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{AF458057-C64F-4524-B01B-5DF5E0C89CE9}: NameServer = 80.58.0.33

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL

O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe

O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

O23 - Service: Servicio del iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: iPodSrv - Unknown owner - C:\Program Files\iPod\bin\iPodSrv.exe

O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

O23 - Service: Servicio Auto-Protect de Norton AntiVirus (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe

O23 - Service: Programador de LiveUpdate automático - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe

O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe



--

End of file - 7989 bytes

[msc hotline sat]

El log está limpio...



Lanza este AV ONLINE y posteanos el informe resultante:



[url=https://www.kaspersky.es/downloads/thank-you/free-antivirus-download][color=darknesred][b] SOLO TESTEO AV ONLINE[/b][/color][/url]



NOTA: Y escojer la opcion de MIPC para escanearlo todo. Dicho AV ONLINE no limpia, solo testea, asi que lo que pretendemos con ello es solo el informe, ya obraremos en consecuencia. ms.





saludos



ms, 27-06-2008

[juls]

Perdon por el retraso, le pasé el antivirus online sin limpiar infecciones y me dió este resultado:



KASPERSKY ONLINE SCANNER INFORME

sábado, 28 de junio de 2008 3:01:29

Sistema operativo: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)

Kaspersky Online Scanner versión: 5.0.98.0

Ultima actualización: 27/06/2008

Registros en la base antivirus: 892038





Configuración del análisis

Analizar usando las siguientes bases estendidas

Analizar archivos verdadero

Analizar bases de correo verdadero



Objetivo a analizar Mi PC

C:\

E:\

F:\

G:\

H:\

I:\



Estadísticas

Número de objeros analizados 77718

Virus encontrados 1

Objetos infectados 3

Objetos sospechosos 0

Duración del análisis 01:38:28



Bombre del objeto infectado Nombre del virus Última acción

C:\Documents and Settings\All Users\Application Data\Microsoft\eHome\logs\ehRecvr.log Object is locked saltado



C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked saltado



C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked saltado



C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\Confid.log Object is locked saltado



C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\Content.log Object is locked saltado



C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\Privacy.log Object is locked saltado



C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\Restrict.log Object is locked saltado



C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked saltado



C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\WebHist.log Object is locked saltado



C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\2008-06-27_Log.ALUSchedulerSvc.LiveUpdate Object is locked saltado



C:\Documents and Settings\All Users\Documents\Recorded TV\TempRec\TempSBE\MSDVRMM_674802988_3473408_38924 Object is locked saltado



C:\Documents and Settings\All Users\Documents\Recorded TV\TempRec\TempSBE\MSDVRMM_674802988_3801088_40144 Object is locked saltado



C:\Documents and Settings\All Users\Documents\Recorded TV\TempRec\TempSBE\SBE1.tmp Object is locked saltado



C:\Documents and Settings\All Users\Documents\Recorded TV\TempRec\TempSBE\SBE2.tmp Object is locked saltado



C:\Documents and Settings\All Users\Documents\Recorded TV\TempRec\{30CD0255-22A1-4A9F-B2F9-D63D5BD23A48}.TmpSBE Object is locked saltado



C:\Documents and Settings\All Users\Documents\Recorded TV\TempRec\{DE5FA566-7A71-417C-B456-D4C624EC887C}.TmpSBE Object is locked saltado



C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp Object is locked saltado



C:\Documents and Settings\All Users\DRM\drmstore.hds Object is locked saltado



C:\Documents and Settings\Furquet\Application Data\Mozilla\Firefox\Profiles\4ymdgeni.default\cert8.db Object is locked saltado



C:\Documents and Settings\Furquet\Application Data\Mozilla\Firefox\Profiles\4ymdgeni.default\history.dat Object is locked saltado



C:\Documents and Settings\Furquet\Application Data\Mozilla\Firefox\Profiles\4ymdgeni.default\key3.db Object is locked saltado



C:\Documents and Settings\Furquet\Application Data\Mozilla\Firefox\Profiles\4ymdgeni.default\parent.lock Object is locked saltado



C:\Documents and Settings\Furquet\Application Data\Mozilla\Firefox\Profiles\4ymdgeni.default\search.sqlite Object is locked saltado



C:\Documents and Settings\Furquet\Application Data\Mozilla\Firefox\Profiles\4ymdgeni.default\urlclassifier2.sqlite Object is locked saltado



C:\Documents and Settings\Furquet\Cookies\index.dat Object is locked saltado



C:\Documents and Settings\Furquet\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked saltado



C:\Documents and Settings\Furquet\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked saltado



C:\Documents and Settings\Furquet\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked saltado



C:\Documents and Settings\Furquet\Local Settings\Application Data\Microsoft\Windows Live Contacts\javiruz@hotmail.es\real\members.stg Object is locked saltado



C:\Documents and Settings\Furquet\Local Settings\Application Data\Microsoft\Windows Live Contacts\javiruz@hotmail.es\shadow\members.stg Object is locked saltado



C:\Documents and Settings\Furquet\Local Settings\Application Data\Mozilla\Firefox\Profiles\4ymdgeni.default\Cache\_CACHE_001_ Object is locked saltado



C:\Documents and Settings\Furquet\Local Settings\Application Data\Mozilla\Firefox\Profiles\4ymdgeni.default\Cache\_CACHE_002_ Object is locked saltado



C:\Documents and Settings\Furquet\Local Settings\Application Data\Mozilla\Firefox\Profiles\4ymdgeni.default\Cache\_CACHE_003_ Object is locked saltado



