Conexion Lenta a Inet Log Hijackthis

fyepez · Mensaje por **fyepez** » 10 Mar 2006, 12:57

Hola

tengo adsl 1mb telefonica, 2 pc uno sobremesa test 951 Kb, otro, este portatil 150 KB velocidad conexion, ambos spyware doctor, antivirus, etc. Adjunto log a ver si alguien me sabe decir algo.

(Este pc esta en red , pag inicio corporativa a traves vpn)

Gracias por anticipado

Logfile of HijackThis v1.99.1

Scan saved at 9:50:12 AM, on 10/03/06

Platform: Windows 2000 SP4 (WinNT 5.00.2195)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:

C:\WINNT\System32\smss.exe

C:\WINNT\system32\csrss.exe

C:\WINNT\system32\winlogon.exe

C:\WINNT\system32\services.exe

C:\WINNT\system32\lsass.exe

C:\WINNT\system32\S24EvMon.exe

C:\WINNT\system32\svchost.exe

C:\WINNT\System32\svchost.exe

C:\WINNT\system32\spoolsv.exe

C:\Program Files\CA\SharedComponents\Alert\ALERT.EXE

C:\WINNT\SYSTEM32\DWRCS.EXE

C:\Program Files\CA\eTrust Antivirus\InoRpc.exe

C:\Program Files\CA\eTrust Antivirus\InoRT.exe

C:\Program Files\CA\eTrust Antivirus\InoTask.exe

C:\WINNT\system32\nvsvc32.exe

C:\WINNT\system32\RegSrvc.exe

C:\WINNT\system32\regsvc.exe

C:\WINNT\System32\SCardSvr.exe

C:\WINNT\system32\MSTask.exe

C:\WINNT\system32\stisvc.exe

C:\WINNT\system32\svchost.exe

C:\WINNT\system32\ZCfgSvc.exe

C:\WINNT\Explorer.EXE

C:\WINNT\system32\1XConfig.exe

C:\WINNT\SYSTEM32\DWRCST.exe

C:\WINNT\system32\carpserv.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

C:\Program Files\Winamp\winampa.exe

C:\Program Files\Cisco Systems\Aironet Client Monitor\ACUMon.Exe

C:\WINNT\system32\DSentry.exe

C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe

C:\PROGRA~1\CA\ETRUST~1\realmon.exe

C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe

C:\WINNT\TPPALDR.EXE

C:\Program Files\WLAN11G\WLAN11gSTA.EXE

C:\WINNT\system32\PRISMSVR.EXE

C:\WINNT\system32\internat.exe

C:\Program Files\belkin\Bluetooth Software\BTTray.exe

C:\WINNT\DvzCommon\DvzMsgr.exe

C:\Program Files\WLAN\802.11 Wireless LAN\WWlanMonitor.exe

C:\Program Files\Palm\HOTSYNC.EXE

C:\Program Files\belkin\Bluetooth Software\BTStackServer.exe

C:\Program Files\Spyware Doctor\swdoctor.exe

C:\Documents and Settings\fyepez\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://portal.idexx.com/portal/server.pt?in_hi_userid=924&space=CommunityPage&parentid=0&cached=false&control=SetCommunity&PageID=0&CommunityID=205&parentname=Login

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R3 - Default URLSearchHook is missing

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll

O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx

O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon

O4 - HKLM\..\Run: [CARPService] carpserv.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe

O4 - HKLM\..\Run: [StillImageMonitor] C:\W

O4 - HKLM\..\Run: [ScanRegistry] C:\W

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINNT\system32\spool\drivers\w32x86\3\hpztsb06.exe

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet

O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe

O4 - HKLM\..\Run: [ACUMon] "C:\Program Files\Cisco Systems\Aironet Client Monitor\ACUMon.Exe" -a

O4 - HKLM\..\Run: [DVDSentry] C:\WINNT\system32\DSentry.exe

O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe

O4 - HKLM\..\Run: [Realtime Monitor] C:\PROGRA~1\CA\ETRUST~1\realmon.exe -s

O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"

O4 - HKLM\..\Run: [TPP Auto Loader] C:\WINNT\TPPALDR.EXE

O4 - HKLM\..\Run: [WLAN11gSTA.EXE] "C:\Program Files\WLAN11G\WLAN11gSTA.EXE" /START

O4 - HKLM\..\Run: [PRISMSVR.EXE] "C:\WINNT\system32\PRISMSVR.EXE" /APPLY

O4 - HKCU\..\Run: [internat.exe] internat.exe

O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_5 -reboot 1

O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q

O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: BTTray.lnk = C:\Program Files\belkin\Bluetooth Software\BTTray.exe

O4 - Global Startup: Dataviz Messenger.lnk = C:\WINNT\DvzCommon\DvzMsgr.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

O4 - Global Startup: WLAN Monitor Utility.lnk = C:\Program Files\WLAN\802.11 Wireless LAN\WWlanMonitor.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm

O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1125998589521

O16 - DPF: {7C405D1B-4007-11D3-8B8E-00104B3E656F} (SBCRecorderPlayer Control) - http://www.vodafonemail.vodafone.es/VoiceRecorder/SBCRP.cab

O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://support.euro.dell.com/global/apps/systemprofiler/PROFILER.CAB

O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx

O16 - DPF: {B785FA3C-1DE9-4D20-8396-613C486FE95E} (AeatCtl Class) - https://aeat.es/imagenes/comun/cactivex.cab

O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/sj/en/check/qdiagh.cab?326

O20 - Winlogon Notify: PCANotify - C:\WINNT\SYSTEM32\PCANotify.dll

O20 - Winlogon Notify: Sebring - C:\WINNT\system32\LgNotify.dll

O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Alert Notification Server - Computer Associates International, Inc. - C:\Program Files\CA\SharedComponents\Alert\ALERT.EXE

O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe

O23 - Service: DameWare Mini Remote Control (DWMRCS) - DameWare Development LLC - C:\WINNT\SYSTEM32\DWRCS.EXE

O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRpc.exe

O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRT.exe

O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoTask.exe

O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe

O23 - Service: RegSrvc - Intel Corporation - C:\WINNT\system32\RegSrvc.exe

O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINNT\system32\S24EvMon.exe

O23 - Service: WEP/WPA-PMK key recovery service (WZCOOK) - Unknown owner - C:\Program Files\Aircrack\aircrack-2.3\win32\wzcook.exe" (file missing)

8)

Mensaje por **msc hotline sat** » 10 Mar 2006, 14:00

Elimina estas claves:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://portal.idexx.com/portal/server.pt?in_hi_userid=924&space=CommunityPage&pa rentid=0&cached=false&control=SetCommunity&PageID=0&CommunityID=205&parentname=L ogin

R3 - Default URLSearchHook is missing

O23 - Service: WEP/WPA-PMK key recovery service (WZCOOK) - Unknown owner - C:\Program Files\Aircrack\aircrack-2.3\win32\wzcook.exe" (file missing)

y ver si conoce estas dos:

O4 - HKLM\..\Run: [StillImageMonitor] C:\W

O4 - HKLM\..\Run: [ScanRegistry] C:\W

y en cualquier caso envienos el fichero C:\W pues no es conocido y es muy extraño su carga en dos claves de valores diferentes...

Anexelo a un mail dirigidp a zonavirus@satinfo.es en cuyo texto indique referencia "REF w" y lo analizaremos, tras lo cual le informaremos

saludos

ms, 10-3-2006