Tengo el panda antivirus actualizado, pero al abrir el ie me redirecciona a una pagina con muchos simbolos raros y si escribo alguna direccion no me abre ninguna. he probado analizar el sistema con el ad-aware, el spybot, el panda... lo menos 4 o 5 diferentes y todos me encuentran spywares pero aunque los elimino e inmunizo el sistema me vuelven a aparecer si lo escaneo de nuevo y no se soluciona el problema. he probado arrancar el ordenador en modo seguro y analizar,eliminar e inmunizar y aun asi sigo sin solucionarlo. Al analizarlo con el hjackthis aparaecen unos ficheros que tienen el mismo nombre de la pagina a la que se me redirecciona el ie, los elimino pero vuelven a aprecer... no se si me explico bien...
el caso es que no puedo acceder a ninguna pagina en el ie (excepto si entro desde el correo del msn que entonces si que me deja), y ya no se que mas probar. si alguien me puede ayudar me hase un favor grandisimo.
gracias y un saludo
esta es la pagina a la que me redirecciona ( no se si vale para algo)
http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D%00@%77%77%77%2e%65%2d%66%69%6e%64%65%72%2e%63%63/%68%70/
el antivirus symantec online me detecta estos 4 virus, pero la verdad es que estoy muy verde de to esto
C:\WINDOWS\dpe.dll is infected with Trojan.StartPage
C:\Archivos de programa\GIANT Company Software\GIANT AntiSpyware\Quarantine\AFE5402D-14E9-40FF-8556-70AD14\FB196947-4729-4BFF-ACAB-78E6D3 is infected with Trojan.StartPage
C:\Archivos de programa\GIANT Company Software\GIANT AntiSpyware\Quarantine\6DFFFA63-CBDA-4D19-B154-D2B838\23A63BC9-5DB0-4CC7-8A32-B1D052 is infected with Trojan.StartPage
C:\Archivos de programa\GIANT Company Software\GIANT AntiSpyware\Quarantine\62BA1DE5-39D4-4546-B07C-797AB5\DCB9E800-5C50-4B97-98B4-541C6F is infected with Trojan.StartPage
y el ad-aware me pone esto en el scan log
Ad-Aware SE Build 1.05
Logfile Created on:sábado, 09 de octubre de 2004 4:37:31
Created with Ad-Aware SE Personal, free for private use.
Using definitions file:SE1R11 07.10.2004
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
References detected during the scan:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
CoolWebSearch(TAC index:10):12 total references
MRU List(TAC index:0):9 total references
Other(TAC index:5):18 total references
Tracking Cookie(TAC index:3):2 total references
Windows(TAC index:3):2 total references
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Ad-Aware SE Settings
===========================
Set : Search for negligible risk entries
Set : Safe mode (always request confirmation)
Set : Scan active processes
Set : Scan registry
Set : Deep-scan registry
Set : Scan my IE Favorites for banned URLs
Set : Scan my Hosts file
Extended Ad-Aware SE Settings
===========================
Set : Unload recognized processes & modules during scan
Set : Scan registry for all users instead of current user only
Set : Always try to unload modules before deletion
Set : During removal, unload Explorer and IE if necessary
Set : Let Windows remove files in use at next reboot
Set : Delete quarantined objects after restoring
Set : Include basic Ad-Aware settings in log file
Set : Include additional Ad-Aware settings in log file
Set : Include reference summary in log file
Set : Include alternate data stream details in log file
Set : Play sound at scan completion if scan locates critical objects
09-10-2004 4:37:31 - Scan started. (Full System Scan)
MRU List Object Recognized!
Location: : S-1-5-21-436374069-1336601894-682003330-1003\software\microsoft\search assistant\acmru
Description : list of recent search terms used with the search assistant
MRU List Object Recognized!
Location: : S-1-5-21-436374069-1336601894-682003330-1003\software\microsoft\windows\currentversion\explorer\comdlg32\opensavemru
Description : list of recently saved files, stored according to file extension
MRU List Object Recognized!
