¿Virus? ¿Troyano? ¿¿??

cirrabo · Mensaje por **cirrabo** » 11 Mar 2007, 18:45

Buenas:

Llevo varios días con problemas en mi PC. Se iniciaron cuando una de mis cuentas de correo cambió su pop3 por el siguiente: 127.0.0.1. Cada vez que reinicio el equipo tengo que cambiarla.

Después. los problemas han ido en aumento: el arranque del PC es eterno, la navegación es cada vez más difícil, con constantes bloqueos, y el rendimiento del sistema llega al 100% a poco que haga.

Tengo instalado el McAfee Security Center, pero primero dejó de funcionar el Spam Killer y ahora se ha desactivado el índice antiintrusión del Privacy Service. Además, he pasado varias veces el Adaware y Spyware, así como el Trojan Remouver y varios antivirus de la web, pero no consigo arreglar la situación.

Adjunto el log del HijackThis por si alguien puede decirme cómo solucionar mi problema y cómo poder evitar que vuelva a suceder.

Muchas gracias.

Logfile of HijackThis v1.98.2

Scan saved at 17:26:23, on 11/03/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

E:\WINDOWS\System32\smss.exe

E:\WINDOWS\SYSTEM32\winlogon.exe

E:\WINDOWS\system32\services.exe

E:\WINDOWS\system32\lsass.exe

E:\WINDOWS\system32\svchost.exe

E:\WINDOWS\System32\svchost.exe

E:\WINDOWS\system32\spoolsv.exe

e:\archivos de programa\mcafee.com\agent\mcdetect.exe

e:\ARCHIV~1\mcafee.com\vso\mcshield.exe

e:\ARCHIV~1\mcafee.com\agent\mctskshd.exe

E:\ARCHIV~1\McAfee.com\PERSON~1\MpfService.exe

E:\ARCHIV~1\McAfee\SPAMKI~1\MSKSrvr.exe

E:\Archivos de programa\Photodex\ProShowGold\ScsiAccess.exe

E:\WINDOWS\System32\svchost.exe

E:\WINDOWS\system32\svchost.exe

E:\WINDOWS\system32\WgaTray.exe

E:\WINDOWS\Explorer.EXE

E:\WINDOWS\System32\rmctrl.exe

E:\WINDOWS\SOUNDMAN.EXE

E:\Archivos de programa\Archivos comunes\Real\Update_OB\realsched.exe

E:\Archivos de programa\Java\jre1.5.0_10\bin\jusched.exe

E:\Archivos de programa\McAfee.com\VSO\mcvsshld.exe

E:\Archivos de programa\McAfee.com\VSO\oasclnt.exe

E:\ARCHIV~1\mcafee.com\agent\mcagent.exe

e:\archiv~1\mcafee.com\vso\mcvsescn.exe

E:\ARCHIV~1\McAfee.com\PERSON~1\MpfTray.exe

E:\ARCHIV~1\McAfee\SPAMKI~1\MskAgent.exe

E:\Archivos de programa\Arovax AntiSpyware\arovaxantispyware.exe

E:\Archivos de programa\SPYWAREfighter\spftray.exe

E:\WINDOWS\system32\ctfmon.exe

E:\Archivos de programa\Microsoft ActiveSync\WCESCOMM.EXE

E:\Archivos de programa\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

E:\Archivos de programa\Sony Corporation\Image Transfer\SonyTray.exe

E:\Archivos de programa\SPYWAREfighter\spfprc.exe

E:\ARCHIV~1\McAfee.com\PERSON~1\MpfAgent.exe

E:\Archivos de programa\Java\jre1.5.0_10\bin\jucheck.exe

E:\WINDOWS\SYSTEM32\taskmgr.exe

C:\Archivos de programa\Internet Explorer\Iexplore.exe

D:\antivirus\hijack this\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Archivos de programa\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

O2 - BHO: McBrwHelper Class - {227B8AA8-DAF2-4892-BD1D-73F568BCB24E} - e:\ARCHIV~1\mcafee.com\mps\mcbrhlpr.dll

O2 - BHO: McAfee PopupKiller - {3EC8255F-E043-4cae-8B3B-B191550C2A22} - e:\archivos de programa\mcafee.com\mps\popupkiller.dll

O2 - BHO: McAfee AntiPhishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - e:\ARCHIV~1\mcafee\SPAMKI~1\mcapfbho.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Archivos de programa\Java\jre1.5.0_10\bin\ssv.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - e:\archivos de programa\google\googletoolbar4.dll

O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)

O3 - Toolbar: DAP Bar - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - E:\Archivos de programa\DAP\DAPIEBar.dll

O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - e:\archiv~1\mcafee.com\vso\mcvsshl.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - e:\archivos de programa\google\googletoolbar4.dll

O4 - HKLM\..\Run: [RemoteControl] E:\WINDOWS\System32\rmctrl.exe

O4 - HKLM\..\Run: [WinampAgent] "E:\Archivos de programa\Winamp\Winampa.exe"

O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [TkBellExe] "E:\Archivos de programa\Archivos comunes\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [NeroFilterCheck] E:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [SunJavaUpdateSched] "E:\Archivos de programa\Java\jre1.5.0_10\bin\jusched.exe"

O4 - HKLM\..\Run: [VSOCheckTask] "E:\ARCHIV~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask

O4 - HKLM\..\Run: [VirusScan Online] E:\Archivos de programa\McAfee.com\VSO\mcvsshld.exe

