HOlas KIRIGI.
bueno ya empeze a hacer lo q me dijiste y aqui te paso en analisis q saque:
-------------------------------------------------------------------------
1.- con "hijackthis"

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:20:34 p.m., on 19/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Archivos de programa\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\Archivos de programa\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://kukkakreck.com/cehpmoin/?cmp=hmr&lid=5_1&gai=hamm_h5_pop&gli=pop_1&affid=6 8113&nid=h5&uid=b4357235
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe
O3 - Toolbar: Asistente para Internet de Encarta - {147D6308-0614-4112-89B1-31402F9B82C4} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
O3 - Toolbar: (no name) - {3F3714A9-89A4-46be-8AF3-D0C9D1FB03F9} - (no file)
O3 - Toolbar: Ask Toolbar - {F4D76F09-7896-458a-890F-E1F05C46069F} - C:\Archivos de programa\AskPBar\bar\1.bin\ASKPBAR.DLL
O3 - Toolbar: (no name) - {11A69AE4-FBED-4832-A2BF-45AF82825583} - (no file)
O4 - HKLM\..\Run: [cploader.exe] C:\WINDOWS\system32\cploader.exe
O4 - HKLM\..\Run: [revisorsystray.exe] C:\WINDOWS\system32\revisorsystray.exe
O4 - HKLM\..\Run: [1utcontr.exe] C:\Archivos de programa\Kids PC Time Administrator\utcontr.exe
O4 - HKLM\..\Run: [APVXDWIN] "C:\Archivos de programa\Panda Security\Panda Antivirus 2008\APVXDWIN.EXE" /s
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICIO LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Servicio de red')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Archivos de programa\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: CDPoker - {A68FC757-51CF-4f3c-B13A-BFB8CA69BB99} - C:\Poker\CDPoker\casino.exe (file missing)
O9 - Extra 'Tools' menuitem: CDPoker - {A68FC757-51CF-4f3c-B13A-BFB8CA69BB99} - C:\Poker\CDPoker\casino.exe (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARCHIV~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARCHIV~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,5055/mcfscan.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Archivos de programa\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Archivos de programa\Archivos comunes\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Panda Software Controller - Panda Software International - C:\Archivos de programa\Panda Security\Panda Antivirus 2008\PsCtrls.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Archivos de programa\Panda Security\Panda Antivirus 2008\pavsrv51.exe
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:\Archivos de programa\Panda Security\Panda Antivirus 2008\PsImSvc.exe

--
End of file - 5002 bytes
-------------------------------------------------------------------------

2.- CON DELPSGUARD:

DelPSGuard v 4.8.3
by www.ForoSpyware.com
Escaneo a las: 22:39:32.90, 19/11/2007
SO: Microsoft Windows XP [Versi¢n 5.1.2600]


»»»»»»»»»»»» Carpetas y Archivos infectados »»»»»»»»»»»»

C:\WINDOWS\system32 \azip32.dll ...: ! Eliminado ! :...

»»»»»»»»»»»» Programas Malwares »»»»»»»»»»»»



»»»»»»»»»»»» FIN »»»»»»»»»»»»

-------------------------------------------------------------------------

3.-luego le aplique el supersntispyware y elimine todo loq scaneo un totalde 51.

4.- entre a vundofix.exe primero scanee y luego le di a "remove vundo"
reporte vundofix.exe:

Beginning removal...

VundoFix V6.6.2

Checking Java version...

Sun Java not detected
Scan started at 01:11:12 a.m. 20/11/2007

Listing files found while scanning....

C:\windows\system32\nldqprcy.dll

Beginning removal...

Attempting to delete C:\windows\system32\nldqprcy.dll
C:\windows\system32\nldqprcy.dll Has been deleted!

Performing Repairs to the registry.
Done!

-------------------------------------------------------------------------

5.- luego de aplicar virtumundobegone, aparecio este informe:


[11/20/2007, 1:24:38] - VirtumundoBeGone v1.5 ( "E:\Help Forospyware.com\VirtumundoBeGone.exe" )
[11/20/2007, 1:24:49] - Detected System Information:
[11/20/2007, 1:24:49] - Windows Version: 5.1.2600, Service Pack 2
[11/20/2007, 1:24:49] - Current Username: amd (Admin)
[11/20/2007, 1:24:49] - Windows is in NORMAL mode.
[11/20/2007, 1:24:49] - Searching for Browser Helper Objects:
[11/20/2007, 1:24:49] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[11/20/2007, 1:24:49] - BHO 2: {259F616C-A300-44F5-B04A-ED001A26C85C} ()
[11/20/2007, 1:24:49] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/20/2007, 1:24:49] - No filename found. Continuing.
[11/20/2007, 1:24:49] - BHO 3: {3F3714A1-89A4-46be-8AF3-D0C9D1FB03F9} ()
[11/20/2007, 1:24:49] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/20/2007, 1:24:49] - No filename found. Continuing.
[11/20/2007, 1:24:49] - BHO 4: {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
[11/20/2007, 1:24:49] - BHO 5: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[11/20/2007, 1:24:49] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/20/2007, 1:24:49] - No filename found. Continuing.
[11/20/2007, 1:24:49] - BHO 6: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[11/20/2007, 1:24:49] - BHO 7: {955BE0B8-BC85-4CAF-856E-8E0D8B610560} (Complemento del Asistente para Internet de Encarta)
[11/20/2007, 1:24:49] - BHO 8: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
[11/20/2007, 1:24:49] - BHO 9: {D73F49B1-B51B-4d32-A3B7-BD04B8342F53} ()
[11/20/2007, 1:24:49] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/20/2007, 1:24:49] - No filename found. Continuing.
[11/20/2007, 1:24:49] - BHO 10: {F4D76F01-7896-458a-890F-E1F05C46069F} (Ask Toolbar BHO)
[11/20/2007, 1:24:49] - Finished Searching Browser Helper Objects
[11/20/2007, 1:24:49] - Finishing up...
[11/20/2007, 1:24:49] - Nothing found! Exiting...

-------------------------------------------------------------------------

6.- seguidamente instale spywareblaster y luego el ccleaner

7.- reporte panda activescan online:

bueno aqui no pude acceder al panda activescan online, no se porq, entonces tuve q volver a instalar el panda antivirus 2008, lo actualize y lo analise y eso fue lo q me boto:

- Comienzo de analisis-- analisis:todo MI PC -- 20/11/07 02:34:11
- Spyware detectado: Cookie/myaffiliateprogram-- Ubicacion: C:\Documents and Settings\Administrator\Cookies\administrador@www.m yaffiliateprogram[1].txt -- 20/11/07 02:44:22 -- Eliminado
- Spyware detectado: Spyware/Virtumonde -- Ubicacion: C:\VundoFixBackups\nldqprcy.dll.bad -- 20/11/07 02:47:44 -- Eliminado
- Fin de analisis -- Analisis: Todo Mi PC -- 20/11/07 02:47:46

Gracias por tu ayuda, ahora quiero saber si ya estoy libre del virus o esq hize algo mal.