 |
| |||||||
| Foro Oficial de HijackThis en español Analizamos tu log de HijackThis para eliminar Hijackers, Spyware, Adware, ToolBars, Virus, Troyanos y Malwares en gral. Antes lea las Políticas del Foro de HijackThis. |
 |
| | Herramientas |
 | 
20/07/07, 13:24:35
|  |
| |||
 Problemas Win32:Rontokbr-I2 [Wrm] Buen dias, tengo este malware Win32:Rontokbr-I2 [Wrm] he instalado varios antivirus todos los encuentran y lo borran pero siempre regresa ayuda por favor muchas gracias, ahi les paso el log de HijackThis Logfile of HijackThis v1.99.1 Scan saved at 10:20:08 a.m., on 20/07/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Documents and Settings\Owner.FRONTDESK1\My Documents\Roxio\Ares.exe C:\vHotel\hotel.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Program Files\HJT\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.forospyware.com/ F2 - REG:system.ini: Shell=Explorer.exe "C:\WINDOWS\eksplorasi.exe" O1 - Hosts: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" O1 - Hosts: "http://www.w3.org/TR/html4/loose.dtd"> O1 - Hosts: <html> O1 - Hosts: <head> O1 - Hosts: <script LANGUAGE="JavaScript"> O1 - Hosts: <!-- O1 - Hosts: if (window != top) O1 - Hosts: top.location.href = location.href; O1 - Hosts: // --> O1 - Hosts: </script> O1 - Hosts: <title>Site Unavailable</title> O1 - Hosts: <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> O1 - Hosts: <style type="text/css"> O1 - Hosts: body{text-align:center;} O1 - Hosts: .geohead {font-family:Verdana, Arial, Helvetica, sans-serif; font-size:10px;width:750px;margin:10px 0 10px 0;height:35px;} O1 - Hosts: .geohead #geologo {width:270px;display:block; float:left; } O1 - Hosts: .geohead #rightside {width:480px;display:block; float:right;border-bottom:1px solid #999999; height:27px;} O1 - Hosts: .geohead #rightside #welcome {width:50%;display:block; float:left; text-align:left;} O1 - Hosts: .geohead #rightside #wlinks {width:50%;display:block; float:right; text-align:right;} O1 - Hosts: .ftr { margin:0px; color:#404040; font:x-small Arial,sans-serif; text-align:center; width:750px;} O1 - Hosts: .bodywrap{display:block;height:470px;} O1 - Hosts: .bodycnt{width:510px; display:block; float:left; background-color:#EEE9F5; height:auto; text-align:left; font-family:Arial, Helvetica, sans-serif;font-size:13px; color:#000000; padding:20px 20px 35px 20px;} O1 - Hosts: .title { font-family:Arial, Helvetica, sans-serif; font-weight:bold; font-size:24px; color:#7C56A9} O1 - Hosts: .adcnt{width:172px; display:block; float:right; text-align:left;cursor:pointer;cursor:hand;} O1 - Hosts: .adcnt td {text-align:left;} O1 - Hosts: .adsubt{font-size:10px; font-family:verdana; font-weight:bold; color:#b4b4b4; cursor:default;margin-top:5px;} O1 - Hosts: .ybadge { font-family: Verdana, Arial, Helvetica, sans-serif; font-size:10px; color: #666666; margin-top:10px;} O1 - Hosts: .ybadge img {margin-top:6px;} O1 - Hosts: .adtable {font-family:Verdana, Arial, Helvetica, sans-serif; font-size:10px;border: 1px solid #d6dbe7; background-color:#eff7ff; padding:3px; margin-bottom:10px; width:172px;} O1 - Hosts: .adttl{font-weight:bold;margin-bottom:3px;} O1 - Hosts: .addescr{color:#6b6b6b; margin-bottom:3px;} O1 - Hosts: .adlink a {color:#008200; text-decoration:none;} O1 - Hosts: </style> O1 - Hosts: </head> O1 - Hosts: <body> O1 - Hosts: <!-- following code added by server. PLEASE REMOVE --> O1 - Hosts: <!-- preceding code added by server. PLEASE REMOVE --> O1 - Hosts: <div id="maincnt"> O1 - Hosts: <div class="geohead"><div id="geologo"><a href="http://geocities.yahoo.com"><img height=33 alt="Yahoo! GeoCities" src="http://us.i1.yimg.com/us.yimg.com/i/us/nt/ma/ma_geo_1.gif" width=259 border=0></a></div> O1 - Hosts: <div id="rightside"><div id="wlinks"><a href="http://geocities.yahoo.com">GeoCities Home</a> - <a href="http://www.yahoo.com">Yahoo!</a> - <a href="http://help.yahoo.com/help/us/geo/">Help</a></div> O1 - Hosts: </div></div> O1 - Hosts: <div class="bodywrap"> O1 - Hosts: <div class="bodycnt"> O1 - Hosts: <div class="title">Sorry, this GeoCities site is currently unavailable.