O4 - HKLM\..\Run: [OASClnt] E:\Archivos de programa\McAfee.com\VSO\oasclnt.exe

O4 - HKLM\..\Run: [MCAgentExe] e:\ARCHIV~1\mcafee.com\agent\mcagent.exe

O4 - HKLM\..\Run: [MCUpdateExe] e:\ARCHIV~1\mcafee.com\agent\mcupdate.exe

O4 - HKLM\..\Run: [MPFExe] E:\ARCHIV~1\McAfee.com\PERSON~1\MpfTray.exe

O4 - HKLM\..\Run: [MPSExe] e:\ARCHIV~1\mcafee.com\mps\mscifapp.exe /embedding

O4 - HKLM\..\Run: [MSKAGENTEXE] E:\ARCHIV~1\McAfee\SPAMKI~1\MskAgent.exe

O4 - HKLM\..\Run: [MSKDetectorExe] E:\ARCHIV~1\McAfee\SPAMKI~1\MSKDetct.exe /startup

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [Arovax AntiSpyware] E:\Archivos de programa\Arovax AntiSpyware\arovaxantispyware.exe /s

O4 - HKLM\..\Run: [spywarefighterguard] E:\Archivos de programa\SPYWAREfighter\spftray.exe

O4 - HKCU\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [H/PC Connection Agent] "E:\Archivos de programa\Microsoft ActiveSync\WCESCOMM.EXE"

O4 - HKCU\..\Run: [swg] E:\Archivos de programa\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

O4 - Global Startup: Microsoft Office.lnk = E:\Archivos de programa\Microsoft Office\Office10\OSA.EXE

O4 - Global Startup: Image Transfer.lnk = ?

O8 - Extra context menu item: &Download with &DAP - E:\ARCHIV~1\DAP\dapextie.htm

O8 - Extra context menu item: Download &all with DAP - E:\ARCHIV~1\DAP\dapextie2.htm

O8 - Extra context menu item: E&xportar a Microsoft Excel - res://E:\ARCHIV~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Archivos de programa\Java\jre1.5.0_10\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Archivos de programa\Java\jre1.5.0_10\bin\ssv.dll

O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - e:\ARCHIV~1\mcafee\SPAMKI~1\mcapfbho.dll

O9 - Extra 'Tools' menuitem: McAfee AntiPhishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - e:\ARCHIV~1\mcafee\SPAMKI~1\mcapfbho.dll

O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab

O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O16 - DPF: {B1826A9F-4AA0-4510-BA77-9013E74E4B9B} - http://www.trendmicro.com/spyware-scan/as4web.cab

O16 - DPF: {B785FA3C-1DE9-4D20-8396-613C486FE95E} (AeatCtl Class) - https://www5.aeat.es/es13/h/cactivex.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{15712628-3B05-441D-9244-CB79062869DF}: NameServer = 80.58.61.250 80.58.61.254

O17 - HKLM\System\CS1\Services\Tcpip\..\{15712628-3B05-441D-9244-CB79062869DF}: NameServer = 80.58.61.250 80.58.61.254

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - E:\ARCHIV~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - E:\ARCHIV~1\MSNMES~1\MSGRAP~1.DLL

Mensaje por **lucl** » 11 Mar 2007, 19:06

De momento fix cheked a esta entrada

O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)

el resto del log ya te iran indicando, pero pasate elistara y elitriip en modo seguro y luego peganos el log que te dejaran en C llamado infosat.txt saludos

http://www.zonavirus.com/articulos/como-arrancar-en-modo-seguro-o-a-prueba-de-fallos.asp

http://www.zonavirus.com/descargas/elistara.asp

http://www.zonavirus.com/descargas/elitriip.asp

Mensaje por **msc hotline sat** » 11 Mar 2007, 20:39

Y tras actualizar el HJT (usas HijackThis v1.98.2 y debes usar el 1.99.1), lanzalo de nuevo y nos posteas nuevo log, pues este no mostraba los servicios y otras hierbas...

[url=http://www.zonavirus.com/descargas/trendmicro-hijackthis.asp]~~[b]~~Descargar Hijackthis[/b][/url]

saludos

ms, 11-03-2007

cirrabo · Mensaje por **cirrabo** » 11 Mar 2007, 21:39

OK, muchísimas gracias. He hecho ya todo lo que me habéis sugerido, y aquí está el nuevo log con la nueva versión del HijackThis.

A ver qué tal está el paciente.

Muchas gracias de nuevo.

Logfile of HijackThis v1.99.1

Scan saved at 20:40:43, on 11/03/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