Location: : S-1-5-21-436374069-1336601894-682003330-1003\software\microsoft\windows\currentversion\explorer\comdlg32\lastvisitedmru
Description : list of recent programs opened
MRU List Object Recognized!
Location: : S-1-5-21-436374069-1336601894-682003330-1003\software\microsoft\windows\currentversion\explorer\recentdocs
Description : list of recent documents opened
MRU List Object Recognized!
Location: : S-1-5-21-436374069-1336601894-682003330-1003\software\microsoft\internet explorer
Description : last download directory used in microsoft internet explorer
MRU List Object Recognized!
Location: : software\microsoft\directdraw\mostrecentapplication
Description : most recent application to use microsoft directdraw
MRU List Object Recognized!
Location: : S-1-5-21-436374069-1336601894-682003330-1003\software\microsoft\internet explorer\typedurls
Description : list of recently entered addresses in microsoft internet explorer
MRU List Object Recognized!
Location: : .DEFAULT\software\microsoft\windows media\wmsdk\general
Description : windows media sdk
MRU List Object Recognized!
Location: : S-1-5-18\software\microsoft\windows media\wmsdk\general
Description : windows media sdk
Listing running processes
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
#:1 [smss.exe]
FilePath : \SystemRoot\System32\
ProcessID : 608
ThreadCreationTime : 09-10-2004 1:35:22
BasePriority : Normal
#:2 [csrss.exe]
FilePath : \??\C:\WINDOWS\system32\
ProcessID : 656
ThreadCreationTime : 09-10-2004 1:35:23
BasePriority : Normal
#:3 [winlogon.exe]
FilePath : \??\C:\WINDOWS\system32\
ProcessID : 680
ThreadCreationTime : 09-10-2004 1:35:25
BasePriority : High
#:4 [services.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 724
ThreadCreationTime : 09-10-2004 1:35:25
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Sistema operativo Microsoft® Windows®
CompanyName : Microsoft Corporation
FileDescription : Aplicación de servicios y controlador
InternalName : services.exe
LegalCopyright : Copyright (C) Microsoft Corporation. Reservados todos los derechos.
OriginalFilename : services.exe
#:5 [lsass.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 736
ThreadCreationTime : 09-10-2004 1:35:25
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : LSA Shell (Export Version)
InternalName : lsass.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : lsass.exe
#:6 [svchost.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 916
ThreadCreationTime : 09-10-2004 1:35:26
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe
#:7 [svchost.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 960
ThreadCreationTime : 09-10-2004 1:35:26
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe
#:8 [svchost.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 1104
ThreadCreationTime : 09-10-2004 1:35:26
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe
#:9 [svchost.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 1244
ThreadCreationTime : 09-10-2004 1:35:26
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe
#:10 [svchost.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 1316
ThreadCreationTime : 09-10-2004 1:35:26
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe
#:11 [spoolsv.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 1532
ThreadCreationTime : 09-10-2004 1:35:27
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Spooler SubSystem App
InternalName : spoolsv.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : spoolsv.exe
#:12 [pavfires.exe]
FilePath : C:\Archivos de programa\Panda Software\Panda Antivirus Platinum\Firewall\
ProcessID : 1700
ThreadCreationTime : 09-10-2004 1:35:27
BasePriority : Normal
FileVersion : 1, 3, 1, 9
ProductVersion : 7, 6, 0, 0
ProductName : Platinum 7 Pavfires
CompanyName : Panda Software
FileDescription : Personal Firewall Service
InternalName : Pavfires
LegalCopyright : Panda Software Copyright © 2003