C:\Documents and Settings\Furquet\Local Settings\Application Data\Mozilla\Firefox\Profiles\4ymdgeni.default\Cache\_CACHE_MAP_ Object is locked saltado



C:\Documents and Settings\Furquet\Local Settings\History\History.IE5\index.dat Object is locked saltado



C:\Documents and Settings\Furquet\Local Settings\History\History.IE5\MSHist012008062820080629\index.dat Object is locked saltado



C:\Documents and Settings\Furquet\Local Settings\Temp\hsperfdata_Furquet\3808 Object is locked saltado



C:\Documents and Settings\Furquet\Local Settings\Temp\~DF933.tmp Object is locked saltado



C:\Documents and Settings\Furquet\Local Settings\Temp\~DF9D5.tmp Object is locked saltado



C:\Documents and Settings\Furquet\Local Settings\Temp\~DFFD40.tmp Object is locked saltado



C:\Documents and Settings\Furquet\Local Settings\Temp\~DFFDB2.tmp Object is locked saltado



C:\Documents and Settings\Furquet\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked saltado



C:\Documents and Settings\Furquet\Local Settings\Temporary Internet Files\Content.IE5\927M1JQB\b[1].js Infectados: Trojan-Downloader.JS.Agent.ccu saltado



C:\Documents and Settings\Furquet\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked saltado



C:\Documents and Settings\Furquet\Local Settings\Temporary Internet Files\Content.IE5\UME2ZWCN\b[1].js Infectados: Trojan-Downloader.JS.Agent.ccu saltado



C:\Documents and Settings\Furquet\Local Settings\Temporary Internet Files\Content.IE5\UME2ZWCN\b[2].js Infectados: Trojan-Downloader.JS.Agent.ccu saltado



C:\Documents and Settings\Furquet\ntuser.dat Object is locked saltado



C:\Documents and Settings\Furquet\NTUSER.DAT.LOG Object is locked saltado



C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked saltado



C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked saltado



C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked saltado



C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked saltado



C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked saltado



C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked saltado



C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked saltado



C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked saltado



C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked saltado



C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked saltado



C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked saltado



C:\Program Files\Common Files\Symantec Shared\AntiSpam\Log\Spam.log Object is locked saltado



C:\Program Files\Common Files\Symantec Shared\SNDALRT.log Object is locked saltado



C:\Program Files\Common Files\Symantec Shared\SNDCON.log Object is locked saltado



C:\Program Files\Common Files\Symantec Shared\SNDDBG.log Object is locked saltado



C:\Program Files\Common Files\Symantec Shared\SNDFW.log Object is locked saltado



C:\Program Files\Common Files\Symantec Shared\SNDIDS.log Object is locked saltado



C:\Program Files\Common Files\Symantec Shared\SNDSYS.log Object is locked saltado



C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBConfig.log Object is locked saltado



C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBDebug.log Object is locked saltado



C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBDetect.log Object is locked saltado



C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBNotify.log Object is locked saltado



C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBRefr.log Object is locked saltado



C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetCfg.log Object is locked saltado



C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetDev.log Object is locked saltado



C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetLoc.log Object is locked saltado



C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetUsr.log Object is locked saltado



C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBStHash.log Object is locked saltado



C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBStMSI.log Object is locked saltado



C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBValid.log Object is locked saltado



C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPPolicy.log Object is locked saltado



C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPStart.log Object is locked saltado



C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPStop.log Object is locked saltado



C:\Program Files\Norton Internet Security\Norton AntiVirus\AVApp.log Object is locked saltado



C:\Program Files\Norton Internet Security\Norton AntiVirus\AVError.log Object is locked saltado



C:\Program Files\Norton Internet Security\Norton AntiVirus\AVVirus.log Object is locked saltado



C:\Program Files\Norton Internet Security\Norton AntiVirus\Savrt\0801NAV~.TMP Object is locked saltado



C:\Program Files\Norton Internet Security\Norton AntiVirus\Savrt\0941NAV~.TMP Object is locked saltado



C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked saltado



C:\WINDOWS\Debug\PASSWD.LOG Object is locked saltado



C:\WINDOWS\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{0DB49E05-0FBC-4B99-909E-9A7DC7F1C787}.crmlog Object is locked saltado