E:\WINDOWS\System32\smss.exe

E:\WINDOWS\SYSTEM32\winlogon.exe

E:\WINDOWS\system32\services.exe

E:\WINDOWS\system32\lsass.exe

E:\WINDOWS\system32\svchost.exe

E:\WINDOWS\System32\svchost.exe

E:\WINDOWS\system32\spoolsv.exe

e:\archivos de programa\mcafee.com\agent\mcdetect.exe

e:\ARCHIV~1\mcafee.com\vso\mcshield.exe

e:\ARCHIV~1\mcafee.com\agent\mctskshd.exe

E:\ARCHIV~1\McAfee.com\PERSON~1\MpfService.exe

E:\ARCHIV~1\McAfee\SPAMKI~1\MSKSrvr.exe

E:\Archivos de programa\Photodex\ProShowGold\ScsiAccess.exe

E:\WINDOWS\System32\svchost.exe

E:\WINDOWS\system32\svchost.exe

E:\WINDOWS\system32\WgaTray.exe

E:\WINDOWS\Explorer.EXE

E:\WINDOWS\System32\rmctrl.exe

E:\WINDOWS\SOUNDMAN.EXE

E:\Archivos de programa\Archivos comunes\Real\Update_OB\realsched.exe

E:\Archivos de programa\Java\jre1.5.0_10\bin\jusched.exe

E:\Archivos de programa\McAfee.com\VSO\mcvsshld.exe

E:\Archivos de programa\McAfee.com\VSO\oasclnt.exe

E:\ARCHIV~1\mcafee.com\agent\mcagent.exe

E:\ARCHIV~1\McAfee.com\PERSON~1\MpfTray.exe

E:\ARCHIV~1\McAfee\SPAMKI~1\MskAgent.exe

e:\archiv~1\mcafee.com\vso\mcvsescn.exe

E:\Archivos de programa\Arovax AntiSpyware\arovaxantispyware.exe

E:\Archivos de programa\SPYWAREfighter\spftray.exe

E:\WINDOWS\system32\ctfmon.exe

E:\Archivos de programa\Microsoft ActiveSync\WCESCOMM.EXE

E:\Archivos de programa\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

E:\Archivos de programa\SPYWAREfighter\spfprc.exe

E:\ARCHIV~1\McAfee.com\PERSON~1\MpfAgent.exe

E:\Archivos de programa\Sony Corporation\Image Transfer\SonyTray.exe

D:\antivirus\hijack this\HijackThis.exe

E:\WINDOWS\notepad.exe

C:\Archivos de programa\Internet Explorer\Iexplore.exe

E:\ARCHIV~1\DAP\DAP.EXE

E:\ARCHIV~1\WINZIP\winzip32.exe

D:\Programas ejecutables\Antivirus\Nuevos\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Archivos de programa\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

O2 - BHO: McBrwHelper Class - {227B8AA8-DAF2-4892-BD1D-73F568BCB24E} - e:\ARCHIV~1\mcafee.com\mps\mcbrhlpr.dll

O2 - BHO: McAfee PopupKiller - {3EC8255F-E043-4cae-8B3B-B191550C2A22} - e:\archivos de programa\mcafee.com\mps\popupkiller.dll

O2 - BHO: McAfee AntiPhishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - e:\ARCHIV~1\mcafee\SPAMKI~1\mcapfbho.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Archivos de programa\Java\jre1.5.0_10\bin\ssv.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - e:\archivos de programa\google\googletoolbar4.dll

O3 - Toolbar: DAP Bar - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - E:\Archivos de programa\DAP\DAPIEBar.dll

O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - e:\archiv~1\mcafee.com\vso\mcvsshl.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - e:\archivos de programa\google\googletoolbar4.dll

O4 - HKLM\..\Run: [RemoteControl] E:\WINDOWS\System32\rmctrl.exe

O4 - HKLM\..\Run: [WinampAgent] "E:\Archivos de programa\Winamp\Winampa.exe"

O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [TkBellExe] "E:\Archivos de programa\Archivos comunes\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [NeroFilterCheck] E:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [SunJavaUpdateSched] "E:\Archivos de programa\Java\jre1.5.0_10\bin\jusched.exe"

O4 - HKLM\..\Run: [VSOCheckTask] "E:\ARCHIV~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask

O4 - HKLM\..\Run: [VirusScan Online] E:\Archivos de programa\McAfee.com\VSO\mcvsshld.exe

O4 - HKLM\..\Run: [OASClnt] E:\Archivos de programa\McAfee.com\VSO\oasclnt.exe

O4 - HKLM\..\Run: [MCAgentExe] e:\ARCHIV~1\mcafee.com\agent\mcagent.exe

O4 - HKLM\..\Run: [MCUpdateExe] E:\ARCHIV~1\mcafee.com\agent\mcupdate.exe

O4 - HKLM\..\Run: [MPFExe] E:\ARCHIV~1\McAfee.com\PERSON~1\MpfTray.exe

O4 - HKLM\..\Run: [MPSExe] e:\ARCHIV~1\mcafee.com\mps\mscifapp.exe /embedding

O4 - HKLM\..\Run: [MSKAGENTEXE] E:\ARCHIV~1\McAfee\SPAMKI~1\MskAgent.exe

O4 - HKLM\..\Run: [MSKDetectorExe] E:\ARCHIV~1\McAfee\SPAMKI~1\MSKDetct.exe /startup

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [Arovax AntiSpyware] E:\Archivos de programa\Arovax AntiSpyware\arovaxantispyware.exe /s

O4 - HKLM\..\Run: [spywarefighterguard] E:\Archivos de programa\SPYWAREfighter\spftray.exe

O4 - HKCU\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [H/PC Connection Agent] "E:\Archivos de programa\Microsoft ActiveSync\WCESCOMM.EXE"

O4 - HKCU\..\Run: [swg] E:\Archivos de programa\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

O4 - Global Startup: Microsoft Office.lnk = E:\Archivos de programa\Microsoft Office\Office10\OSA.EXE

O4 - Global Startup: Image Transfer.lnk = ?

O8 - Extra context menu item: &Download with &DAP - E:\ARCHIV~1\DAP\dapextie.htm

O8 - Extra context menu item: Download &all with DAP - E:\ARCHIV~1\DAP\dapextie2.htm

O8 - Extra context menu item: E&xportar a Microsoft Excel - res://E:\ARCHIV~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Archivos de programa\Java\jre1.5.0_10\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Archivos de programa\Java\jre1.5.0_10\bin\ssv.dll

O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - e:\ARCHIV~1\mcafee\SPAMKI~1\mcapfbho.dll

O9 - Extra 'Tools' menuitem: McAfee AntiPhishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - e:\ARCHIV~1\mcafee\SPAMKI~1\mcapfbho.dll

O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab

O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O16 - DPF: {B1826A9F-4AA0-4510-BA77-9013E74E4B9B} - http://www.trendmicro.com/spyware-scan/as4web.cab

O16 - DPF: {B785FA3C-1DE9-4D20-8396-613C486FE95E} (AeatCtl Class) - https://www5.aeat.es/es13/h/cactivex.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{15712628-3B05-441D-9244-CB79062869DF}: NameServer = 80.58.61.250 80.58.61.254

O17 - HKLM\System\CS1\Services\Tcpip\..\{15712628-3B05-441D-9244-CB79062869DF}: NameServer = 80.58.61.250 80.58.61.254

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - E:\ARCHIV~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - E:\ARCHIV~1\MSNMES~1\MSGRAP~1.DLL

