Lentitud Del Sistema, Ventanas De Publicidad S.O.S. AYUDA!!!

DJ_CAG · Mensaje por **DJ_CAG** » 04 Nov 2006, 22:31

Hola, os escribo porque tengo el siguiente problemon:

Resulta que mi pc va superlentisimo, parece como si no tuviera mucha memoria RAM, de echo me sale a menudo el mensaje de " Espacio de memoria virtual insfuiciente " con el dibujo ese de la exclamacion en el triangulo amarillo, el caso es que me va muy lento y no solo con Internet, sino a la hora de abrir carpetas, ejecutar programas, abrir el reproductor de windows...etc.

Ese es uno d los problemas, otro problema es Internet explorer, cuando hago alguna buskeda con el google me sale muchas veces pantalla emergentes indicandome que me baje programas antispyware etc...os he dejado un link donde os podeis descargar una imagen que he echo de las pantallas que me aparecen, el link es el siguiente:

http://www.yousendit.com/transfer.php?action=download&ufid=220530EF5ACA10A2

El otro Problema es que me han aparecido en C: unos archivos tipo .EXE que no tengo ni idea de lo que son, sus nombres son los siguientes:

kpecov

ndmaitfg

nhtkanbx

pdyrtpnr

xfrb

uniq (este ultimo me sale sin extension ninguna, solo como archivo)

Os pego el log del hijackthis a ver si me podeis ayudar, que yevo unos dias desesperao y no se que hacer.

el log es este:

Logfile of HijackThis v1.99.1

Scan saved at 18:12:34, on 04/11/2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Archivos de programa\QuickTime\qttask.exe

C:\Archivos de programa\MessengerPlus! 3\MsgPlus.exe

C:\Archivos de programa\Hewlett-Packard\HP Software Update\HPWuSchd.exe

C:\Archivos de programa\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe

C:\Archivos de programa\Java\jre1.5.0_07\bin\jusched.exe

C:\WINDOWS\SOUNDMAN.EXE

c:\archivos de programa\mcafee.com\agent\mcdetect.exe

C:\ARCHIV~1\mcafee.com\agent\mcagent.exe

c:\ARCHIV~1\mcafee.com\vso\mcshield.exe

C:\WINDOWS\system32\LVCOMSX.EXE

c:\ARCHIV~1\mcafee.com\agent\mctskshd.exe

c:\ARCHIV~1\mcafee.com\vso\OasClnt.exe

C:\ARCHIV~1\McAfee\SPAMKI~1\MskAgent.exe

C:\ARCHIV~1\McAfee.com\PERSON~1\MpfTray.exe

c:\archivos de programa\mcafee.com\vso\mcvsshld.exe

C:\WINDOWS\TEMP\ntea1.exe

C:\Archivos de programa\Archivos comunes\Ahead\lib\NMBgMonitor.exe

c:\archiv~1\mcafee.com\vso\mcvsescn.exe

C:\ARCHIV~1\McAfee.com\PERSON~1\MpfService.exe

C:\Archivos de programa\Messenger\msmsgs.exe

C:\WINDOWS\system32\msasvc.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Archivos de programa\Archivos comunes\Microsoft Shared\Web Folders\ibm00006.exe

C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger .exe

C:\Archivos de programa\MSN Messenger\msnmsgr.exe

C:\ARCHIV~1\McAfee.com\PERSON~1\MpfAgent.exe

c:\archiv~1\mcafee.com\vso\mcvsftsn.exe

C:\WINDOWS\system32\svchost.exe

C:\ARCHIV~1\McAfee\SPAMKI~1\MSKSrvr.exe

C:\Archivos de programa\Internet Explorer\IEXPLORE.EXE

C:\Archivos de programa\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.es/

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = localhost

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos

R3 - Default URLSearchHook is missing

O1 - Hosts: localhost 127.0.0.1

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Archivos de programa\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

O2 - BHO: Class - {21A40A09-BFF8-90B5-39C9-01AA3F24DC7E} - C:\WINDOWS\vwunl1.dll (file missing)

O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\archiv~1\mcafee.com\vso\mcvsshl.dll

O4 - HKLM\..\Run: [CnxDslTaskBar] C:\Archivos de programa\Telefonica Kit ADSL USB\CnxDslTb.exe

O4 - HKLM\..\Run: [sachost] C:\WINDOWS\sachostx.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Archivos de programa\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [MessengerPlus3] "C:\Archivos de programa\MessengerPlus! 3\MsgPlus.exe"

O4 - HKLM\..\Run: [HP Software Update] C:\Archivos de programa\Hewlett-Packard\HP Software Update\HPWuSchd.exe

O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb0 8.exe

O4 - HKLM\..\Run: [DeviceDiscovery] C:\Archivos de programa\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe

O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Archivos de programa\Java\jre1.5.0_07\bin\jusched.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [mozilla-text] AppMasterCenter.exe

O4 - HKLM\..\Run: [driver64] teqq32.exe

O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [MCAgentExe] c:\ARCHIV~1\mcafee.com\agent\mcagent.exe