</div> O1 - Hosts: <p>The GeoCities web site you were trying to view has temporarily exceeded its data transfer limit. Please try again later. </p> O1 - Hosts: <p>Are you the site owner? O1 - Hosts: Avoid service interruptions in the future by increasing your data transfer limit! O1 - Hosts: <a href="http://help.yahoo.com/help/us/geo/transfer/transfer-05.html" target="_blank">Find out how.</a> </p> O1 - Hosts: <p><a href="http://help.yahoo.com/help/us/geo/transfer/" target="_blank">Learn more about data transfer.</a></p> O1 - Hosts: </div> O1 - Hosts: <div class="adcnt"> O1 - Hosts: <a target="_top" href="http://geocities.yahoo.com"><img src="http://us.i1.yimg.com/us.yimg.com/i/us/smbiz/b/geo_mast_small2.gif" alt="Yahoo! GeoCities" border="0" height="15" hspace="0" vspace="0" width="141"></a> O1 - Hosts: <div class="adsubt">SPONSORED LINKS</div> O1 - Hosts: <!--<table width="172" border="0" bgcolor="#FFFFFF" class="adtable"><tr><td align=left>--> O1 - Hosts: <div class="adtable"> O1 - Hosts: <div class="adttl" title="Reliable plans include domain & 24x7 support."><a href="http://pa.yahoo.com/*http://us.rd.yahoo.com/evt=27166/*http://smallbusiness.yahoo.com/webhosting" target="_blank">Yahoo! Web Hosting<br> O1 - Hosts: $25 Setup Waived</a></div> O1 - Hosts: <div class="addescr" title="Reliable plans include domain & 24x7 support.">Reliable plans include domain & 24x7 support.</div> O1 - Hosts: <div class="adlink" title="Reliable plans include domain & 24x7 support."><a href="http://pa.yahoo.com/*http://us.rd.yahoo.com/evt=27166/*http://smallbusiness.yahoo.com/webhosting" target="_blank">webhosting.yahoo.com</a></div> O1 - Hosts: </div> O1 - Hosts: <div class="adtable"> O1 - Hosts: <div class="adttl" title="Reliable plans include domain & 24x7 support."><a href="http://pa.yahoo.com/*http://us.rd.yahoo.com/evt=27176/*http://smallbusiness.yahoo.com/domains/" target="_blank">Domain Names from Yahoo! only $9.95/yr</a></div> O1 - Hosts: <div class="addescr" title="Includes starter web page, email & domain forwarding, 24x7 support.">Includes starter web page, email & domain forwarding, 24x7 support.</div> O1 - Hosts: <div class="adlink" title="Includes starter web page, email & domain forwarding, 24x7 support."><a href="http://pa.yahoo.com/*http://us.rd.yahoo.com/evt=27176/*http://smallbusiness.yahoo.com/domains/" target="_blank">domains.yahoo.com</a></div> O1 - Hosts: </div> O1 - Hosts: <div class="adtable"> O1 - Hosts: <div class="adttl" title="Setup fee waived. Up to 10 emails, SpamGuard, forwarding & virus scanning."><a href="http://pa.yahoo.com/*http://us.rd.yahoo.com/evt=27184/*http://smallbusiness.yahoo.com/mail" target="_blank">Yahoo! Business Email<br> Domain Included</a></div> O1 - Hosts: <div class="addescr" title="Setup fee waived. Up to 10 emails, SpamGuard, forwarding & virus scanning.">Setup fee waived. Up to 10 emails, SpamGuard, forwarding & virus scanning.</div> O1 - Hosts: <div class="adlink" title="Setup fee waived. Up to 10 emails, SpamGuard, forwarding & virus scanning."><a href="http://pa.yahoo.com/*http://us.rd.yahoo.com/evt=27184/*http://smallbusiness.yahoo.com/mail" target="_blank">smallbusiness.yahoo.com</a></div> O1 - Hosts: </div> O1 - Hosts: <div class="adtable"> O1 - Hosts: <div class="adttl" title="$50 setup fee waived. A reliable ecommerce plan, 24x7 support."><a href="http://pa.yahoo.com/*http://us.rd.yahoo.com/evt=/27190/*http://smallbusiness.yahoo.com/merchant" target="_blank">Ecommerce from Yahoo!<br> 1 Month Free</a></div> O1 - Hosts: <div class="addescr" title="$50 setup fee waived. A reliable ecommerce plan, 24x7 support.">$50 setup fee waived. A reliable ecommerce plan, 24x7 support.</div> O1 - Hosts: <div class="adlink" title="$50 setup fee waived. A reliable ecommerce plan, 24x7 support."