OriginalFilename : Pavfires.exe
#:13 [pavsrv51.exe]
FilePath : C:\Archivos de programa\Panda Software\Panda Antivirus Platinum\
ProcessID : 1736
ThreadCreationTime : 09-10-2004 1:35:27
BasePriority : High
FileVersion : 6, 3, 0, 530
ProductVersion : 6.3
ProductName : Panda Antivirus
CompanyName : Panda Software
FileDescription : Panda Antivirus Service for Windows NT/2000
InternalName : pavsrv
LegalCopyright : Copyright © Panda Software 2003
OriginalFilename : pavsrv.exe
#:14 [svchost.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 260
ThreadCreationTime : 09-10-2004 1:35:28
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe
#:15 [avengine.exe]
FilePath : C:\Archivos de programa\Panda Software\Panda Antivirus Platinum\
ProcessID : 408
ThreadCreationTime : 09-10-2004 1:35:28
BasePriority : Normal
FileVersion : 6, 3, 0, 492
ProductVersion : 6.3
ProductName : Panda Antivirus Windows NT/2000
CompanyName : Panda Software
FileDescription : Proceso análisis independiente
InternalName : avengine
LegalCopyright : Copyright © Panda Software 1990-2002
OriginalFilename : avengine.exe
#:16 [explorer.exe]
FilePath : C:\WINDOWS\
ProcessID : 1588
ThreadCreationTime : 09-10-2004 1:35:32
BasePriority : Normal
FileVersion : 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 6.00.2900.2180
ProductName : Sistema operativo Microsoft® Windows®
CompanyName : Microsoft Corporation
FileDescription : Explorador de Windows
InternalName : explorer
LegalCopyright : © Microsoft Corporation. Reservados todos los derechos.
OriginalFilename : EXPLORER.EXE
#:17 [apvxdwin.exe]
FilePath : C:\Archivos de programa\Panda Software\Panda Antivirus Platinum\
ProcessID : 1952
ThreadCreationTime : 09-10-2004 1:35:34
BasePriority : Normal
FileVersion : 2, 14, 2, 0
ProductVersion : 7.00
ProductName : Panda Antivirus Platinum
CompanyName : Panda Software International
FileDescription : Platinum permanent protection
InternalName : Apvxdwin.exe
LegalCopyright : Panda Software. 2003 All rights reserved
#:18 [smtray.exe]
FilePath : C:\Archivos de programa\Analog Devices\SoundMAX\
ProcessID : 1960
ThreadCreationTime : 09-10-2004 1:35:34
BasePriority : Normal
FileVersion : 3, 2, 12, 0
ProductVersion : 3, 2, 12, 0
ProductName : SoundMAX Integrated Digital Audio
CompanyName : Analog Devices, Inc.
FileDescription : SoundMAX System Tray
InternalName : SMTray
LegalCopyright : Copyright © 2001 Analog Devices
OriginalFilename : SMTray.exe
#:19 [hpgs2wnd.exe]
FilePath : C:\Archivos de programa\Hewlett-Packard\HP Share-to-Web\
ProcessID : 1000
ThreadCreationTime : 09-10-2004 1:35:34
BasePriority : Normal
FileVersion : 2,4,0,26
ProductVersion : 2,4,0,26
ProductName : Hewlett-Packard hpgs2wnd
CompanyName : Hewlett-Packard
FileDescription : hpgs2wnd
InternalName : hpgs2wnd
LegalCopyright : Copyright © 2001
OriginalFilename : hpgs2wnd.exe
#:20 [alg.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 1032
ThreadCreationTime : 09-10-2004 1:35:34
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Application Layer Gateway Service
InternalName : ALG.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : ALG.exe
#:21 [ctfmon.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 1296
ThreadCreationTime : 09-10-2004 1:35:34
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : CTF Loader
InternalName : CTFMON
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : CTFMON.EXE
#:22 [msnmsgr.exe]
FilePath : C:\Archivos de programa\MSN Messenger\
ProcessID : 1340
ThreadCreationTime : 09-10-2004 1:35:34
BasePriority : Normal
FileVersion : 6.2.0137
ProductVersion : Version 6.2
ProductName : MSN Messenger
CompanyName : Microsoft Corporation
FileDescription : MSN Messenger
InternalName : msnmsgr
LegalCopyright : Copyright (c) Microsoft Corporation 1997-2004
LegalTrademarks : Microsoft(R) is a registered trademark of Microsoft Corporation in the U.S. and/or other countries.