C:\WINDOWS\SchedLgU.Txt Object is locked saltado



C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked saltado



C:\WINDOWS\Sti_Trace.log Object is locked saltado



C:\WINDOWS\system32\CatRoot2\edb.log Object is locked saltado



C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked saltado



C:\WINDOWS\system32\config\AppEvent.Evt Object is locked saltado



C:\WINDOWS\system32\config\default Object is locked saltado



C:\WINDOWS\system32\config\default.LOG Object is locked saltado



C:\WINDOWS\system32\config\Internet.evt Object is locked saltado



C:\WINDOWS\system32\config\Media Ce.evt Object is locked saltado



C:\WINDOWS\system32\config\ODiag.evt Object is locked saltado



C:\WINDOWS\system32\config\OSession.evt Object is locked saltado



C:\WINDOWS\system32\config\SAM Object is locked saltado



C:\WINDOWS\system32\config\SAM.LOG Object is locked saltado



C:\WINDOWS\system32\config\SecEvent.Evt Object is locked saltado



C:\WINDOWS\system32\config\SECURITY Object is locked saltado



C:\WINDOWS\system32\config\SECURITY.LOG Object is locked saltado



C:\WINDOWS\system32\config\software Object is locked saltado



C:\WINDOWS\system32\config\software.LOG Object is locked saltado



C:\WINDOWS\system32\config\SysEvent.Evt Object is locked saltado



C:\WINDOWS\system32\config\system Object is locked saltado



C:\WINDOWS\system32\config\system.LOG Object is locked saltado



C:\WINDOWS\system32\drivers\sptd.sys Object is locked saltado



C:\WINDOWS\system32\h323log.txt Object is locked saltado



C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked saltado



C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked saltado



C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked saltado



C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked saltado



C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked saltado



C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked saltado



C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked saltado



C:\WINDOWS\wiadebug.log Object is locked saltado



C:\WINDOWS\wiaservc.log Object is locked saltado



C:\WINDOWS\WindowsUpdate.log Object is locked saltado



Análisis completado.

[msc hotline sat]

Pues efectivamente, tienes en temporales de internet un malware residente: Trojan-Downloader.JS.Agent.ccu



C:\Documents and Settings\Furquet\Local Settings\Temporary Internet Files\Content.IE5\927M1JQB\b[1].js Infectados: Trojan-Downloader.JS.Agent.ccu saltado



C:\Documents and Settings\Furquet\Local Settings\Temporary Internet Files\Content.IE5\UME2ZWCN\b[1].js Infectados: Trojan-Downloader.JS.Agent.ccu saltado



C:\Documents and Settings\Furquet\Local Settings\Temporary Internet Files\Content.IE5\UME2ZWCN\b[2].js Infectados: Trojan-Downloader.JS.Agent.ccu saltado



Envianos este fichero C:\Documents and Settings\Furquet\Local Settings\Temporary Internet Files\Content.IE5\UME2ZWCN\b[2].js



y pasaremos a controlarlo en la proxima version del ELISTARA al tratarse de un downloader, a ver si con la misma cadena detectamos la madre del cordero, o sea el dropper que lo lanza, si es que lo tienes en el ordenador, pues puede ser que lo ingreses cada vez que entras en internet.



Aparte de enviarnos dicho malware para analizar, prueba el SPROCES y nos posteas el SPROCLOG.TXT resultante, por si no detectamos dicha madre por cadenas y vemos algun fichero sospechoso para analizar:



[b]¿Como enviar las muestras a zonavirus? - Para ello recordar[/b]:

https://foros.zonavirus.com/viewtopic.php?f=5&t=14253



saludos



ms, 2 de Julio de 2008

[juls]

No encuentro el archivo que me solicitas, en la carpeta de temporary internet files ya no se encuentra, y con la opcion buscar me dice que no lo encuentra.

te envio el log de sproces:



Wed Jul 02 18:30:16 2008

SProces v3.1 (c)2008 S.G.H. / Satinfo S.L.

-------------------------------------------

Sistema Operativo: Microsoft Windows XP (v5.1.2600) Service Pack 2

Internet Explorer: (v7.0.5730.11) 0



Procesos Activos:

C:\WINDOWS\SYSTEM32\SMSS.EXE

C:\WINDOWS\SYSTEM32\WINLOGON.EXE

C:\WINDOWS\SYSTEM32\SERVICES.EXE

C:\WINDOWS\SYSTEM32\LSASS.EXE

C:\WINDOWS\SYSTEM32\SVCHOST.EXE

C:\WINDOWS\SYSTEM32\SVCHOST.EXE

C:\WINDOWS\EXPLORER.EXE

C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPROXY.EXE

C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE

C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE

C:\WINDOWS\SYSTEM32\SPOOLSV.EXE

C:\WINDOWS\ARSERVICE.EXE

C:\WINDOWS\EHOME\EHRECVR.EXE

C:\WINDOWS\EHOME\EHSCHED.EXE

C:\PROGRAM FILES\IPOD\BIN\IPODSRV.EXE

C:\PROGRAM FILES\NORTON INTERNET SECURITY\NORTON ANTIVIRUS\NAVAPSVC.EXE

C:\PROGRAM FILES\SYMANTEC\LIVEUPDATE\ALUSCHEDULERSVC.EXE

C:\WINDOWS\SYSTEM32\SVCHOST.EXE

C:\WINDOWS\SYSTEM32\DLLHOST.EXE

C:\WINDOWS\EHOME\EHTRAY.EXE

C:\WINDOWS\ARPWRMSG.EXE

C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE

C:\WINDOWS\EHOME\EHMSAS.EXE

C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE12\GROOVEMONITOR.EXE

C:\WINDOWS\SYSTEM32\IGFXTRAY.EXE

C:\WINDOWS\SYSTEM32\HKCMD.EXE

C:\WINDOWS\SYSTEM32\IGFXPERS.EXE

C:\WINDOWS\RTHDCPL.EXE

C:\PROGRAM FILES\ITUNES\ITUNESHELPER.EXE

C:\WINDOWS\SYSTEM32\CTFMON.EXE

C:\PROGRAM FILES\IPOD\BIN\IPODSERVICE.EXE

C:\PROGRAM FILES\ADOBE\READER 8.0\READER\ACRORD32.EXE

C:\PROGRAM FILES\MOZILLA FIREFOX\FIREFOX.EXE

C:\PROGRAM FILES\SYMANTEC\LIVEUPDATE\AUPDATE.EXE

C:\PROGRA~1\SYMANTEC\LIVEUP~1\LUCOMS~1.EXE

C:\PROGRAM FILES\SYMANTEC\LIVEUPDATE\LUCALLBACKPROXY.EXE

C:\DOCUMENTS AND SETTINGS\FURQUET\DESKTOP\SPROCES.EXE



R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.es

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://es.yahoo.com

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

R3 - URLSearchHook: Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\system32\ieframe.dll