><a href="http://pa.yahoo.com/*http://us.rd.yahoo.com/evt=/27190/*http://smallbusiness.yahoo.com/merchant" target="_blank">smallbusiness.yahoo.com</a></div> O1 - Hosts: </div> O1 - Hosts: <div class="ybadge"> O1 - Hosts: Get your own web site at <br><a target="_top" href="http://geocities.yahoo.com">Yahoo! GeoCities</a> O1 - Hosts: <a href="http://smallbusiness.yahoo.com/webhosting/" target="_top"><img src="http://us.i1.yimg.com/us.yimg.com/i/us/wh/gr/badge_hostedby_purp_2.gif" alt="Hosted by Yahoo! Web Hosting" align="middle" border="0" height="31" width="88"></a> O1 - Hosts: </div> O1 - Hosts: </div> O1 - Hosts: </div> O1 - Hosts: <div class=ftr> O1 - Hosts: <hr size=1 width=100%> O1 - Hosts: Copyright © O1 - Hosts: 2005 Yahoo! Inc. All rights reserved<br> O1 - Hosts: <a href="http://privacy.yahoo.com/privacy/us/geo/">Privacy Policy</a> O1 - Hosts: - <a href="http://docs.yahoo.com/info/copyright/copyright.html">Copyright Policy</a> O1 - Hosts: - <a href="http://docs.yahoo.com/info/guidelines/community.html">Guidelines</a> O1 - Hosts: - <a href="http://docs.yahoo.com/info/terms/geoterms.html">Terms of Service</a> O1 - Hosts: - <a href="http://help.yahoo.com/help/us/geo/">Help</a> O1 - Hosts: </div> O1 - Hosts: </div> O1 - Hosts: </body> O1 - Hosts: </html> O1 - Hosts: <!-- text below generated by server. PLEASE REMOVE --></object></layer></div></span></style></noscript></table></script></applet> O1 - Hosts: <IMG SRC="http://geo.yahoo.com/serv?s=19190039&t=1182015182&f=us-w65" ALT=1 WIDTH=1 HEIGHT=1> O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [Bron-Spizaetus] "C:\WINDOWS\ShellNew\sempalong.exe" O4 - HKCU\..\Run: [ares] "C:\Documents and Settings\Owner.FRONTDESK1\My Documents\Roxio\Ares.exe" -h O4 - HKCU\..\Run: [Tok-Cirrhatus] "C:\Documents and Settings\Owner.FRONTDESK1\Local Settings\Application Data\smss.exe" O4 - Global Startup: Startup.exe O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Pol icies\System, DisableRegedit=1 O16 - DPF: {163A949D-2A1F-4B4C-AE46-83D0F59BE189} (X4 Control) - http://189.171.65.168/XHD.cab O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O16 - DPF: {7EC687F9-9EFB-4FA3-A5BA-197C3461448A} (Rm Control) - http://189.171.65.168/RM.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{A165D846-7B9B-4BBB-894A-91D238625530}: NameServer = 192.168.113.1 O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: SmartFinder Uninstall (SmartFinder_Uninstall) - Unknown owner - C:\DOCUMENTS AND SETTINGS\OWNER.FRONTDESK1\DESKTOP\SFUninstaller.ex e" service (file missing) O23 - Service: Workstation NetLogon Service (%AF夶À¨) - Unknown owner - C:\WINDOWS\crby32.exe (file missing)     |
|
20/07/07, 16:50:41
| |
| ||||
| Re: Problemas Win32:Rontokbr-I2 [Wrm] Hola eljorgema, te doy la bienvenida al Foro de InfoSpyware Descarga CCleaner y ejecútalo usando primero su opción de "Limpiador" para borrar cookies, temporales de Internet y todos los archivos que este te muestre como obsoletos, y luego usa su opción de "Registro" para limpiar todo el registro de Windows (haciendo copia de seguridad). Descarga, actualiza y ejecuta
Reinicia y nos contas los resultados. Salu2 Hablándole al mundo en "Twitter"" Novedades del Foro | Antivirus Online | Eliminar Malwares | Políticas del Foro | Blog * Ayúdanos haciendo una DONACIÓN para poder seguir Ayudando. * Para evitar Virus y Spywares al navegar por internet, USE FIREFOX !! * No se resuelven dudas por Privados ni por E-mail, ya que para eso esta el foro. |
|
21/07/07, 13:01:19
| |
| |||
| Re: Problemas Win32:Rontokbr-I2 [Wrm] muchas gracas mi amigo cheka ya realize todos los paso aqui esta el log combofix: "Owner" - 2007-07-21 9:13:40 - ComboFix 07-07-14.6 - Service Pack 2 FAT32 ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\C.exe ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) -------\nm ((((((((((((((((((((((((( Files Created from 2007-06-21 to 2007-07-21 ))))))))))))))))))))))))))))))) 2007-07-21 09:12 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-07-20 07:57 92,672 --a------ C:\KillBox.exe 2007-07-19 16:10 <DIR> d-------- C:\Program Files\Windows Live Safety Center 2007-07-16 14:46 