O20 - Winlogon Notify: WgaLogon - E:\WINDOWS\SYSTEM32\WgaLogon.dll

O23 - Service: Google Updater Service (gusvc) - Google - E:\Archivos de programa\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - e:\archivos de programa\mcafee.com\agent\mcdetect.exe

O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - e:\ARCHIV~1\mcafee.com\vso\mcshield.exe

O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - e:\ARCHIV~1\mcafee.com\agent\mctskshd.exe

O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - E:\ARCHIV~1\McAfee.com\Agent\mcupdmgr.exe

O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - E:\ARCHIV~1\McAfee.com\PERSON~1\MpfService.exe

O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - E:\ARCHIV~1\McAfee\SPAMKI~1\MSKSrvr.exe

O23 - Service: ScsiAccess - Unknown owner - E:\Archivos de programa\Photodex\ProShowGold\ScsiAccess.exe

O23 - Service: SPYWAREfighterRP - SpamFighter APS - E:\Archivos de programa\SPYWAREfighter\spfprc.exe

Mensaje por **lucl** » 11 Mar 2007, 21:42

Y el log del elistara? Lo tienes en C se llama infosat.txt, copianoslo porfavor, en cuanto al hijackthis creo que esta de guardia el Dr. Nuker, ahora le llamo un momento por favor.... :P

saludos

Mensaje por **lucl** » 11 Mar 2007, 21:49

O era el Dr. Msc... Un momento que lo confirmo.

p,d: tan solo es un poco de humor, pero aqui somos muy serios te lo aseguro, saludos

:D

Mensaje por **msc hotline sat** » 11 Mar 2007, 22:07

Pues por si te sirve mi diagnostico, el log del HJT esta limpio.

y mientras, a la vista de lo que indicas, como que el Bagle usa RootKit, y puede ocultarnos del log de HJT sus gusanos y claves al respecto, prueba el ELIBAGLA:

ELIBAGLA:

http://www.zonavirus.com/descargas/elibagla.asp

Cuando postees el contenido de C:\infosat.txt lo veremos lo que hizo el ELISTARA y el ELIBAGLA...

saludos

ms, 11-03-2007

cirrabo · Mensaje por **cirrabo** » 12 Mar 2007, 22:54

Muy buenas. Pues aquí va el resultado del InfoSat. Deciros que, de nuevo, el servidor de correo entrante es el 127.0.0.1, no he conseguido aún eliminarlo.

Thu Sep 23 23:09:49 2004

EliSasser v1.5 (c)2004 S.G.H. / Satinfo S.L.

---------------------------------------------

Lista de Acciones:

C:\WIN.LOG --> Eliminado

C:\WIN2.LOG --> Eliminado

Fri Sep 24 19:05:53 2004

EliDCOM-RPC v7.0 (c)2004 S.G.H. / Satinfo S.L.

-----------------------------------------------

Lista de Acciones:

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 adsubtract # added by adsubtract for auto-dial.

Linea Eliminada del HOSTS --> 127.0.0.1 AdSubtract # Added by AdSubtract for auto-dial.

No detectado Parche MS04-012 de Microsoft instalado.

Fri Sep 24 19:06:04 2004

EliStartPage v3.3 (c)2004 S.G.H. / Satinfo S.L.

------------------------------------------------

Lista de Acciones:

E:\WINDOWS\SYSTEM32\CSRSS.EXE --> Renombrado a .VIR

Eliminadas las Paginas de Inicio y de Busqueda del IE

Fri Sep 24 21:16:21 2004

EliStartPage v3.3 (c)2004 S.G.H. / Satinfo S.L.

------------------------------------------------

Lista de Acciones:

E:\WINDOWS\SYSTEM32\CSRSS.EXE --> Renombrado a .VIR

Eliminadas las Paginas de Inicio y de Busqueda del IE

Fri Sep 24 21:20:22 2004

EliStartPage v3.3 (c)2004 S.G.H. / Satinfo S.L.

------------------------------------------------

Lista de Acciones:

E:\WINDOWS\SYSTEM32\CSRSS.EXE --> Renombrado a .VIR

Eliminadas las Paginas de Inicio y de Busqueda del IE

Fri Sep 24 22:37:29 2004

EliStartPage v3.3 (c)2004 S.G.H. / Satinfo S.L.

------------------------------------------------

Lista de Acciones:

E:\WINDOWS\SYSTEM32\CSRSS.EXE --> Renombrado a .VIR

Eliminadas las Paginas de Inicio y de Busqueda del IE

Fri Sep 24 22:44:32 2004

EliStartPage v3.3 (c)2004 S.G.H. / Satinfo S.L.

------------------------------------------------

Lista de Acciones:

E:\WINDOWS\SYSTEM32\CSRSS.EXE --> Renombrado a .VIR

Eliminadas las Paginas de Inicio y de Busqueda del IE

Sat Sep 25 00:18:31 2004

EliStartPage v3.3 (c)2004 S.G.H. / Satinfo S.L.

------------------------------------------------

Lista de Acciones:

E:\WINDOWS\SYSTEM32\CSRSS.EXE --> Renombrado a .VIR

Eliminadas las Paginas de Inicio y de Busqueda del IE

Sat Sep 25 11:18:06 2004

EliStartPage v3.3 (c)2004 S.G.H. / Satinfo S.L.

------------------------------------------------

Lista de Acciones:

E:\WINDOWS\SYSTEM32\CSRSS.EXE --> Renombrado a .VIR

Eliminadas las Paginas de Inicio y de Busqueda del IE

Sat Sep 25 12:25:52 2004

EliStartPage v3.3 (c)2004 S.G.H. / Satinfo S.L.

------------------------------------------------

Lista de Acciones:

E:\WINDOWS\SYSTEM32\CSRSS.EXE --> Renombrado a .VIR

Eliminadas las Paginas de Inicio y de Busqueda del IE

Sun Mar 11 20:10:51 2007

EliStartPage v13.50 (c)2007 S.G.H. / Satinfo S.L.