O4 - HKLM\..\Run: [MCUpdateExe] C:\ARCHIV~1\mcafee.com\agent\mcupdate.exe

O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE

O4 - HKLM\..\Run: [MSKDetectorExe] C:\ARCHIV~1\McAfee\SPAMKI~1\MSKDetct.exe /startup

O4 - HKLM\..\Run: [VSOCheckTask] "C:\ARCHIV~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask

O4 - HKLM\..\Run: [VirusScan Online] C:\Archivos de programa\McAfee.com\VSO\mcvsshld.exe

O4 - HKLM\..\Run: [OASClnt] C:\Archivos de programa\McAfee.com\VSO\oasclnt.exe

O4 - HKLM\..\Run: [MSKAGENTEXE] C:\ARCHIV~1\McAfee\SPAMKI~1\MskAgent.exe

O4 - HKLM\..\Run: [MPFExe] C:\ARCHIV~1\McAfee.com\PERSON~1\MpfTray.exe

O4 - HKLM\..\Run: [ntea1.exe] C:\WINDOWS\TEMP\ntea1.exe

O4 - HKLM\..\RunServices: [0mcamcap] C:\WINDOWS\system32\0mcamcap.exe

O4 - HKLM\..\RunServices: [SystemTools] C:\WINDOWS\system32\kernels8.exe

O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Archivos de programa\Archivos comunes\Ahead\lib\NMBgMonitor.exe"

O4 - HKCU\..\Run: [MSMSGS] "C:\Archivos de programa\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [shell] "C:\Archivos de programa\Archivos comunes\Microsoft Shared\Web Folders\ibm00006.exe"

O4 - HKCU\..\Run: [KillAndClean] "C:\Archivos de programa\KillAndClean\KillAndClean.exe"

O4 - HKCU\..\Run: [dialer423] BoundRec.exe

O4 - HKCU\..\Run: [trycrt] sbin.exe

O4 - HKCU\..\Run: [Uint32] bingo9.exe

O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger .exe

O4 - HKCU\..\Run: [MessengerPlus3] "C:\Archivos de programa\MessengerPlus! 3\MsgPlus.exe" /WinStart

O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Archivos de programa\Archivos comunes\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Archivos de programa\Archivos comunes\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe

O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_07\bin\ssv.dll (file missing)

O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_07\bin\ssv.dll (file missing)

O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\archivos de programa\mcafee\spamkiller\mcapfbho.dll (file missing)

O9 - Extra 'Tools' menuitem: McAfee Anti-Phishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\archivos de programa\mcafee\spamkiller\mcapfbho.dll (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe

O12 - Plugin for .spop: C:\Archivos de programa\Internet Explorer\Plugins\NPDocBox.dll

O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab

O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab

O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{B95F4448-57E3-4D54-92BC-90FC6BA482CC}: NameServer = 85.255.113.106,85.255.112.167

O17 - HKLM\System\CCS\Services\Tcpip\..\{C49A7F02-048B-4B20-B24C-4FE47CF39AB4}: NameServer = 85.255.113.106,85.255.112.167

O17 - HKLM\System\CCS\Services\Tcpip\..\{F7556106-CAEF-4F72-930C-F12EE5F3C73F}: NameServer = 85.255.113.106,85.255.112.167

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.113.106 85.255.112.167

O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.113.106 85.255.112.167

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.113.106 85.255.112.167

O18 - Protocol: bw+0 - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw+0s - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw-0 - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw-0s - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw00 - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw00s - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw10 - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw10s - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw20 - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw20s - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw30 - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw30s - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw40 - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw40s - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw50 - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw50s - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw60 - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw60s - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw70 - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw70s - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw80 - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw80s - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw90 - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw90s - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwa0 - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwa0s - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwb0 - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwb0s - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwc0 - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwc0s - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwd0 - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwd0s - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwe0 - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwe0s - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwf0 - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwf0s - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll

O18 - Protocol: bwg0 - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwg0s - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwh0 - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwh0s - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwi0 - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwi0s - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwj0 - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwj0s - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwk0 - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwk0s - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwl0 - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwl0s - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwm0 - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwm0s - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwn0 - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwn0s - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwo0 - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwo0s - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwp0 - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwp0s - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwq0 - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwq0s - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwr0 - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwr0s - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bws0 - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bws0s - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwt0 - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwt0s - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwu0 - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwu0s - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwv0 - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwv0s - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bww0 - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bww0s - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwx0 - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwx0s - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwy0 - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwy0s - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwz0 - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwz0s - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\ARCHIV~1\MSNMES~1\msgrapp.dll" (file missing)

O18 - Protocol: offline-8876480 - {B568B1C7-65FC-4158-BD4F-9115A7F8D6FD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Archivos de programa\Archivos comunes\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\archivos de programa\mcafee.com\agent\mcdetect.exe

O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\ARCHIV~1\mcafee.com\vso\mcshield.exe

O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\ARCHIV~1\mcafee.com\agent\mctskshd.exe

O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\ARCHIV~1\McAfee.com\Agent\mcupdmgr.exe

O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\ARCHIV~1\McAfee.com\PERSON~1\MpfService.exe

O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - C:\WINDOWS\system32\msasvc.exe

O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\ARCHIV~1\McAfee\SPAMKI~1\MSKSrvr.exe

O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

Espero que me podais ayudar ya que estoy desesperado.