14,647,296 --------- C:\DOCUME~1\OWNER~1.FRO\ntuser.dat 2007-07-16 11:12 <DIR> d-------- C:\Program Files\Alwil Software 2007-07-11 14:26 0 --------- C:\WINDOWS\system32\drivers\wnmsav.dat 2007-07-11 13:59 5,632 --------- C:\WINDOWS\system32\pfdnnt.exe 2007-07-11 10:24 26,529,848 --a------ C:\T07promo.exe 2007-07-09 14:16 <DIR> d-------- C:\!KillBox 2007-07-09 10:00 28,672 --------- C:\WINDOWS\system32\drivers\CO_Mon.sys 2007-07-07 09:54 <DIR> d-------- C:\Program Files\Symantec 2007-07-06 12:03 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared 2007-07-06 11:41 42,457,104 --a------ C:\NAV071430.exe 2007-07-02 09:28 12,413,440 --a------ C:\avgas-setup-7.5.1.43.exe 2007-07-01 08:45 23,649,352 --a------ C:\avg75free_476a1048.exe 2007-06-11 19:56 <DIR> d-------- C:\BET 2007-06-09 00:48 974,848 --------- C:\WINDOWS\system32\mfc70.dll 2007-06-09 00:48 487,424 --------- C:\WINDOWS\system32\msvcp70.dll 2007-06-09 00:48 261,632 --------- C:\WINDOWS\system32\mcdvd_32.dll 2007-06-09 00:48 24,576 --------- C:\WINDOWS\system32\msxml3a.dll 2007-06-09 00:48 1,700,352 --------- C:\WINDOWS\system32\GdiPlus.dll 2007-06-09 00:48 <DIR> d-------- C:\Program Files\Common Files\AVSMedia 2007-06-09 00:48 <DIR> d-------- C:\Program Files\AVSMedia 2007-06-06 09:05 <DIR> d-------- C:\Program Files\WMV9_VCM 2007-06-06 09:03 139,264 --------- C:\WINDOWS\system32\xvidvfw.dll 2007-06-06 09:03 <DIR> d-------- C:\Program Files\Xvid 2007-06-03 16:47 <DIR> d-------- C:\DOCUME~1\OWNER~1.FRO\Contacts 2007-06-03 16:44 <DIR> d-------- C:\WINDOWS\system32\DRVSTORE (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) )) 2007-07-20 17:34:18 12,395,248 ----a-w C:\nentspst.exe 2007-06-12 17:23:54 42,687 ---h--w C:\WINDOWS\eksplorasi.exe 2007-06-12 17:23:54 42,687 ----a-w C:\WINDOWS\WINDOWS.exe 2007-06-12 17:23:54 42,687 ----a-w C:\WINDOWS\system32\System's Setting.scr 2007-06-12 17:23:54 42,687 ----a-w C:\WINDOWS\system32\Owner.FRONTDESK1's Setting.scr 2007-06-12 17:23:54 42,687 ----a-w C:\WINDOWS\system32\drivers\drivers.exe 2007-06-12 17:23:54 42,687 ----a-w C:\DOCUME~1\OWNER~1.FRO\APPLIC~1\Application Data.exe 2007-06-12 17:23:54 42,687 ----a-w C:\Brengkolang.com 2007-05-16 15:12:02 683,520 ------w C:\WINDOWS\system32\inetcomm.dll 2007-04-25 14:21:16 144,896 ------w C:\WINDOWS\system32\schannel.dll ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] 2006-01-12 20:38 63128 --------- C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}] 2005-05-31 01:04 853672 --a------ C:\PROGRA~1\SPYBOT~1\SDHelper.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}] 2005-11-10 13:22 184423 --------- C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}] 2006-08-31 20:33 322368 --a------ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run] "Bron-Spizaetus"="C:\WINDOWS\ShellNew\sempalong.exe" [2007-06-12 10:23] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run] "ares"="C:\Documents and Settings\Owner.FRONTDESK1\My Documents\Roxio\Ares.exe" [2005-07-07 15:43] "SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-02-27 11:39] "Tok-Cirrhatus"="C:\Documents and Settings\Owner.FRONTDESK1\Local Settings\Application Data\smss.exe" [2007-06-12 10:23] [HKEY_USERS\.default\software\microsoft\windows\cur rentversion\run] "Tok-Cirrhatus"="C:\Documents and Settings\NetworkService.NT AUTHORITY\Local Settings\Application Data\smss.exe" [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\policies\system] "DisableCMD"=0 (0x0) "DisableRegistryTools"=1 (0x1) [HKEY_USERS\.default\software\microsoft\windows\cur rentversion\policies\system] "DisableCMD"=0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\policies\explorer] "NoFolderOptions"=1 (0x1) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"="C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2006-12-20 12:55] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "Shell"="Explorer.exe \"C:\WINDOWS\eksplorasi.exe\"" [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] C:\Program Files\SUPERAntiSpyware\SASWINLO.dll --a------ 2007-02-27 11:39 282624 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Avisos del Calendario de Microsoft Works.lnk] path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Avisos del Calendario de Microsoft Works.lnk backup=C:\WINDOWS\pss\Avisos del Calendario de Microsoft Works.