--------------------------------------------------

Lista de Acciones (por Acción Directa):

E:\DOCUME~1\CIRRABO\CONFIG~1\TEMP\VERSION.TXT --> Eliminado (Fichero Complementario).

Eliminadas las Paginas de Inicio y de Busqueda del IE

Eliminados Ficheros Temporales del IE

Sun Mar 11 20:12:26 2007

EliStartPage v13.50 (c)2007 S.G.H. / Satinfo S.L.

--------------------------------------------------

Lista de Acciones (por Exploración):

Explorando Unidad C:\

Sun Mar 11 20:13:03 2007

EliStartPage v13.50 (c)2007 S.G.H. / Satinfo S.L.

--------------------------------------------------

Lista de Acciones (por Exploración):

Explorando Unidad D:\

Sun Mar 11 20:13:41 2007

EliStartPage v13.50 (c)2007 S.G.H. / Satinfo S.L.

--------------------------------------------------

Lista de Acciones (por Exploración):

Explorando Unidad E:\

Sun Mar 11 20:19:35 2007

EliTriIP v3.31 (c)2007 S.G.H. / Satinfo S.L.

---------------------------------------------

Lista de Acciones (por Acción Directa):

Sun Mar 11 20:19:40 2007

EliTriIP v3.31 (c)2007 S.G.H. / Satinfo S.L.

---------------------------------------------

Lista de Acciones (por Exploración):

Explorando Unidad C:\

C:\WINDOWS\TEMP\vsp8.tmp\autorun.inf --> Eliminado, BackDoor.CMQ (inf)

Sun Mar 11 20:20:26 2007

EliTriIP v3.31 (c)2007 S.G.H. / Satinfo S.L.

---------------------------------------------

Lista de Acciones (por Exploración):

Explorando Unidad D:\

D:\eMule\Incoming\TomTom 5, Radares, Mapas Iberia Plus, Spanish\INSTALAR\Autorun.inf --> Eliminado, BackDoor.CMQ (inf)

Sun Mar 11 20:21:10 2007

EliTriIP v3.31 (c)2007 S.G.H. / Satinfo S.L.

---------------------------------------------

Lista de Acciones (por Exploración):

Explorando Unidad E:\

Mon Mar 12 21:36:56 2007

EliBagle v10.27 (c)2007 S.G.H. / Satinfo S.L.

----------------------------------------------

Lista de Acciones (por Acción Directa):

Mon Mar 12 21:36:59 2007

EliBagle v10.27 (c)2007 S.G.H. / Satinfo S.L.

----------------------------------------------

Lista de Acciones (por Exploración):

Explorando Unidad C:\

Mon Mar 12 21:39:41 2007

EliBagle v10.27 (c)2007 S.G.H. / Satinfo S.L.

----------------------------------------------

Lista de Acciones (por Exploración):

Explorando Unidad D:\

Mon Mar 12 21:43:59 2007

EliBagle v10.27 (c)2007 S.G.H. / Satinfo S.L.

----------------------------------------------

Lista de Acciones (por Exploración):

Explorando Unidad E:\

Nuker · Mensaje por **Nuker** » 12 Mar 2007, 23:10

Gracias enfermera lucl pero no estaba disponible en esos momentos, pues el ELIBAGLE no detecto nada, pasate el RootkitRevealer desde Microsoft lo pasas y nos comentas o nos pegas el resultado que te cree este. Para ver si tuvieras alguno por ahi.

RootkitRevealer:

http://www.microsoft.com/en/us/default.aspxtechnet/sysinternals/utilities/RootkitRevealer.mspx

Mensaje por **msc hotline sat** » 13 Mar 2007, 14:20

Y no estaría de mas que pasaras estos ONLINE y nos informaras de los resultados, gracias

[url=https://www.eset.es/analisis-online/]~~[b]~~[color=Darknesred]Antivirus ONLINE aconsejado[/color][/b][/url]

[url=https://www.pandasecurity.com/spain/homeusers/solutions/online-antivirus/]~~[b]~~[color=Darknesred]testeo ONLINE de virus en memoria[/color][/b][/url]

saludos

ms, 13-03-2007

cirrabo · Mensaje por **cirrabo** » 14 Mar 2007, 01:13

Mañana posteo rdos. Hoy no puedo dedicarle tiempo. De todas formas, quiero agradecer el interés y la ayuda que me ofrecéis.

Mañana más.

Gracias

Mensaje por **msc hotline sat** » 14 Mar 2007, 06:57

Bien pues cuando puedas nos indicas el resultado de los escaneos, a ver si detectan algo conocido tanto por los dos ONLINE ultimos, como por el detector de Rootkits propuestos por Nuker, que de todo puede haber ...

saludos

ms, 14-03-2007

cirrabo · Mensaje por **cirrabo** » 14 Mar 2007, 07:38

Sres:

Después de pàsar todos los procesos solicitados (Elistara, Elibagla, Elitrip, RootkitRevealer) y pasar los dos antivirus on line, deciros:

Uno de los antivirus on line, el eTrust, ha encontrado tres virus:

Resultados de la exploración 51246 archivos explorados. 3 virus detectados.

Archivo Infección Estado Ruta

M0000000774.eml HTML/Phishbank.AZA infected E:\Documents and Settings\All Users\Datos de programa\McAfee\SpamKiller\Users\1\Front\1\

M0000000774.eml>unknown HTML/Phishbank.AZA infected E:\Documents and Settings\All Users\Datos de programa\McAfee\SpamKiller\Users\1\Front\1\

FirstApplet.class-588c89f0-39a8aa59.class Java/ByteVerify!exploit infected E:\Documents and Settings\Cirrabo\.jpi_cache\file\1.0\

De los cuales sólo el primero se puede desinfectar, pero no los otros dos, por lo que los he eliminado.

