Posible Spyware?

Chueco · Mensaje por **Chueco** » 20 Feb 2007, 04:41

Hola a todos, quisiera si por favor me podrian ayudar con este problema, la otra noche estaba jugando lo mas normal, a un juego online que juego hace tiempo cuando de repente la placa de video (intel R 82852/82855 GM/GME graphic controller) me produjo un error y un mensaje "The ialmrnt5 display driver has stopped working normally. Save yourwork and reboot the system to restore full display functionality. The next time you reboot the machine a dialog will be displayed giving you a chance to upload data about this failure to microsoft." lo que me dejo con la secuela de que no funciona bien como antes cuando entro a los juegos, buscando y buscando, encontre en algunos lugares que es posible de que sea un spyware o malware, no estoy seguro y perdon por mi ignoracia es que no se si sea esto cierto o no. por eso decidi publicarlo en este Foro de Spyware y no en otra parte, aqui les dejo el log de mi pc.

P.S: Cuando intento reinstalar o actualizar los controladores no me deja o me da un mensaje que dice "this software canot be intaled on ur computer, plz refer to manufacturer

Logfile of HijackThis v1.99.1
Scan saved at 00:33:00, on 20/2/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:

Código: Seleccionar todo

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\GERMANO\Local Settings\Temporary Internet 
Files\Content.IE5\G2GH2PHQ\HijackThis_1.99.1[1].exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = 
http://www.toshiba.com/search
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = 
http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = 
http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = 
http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = 
http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = 
http://www.toshiba.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - 
C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - 
C:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: &iG - {7EEF1E3D-FD97-4401-BCDB-5827F2D11709} - 
C:\PROGRA~1\iGv6\igshop.dll
O2 - BHO: Windows Live Sign-in Helper - 
{9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common 
Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - 
c:\program files\google\googletoolbar3.dll
O2 - BHO: Windows Live Toolbar Helper - 
{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live 
Toolbar\msntb.dll
O2 - BHO: QUICKfind BHO Object - {C08DF07A-3E49-4E25-9AB0-D3882835F153} - 
C:\PROGRA~1\IDM\QUICKF~1\PlugIns\IEHelp.dll
O2 - BHO: gFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - 
C:\PROGRA~1\FlashGet\getflash.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - 
C:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} 
- C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &iG - {7EEF1E3D-FD97-4401-BCDB-5827F2D11709} - 
C:\PROGRA~1\iGv6\igshop.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program 
files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [00THotkey] C:\WINDOWS\System32\00THotkey.exe
O4 - HKLM\..\Run: [000StTHK] 000StTHK.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [TouchED] C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
O4 - HKLM\..\Run: [TFNF5] TFNF5.exe
O4 - HKLM\..\Run: [PadTouch] "C:\Program Files\TOSHIBA\PadTouch\PadExe.exe
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
O4 - HKLM\..\Run: [B'sCLiP] C:\PROGRA~1\B'SCLI~1\Win2K\BSCLIP.exe
O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SysBrand] "C:\PROGRA~1\iGv6\sysbrand.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" 
/background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft 
Office\Office10\OSA.EXE
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program 
Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Download All by FlashGet - C:\Program 
Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program 
Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xportar para o Microsoft Excel - 
res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - 
C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - 
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program 
Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - 
C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - 
C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - 
{D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - 
C:\Documents and Settings\GERMANO\Start Menu\Programs\IMVU\Run IMVU.lnk
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - 
%windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - 
{e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network 
Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - 
C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - 
{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program 
Files\Messenger\msmsgs.exe
O9 - Extra button: Barra do iG - {FD1672E0-AE0D-465B-B345-F7B0944A121D} - 
C:\PROGRA~1\iGv6\igshop.dll
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet 
Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.toshiba.com
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - 
http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1163793171046
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - 
C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - 
C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - 
C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - 
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - 
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - 
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - 
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - 
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - 
C:\WINDOWS\System32\DVDRAMSV.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program 
Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - 
Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division 
Software - C:\Program Files\Alcohol Soft\Alcohol 
52\StarWind\StarWindService.exe
O23 - Service: Swupdtmr - Unknown owner - 
c:\toshiba\ivp\swupdate\swupdtmr.exe
O23 - Service: SecuROM User Access Service (UserAccess) - Unknown owner - 
C:\WINDOWS\system32\UAService.exe

Desde ya muchas gracias a todos por darme la oportunidad de publicar mi problema.

Mensaje por **msc hotline sat** » 20 Feb 2007, 06:13

Envianos estos ficheros para analizar:

C:\PROGRA~1\iGv6\igshop.dll

C:\PROGRA~1\iGv6\sysbrand.exe

C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll

C:\WINDOWS\system32\UAService.exe

Y elimina estas claves:

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} (no file)

O2 - BHO: &iG - {7EEF1E3D-FD97-4401-BCDB-5827F2D11709} - C:\PROGRA~1\iGv6\igshop.dll

O3 - Toolbar: &iG - {7EEF1E3D-FD97-4401-BCDB-5827F2D11709} - C:\PROGRA~1\iGv6\igshop.dll

recordar: https://foros.zonavirus.com/viewtopic.php?f=2&t=45334

saludos

ms, 20-02-2007

Chueco · Mensaje por **Chueco** » 21 Feb 2007, 00:58

OK, borre las entradas que me pidieron, aunque el IG6, es un programa conocido por mi y que yo instale lo he hecho igual.

En algunos minutos les envio a ustedes los ficheros que me pidieron para analizar.

Mensaje por **msc hotline sat** » 21 Feb 2007, 07:39

Cuando entremos a trabajar hoy en SATINFO, analizaremos los ficheros recibidos e informaremos

saludos

ms, 21-02-2007

Mensaje por **msc hotline sat** » 21 Feb 2007, 13:16

Revisados los ficheros, no parecen ser la solucion que esperabamos.

Para mas informacion vea lo que puede convenirle al respecto:

[quote]
please find more information about this problem:

due to ialmrnt5 crash error, you can find a very interresting information from the link below, but the most important question is: HOW to DO to resolve the problem??

exepting replacing the 82845 graphic adapter bye an other (non intel) one...

http://secunia.com/advisories/18286/

Description:

$um$id has discovered a vulnerability in Intel Graphics Accelerator Driver, which can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerability is cause due to an error in the "ialmrnt5" display driver when handing overly long text in a textfield. This can potentially be exploited to cause a DoS e.g. by tricking a user to open a window to an overly long URL with the browser.

Successful exploitation may cause the system to restart or cause the system to revert to a low resolution display mode.

The vulnerability has been confirmed in version 6.14.10.4308. Other versions may also be affected.

[/quote]

Y una vez eliminados dichos ficheros y claves de carga, se descarta posible actividad virica al respecto.

Pruebe de reinstalar la placa de video con unos drivers mas recientes, o pruebe con otra, no sea que se haya dañado.

saludos

ms, 21-02-2007