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)

O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - (no file)

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Aplicación auxiliar de inicio de sesión - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll

O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe

O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe

O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - Startup: desktop.ini

O4 - Startup: Recorte de pantalla e Inicio rápido de OneNote 2007.lnk

O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab

O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll

O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://picasaweb.google.com/s/v/31.41/uploader2.cab

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab

O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab

O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/ES-ES/a-UNO1/GAME_UNO1.cab

O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Plug-in 1.6.0_03) - http://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

O16 - DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} (Java Plug-in 1.5.0_02) - http://java.sun.com/update/1.5.0/jinstall-1_5_0_02-windows-i586.cab

O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} (Java Plug-in 1.6.0_02) - http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab

O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} (Java Plug-in 1.6.0_03) - http://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} (Java Plug-in 1.6.0_03) - http://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{AF458057-C64F-4524-B01B-5DF5E0C89CE9}: NameServer = 80.58.0.33

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

O20 - Winlogon Notify: !SASWINLOGON - C:\PROGRAM FILES\SUPERANTISPYWARE\SASWINLO.DLL

O20 - Winlogon Notify: IGFXCUI - IGFXDEV.DLL

O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - %SystemRoot%\system32\SHELL32.dll

O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - %SystemRoot%\system32\SHELL32.dll

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\system32\webcheck.dll

O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINDOWS\system32\stobject.dll

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O21 - SSODL: UPnPMonitor - {e57ce738-33e8-4c51-8354-bb4de9d215d1} - C:\WINDOWS\system32\upnpui.dll

O22 - SharedTaskScheduler: {438755C2-A8BA-11D1-B96B-00A0C90312E1} - Browseui preloader - %SystemRoot%\system32\browseui.dll

O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - %SystemRoot%\system32\browseui.dll



Información Adicional:

----------------------

ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - Groove GFS Stub Execution Hook - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL

ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL

scrfile: "%1" %*



Listado de Servicios (Carga Automatica):

----------------------------------------

O23 - Service: ARSVC - Microsoft - C:\WINDOWS\arservice.exe

O23 - Service: USB PC Camera (Ca533av) - Unknown owner - C:\WINDOWS\SYSTEM32\Drivers\Ca533av.sys (file missing)

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

**O23 - Service: DCOM Server Process Launcher (DcomLaunch) - Unknown owner - C:\WINDOWS\system32\svchost -k DcomLaunch (file missing)

O23 - Service: iPodSrv - Unknown owner - C:\Program Files\iPod\bin\iPodSrv.exe

O23 - Service: Servicio Auto-Protect de Norton AntiVirus (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe

O23 - Service: Programador de LiveUpdate automático - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

**O23 - Service: Remote Procedure Call (RPC) (RpcSs) - Unknown owner - C:\WINDOWS\system32\svchost -k rpcss (file missing)

O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe

O23 - Service: Secdrv - Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K. - C:\WINDOWS\SYSTEM32\DRIVERS\secdrv.sys



Listado de Servicios (Carga Manual):

------------------------------------

O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe

**O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - Microsoft Corp., Veritas Software - C:\WINDOWS\System32\dmadmin.exe

O23 - Service: DSDrv4 - Unknown owner - C:\PROGRA~1\K!TV\Plugins\S_Bt8x8\DSDrv4.sys (file missing)

O23 - Service: GEARAspiWDM - GEAR Software Inc. - C:\WINDOWS\SYSTEM32\Drivers\GEARAspiWDM.sys

O23 - Service: Hauppauge WinTV 88x DVB Tuner/Demod (HCW88BDA) - Hauppauge Computer Works, Inc - C:\WINDOWS\SYSTEM32\drivers\hcw88bda.sys

O23 - Service: Hauppauge WinTV 88x MPEG/TS Capture (HCW88TSE) - Hauppauge Computer Works, Inc - C:\WINDOWS\SYSTEM32\drivers\hcw88tse.sys

O23 - Service: Hauppauge WinTV 88x Tuner (HCW88TUNE) - Hauppauge Computer Works, Inc. - C:\WINDOWS\SYSTEM32\drivers\hcw88tun.sys

O23 - Service: Hauppauge WinTV 88x Video (hcw88vid) - Hauppauge Computer Works, Inc - C:\WINDOWS\SYSTEM32\drivers\hcw88vid.sys

O23 - Service: Hauppauge WinTV 88x Crossbar (HCW88XBAR) - Hauppauge Computer Works, Inc. - C:\WINDOWS\SYSTEM32\drivers\HCW88BAR.sys

O23 - Service: Microsoft UAA Function Driver for High Definition Audio Service (HdAudAddService) - Windows (R) Server 2003 DDK provider - C:\WINDOWS\SYSTEM32\drivers\HdAudio.sys

O23 - Service: Microsoft UAA Bus Driver for High Definition Audio (HDAudBus) - Windows (R) Server 2003 DDK provider - C:\WINDOWS\SYSTEM32\DRIVERS\HDAudBus.sys

O23 - Service: IEEE-1284.4 Driver HPZid412 (HPZid412) - HP - C:\WINDOWS\SYSTEM32\DRIVERS\HPZid412.sys