OriginalFilename : msnmsgr.exe
#:23 [msmsgsvc.exe]
FilePath : C:\WINDOWS\System\
ProcessID : 1360
ThreadCreationTime : 09-10-2004 1:35:34
BasePriority : Normal
#:24 [hpgs2wnf.exe]
FilePath : C:\ARCHIV~1\HEWLET~1\HPSHAR~1\
ProcessID : 1780
ThreadCreationTime : 09-10-2004 1:35:35
BasePriority : Normal
FileVersion : 2,4,0,26
ProductVersion : 2,4,0,26
ProductName : hpgs2wnf Module
FileDescription : hpgs2wnf Module
InternalName : hpgs2wnf
LegalCopyright : Copyright 2001
OriginalFilename : hpgs2wnf.EXE
#:25 [pavproxy.exe]
FilePath : C:\Archivos de programa\Panda Software\Panda Antivirus Platinum\
ProcessID : 2464
ThreadCreationTime : 09-10-2004 1:35:45
BasePriority : Normal
FileVersion : 3, 6, 10, 24
ProductVersion : 3, 6, 10, 24
ProductName : Mail Resident
CompanyName : Panda Software
FileDescription : PavProxy
InternalName : PavProxy
LegalCopyright : Copyright © 2002
OriginalFilename : PavProxy.exe
#:26 [iexplore.exe]
FilePath : C:\Archivos de programa\Internet Explorer\
ProcessID : 2820
ThreadCreationTime : 09-10-2004 1:46:50
BasePriority : Normal
FileVersion : 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 6.00.2900.2180
ProductName : Sistema operativo Microsoft® Windows®
CompanyName : Microsoft Corporation
FileDescription : Internet Explorer
InternalName : iexplore
LegalCopyright : © Microsoft Corporation. Reservados todos los derechos.
OriginalFilename : IEXPLORE.EXE
#:27 [ad-aware.exe]
FilePath : C:\Archivos de programa\Lavasoft\Ad-Aware SE Personal\
ProcessID : 3692
ThreadCreationTime : 09-10-2004 2:37:18
BasePriority : Normal
FileVersion : 6.2.0.206
ProductVersion : VI.Second Edition
ProductName : Lavasoft Ad-Aware SE
CompanyName : Lavasoft Sweden
FileDescription : Ad-Aware SE Core application
InternalName : Ad-Aware.exe
LegalCopyright : Copyright © Lavasoft Sweden
OriginalFilename : Ad-Aware.exe
Comments : All Rights Reserved
Memory scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 9
Started registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
CoolWebSearch Object Recognized!
Type : Regkey
Data :
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : typelib\{bd0022a3-a43f-4f44-b64f-53ea7575f097}
CoolWebSearch Object Recognized!
Type : Regkey
Data :
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : clsid\{834261e1-dd97-4177-853b-c907e5d5bd6e}
CoolWebSearch Object Recognized!
Type : RegValue
Data :
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : clsid\{834261e1-dd97-4177-853b-c907e5d5bd6e}
Value :
CoolWebSearch Object Recognized!
Type : Regkey
Data :
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : analyzeie.dompeek.1
CoolWebSearch Object Recognized!
Type : RegValue
Data :
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : analyzeie.dompeek.1
Value :
CoolWebSearch Object Recognized!
Type : Regkey
Data :
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : analyzeie.dompeek
CoolWebSearch Object Recognized!
Type : RegValue
Data :
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : analyzeie.dompeek
Value :
CoolWebSearch Object Recognized!
Type : Regkey
Data :
Category : Malware
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\windows\currentversion\explorer\browser helper objects\{834261e1-dd97-4177-853b-c907e5d5bd6e}
Windows Object Recognized!