En segundo lugar, he pasado dos veces el RootkiRevealer, del que posteo sus resultados:

HKU\S-1-5-21-1220945662-583907252-725345543-1003\RemoteAccess\InternetProfile 09/12/2006 19:24 17 bytes Data mismatch between Windows API and raw hive data.

HKLM\SECURITY\Policy\Secrets\SAC* 25/09/2004 16:21 0 bytes Key name contains embedded nulls (*)

HKLM\SECURITY\Policy\Secrets\SAI* 25/09/2004 16:21 0 bytes Key name contains embedded nulls (*)

HKLM\SOFTWARE\Classes\magnet\shell\open\command\ 23/10/2005 9:23 45 bytes Data mismatch between Windows API and raw hive data.

HKLM\SOFTWARE\McAfee.com\Agent\Scheduler\mcupdtsk\Freq 13/03/2007 23:54 36 bytes Data mismatch between Windows API and raw hive data.

HKLM\SOFTWARE\McAfee.com\Agent\Scheduler\mcupdtsk\NextRun 13/03/2007 23:54 36 bytes Data mismatch between Windows API and raw hive data.

HKLM\SOFTWARE\McAfee.com\Agent\Update\ResultLog\~LastLogIdx 13/03/2007 23:54 4 bytes Data mismatch between Windows API and raw hive data.

HKLM\SOFTWARE\McAfee.com\Agent\Update\ResultLog\Log#044 13/03/2007 23:54 192 bytes Windows API length not consistent with raw hive data.

HKLM\SOFTWARE\McAfee.com\Agent\Update\ResultLog\Log#045 13/03/2007 23:54 426 bytes Windows API length not consistent with raw hive data.

HKLM\SOFTWARE\McAfee.com\Agent\Update\ResultLog\Log#046 13/03/2007 23:54 100 bytes Windows API length not consistent with raw hive data.

HKLM\SOFTWARE\McAfee.com\Agent\Update\ResultLog\Log#047 13/03/2007 23:54 2.00 KB Windows API length not consistent with raw hive data.

HKLM\SOFTWARE\McAfee.com\Agent\Update\ResultLog\Log#048 13/03/2007 23:54 2.00 KB Windows API length not consistent with raw hive data.

HKLM\SOFTWARE\McAfee.com\Agent\Update\ResultLog\Log#049 13/03/2007 23:54 136 bytes Windows API length not consistent with raw hive data.

HKLM\SOFTWARE\McAfee.com\Agent\Update\ResultLog\Log#050 13/03/2007 23:54 196 bytes Windows API length not consistent with raw hive data.

HKLM\SOFTWARE\McAfee.com\Agent\Update\ResultLog\Log#051 13/03/2007 23:54 426 bytes Windows API length not consistent with raw hive data.

HKLM\SOFTWARE\McAfee.com\Agent\Update\ResultLog\Log#052 13/03/2007 23:54 100 bytes Windows API length not consistent with raw hive data.

HKLM\SOFTWARE\McAfee.com\Agent\Update\ResultLog\Log#053 13/03/2007 23:54 656 bytes Windows API length not consistent with raw hive data.

HKLM\SOFTWARE\McAfee.com\Agent\Update\ResultLog\Log#054 13/03/2007 23:54 1.06 KB Windows API length not consistent with raw hive data.

HKLM\SOFTWARE\McAfee.com\Agent\Update\ResultLog\Log#055 13/03/2007 23:54 154 bytes Windows API length not consistent with raw hive data.

HKLM\SOFTWARE\McAfee.com\Agent\Update\ResultLog\Log#056 13/03/2007 23:54 202 bytes Windows API length not consistent with raw hive data.

HKLM\SOFTWARE\McAfee.com\Agent\Update\ResultLog\Log#057 13/03/2007 23:54 314 bytes Windows API length not consistent with raw hive data.

HKLM\SOFTWARE\McAfee.com\Agent\Update\ResultLog\Log#058 13/03/2007 23:54 150 bytes Windows API length not consistent with raw hive data.

HKLM\SOFTWARE\McAfee.com\Agent\Update\ResultLog\Log#059 13/03/2007 23:54 214 bytes Windows API length not consistent with raw hive data.

HKLM\SOFTWARE\McAfee.com\Agent\Update\ResultLog\Log#060 13/03/2007 23:54 598 bytes Windows API length not consistent with raw hive data.

HKLM\SOFTWARE\McAfee.com\Agent\Update\ResultLog\Log#061 13/03/2007 23:54 150 bytes Windows API length not consistent with raw hive data.

HKLM\SOFTWARE\McAfee.com\Agent\Update\ResultLog\Log#062 13/03/2007 23:54 84 bytes Windows API length not consistent with raw hive data.

HKLM\SOFTWARE\McAfee.com\Agent\Update\ResultLog\Log#063 13/03/2007 23:54 172 bytes Windows API length not consistent with raw hive data.

HKLM\SOFTWARE\McAfee.com\Agent\Update\ResultLog\Log#064 13/03/2007 23:54 174 bytes Windows API length not consistent with raw hive data.

HKLM\SOFTWARE\McAfee.com\Agent\Update\ResultLog\Log#065 13/03/2007 23:54 302 bytes Windows API length not consistent with raw hive data.

HKLM\SOFTWARE\McAfee.com\Agent\Update\ResultLog\Log#066 13/03/2007 23:54 298 bytes Windows API length not consistent with raw hive data.

HKLM\SOFTWARE\McAfee.com\Agent\Update\ResultLog\Log#067 13/03/2007 23:54 298 bytes Windows API length not consistent with raw hive data.

