Estimados,

Hace un tiempo atras no pude hacer update del AVG, lo desinstale y no pude volver a insatlarlo, ahoro tengo el Avira.
Comenzo a pasarme tambien que no podia entrar en determinadas paginas como por ejemplo circuitcity.com y en otras podia hacerlo en cache, pero muuy lento.

Segui los pasos de forospyware para limpieza y a partir, cada vez que no podia entrar en una pagina aparecia un popup con el url: Adserving.cpxinteractive.com (es como que algo del proceso desenmascaro a este malware).

En el foro de malware me dijeron que era un LOP MALWARE.....
Al hacer la limpieza solo funciono el kaspersky online y en modo normal no pude correr otro, a prueba de fallos corri el nod32 online.
Detecto un par de cosas de spy, pero me parece muy raro que no haya aparecido este malware...en fin, saque el LOG de HJT y desde ya les agradezco muchisimo que puedan ayudarme.
MUCHAS GRACIAS


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:40:52 a.m., on 21/03/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16609)
Boot mode: Safe mode

Running processes:
C:\Windows\Explorer.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.latam.msn.com/0SEESXL/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.latam.msn.com/0SEESXL/SAOS01?FORM=TOOLBR
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.toshibadirect.com/dpdstart
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.latam.msn.com/0SEESXL/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKLM\..\Run: [Camera Assistant Software] "C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe"
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [HWSetup] \HWSetup.exe hwSetUP
O4 - HKLM\..\Run: [SVPWUTIL] C:\Program Files\TOSHIBA\Utilities\SVPWUTIL.exe SVPwUTIL
O4 - HKLM\..\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
O4 - HKLM\..\Run: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe
O4 - HKLM\..\Run: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
O4 - HKLM\..\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
O4 - HKLM\..\Run: [KeNotify] C:\Program Files\TOSHIBA\Utilities\KeNotify.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Ink Monitor] C:\Program Files\EPSON\Ink Monitor\InkMonitor.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [mouseElf] C:\PROGRA~1\TWINTO~1\MouseElf.EXE
O4 - HKLM\..\Run: [CmUsbSound] RunDll32 cmcnfgu.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [snpstd] C:\Windows\vsnpstd.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [EPSON Stylus CX5600 Series] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIC AL.EXE /FU "C:\Windows\TEMP\E_S9B74.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: Recorte de pantalla e Inicio rápido de OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Bluetooth.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
O9 - Extra button: Enviar a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Enviar a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} (TotalScan Installer Class) - http://www.nanoscan.com/as/cabs/ascstubie.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{7341369A-05FE-467D-BEA1-822987B045B0}: NameServer = 200.42.0.108,200.42.0.109
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762# # (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\TOSHIBA Games\TOSHIBA Game Console\GameConsoleService.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: pinger - Unknown owner - C:\Toshiba\IVP\ISM\pinger.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: Swupdtmr - Unknown owner - c:\Toshiba\IVP\swupdate\swupdtmr.exe
O23 - Service: TOSHIBA Navi Support Service (TNaviSrv) - TOSHIBA Corporation - C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe
O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--
End of file - 11202 bytes

Hola edg2007,

Tu log de HijackThis esta limpio y si ya seguiste los "11 Pasos para eliminar Malwares" pasando los AntiSpywares y Antivirus que ahí se mencionan y estos no encontraron nada, tu problema no es por un malware.

Descarga CCleaner y ejecútalo usando primero su opción de "Limpiador" para borrar cookies, temporales de internet y todos los archivos que este te muestre como obsoletos, y luego usa su opción de "Registro" para limpiar todo el registro de Windows (haciendo copia de seguridad).

Una vez que este termine de limpiar todo, actualiza "Java", hace una Desfragmentación del disco con la opción de Windows y pasa por www.windowsupdate.com para descargar todos los parches disponibles (si tu sistema lo permite)

• Descarga y ejecuta la utilidad Advanced WindowsCare, para reparar y optimizar a fondo tu PC.

Reinicia y nos contas los resultados.

Salu2

Articulo de interés: "Eliminar lentitud en Windows"

ok, muchas gracias por la info.

mira, pase el ccleaner y despues al querer instalar java me aparece el siguiente mensaje: ...java.. is not a valid win32 app..
probe con las versdiones en linea y offline y no va ninguna. Te agradezco si tenes alguna ayuda.

muchas gracias nuevamente.