Gracias de antemano.

ahi · Mensaje por **ahi** » 05 Nov 2006, 00:26

ufff. veamos ese log..:

borra estas claves.

O4 - HKLM\..\Run: [sachost] C:\WINDOWS\sachostx.exe

O4 - HKLM\..\Run: [ntea1.exe] C:\WINDOWS\TEMP\ntea1.exe

O4 - HKLM\..\RunServices: [0mcamcap] C:\WINDOWS\system32\0mcamcap.exe

O4 - HKLM\..\RunServices: [SystemTools] C:\WINDOWS\system32\kernels8.exe

esta es del nero 7 pero abre puertos. eliminela:

O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Archivos de programa\Archivos comunes\Ahead\lib\NMBgMonitor.exe"

O4 - HKCU\..\Run: [shell] "C:\Archivos de programa\Archivos comunes\Microsoft Shared\Web Folders\ibm00006.exe"

O4 - HKCU\..\Run: [KillAndClean] "C:\Archivos de programa\KillAndClean\KillAndClean.exe"

O4 - HKCU\..\Run: [dialer423] BoundRec.exe

O4 - HKCU\..\Run: [trycrt] sbin.exe

O4 - HKCU\..\Run: [Uint32] bingo9.exe

y seguro que se me escapa algo (de las lineas 018) pero de eso sabe mas msc hotline sat así que espera su respuesta. ah recuerda como eliminar las claves:

marca la casilla de la izquierda de estas claves y eliminalas con FIX CHECKED. l

luego reinicias y nos cuentas el resultado.

Mensaje por **msc hotline sat** » 05 Nov 2006, 08:43

Complementando lo indicado por "ahi", eliminar ademas:

R3 - Default URLSearchHook is missing

O2 - BHO: Class - {21A40A09-BFF8-90B5-39C9-01AA3F24DC7E} - C:\WINDOWS\vwunl1.dll (file missing)

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_07\bin\ssv.dll (file missing)

O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_07\bin\ssv.dll (file missing)

O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\archivos de programa\mcafee\spamkiller\mcapfbho.dll (file missing)

O9 - Extra 'Tools' menuitem: McAfee Anti-Phishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\archivos de programa\mcafee\spamkiller\mcapfbho.dll (file missing)

Creo importante conocer el bicho que tenia dentro, backdoor roba-passwords, gusano de e-mail, servidor proxy...:

http://www.vsantivirus.com/locksky-i.htm

Tener precaucion con el riesgo bancario al respecto...

"El troyano monitorea la apertura de ciertas ventanas de Internet relacionadas con la banca on-line, etc., e intenta capturar la información desplegada y la ingresada por el usuario en ellas (contraseñas, etc.)."

Y mire de enviarnos este fichero para analizarlo y controlarlo con nuestras utilidades, ya que es la madre del cordero:

C:\WINDOWS\sachostx.exe

y tambien de estos otros que nadie conoce y que se ejecuta desde una carpeta temporal y demas...:

C:\WINDOWS\TEMP\ntea1.exe

C:\WINDOWS\system32\0mcamcap.exe

C:\WINDOWS\system32\kernels8.exe

C:\Archivos de programa\Archivos comunes\Microsoft Shared\Web Folders\ibm00006.exe"

C:\Archivos de programa\KillAndClean\KillAndClean.exe"

BoundRec.exe

sbin.exe

bingo9.exe

Bueno y hemos llegado a Ukraina !!!:

Vea las claves O17 los servidores de DNS que le hace usar

85.255.113.106 UA Ukraine 07 Kharkivs'ka Oblast' Kharkiv 50.0000 36.2500 Inhoster hosting company Inhoster hosting company

85.255.112.167 UA Ukraine 07 Kharkivs'ka Oblast' Kharkiv 50.0000 36.2500 Inhoster hosting company Inhoster hosting company

Estos servidores estan considerados maliciosos

Tras informarte con tu ISP de cuales te recomiendan, puedes probar cambiarlos con CONFGDNS.EXE

CONFGDNS.EXE

http://www.zonavirus.com/descargas/confgdns.asp

y finalmente, para restaurar u eliminar claves no visibles en el log del HJT, lanza el ELISTARA:

ELISTARA:

http://www.zonavirus.com/descargas/elistara.asp

Tras lanzarlo, reiniciar y postearnos el contenido de C:\infosat.txt para ver el resultado del proceso

saludos

ms, 5-11-2006

nota: recuerda https://foros.zonavirus.com/viewtopic.php?f=5&t=45334