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Inicio rápido de Adobe Reader.lnk] path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Inicio rápido de Adobe Reader.lnk backup=C:\WINDOWS\pss\Inicio rápido de Adobe Reader.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^InterVideo WinCinema Manager.lnk] path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\InterVideo WinCinema Manager.lnk backup=C:\WINDOWS\pss\InterVideo WinCinema Manager.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Microsoft Office.lnk] path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Startup.exe] path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Startup.exe backup=C:\WINDOWS\pss\Startup.exeCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Owner.FRONTDESK1^Start Menu^Programs^Startup^iMesh.lnk] path=C:\Documents and Settings\Owner.FRONTDESK1\Start Menu\Programs\Startup\iMesh.lnk backup=C:\WINDOWS\pss\iMesh.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Owner.FRONTDESK1^Start Menu^Programs^Startup^Startup.exe] path=C:\Documents and Settings\Owner.FRONTDESK1\Start Menu\Programs\Startup\Startup.exe backup=C:\WINDOWS\pss\Startup.exeStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares] "C:\Documents and Settings\Owner.FRONTDESK1\My Documents\Roxio\Ares.exe" -h [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DataLayer] C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dlsp2mx] c:\windows\system32\dlsp2mx.exe /nocomm [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dxvid] c:\windows\system32\dxvid.exe /nocomm [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb0 7.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IdolMfcd] C:\DOCUME~1\OWNER~1.FRO\APPLIC~1\SUPPOR~1\find regs media.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray] C:\WINDOWS\System32\igfxtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck] %systemroot%\system32\dumprep 0 -k [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Meet start burn plan] C:\Documents and Settings\All Users.WINDOWS\Application Data\Play long meet start\PeakWma.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\monitor1a] C:\Windows\monitor1a.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Navegate] C:\Windows\wisterd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Patch] C:\WINDOWS\Patch.exe /nomsg [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCCClient.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\pccguide.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Pop3trap.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TerroristTakedownSetup.e xe] C:\DOCUME~1\OWNER~1.FRO\Desktop\TERROR~1.EXE /r [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Tsl] C:\PROGRA~1\COMMON~1\tsa\tsl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_7 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winmu32.exe] C:\WINDOWS\system32\winmu32.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\zajyhkv] C:\WINDOWS\zajyhkv.exe [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\E] AutoRun\command- E:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{36916194-ff02-11d5-b195-0007e995799b}] AutoRun\command- E:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{36916195-ff02-11d5-b195-0007e995799b}] 1\Command- F:\.\RECYCLER\RECYCLER\autorun.exe 2\Command- F:\.\RECYCLER\RECYCLER\autorun.exe AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL .\RECYCLER\RECYCLER\autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{36916196-ff02-11d5-b195-0007e995799b}] 1\Command- E:\.\RECYCLER\RECYCLER\autorun.exe 2\Command- E:\.\RECYCLER\RECYCLER\autorun.exe AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL .\RECYCLER\RECYCLER\autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{64b8a71a-c8ee-11db-b121-0007e995799b}] 1\Command- .\RECYCLER\RECYCLER\autorun.exe 2\Command- .\RECYCLER\RECYCLER\autorun.exe AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL .\RECYCLER\RECYCLER\autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{6bab2ba6-ba39-11db-b108-0007e995799b}] AutoRun\command- E:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{75146394-366f-11dc-b1c3-0007e995799b}] Auto\command- infrom.exe AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL infrom.exe [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{7e7add40-367f-11dc-b1c4-0007e995799b}] AutoRun\command- RavMon.exe explore\Command- RavMon.exe -e open\Command- RavMon.exe [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{989071ec-9f74-11db-b0eb-0007e995799b}] 1\Command- E:\.\RECYCLER\RECYCLER\autorun.exe 2\Command- E:\.\RECYCLER\RECYCLER\autorun.exe AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL .\RECYCLER\RECYCLER\autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{9ed9e313-ffa6-11d5-b12b-0007e995799b}] 1\Command- .\RECYCLER\RECYCLER\autorun.exe 2\Command- .\RECYCLER\RECYCLER\autorun.exe AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL .\RECYCLER\RECYCLER\autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{bff56612-f9c3-11db-b15f-0007e995799b}] 1\Command- .\RECYCLER\RECYCLER\autorun.exe 2\Command- .\RECYCLER\RECYCLER\autorun.exe AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL .\RECYCLER\RECYCLER\autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{c3c64c6e-00ab-11d6-b0fd-0007e995799b}] AutoRun\command- E:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{d19850cf-fecd-11d5-b160-0007e995799b}] AutoRun\command- .\Recycled\Driveinfo.exe Open\Command- .\Recycled\Driveinfo.exe [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{d5c54356-ff08-11d5-b13f-0007e995799b}] 1\Command- E:\.\RECYCLER\RECYCLER\autorun.exe 2\Command- E:\.\RECYCLER\RECYCLER\autorun.exe AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL .\RECYCLER\RECYCLER\autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{f8d4fbe2-6797-11da-aebf-0007e995799b}] Auto\command- infrom.exe AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL infrom.exe Contents of the 'Scheduled Tasks' folder 2007-07-21 16:00:04 C:\WINDOWS\tasks\A45C0E74914B876C.job 2002-01-01 07:04:30 C:\WINDOWS\tasks\At1.job ************************************************** ************************ catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2002-01-01 00:04:10 Windows 5.1.2600 Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************** ************************ Completion time: 2002-01-01 0:06:11 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2002-01-01 00:06 --- E O F --- Espero pronta respuesta y gracias de nuevo |
|
24/07/07, 00:37:14
| |
| ||||
| Re: Problemas Win32:Rontokbr-I2 [Wrm] Hola, ahora hace estos pasos y al terminarlos y luego de reiniciar nos dejas un nuevo log de HJT en este mensaje. Cita:
Hablándole al mundo en "Twitter"" Novedades del Foro | Antivirus Online | Eliminar Malwares | Políticas del Foro | Blog * Ayúdanos haciendo una DONACIÓN para poder seguir Ayudando. * Para evitar Virus y Spywares al navegar por internet, USE FIREFOX !! * No se resuelven dudas por Privados ni por E-mail, ya que para eso esta el foro. |
|
« Tema Anterior
|
Próximo Tema »
| Herramientas | |
|
|
| 
Temas Similares | |
| Tema | Autor | Foro | Respuestas | Último mensaje |
| Problemas con mi PC | j_soloriov | Ayuda General | 6 | 05/01/07 06:54:28 |
| PC con problemas Windows2000 | Satanicha | Foro de Windows | 1 | 22/12/06 15:08:25 |
| Problemas, problemas y problemas... | santako | Foro de Virus y Spywares | 3 | 07/12/06 13:49:01 |
| Problemas Con Monitor y otros | ghostroy | Ayuda General | 15 | 19/09/06 00:13:47 |
| Varios problemas con el ordenador (no abre windows media,restaurar sistema..) | Lionheartilly | Ayuda General | 11 | 13/01/06 18:06:09 |
Todas las horas son GMT -4. La hora es 17:16:55.