Ah, la pregunta es: porque me aparecian ventanas emergenets con el mensaje "adserving cpxinteractive" al intentar ingresar a las paginas (por ejemplo circuitcity.com). No es ese mensaje algun tipo de pronblema????

Ahora ya no me aaprece ese pop up pero no puedo ingresas a esas paginas, solo aparece LISTO abajo a la izquierda....
gracias

- Descarga la herramienta ComboFix.exe y guárdala en el escritorio.

• Desactiva temporalmente el Antivirus y/o Antispyware.
• Cierra todas las ventanas abiertas.
• Hacele doble clic al archivo ComboFix.exe y seguí las instrucciones.
• Cuando termine, generara un registro en C:\ComboFix.txt.
  • *Nota* Mientras CF este trabajando no mover el mouse ya que pararía su proceso.
  • *Nota* ComboFix puede reiniciar automáticamente el PC para completar el proceso de eliminación.

• Reinicia y pega el reporte de C:\ComboFix.txt en este mismo mensaje.

Salu2

OK gracias!!

Pase el Combo Fix y este es el reporte:

ComboFix 08-03-25.4 - BCM 2008-03-26 21:58:48.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1033.18.1136 [GMT -3:00]
Running from: C:\Users\BCM\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2008-02-27 to 2008-03-27 )))))))))))))))))))))))))))))))
.