O23 - Service: Print Class Driver for IEEE-1284.4 HPZipr12 (HPZipr12) - HP - C:\WINDOWS\SYSTEM32\DRIVERS\HPZipr12.sys

O23 - Service: USB to IEEE-1284.4 Translation Driver HPZius12 (HPZius12) - HP - C:\WINDOWS\SYSTEM32\DRIVERS\HPZius12.sys

O23 - Service: ialm - Intel Corporation - C:\WINDOWS\SYSTEM32\DRIVERS\ialmnt5.sys

O23 - Service: Service for Realtek HD Audio (WDM) (IntcAzAudAddService) - Realtek Semiconductor Corp. - C:\WINDOWS\SYSTEM32\drivers\RtkHDAud.sys

O23 - Service: Servicio del iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

O23 - Service: NAVENG - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20080625.003\NAVENG.Sys

O23 - Service: NAVEX15 - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20080625.003\NavEx15.Sys

O23 - Service: Direct Parallel Link Driver (Ptilink) - Parallel Technologies, Inc. - C:\WINDOWS\SYSTEM32\DRIVERS\ptilink.sys

O23 - Service: Realtek 10/100/1000 NIC Family all in one NDIS XP Driver (RTL8023xp) - Realtek Semiconductor Corporation - C:\WINDOWS\SYSTEM32\DRIVERS\Rtnicxp.sys

O23 - Service: Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver (rtl8139) - Realtek Semiconductor Corporation - C:\WINDOWS\SYSTEM32\DRIVERS\RTL8139.SYS

O23 - Service: SASENUM - SuperAdBlocker, Inc. - C:\Program Files\SUPERAntiSpyware\SASENUM.SYS

O23 - Service: SAVRT - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVRT.SYS

O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe

O23 - Service: Sony USB Filter Driver (SONYPVU1) (SONYPVU1) - Sony Corporation - C:\WINDOWS\SYSTEM32\DRIVERS\SONYPVU1.SYS

O23 - Service: SPBBCDrv - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys

O23 - Service: SYMDNS - Symantec Corporation - C:\WINDOWS\System32\Drivers\SYMDNS.SYS

O23 - Service: SymEvent - Symantec Corporation - C:\Program Files\Symantec\SYMEVENT.SYS

O23 - Service: SYMFW - Symantec Corporation - C:\WINDOWS\System32\Drivers\SYMFW.SYS

O23 - Service: SYMIDS - Symantec Corporation - C:\WINDOWS\System32\Drivers\SYMIDS.SYS

O23 - Service: SYMIDSCO - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SymcData\idsdefs\20080623.001\symidsco.sys

O23 - Service: SYMNDIS - Symantec Corporation - C:\WINDOWS\System32\Drivers\SYMNDIS.SYS

O23 - Service: SYMREDRV - Symantec Corporation - C:\WINDOWS\System32\Drivers\SYMREDRV.SYS

*O23 - Service: Terminal Services (TermService) - Unknown owner - C:\WINDOWS\System32\svchost -k DComLaunch (file missing)

O23 - Service: Apple Mobile USB Driver (USBAAPL) - Apple, Inc. - C:\WINDOWS\SYSTEM32\Drivers\usbaapl.sys

O23 - Service: DIGITAL CAMERA (USBCamera) - Unknown owner - C:\WINDOWS\SYSTEM32\Drivers\Bulk533.sys (file missing)



Listado de Servicios (Deshabilitados):

--------------------------------------

**O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

**O23 - Service: dmboot - Microsoft Corp., Veritas Software - C:\WINDOWS\SYSTEM32\drivers\dmboot.sys

O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe



57 Servicios.

12 de Carga Automatica.

38 de Carga Manual.

7 Deshabilitados.

[lucl]

Haz esto por si no lo has probado





Dentro de Mipc/Herramientas/Opciones de carpeta/Ver/Archivos y carpetas



ocultos "selecciona Mostrar archivos y carpetas ocultos/aplicar/aceptar



y a ver si asi lo encuentras, saludos

[msc hotline sat]

Los temporales de internet pueden cambiar el nombre en cada sesion...



Elimina dichos temporales con el ELITEMPO, y elimina estas claves:





R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://es.yahoo.com



O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)





es posible que sea por acceso a dicha web de yahoo... y teniendo la de google.es como pagina de inicio, estas claves no hacen falta





para lo primero:





ELITEMPO

http://www.zonavirus.com/datos/descarga ... iTempo.asp



y para lo segundo:





[b]¿Como enviar las muestras a zonavirus? - Para ello recordar[/b]:

https://foros.zonavirus.com/viewtopic.php?f=5&t=14253



y de paso, creo que te interesará leer este Tema de hoy:



https://foros.zonavirus.com/viewtopic.php?f=12&t=25395



saludos



ms, 2 de Julio de 2008

[juls]

Eliminados temporales de internet con ELITEMPO y eliminados los dos archivos comentados antes.