Type : RegData
Data : http://%65%68%74%74%70%2e%63%63/?
Category : Vulnerability
Comment : URL Prefix Possibly Compromised
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\windows\currentversion\url\defaultprefix
Value :
Data : http://%65%68%74%74%70%2e%63%63/?
Windows Object Recognized!
Type : RegData
Data : http://%65%68%74%74%70%2e%63%63/?
Category : Vulnerability
Comment : URL Prefix Possibly Compromised
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\windows\currentversion\url\prefixes
Value : www
Data : http://%65%68%74%74%70%2e%63%63/?
Registry Scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 10
Objects found so far: 19
Started deep registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Possible Browser Hijack attempt : Software\Microsoft\Internet Explorer\MainSearch Pagee-finder.cc
Other Object Recognized!
Type : RegData
Data : "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%73%65%61%72%63%68/"
Category : Vulnerability
Comment : Possible Browser Hijack attempt
Rootkey : HKEY_LOCAL_MACHINE
Object : Software\Microsoft\Internet Explorer\Main
Value : Search Page
Data : "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%73%65%61%72%63%68/"
Possible Browser Hijack attempt : Software\Microsoft\Internet Explorer\MainStart Pagee-finder.cc
Other Object Recognized!
Type : RegData
Data : "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%68%70/"
Category : Vulnerability
Comment : Possible Browser Hijack attempt
Rootkey : HKEY_LOCAL_MACHINE
Object : Software\Microsoft\Internet Explorer\Main
Value : Start Page
Data : "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%68%70/"
Possible Browser Hijack attempt : Software\Microsoft\Internet Explorer\MainSearch Bare-finder.cc
Other Object Recognized!
Type : RegData
Data : "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%73%65%61%72%63%68/"
Category : Vulnerability
Comment : Possible Browser Hijack attempt
Rootkey : HKEY_LOCAL_MACHINE
Object : Software\Microsoft\Internet Explorer\Main
Value : Search Bar
Data : "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%73%65%61%72%63%68/"
Possible Browser Hijack attempt : Software\Microsoft\Internet Explorer\MainDefault_Search_URLe-finder.cc
Other Object Recognized!
Type : RegData
Data : "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%73%65%61%72%63%68/"
Category : Vulnerability
Comment : Possible Browser Hijack attempt
Rootkey : HKEY_LOCAL_MACHINE
Object : Software\Microsoft\Internet Explorer\Main
Value : Default_Search_URL
Data : "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%73%65%61%72%63%68/"
Possible Browser Hijack attempt : Software\Microsoft\Internet Explorer\SearchSearchAssistante-finder.cc
Other Object Recognized!
Type : RegData
Data : "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%73%65%61%72%63%68/"
Category : Vulnerability
Comment : Possible Browser Hijack attempt
Rootkey : HKEY_LOCAL_MACHINE
Object : Software\Microsoft\Internet Explorer\Search
Value : SearchAssistant
Data : "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%73%65%61%72%63%68/"
Possible Browser Hijack attempt : Software\Microsoft\Internet Explorer\SearchCustomizeSearche-finder.cc
Other Object Recognized!
Type : RegData
Data : "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%73%65%61%72%63%68/"
Category : Vulnerability
Comment : Possible Browser Hijack attempt
Rootkey : HKEY_LOCAL_MACHINE
Object : Software\Microsoft\Internet Explorer\Search
Value : CustomizeSearch
Data : "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%73%65%61%72%63%68/"
Possible Browser Hijack attempt : Software\Microsoft\Internet Explorer\Searche-finder.cc
Other Object Recognized!
Type : RegData
Data : "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%73%65%61%72%63%68/"
Category : Vulnerability
Comment : Possible Browser Hijack attempt
Rootkey : HKEY_LOCAL_MACHINE
Object : Software\Microsoft\Internet Explorer\Search
Value :
Data : "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%73%65%61%72%63%68/"
Possible Browser Hijack attempt : Software\Microsoft\Internet Explorer\SearchURLe-finder.cc
Other Object Recognized!