No new files created in this timespan

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2008-03-27 00:54 --------- d-----w C:\Users\BCM\AppData\Roaming\Skype
2008-03-26 20:27 --------- d-----w C:\Users\BCM\AppData\Roaming\skypePM
2008-03-26 14:00 --------- d-----w C:\Program Files\IObit
2008-03-24 15:11 106 ----a-w C:\delete.bat
2008-03-22 19:57 --------- d-----w C:\Program Files\AC3Filter
2008-03-22 15:16 --------- d-----w C:\Program Files\Gabest
2008-03-22 14:55 --------- d-----w C:\Program Files\Xvid
2008-03-22 14:22 --------- d-----w C:\Program Files\Webteh
2008-03-22 00:25 --------- d---a-w C:\ProgramData\TEMP
2008-03-22 00:21 --------- d-----w C:\Program Files\SpywareBlaster
2008-03-21 00:48 --------- d-----w C:\Program Files\EsetOnlineScanner
2008-03-20 23:00 --------- d-----w C:\Program Files\Panda Security
2008-03-20 16:59 --------- d-----w C:\Program Files\Trend Micro
2008-03-20 16:33 --------- d-----w C:\Users\BCM\AppData\Roaming\SUPERAntiSpyware.com
2008-03-20 16:33 --------- d-----w C:\ProgramData\SUPERAntiSpyware.com
2008-03-20 16:33 --------- d-----w C:\Program Files\SUPERAntiSpyware
2008-03-20 16:33 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-03-20 16:15 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-20 16:15 --------- d-----w C:\ProgramData\BVRP Software
2008-03-20 16:15 --------- d-----w C:\Program Files\Motorola Phone Tools
2008-03-20 15:48 --------- d-----w C:\Program Files\Windows Live Toolbar
2008-03-20 15:47 --------- d-----w C:\ProgramData\YAHOO
2008-03-20 15:47 --------- d-----w C:\Program Files\Yahoo!
2008-03-20 13:21 --------- d-----w C:\Program Files\CCleaner
2008-03-15 13:48 --------- d-----w C:\Program Files\Google
2008-03-12 11:52 --------- d-----w C:\ProgramData\Microsoft Help
2008-03-12 11:51 --------- d-----w C:\Program Files\Windows Mail
2008-03-08 02:01 --------- d-----w C:\ProgramData\WinZip
2008-03-07 11:33 32 ----a-w C:\Users\All Users\ezsid.dat
2008-03-07 11:33 32 ----a-w C:\ProgramData\ezsid.dat
2008-03-07 11:32 --------- d-----w C:\Program Files\Common Files\Skype
2008-03-03 20:45 --------- d-----w C:\ProgramData\Avg7
2008-02-29 11:32 --------- d-----w C:\ProgramData\Avira
2008-02-29 11:32 --------- d-----w C:\Program Files\Avira
2008-02-28 11:00 --------- d-----w C:\Users\BCM\AppData\Roaming\AVG7
2008-02-27 14:07 --------- d-----w C:\ProgramData\Spybot - Search & Destroy
2008-02-27 14:06 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-02-16 00:31 --------- d-----w C:\Users\BCM\AppData\Roaming\Joost
2008-02-14 12:13 1,244,672 ----a-w C:\Windows\System32\mcmde.dll
2008-02-14 06:16 194,560 ----a-w C:\Windows\System32\WebClnt.dll
2008-02-14 06:16 110,080 ----a-w C:\Windows\system32\drivers\mrxdav.sys
2008-02-14 06:08 45,112 ----a-w C:\Windows\system32\drivers\pciidex.sys
2008-02-14 06:08 3,504,696 ----a-w C:\Windows\System32\ntkrnlpa.exe
2008-02-14 06:08 3,470,392 ----a-w C:\Windows\System32\ntoskrnl.exe
2008-02-14 06:08 21,560 ----a-w C:\Windows\system32\drivers\atapi.sys
2008-02-14 06:08 154,624 ----a-w C:\Windows\system32\drivers\nwifi.sys
2008-02-14 06:08 15,928 ----a-w C:\Windows\system32\drivers\pciide.sys
2008-02-14 06:08 109,624 ----a-w C:\Windows\system32\drivers\ataport.sys
2008-02-14 06:07 803,328 ----a-w C:\Windows\system32\drivers\tcpip.sys
2008-02-14 06:07 24,064 ----a-w C:\Windows\System32\netcfg.exe
2008-02-14 06:07 22,016 ----a-w C:\Windows\System32\netiougc.exe
2008-02-14 06:07 216,632 ----a-w C:\Windows\system32\drivers\netio.sys
2008-02-14 06:07 167,424 ----a-w C:\Windows\System32\tcpipcfg.dll
2008-02-14 06:06 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-02-14 06:06 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-02-14 06:06 4,247,552 ----a-w C:\Windows\System32\GameUXLegacyGDFs.dll
2008-02-14 06:06 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-02-14 06:06 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-02-14 06:06 1,686,528 ----a-w C:\Windows\System32\gameux.dll
2008-02-14 06:02 824,832 ----a-w C:\Windows\System32\wininet.dll
2008-02-14 06:02 56,320 ----a-w C:\Windows\System32\iesetup.dll
2008-02-14 06:02 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-02-14 06:02 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
2008-02-11 12:39 253,952 ----a-w C:\Windows\System32\OnlineScannerDLLA.dll
2008-02-11 12:39 237,568 ----a-w C:\Windows\System32\OnlineScannerDLLW.dll
2008-02-08 16:53 110,592 ----a-w C:\Windows\System32\OnlineScannerLang.dll
2008-02-05 11:48 77,824 ----a-w C:\Windows\System32\OnlineScannerUninstaller.exe
2008-02-05 11:36 --------- d-----w C:\ProgramData\ATI
2008-01-11 17:05 11,776 ----a-w C:\Windows\System32\sbunattend.exe
2008-01-09 18:01 53,248 ----a-w C:\Windows\bdoscandel.exe
2007-10-03 10:51 174 --sha-w C:\Program Files\desktop.ini
2007-05-17 01:46 262,144 ----a-w C:\ProgramData\ntuser.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"TOSCDSPD"="C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe" [2007-01-22 12:59 417792]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 09:35 125440]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-02-01 17:22 21898024]
"EPSON Stylus CX5600 Series"="C:\Windows\system32\spool\DRIVERS\W32X86\ 3\E_FATICAL.exe" [2007-01-25 03:00 179200]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-02-29 16:03 1481968]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 16:35 90112]
"Camera Assistant Software"="C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe" [2007-04-10 16:40 413696]
"Apoint"="C:\Program Files\Apoint2K\Apoint.exe" [2006-09-11 19:21 180224]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-10-03 03:13 1006264]
"RtHDVCpl"="RtHDVCpl.exe" [2007-04-25 15:14 4444160 C:\Windows\RtHDVCpl.exe]
"NDSTray.exe"="NDSTray.exe" []
"HWSetup"="\HWSetup.exe" [ ]
"SVPWUTIL"="C:\Program Files\TOSHIBA\Utilities\SVPWUTIL.exe" [2006-03-23 01:42 438272]
"TPwrMain"="C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE" [2007-03-29 14:39 411192]
"HSON"="C:\Program Files\TOSHIBA\TBS\HSON.exe" [2006-12-07 20:49 55416]
"SmoothView"="C:\Program Files\Toshiba\SmoothView\SmoothView.exe" [2007-03-22 15:46 448632]
"00TCrdMain"="C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe" [2007-04-26 22:56 538744]
"KeNotify"="C:\Program Files\TOSHIBA\Utilities\KeNotify.exe" [2006-11-06 21:14 34352]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-05-21 15:31 1862144]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
"Ink Monitor"="C:\Program Files\EPSON\Ink Monitor\InkMonitor.exe" [2003-05-05 01:27 258116]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 07:00 33648]
"mouseElf"="C:\PROGRA~1\TWINTO~1\MouseElf.EXE" [2004-08-26 01:45 192512]
"CmUsbSound"="cmcnfgu.cpl" []
"snpstd"="C:\Windows\vsnpstd.exe" [2007-03-30 14:16 344064]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-29 08:41 249896]