El nuevo log de hijackthis queda así:



Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 19:40:14, on 02/07/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16674)

Boot mode: Normal



Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Common Files\Symantec Shared\ccProxy.exe

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\arservice.exe

C:\WINDOWS\eHome\ehRecvr.exe

C:\WINDOWS\eHome\ehSched.exe

C:\Program Files\iPod\bin\iPodSrv.exe

C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe

C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\dllhost.exe

C:\WINDOWS\ehome\ehtray.exe

C:\WINDOWS\ARPWRMSG.EXE

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\WINDOWS\eHome\ehmsas.exe

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe



R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.es

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://es.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://es.search.yahoo.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

O2 - BHO: Aplicación auxiliar de vínculos de Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Aplicación auxiliar de inicio de sesión - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll

O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll

O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe

O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe

O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICIO LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Servicio de red')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: Recorte de pantalla e Inicio rápido de OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab

O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll

O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://picasaweb.google.com/s/v/31.41/uploader2.cab

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab

O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab

O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/ES-ES/a-UNO1/GAME_UNO1.cab

O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{AF458057-C64F-4524-B01B-5DF5E0C89CE9}: NameServer = 80.58.0.33

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL

O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe

O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

O23 - Service: Servicio del iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: iPodSrv - Unknown owner - C:\Program Files\iPod\bin\iPodSrv.exe

O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

O23 - Service: Servicio Auto-Protect de Norton AntiVirus (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe

O23 - Service: Programador de LiveUpdate automático - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe

O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe



--

End of file - 7797 bytes





Y el log de SPROCES queda así:



Wed Jul 02 19:41:13 2008

SProces v3.1 (c)2008 S.G.H. / Satinfo S.L.

-------------------------------------------

Sistema Operativo: Microsoft Windows XP (v5.1.2600) Service Pack 2

Internet Explorer: (v7.0.5730.11) 0



Procesos Activos:

C:\WINDOWS\SYSTEM32\SMSS.EXE

C:\WINDOWS\SYSTEM32\WINLOGON.EXE

C:\WINDOWS\SYSTEM32\SERVICES.EXE

C:\WINDOWS\SYSTEM32\LSASS.EXE

C:\WINDOWS\SYSTEM32\SVCHOST.EXE

C:\WINDOWS\SYSTEM32\SVCHOST.EXE

C:\WINDOWS\EXPLORER.EXE

C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPROXY.EXE

C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE

C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE

C:\WINDOWS\SYSTEM32\SPOOLSV.EXE

C:\WINDOWS\ARSERVICE.EXE

C:\WINDOWS\EHOME\EHRECVR.EXE

C:\WINDOWS\EHOME\EHSCHED.EXE

C:\PROGRAM FILES\IPOD\BIN\IPODSRV.EXE

C:\PROGRAM FILES\NORTON INTERNET SECURITY\NORTON ANTIVIRUS\NAVAPSVC.EXE

C:\PROGRAM FILES\SYMANTEC\LIVEUPDATE\ALUSCHEDULERSVC.EXE

C:\WINDOWS\SYSTEM32\SVCHOST.EXE

C:\WINDOWS\SYSTEM32\DLLHOST.EXE

C:\WINDOWS\EHOME\EHTRAY.EXE

C:\WINDOWS\ARPWRMSG.EXE

C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE

C:\WINDOWS\EHOME\EHMSAS.EXE

C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE12\GROOVEMONITOR.EXE

C:\WINDOWS\SYSTEM32\IGFXTRAY.EXE

C:\WINDOWS\SYSTEM32\HKCMD.EXE

C:\WINDOWS\SYSTEM32\IGFXPERS.EXE

C:\WINDOWS\RTHDCPL.EXE

C:\PROGRAM FILES\ITUNES\ITUNESHELPER.EXE

C:\WINDOWS\SYSTEM32\CTFMON.EXE

C:\PROGRAM FILES\IPOD\BIN\IPODSERVICE.EXE

C:\PROGRAM FILES\ADOBE\READER 8.0\READER\ACRORD32.EXE

C:\PROGRAM FILES\MOZILLA FIREFOX\FIREFOX.EXE

C:\DOCUMENTS AND SETTINGS\FURQUET\DESKTOP\SPROCES.EXE



R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.es

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

R3 - URLSearchHook: Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\system32\ieframe.dll

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,

O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - (no file)

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Aplicación auxiliar de inicio de sesión - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll

O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe

O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe

O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - Startup: desktop.ini

O4 - Startup: Recorte de pantalla e Inicio rápido de OneNote 2007.lnk

O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab

O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll

O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://picasaweb.google.com/s/v/31.41/uploader2.cab

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab

O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab

O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/ES-ES/a-UNO1/GAME_UNO1.cab

O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Plug-in 1.6.0_03) - http://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

O16 - DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} (Java Plug-in 1.5.0_02) - http://java.sun.com/update/1.5.0/jinstall-1_5_0_02-windows-i586.cab

O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} (Java Plug-in 1.6.0_02) - http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab

O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} (Java Plug-in 1.6.0_03) - http://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} (Java Plug-in 1.6.0_03) - http://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{AF458057-C64F-4524-B01B-5DF5E0C89CE9}: NameServer = 80.58.0.33

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

O20 - Winlogon Notify: !SASWINLOGON - C:\PROGRAM FILES\SUPERANTISPYWARE\SASWINLO.DLL

O20 - Winlogon Notify: IGFXCUI - IGFXDEV.DLL

O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - %SystemRoot%\system32\SHELL32.dll

O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - %SystemRoot%\system32\SHELL32.dll

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\system32\webcheck.dll

O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINDOWS\system32\stobject.dll

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O21 - SSODL: UPnPMonitor - {e57ce738-33e8-4c51-8354-bb4de9d215d1} - C:\WINDOWS\system32\upnpui.dll

O22 - SharedTaskScheduler: {438755C2-A8BA-11D1-B96B-00A0C90312E1} - Browseui preloader - %SystemRoot%\system32\browseui.dll