HKLM\SOFTWARE\Microsoft\Cryptography\RNG\Seed 13/03/2007 23:58 80 bytes Data mismatch between Windows API and raw hive data.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\24209752571DE5E4D99B36C10121E487\Usage\Complete 13/03/2007 23:58 4 bytes Data mismatch between Windows API and raw hive data.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\Directory 13/03/2007 23:51 196 bytes Windows API length not consistent with raw hive data.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1\CachePath 13/03/2007 23:51 210 bytes Windows API length not consistent with raw hive data.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2\CachePath 13/03/2007 23:51 210 bytes Windows API length not consistent with raw hive data.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3\CachePath 13/03/2007 23:51 210 bytes Windows API length not consistent with raw hive data.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4\CachePath 13/03/2007 23:51 210 bytes Windows API length not consistent with raw hive data.

En la segunda ocasión lo siguiente:

HKU\S-1-5-21-1220945662-583907252-725345543-1003\RemoteAccess\InternetProfile 09/12/2006 19:24 17 bytes Data mismatch between Windows API and raw hive data.

HKLM\SECURITY\Policy\Secrets\SAC* 25/09/2004 16:21 0 bytes Key name contains embedded nulls (*)

HKLM\SECURITY\Policy\Secrets\SAI* 25/09/2004 16:21 0 bytes Key name contains embedded nulls (*)

HKLM\SOFTWARE\Classes\magnet\shell\open\command\ 23/10/2005 9:23 45 bytes Data mismatch between Windows API and raw hive data.

Por último, un nuevo resultado del HJT:

Logfile of HijackThis v1.99.1

Scan saved at 6:41:58, on 14/03/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

E:\WINDOWS\System32\smss.exe

E:\WINDOWS\SYSTEM32\winlogon.exe

E:\WINDOWS\system32\services.exe

E:\WINDOWS\system32\lsass.exe

E:\WINDOWS\system32\svchost.exe

E:\WINDOWS\System32\svchost.exe

E:\WINDOWS\system32\spoolsv.exe

e:\archivos de programa\mcafee.com\agent\mcdetect.exe

e:\ARCHIV~1\mcafee.com\vso\mcshield.exe

e:\ARCHIV~1\mcafee.com\agent\mctskshd.exe

E:\ARCHIV~1\McAfee.com\PERSON~1\MpfService.exe

E:\ARCHIV~1\McAfee\SPAMKI~1\MSKSrvr.exe

E:\Archivos de programa\Photodex\ProShowGold\ScsiAccess.exe

E:\WINDOWS\System32\svchost.exe

E:\WINDOWS\system32\svchost.exe

E:\WINDOWS\system32\WgaTray.exe

E:\WINDOWS\Explorer.EXE

E:\WINDOWS\System32\rmctrl.exe

E:\WINDOWS\SOUNDMAN.EXE

E:\Archivos de programa\Archivos comunes\Real\Update_OB\realsched.exe

E:\Archivos de programa\Java\jre1.5.0_10\bin\jusched.exe

E:\Archivos de programa\McAfee.com\VSO\mcvsshld.exe

E:\Archivos de programa\McAfee.com\VSO\oasclnt.exe

E:\ARCHIV~1\mcafee.com\agent\mcagent.exe

e:\archiv~1\mcafee.com\vso\mcvsescn.exe

E:\ARCHIV~1\McAfee.com\PERSON~1\MpfTray.exe

E:\ARCHIV~1\mcafee.com\mps\mscifapp.exe

E:\ARCHIV~1\McAfee\SPAMKI~1\MskAgent.exe

E:\Archivos de programa\Arovax AntiSpyware\arovaxantispyware.exe

E:\Archivos de programa\SPYWAREfighter\spftray.exe

E:\WINDOWS\system32\ctfmon.exe

E:\Archivos de programa\Microsoft ActiveSync\WCESCOMM.EXE

E:\Archivos de programa\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

E:\Archivos de programa\Sony Corporation\Image Transfer\SonyTray.exe

E:\ARCHIV~1\McAfee.com\PERSON~1\MpfAgent.exe

E:\Archivos de programa\SPYWAREfighter\spfprc.exe

C:\Archivos de programa\Internet Explorer\Iexplore.exe

E:\Archivos de programa\Java\jre1.5.0_10\bin\jucheck.exe

E:\ARCHIV~1\DAP\DAP.EXE

D:\Programas ejecutables\Antivirus\Nuevos\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Archivos de programa\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

O2 - BHO: McBrwHelper Class - {227B8AA8-DAF2-4892-BD1D-73F568BCB24E} - e:\ARCHIV~1\mcafee.com\mps\mcbrhlpr.dll

O2 - BHO: McAfee PopupKiller - {3EC8255F-E043-4cae-8B3B-B191550C2A22} - e:\archivos de programa\mcafee.com\mps\popupkiller.dll

O2 - BHO: McAfee AntiPhishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - e:\ARCHIV~1\mcafee\SPAMKI~1\mcapfbho.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Archivos de programa\Java\jre1.5.0_10\bin\ssv.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - e:\archivos de programa\google\googletoolbar4.dll

O3 - Toolbar: DAP Bar - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - E:\Archivos de programa\DAP\DAPIEBar.dll

O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - e:\archiv~1\mcafee.com\vso\mcvsshl.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - e:\archivos de programa\google\googletoolbar4.dll

O4 - HKLM\..\Run: [RemoteControl] E:\WINDOWS\System32\rmctrl.exe

O4 - HKLM\..\Run: [WinampAgent] "E:\Archivos de programa\Winamp\Winampa.exe"

O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [TkBellExe] "E:\Archivos de programa\Archivos comunes\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [NeroFilterCheck] E:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [SunJavaUpdateSched] "E:\Archivos de programa\Java\jre1.5.0_10\bin\jusched.exe"

O4 - HKLM\..\Run: [VSOCheckTask] "E:\ARCHIV~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask

O4 - HKLM\..\Run: [VirusScan Online] E:\Archivos de programa\McAfee.com\VSO\mcvsshld.exe