Type : RegData
Data : "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%73%65%61%72%63%68/"
Category : Vulnerability
Comment : Possible Browser Hijack attempt
Rootkey : HKEY_LOCAL_MACHINE
Object : Software\Microsoft\Internet Explorer\SearchURL
Value :
Data : "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%73%65%61%72%63%68/"
Possible Browser Hijack attempt : Software\Microsoft\Windows\CurrentVersion\URL\DefaultPrefixehttp.cc
Other Object Recognized!
Type : RegData
Data : "http://%65%68%74%74%70%2E%63%63/?"
Category : Vulnerability
Comment : Possible Browser Hijack attempt
Rootkey : HKEY_LOCAL_MACHINE
Object : Software\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix
Value :
Data : "http://%65%68%74%74%70%2E%63%63/?"
Possible Browser Hijack attempt : SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixeswwwehttp.cc
Other Object Recognized!
Type : RegData
Data : "http://%65%68%74%74%70%2E%63%63/?"
Category : Vulnerability
Comment : Possible Browser Hijack attempt
Rootkey : HKEY_LOCAL_MACHINE
Object : SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixes
Value : www
Data : "http://%65%68%74%74%70%2E%63%63/?"
Possible Browser Hijack attempt : S-1-5-21-436374069-1336601894-682003330-1003\Software\Microsoft\Internet Explorer\MainSearch Pagee-finder.cc
Other Object Recognized!
Type : RegData
Data : "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%73%65%61%72%63%68/"
Category : Vulnerability
Comment : Possible Browser Hijack attempt
Rootkey : HKEY_USERS
Object : S-1-5-21-436374069-1336601894-682003330-1003\Software\Microsoft\Internet Explorer\Main
Value : Search Page
Data : "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%73%65%61%72%63%68/"
Possible Browser Hijack attempt : S-1-5-21-436374069-1336601894-682003330-1003\Software\Microsoft\Internet Explorer\MainStart Pagee-finder.cc
Other Object Recognized!
Type : RegData
Data : "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%68%70/"
Category : Vulnerability
Comment : Possible Browser Hijack attempt
Rootkey : HKEY_USERS
Object : S-1-5-21-436374069-1336601894-682003330-1003\Software\Microsoft\Internet Explorer\Main
Value : Start Page
Data : "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%68%70/"
Possible Browser Hijack attempt : S-1-5-21-436374069-1336601894-682003330-1003\Software\Microsoft\Internet Explorer\MainSearch Bare-finder.cc
Other Object Recognized!
Type : RegData
Data : "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%73%65%61%72%63%68/"
Category : Vulnerability
Comment : Possible Browser Hijack attempt
Rootkey : HKEY_USERS
Object : S-1-5-21-436374069-1336601894-682003330-1003\Software\Microsoft\Internet Explorer\Main
Value : Search Bar
Data : "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%73%65%61%72%63%68/"
Possible Browser Hijack attempt : S-1-5-21-436374069-1336601894-682003330-1003\Software\Microsoft\Internet Explorer\MainDefault_Search_URLe-finder.cc
Other Object Recognized!
Type : RegData
Data : "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%73%65%61%72%63%68/"
Category : Vulnerability
Comment : Possible Browser Hijack attempt
Rootkey : HKEY_USERS
Object : S-1-5-21-436374069-1336601894-682003330-1003\Software\Microsoft\Internet Explorer\Main
Value : Default_Search_URL
Data : "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%73%65%61%72%63%68/"
Possible Browser Hijack attempt : S-1-5-21-436374069-1336601894-682003330-1003\Software\Microsoft\Internet Explorer\SearchSearchAssistante-finder.cc
Other Object Recognized!