O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - %SystemRoot%\system32\browseui.dll



Información Adicional:

----------------------

ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - Groove GFS Stub Execution Hook - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL

ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL

scrfile: "%1" %*



Listado de Servicios (Carga Automatica):

----------------------------------------

O23 - Service: ARSVC - Microsoft - C:\WINDOWS\arservice.exe

O23 - Service: USB PC Camera (Ca533av) - Unknown owner - C:\WINDOWS\SYSTEM32\Drivers\Ca533av.sys (file missing)

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

**O23 - Service: DCOM Server Process Launcher (DcomLaunch) - Unknown owner - C:\WINDOWS\system32\svchost -k DcomLaunch (file missing)

O23 - Service: iPodSrv - Unknown owner - C:\Program Files\iPod\bin\iPodSrv.exe

O23 - Service: Servicio Auto-Protect de Norton AntiVirus (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe

O23 - Service: Programador de LiveUpdate automático - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

**O23 - Service: Remote Procedure Call (RPC) (RpcSs) - Unknown owner - C:\WINDOWS\system32\svchost -k rpcss (file missing)

O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe

O23 - Service: Secdrv - Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K. - C:\WINDOWS\SYSTEM32\DRIVERS\secdrv.sys



Listado de Servicios (Carga Manual):

------------------------------------

O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe

**O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - Microsoft Corp., Veritas Software - C:\WINDOWS\System32\dmadmin.exe

O23 - Service: DSDrv4 - Unknown owner - C:\PROGRA~1\K!TV\Plugins\S_Bt8x8\DSDrv4.sys (file missing)

O23 - Service: GEARAspiWDM - GEAR Software Inc. - C:\WINDOWS\SYSTEM32\Drivers\GEARAspiWDM.sys

O23 - Service: Hauppauge WinTV 88x DVB Tuner/Demod (HCW88BDA) - Hauppauge Computer Works, Inc - C:\WINDOWS\SYSTEM32\drivers\hcw88bda.sys

O23 - Service: Hauppauge WinTV 88x MPEG/TS Capture (HCW88TSE) - Hauppauge Computer Works, Inc - C:\WINDOWS\SYSTEM32\drivers\hcw88tse.sys

O23 - Service: Hauppauge WinTV 88x Tuner (HCW88TUNE) - Hauppauge Computer Works, Inc. - C:\WINDOWS\SYSTEM32\drivers\hcw88tun.sys

O23 - Service: Hauppauge WinTV 88x Video (hcw88vid) - Hauppauge Computer Works, Inc - C:\WINDOWS\SYSTEM32\drivers\hcw88vid.sys

O23 - Service: Hauppauge WinTV 88x Crossbar (HCW88XBAR) - Hauppauge Computer Works, Inc. - C:\WINDOWS\SYSTEM32\drivers\HCW88BAR.sys

O23 - Service: Microsoft UAA Function Driver for High Definition Audio Service (HdAudAddService) - Windows (R) Server 2003 DDK provider - C:\WINDOWS\SYSTEM32\drivers\HdAudio.sys

O23 - Service: Microsoft UAA Bus Driver for High Definition Audio (HDAudBus) - Windows (R) Server 2003 DDK provider - C:\WINDOWS\SYSTEM32\DRIVERS\HDAudBus.sys

O23 - Service: IEEE-1284.4 Driver HPZid412 (HPZid412) - HP - C:\WINDOWS\SYSTEM32\DRIVERS\HPZid412.sys

O23 - Service: Print Class Driver for IEEE-1284.4 HPZipr12 (HPZipr12) - HP - C:\WINDOWS\SYSTEM32\DRIVERS\HPZipr12.sys

O23 - Service: USB to IEEE-1284.4 Translation Driver HPZius12 (HPZius12) - HP - C:\WINDOWS\SYSTEM32\DRIVERS\HPZius12.sys

O23 - Service: ialm - Intel Corporation - C:\WINDOWS\SYSTEM32\DRIVERS\ialmnt5.sys

O23 - Service: Service for Realtek HD Audio (WDM) (IntcAzAudAddService) - Realtek Semiconductor Corp. - C:\WINDOWS\SYSTEM32\drivers\RtkHDAud.sys

O23 - Service: Servicio del iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

O23 - Service: NAVENG - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20080702.003\NAVENG.Sys

O23 - Service: NAVEX15 - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20080702.003\NavEx15.Sys

O23 - Service: Direct Parallel Link Driver (Ptilink) - Parallel Technologies, Inc. - C:\WINDOWS\SYSTEM32\DRIVERS\ptilink.sys

O23 - Service: Realtek 10/100/1000 NIC Family all in one NDIS XP Driver (RTL8023xp) - Realtek Semiconductor Corporation - C:\WINDOWS\SYSTEM32\DRIVERS\Rtnicxp.sys

O23 - Service: Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver (rtl8139) - Realtek Semiconductor Corporation - C:\WINDOWS\SYSTEM32\DRIVERS\RTL8139.SYS

O23 - Service: SASENUM - SuperAdBlocker, Inc. - C:\Program Files\SUPERAntiSpyware\SASENUM.SYS

O23 - Service: SAVRT - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVRT.SYS

O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe

O23 - Service: Sony USB Filter Driver (SONYPVU1) (SONYPVU1) - Sony Corporation - C:\WINDOWS\SYSTEM32\DRIVERS\SONYPVU1.SYS