O4 - HKLM\..\Run: [OASClnt] E:\Archivos de programa\McAfee.com\VSO\oasclnt.exe

O4 - HKLM\..\Run: [MCAgentExe] e:\ARCHIV~1\mcafee.com\agent\mcagent.exe

O4 - HKLM\..\Run: [MCUpdateExe] e:\ARCHIV~1\mcafee.com\agent\mcupdate.exe

O4 - HKLM\..\Run: [MPFExe] E:\ARCHIV~1\McAfee.com\PERSON~1\MpfTray.exe

O4 - HKLM\..\Run: [MPSExe] e:\ARCHIV~1\mcafee.com\mps\mscifapp.exe /embedding

O4 - HKLM\..\Run: [MSKAGENTEXE] E:\ARCHIV~1\McAfee\SPAMKI~1\MskAgent.exe

O4 - HKLM\..\Run: [MSKDetectorExe] E:\ARCHIV~1\McAfee\SPAMKI~1\MSKDetct.exe /startup

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [Arovax AntiSpyware] E:\Archivos de programa\Arovax AntiSpyware\arovaxantispyware.exe /s

O4 - HKLM\..\Run: [spywarefighterguard] E:\Archivos de programa\SPYWAREfighter\spftray.exe

O4 - HKCU\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [H/PC Connection Agent] "E:\Archivos de programa\Microsoft ActiveSync\WCESCOMM.EXE"

O4 - HKCU\..\Run: [swg] E:\Archivos de programa\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

O4 - Global Startup: Microsoft Office.lnk = E:\Archivos de programa\Microsoft Office\Office10\OSA.EXE

O4 - Global Startup: Image Transfer.lnk = ?

O8 - Extra context menu item: &Download with &DAP - E:\ARCHIV~1\DAP\dapextie.htm

O8 - Extra context menu item: Download &all with DAP - E:\ARCHIV~1\DAP\dapextie2.htm

O8 - Extra context menu item: E&xportar a Microsoft Excel - res://E:\ARCHIV~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Archivos de programa\Java\jre1.5.0_10\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Archivos de programa\Java\jre1.5.0_10\bin\ssv.dll

O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - e:\ARCHIV~1\mcafee\SPAMKI~1\mcapfbho.dll

O9 - Extra 'Tools' menuitem: McAfee AntiPhishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - e:\ARCHIV~1\mcafee\SPAMKI~1\mcapfbho.dll

O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab

O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab

O16 - DPF: {8436FE12-31DB-48BF-83BF-FE682F9160B4} (NanoInstaller Class) - https://www.pandasecurity.com/spain/homeusers/solutions/online-antivirus//cabs/nanoinst.cab

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O16 - DPF: {B1826A9F-4AA0-4510-BA77-9013E74E4B9B} - http://www.trendmicro.com/spyware-scan/as4web.cab

O16 - DPF: {B785FA3C-1DE9-4D20-8396-613C486FE95E} (AeatCtl Class) - https://www5.aeat.es/es13/h/cactivex.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{15712628-3B05-441D-9244-CB79062869DF}: NameServer = 80.58.61.250 80.58.61.254

O17 - HKLM\System\CS1\Services\Tcpip\..\{15712628-3B05-441D-9244-CB79062869DF}: NameServer = 80.58.61.250 80.58.61.254

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - E:\ARCHIV~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - E:\ARCHIV~1\MSNMES~1\MSGRAP~1.DLL

O20 - Winlogon Notify: WgaLogon - E:\WINDOWS\SYSTEM32\WgaLogon.dll

O23 - Service: Google Updater Service (gusvc) - Google - E:\Archivos de programa\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - e:\archivos de programa\mcafee.com\agent\mcdetect.exe

O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - e:\ARCHIV~1\mcafee.com\vso\mcshield.exe

O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - e:\ARCHIV~1\mcafee.com\agent\mctskshd.exe

O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - E:\ARCHIV~1\McAfee.com\Agent\mcupdmgr.exe

O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - E:\ARCHIV~1\McAfee.com\PERSON~1\MpfService.exe

O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - E:\ARCHIV~1\McAfee\SPAMKI~1\MSKSrvr.exe

O23 - Service: ScsiAccess - Unknown owner - E:\Archivos de programa\Photodex\ProShowGold\ScsiAccess.exe

O23 - Service: SPYWAREfighterRP - SpamFighter APS - E:\Archivos de programa\SPYWAREfighter\spfprc.exe

Muchas gracias por la ayuda.

Mensaje por **msc hotline sat** » 14 Mar 2007, 07:55

Pues lo unico que cabe eliminar del HJT es este DPF:

O16 - DPF: {8436FE12-31DB-48BF-83BF-FE682F9160B4} (NanoInstaller Class) - https://www.pandasecurity.com/spain/homeusers/solutions/online-antivirus//cabs/nanoinst.cab

ya que da problemas de acceso, y con eso y la eliminacion de los malwares con el AV ONLINE, esperamos que ya esté normalizada la situacion

Del resultado del RootKitRevealer dejo que Nuker nos indique sus comentarios, ya que yo no conozco ni dicha utilidad ni sus comentarios.

saludos

ms, 14-3-2007

cirrabo · Mensaje por **cirrabo** » 15 Mar 2007, 14:02

Pues no ha habido suerte, ya que cada vez que ejecuto el Outlook Express sigue apareciéndome como servidor de correo entrante 127.0.0.1 en una de mis tres cuentas configuradas, con lo que, o lo cambio a manubrio, o no puedo descargarme el correo de esa cuenta.

Además impide que funcione el SpamKiller en esa misma cuenta de correo.

Lo extraño es que, en las otras dos cuentas de correo, todo va OK, tanto con los servidores como con el funcionamiento del SpamKiller de McAfee.

Saludos.

Mensaje por **msc hotline sat** » 15 Mar 2007, 14:22

Pues le sugiero que lo instale de nuevo y lo configure desde cero, ya que en el log no aparecen otras anomalias y el problema no queda reflejado en lo mostrado con él.

De todas formas veamos qué dice Nuker del informe del Rootkitrevealer...

saludos

ms, 15-03-2007