Type : RegData
Data : "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%73%65%61%72%63%68/"
Category : Vulnerability
Comment : Possible Browser Hijack attempt
Rootkey : HKEY_USERS
Object : S-1-5-21-436374069-1336601894-682003330-1003\Software\Microsoft\Internet Explorer\Search
Value : SearchAssistant
Data : "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%73%65%61%72%63%68/"
Possible Browser Hijack attempt : S-1-5-21-436374069-1336601894-682003330-1003\Software\Microsoft\Internet Explorer\SearchCustomizeSearche-finder.cc
Other Object Recognized!
Type : RegData
Data : "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%73%65%61%72%63%68/"
Category : Vulnerability
Comment : Possible Browser Hijack attempt
Rootkey : HKEY_USERS
Object : S-1-5-21-436374069-1336601894-682003330-1003\Software\Microsoft\Internet Explorer\Search
Value : CustomizeSearch
Data : "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%73%65%61%72%63%68/"
Possible Browser Hijack attempt : S-1-5-21-436374069-1336601894-682003330-1003\Software\Microsoft\Internet Explorer\Searche-finder.cc
Other Object Recognized!
Type : RegData
Data : "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%73%65%61%72%63%68/"
Category : Vulnerability
Comment : Possible Browser Hijack attempt
Rootkey : HKEY_USERS
Object : S-1-5-21-436374069-1336601894-682003330-1003\Software\Microsoft\Internet Explorer\Search
Value :
Data : "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%73%65%61%72%63%68/"
Possible Browser Hijack attempt : S-1-5-21-436374069-1336601894-682003330-1003\Software\Microsoft\Internet Explorer\SearchURLe-finder.cc
Other Object Recognized!
Type : RegData
Data : "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%73%65%61%72%63%68/"
Category : Vulnerability
Comment : Possible Browser Hijack attempt
Rootkey : HKEY_USERS
Object : S-1-5-21-436374069-1336601894-682003330-1003\Software\Microsoft\Internet Explorer\SearchURL
Value :
Data : "http://%68%6F%6D%65%70%61%67%65%2E%63%6F%6D%00@%77%77%77%2E%65%2D%66%69%6E%64%65%72%2E%63%63/%73%65%61%72%63%68/"
Deep registry scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 18
Objects found so far: 37
Started Tracking Cookie scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : jesus
Category : Data Miner
Comment : Hits:1
Value : Cookie:jesus
Expires : 09-10-2004 8:06:40
LastSync : Hits:1
UseCount : 0
Hits : 1
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : jesus roman@tribalfusion[1].txt
Category : Data Miner
Comment : Hits:1
Value : Cookie:jesus
Expires : 01-01-2038 2:00:00
LastSync : Hits:1
UseCount : 0
Hits : 1
Tracking cookie scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 2
Objects found so far: 39
Deep scanning and examining files (C:)
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Disk Scan Result for C:\
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 39
Scanning Hosts file......
Hosts file location:"C:\WINDOWS\system32\drivers\etc\hosts".
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Hosts file scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
1 entries scanned.
New critical objects:0
Objects found so far: 39
Performing conditional scans...
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
CoolWebSearch Object Recognized!
Type : Regkey
Data :
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{b1e68d42-02c4-465b-8368-5ed9b732e22d}
CoolWebSearch Object Recognized!
Type : RegValue
Data :
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{b1e68d42-02c4-465b-8368-5ed9b732e22d}
Value :
CoolWebSearch Object Recognized!
Type : RegValue
Data :
Category : Malware
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\internet explorer\main
Value : Search Bar
CoolWebSearch Object Recognized!
Type : File
Data : hosts
Category : Malware
Comment :
Object : C:\WINDOWS\
Conditional scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 4
Objects found so far: 43
4:43:53 Scan Complete
Summary Of This Scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Total scanning time:00:06:21.797
Objects scanned:72732
Objects identified:34
Objects ignored:0
New critical objects:34
Pues nada, eso es todo. un saludo.