O23 - Service: SPBBCDrv - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys

O23 - Service: SYMDNS - Symantec Corporation - C:\WINDOWS\System32\Drivers\SYMDNS.SYS

O23 - Service: SymEvent - Symantec Corporation - C:\Program Files\Symantec\SYMEVENT.SYS

O23 - Service: SYMFW - Symantec Corporation - C:\WINDOWS\System32\Drivers\SYMFW.SYS

O23 - Service: SYMIDS - Symantec Corporation - C:\WINDOWS\System32\Drivers\SYMIDS.SYS

O23 - Service: SYMIDSCO - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SymcData\idsdefs\20080623.001\symidsco.sys

O23 - Service: SYMNDIS - Symantec Corporation - C:\WINDOWS\System32\Drivers\SYMNDIS.SYS

O23 - Service: SYMREDRV - Symantec Corporation - C:\WINDOWS\System32\Drivers\SYMREDRV.SYS

*O23 - Service: Terminal Services (TermService) - Unknown owner - C:\WINDOWS\System32\svchost -k DComLaunch (file missing)

O23 - Service: Apple Mobile USB Driver (USBAAPL) - Apple, Inc. - C:\WINDOWS\SYSTEM32\Drivers\usbaapl.sys

O23 - Service: DIGITAL CAMERA (USBCamera) - Unknown owner - C:\WINDOWS\SYSTEM32\Drivers\Bulk533.sys (file missing)



Listado de Servicios (Deshabilitados):

--------------------------------------

**O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

**O23 - Service: dmboot - Microsoft Corp., Veritas Software - C:\WINDOWS\SYSTEM32\drivers\dmboot.sys

O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe



57 Servicios.

12 de Carga Automatica.

38 de Carga Manual.

7 Deshabilitados.





Por mi parte ya no se que mas puedo hacer.

Muchas gracias.

[msc hotline sat]

Pues dos cosas:



REPARA windows:




[quote="para REPARAR WINDOWS, msc"]
Sugiero proceder a REPARAR windows, arrancando con el CD de instalacion y primero seleccionar instalar, y tras detectar la particion existente, escoger REPARAR, no reinstalar para no perder las aplicaciones instaladas, y finalizar con un windowsupdate [/quote]







y al final al lanzar el windowsupdate, actualiza a SP3



y nos comentas el resultado, gracias



saludos



ms, 2 de Julio de 2008

[juls]

No me deja reparar windows, el caso es que tengo un xp media center edition 2005, el cd de instalación es en inglés, le doy a la opción Repair pero me pide una contraseña de administrador de la cual carezco porque nunca inicio sesión con ninguna contraseña. Se podría reparar, una vez he entrado en windows, cargando el cd? hay una opción que es 'upgrade', no se si será lo mismo que reparar.

[lucl]

Upgrade es mejora pero yo no te puedo asegurar que le des ahi, intenta omitir contraseña a ver si te deja, saludos

[juls]

Ya he conseguido reparar windows pero ahora entro en windows update y las actualizaciones no se instalan, me da un mensaje de error. Además no encuentro service pack 3 para descargar ni se si servirá para xp media center edition, porque con la puñetera incompatibilidad de idioma que trae media center no se si podré instalarlo.

Además, ahora cuando inicio Windows me aparece el siguiente mensaje: rthdcpl EAcces violation.

[msc hotline sat]

Pues caben dos soluciones, pruebalas, a ver si asi desaparece el mensaje:



Primera, Descarga:



http://www.ocxdump.com/download-ocx-files_...2/download.html



Sustituyela en C:\windows\system32\



Reinicia y listo.



Segunda, descarga este parche de Microsoft y reinicia:



http://support.microsoft.com/kb/935448/





Especialmente la primera, pues lo del parche de la segunda es implicito con el windowsupdate, y tambien podría ser la causa... Si no se resolviera, probaríamos de desinstalar el que debes tener...



y cuentanos el resultado, gracias



saludos



ms, 4 de Juliou de 2008

[juls]

Lo siento pero no lo he entendido muy bien, Que es lo que tengo que descargar del primer enlace que me dais?

Po que al reparar he perdido el acceso a muchos programas que siguen instalados?

[msc hotline sat]

No, REPARANDO windows no se pierde ningun acceso a ninguna aplicacion... a ver si ha REINSTALADO en lugar de REPARADO ...



y lo que oregunta de qué descargar, pues la download-ocx-files_...2/download.html y lo copia a la carpeta de sistema



saludos



ms, 4 de julio de 2008

[juls]

Lo que me aparece en la pagina es una lista de archivos .ocx, pero no se cual de ellos he de descargar.

Yo creo que reparé,no he perdido ningun dato, sigo teniendo toda mi música, fotos, etc.. lo que pasa es que muchos accesos directos de los programas ya no estan, tengo que ir a la carpeta donde estan ubicados para ejecutarlos, el antivirus despues de la reparación ya no podía funcionar y tuve que desinstalarlo.

[msc hotline sat]

Pues simplemente vaya donde tiene las aplicaciones, pulse botón derecho sobre el ejecutable y selecciones CREAR ACCESO DIRECTO, luego lo mueve al escritorio y listos.



Conviene que tenga en cuenta que las últimas noticias recibidas, puede que haya sido la falta del SP3 lo que ha facilitado la entrada de troyanos en su equipo, por lo que es MUY IMPORTANTE que lance un windowsupdate y actualice a SP3.



Por nuestra parte, dando el tema por solucionado, procedemos a cerrarlo



saludos



ms, 7-07-2008