C:\Users\BCM\AppData\Roaming\Microsoft\Windows\Sta rt Menu\Programs\Startup\
Recorte de pantalla e Inicio r pido de OneNote 2007.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2007-08-24 04:45:42 101784]

[hkey_local_machine\software\microsoft\windows\curr entversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 12:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 12:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~ 1.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\FirewallRules]
"{2FD54F10-3F17-4F1E-866A-FA8B2FD5EE86}"= UDP:C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe:McAfee Network Agent
"TCP Query User{7D5A56E7-0FB1-46BA-A357-FB126F7BCF61}C:\\program files\\joost\\xulrunner\\tvprunner.exe"= UDP:C:\program files\joost\xulrunner\tvprunner.exe:tvprunner
"UDP Query User{4A60C9F9-D92C-4DDD-BB0D-10C4311FCCFA}C:\\program files\\joost\\xulrunner\\tvprunner.exe"= TCP:C:\program files\joost\xulrunner\tvprunner.exe:tvprunner
"TCP Query User{34B0FA4E-DF4B-4F5F-9AB8-AE1064E50B85}C:\\program files\\skype\\phone\\skype.exe"= UDP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"UDP Query User{B4D091C4-2A8B-4F62-9B6B-E0AC65E1C8FD}C:\\program files\\skype\\phone\\skype.exe"= TCP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"{D041548F-5346-4741-A2C5-BC396FEBD143}"= C:\Program Files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"{92AB4593-61A4-4977-AB40-F1105F26C785}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{28925D35-9F67-4F7E-BAD0-99AB4CCB5FC6}"= UDP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{2E1A4C3E-31A8-44BF-8B46-A528CC507247}"= TCP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{21C29681-8DC9-4C1B-82F6-C67A31C05FE1}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{36C923EA-ECDF-47D6-9653-906DF18C35F3}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{D46A7F89-2D79-49DD-A438-C864C166C427}"= C:\Program Files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"TCP Query User{4283D2C3-F96E-42DF-86A8-292B1713E6F5}C:\\program files\\skype\\phone\\skype.exe"= UDP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"UDP Query User{B377E593-DACC-4A61-B215-4EE89BD3A5A0}C:\\program files\\skype\\phone\\skype.exe"= TCP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"TCP Query User{EEF51548-4D2D-4ED5-AC9E-0C3194160F00}C:\\program files\\emule\\emule.exe"= Disabled:UDP:C:\program files\emule\emule.exe:eMule
"UDP Query User{B7404979-3C8D-4B10-B851-E683C323E769}C:\\program files\\emule\\emule.exe"= Disabled:TCP:C:\program files\emule\emule.exe:eMule
"TCP Query User{633F3D0A-1B6B-4BD5-B13D-441B10686773}C:\\program files\\mozilla firefox\\firefox.exe"= Disabled:UDP:C:\program files\mozilla firefox\firefox.exe:Firefox
"UDP Query User{5B47D3D9-E657-481E-AFF8-E1B8D84454A8}C:\\program files\\mozilla firefox\\firefox.exe"= Disabled:TCP:C:\program files\mozilla firefox\firefox.exe:Firefox

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|S vc=DFSR:Allow inbound TCP traffic|

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\StandardProfile\AuthorizedApplications\List]
"C:\\TOSHIBA\\ivp\\NetInt\\Netint.exe"= C:\TOSHIBA\ivp\NetInt\Netint.exe:*:Enabled:NIE - Toshiba Software Upgrades Engine
"C:\\TOSHIBA\\Ivp\\ISM\\pinger.exe"= C:\TOSHIBA\Ivp\ISM\pinger.exe:*:Enabled:Toshiba Software Upgrades Pinger

R0 LPCFilter;LPC Lower Filter Driver;C:\Windows\system32\DRIVERS\LPCFilter.sys [2006-07-28 20:25]
R0 tos_sps32;TOSHIBA tos_sps32 Service;C:\Windows\system32\DRIVERS\tos_sps32.sys [2007-04-28 00:13]
R2 pinger;pinger;C:\Toshiba\IVP\ISM\pinger.exe [2007-01-25 21:47]
R2 SBSDWSCService;SBSD Security Center Service;C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [2008-01-28 11:43]
R2 TNaviSrv;TOSHIBA Navi Support Service;C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe [2007-04-28 00:15]
R2 TOSHIBA Bluetooth Service;TOSHIBA Bluetooth Service;C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe [2007-02-26 01:55]
R3 athr;Atheros Extensible Wireless LAN device driver;C:\Windows\system32\DRIVERS\athr.sys [2007-02-28 22:04]
R3 atikmdag;atikmdag;C:\Windows\system32\DRIVERS\atik mdag.sys [2007-04-25 02:07]
R3 tdcmdpst;TOSHIBA Writing Engine Filter Driver;C:\Windows\system32\DRIVERS\tdcmdpst.sys [2006-10-18 15:50]
R3 UVCFTR;UVCFTR;C:\Windows\system32\DRIVERS\UVCFTR_S .SYS [2007-03-13 01:47]
S3 btwaudio;Bluetooth Audio Device Service;C:\Windows\system32\drivers\btwaudio.sys [2007-03-30 03:46]
S3 btwavdt;Bluetooth AVDT Service;C:\Windows\system32\drivers\btwavdt.sys [2007-02-27 14:20]
S3 btwrchid;btwrchid;C:\Windows\system32\DRIVERS\btwr chid.sys [2007-02-27 14:20]
S3 cmudau;C-Media USB Sound Interface;C:\Windows\system32\drivers\cmudau.sys [2004-08-06 00:49]
S3 GameConsoleService;GameConsoleService;"C:\Program Files\TOSHIBA Games\TOSHIBA Game Console\GameConsoleService.exe" [2008-01-29 14:09]
S3 genmcmnUSB;USB Scroll Mouse Driver;C:\Windows\system32\DRIVERS\gflmouhid.sys [2004-04-19 07:01]
S4 KR10I;KR10I;C:\Windows\system32\drivers\kr10i.sys [2006-02-14 15:50]
S4 KR10N;KR10N;C:\Windows\system32\drivers\kr10n.sys [2005-09-27 20:57]
S4 KR3NPXP;KR3NPXP;C:\Windows\system32\drivers\kr3npx p.sys [2006-09-28 00:06]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ

[HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{8074d4e5-7451-11dc-94c6-0016d4fe232f}]
\shell\auto\command - E:\Knight.exe open
\shell\AutoRun\command - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL E:\Knight.exe open
\shell\explore\command - E:\Knight.exe open
\shell\find\command - E:\Knight.exe open
\shell\install\command - E:\Knight.exe open
\shell\open\command - E:\Knight.exe open

.
************************************************** ************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-26 22:03:16
Windows 6.0.6000 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

************************************************** ************************
.
Completion time: 2008-03-26 22:04:11
ComboFix-quarantined-files.txt 2008-03-27 01:04:07
.
2008-03-25 19:50:33 --- E O F ---

MUCHAS GRACIAS

El Piedra,

Creo que el problema puede estar con algun plugin, puede ser?????????
algo con un tal wordpress, vbulletin o algo asi, puede ser eso....
agradezco tu opinion

Error de pagina en blanco
26 de Agosto, 2006

Aprovechando todo el trasiego del cambio de servidor para poner fin a un error bastante molesto que tenía este Cuaderno de Campo (y muchos otros por lo leido) consistente en que el sitio muestra una página en blanco cuando se le solicita una página, despues de hacer un comentario, etc…. El error se origina en el plugin wp-cache. para Wordpress. Parece que cuando el plugin cachea una nueva página, en la primera solicitud devuelve una página en blanco. Había que recargar varias veces la página y armarse de paciencia para lograr ver la página.

La solución:
Edita el archivo wp-cache-phase2.php que se ubica en /wp-content/plugins/wp-cache/
En este archivo, a la altura de la linea 219 aparece ob_end_clean(); reemplazalo por ob_end_flush(); dejando algo como://ob_end_clean();
ob_end_flush();

Se acabaron las páginas en blanco.


SERA ESTO??????

Hola, tus reportes están todos libres de malwares por lo que si el problema solo te da en un sitio o en los que estan en Wordpress puede que el problema sea de estos y no de tu pc.

Salu2

oK El Piedra, coincido. Como siempre MUCHAS GRACIAS y demos por cerrado, cualquier cosa te consulto