Siguiendo las instrucciones para eliminar el Winfixer, me dice que tengo que eliminar el archivo aleatorio .DLL, que se encuentra en las entradas 02 y 020 del reporte de Hijackthis, pero no sé exactamente cual es el archivo que tengo que borrar. Os dejo mi log para ver si me podeis ayudar, porque no sé como eliminarlo.

Logfile of HijackThis v1.99.1
Scan saved at 19:08:14, on 14/11/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Archivos de programa\Alwil Software\Avast4\aswUpdSv.exe
C:\Archivos de programa\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb0 5.exe
C:\Archivos de programa\QuickTime\qttask.exe
C:\ARCHIV~1\ALWILS~1\Avast4\ashDisp.exe
C:\Archivos de programa\Zone Labs\ZoneAlarm\zlclient.exe
C:\Archivos de programa\Logitech\iTouch\iTouch.exe
C:\ARCHIV~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\Archivos de programa\Picasa2\PicasaMediaDetector.exe
C:\WINDOWS\Downloaded Program Files\UWFX5Y_0001_LPNetInstaller.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Archivos de programa\MSN Messenger\MsnMsgr.Exe
C:\Archivos de programa\Messenger\MSMSGS.EXE
C:\Archivos de programa\Logitech\iTouch\kbdtray.exe
C:\WINDOWS\System32\svchost.exe
C:\Archivos de programa\Alwil Software\Avast4\ashWebSv.exe
C:\Archivos de programa\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Archivos de programa\Internet Explorer\iexplore.exe
C:\Archivos de programa\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZSTC0 5.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZENG0 5.EXE
C:\Archivos de programa\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.es/0SEESES/SAOS01
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.es/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O1 - Hosts: 64.94.29.64 onlineaccounts2.abbeynational.co.uk
O1 - Hosts: 64.94.29.64 www3.aibgbonline.co.uk
O1 - Hosts: 64.94.29.64 www.bank.alliance-leicester.co.uk
O1 - Hosts: 64.94.29.64 login.iblogin.com
O1 - Hosts: 64.94.29.64 ww2.bankofscotlandhalifax-online.co.uk
O1 - Hosts: 64.94.29.64 inet.barclays.co.uk
O1 - Hosts: 64.94.29.64 iibank.barclays.co.uk
O1 - Hosts: 64.94.29.64 iibank.cahoot.com
O1 - Hosts: 64.94.29.64 www3.coventrybuildingsociety.co.uk
O1 - Hosts: 64.94.29.64 ww.hsbc.co.uk
O1 - Hosts: 64.94.29.64 login.ebank.offshore.hsbc.co.je
O1 - Hosts: 64.94.29.64 ww3.online-offshore.lloydstsb.com
O1 - Hosts: 64.94.29.64 ww3.online-business.lloydstsb.co.uk
O1 - Hosts: 64.94.29.64 ww3.online.lloydstsb.co.uk
O1 - Hosts: 64.94.29.64 ww3.online.lloydstsb.co.uk
O1 - Hosts: 64.94.29.64 ww3.online-business.lloydstsb.co.uk
O1 - Hosts: 64.94.29.64 ob2.nationet.com
O1 - Hosts: 64.94.29.64 ww3.onlinebanking.natwestoffshore.com
O1 - Hosts: 64.94.29.64 ww1.nwolb.com
O1 - Hosts: 64.94.29.64 ww1.onlinebanking.iombank.com
O1 - Hosts: 64.94.29.64 ww1.www.rbsdigital.com
O1 - Hosts: 64.94.29.64 welcome.smile.co.uk
O1 - Hosts: 64.94.29.64 login.365online.com
O1 - Hosts: 64.94.29.64 wvw.citizensbankonline.com
O1 - Hosts: 64.94.29.64 esecure.regionsnet.com
O1 - Hosts: 64.94.29.64 rollb.associatedbank.com
O1 - Hosts: 64.94.29.64 upb.unionplanters.com
O1 - Hosts: 64.94.29.64 www.onlinebanking.huntington.com
O1 - Hosts: 64.94.29.64 inet.southtrustonlinebanking.com
O1 - Hosts: 64.94.29.64 logon.personal.wamu.com
O1 - Hosts: 64.94.29.64 login.compassweb.com
O1 - Hosts: 64.94.29.64 logon.firstmeritib.com
O1 - Hosts: 64.94.29.64 login.ccfcuonline.org
O1 - Hosts: 64.94.29.64 ww3.etimebanker.bankofthewest.com
O1 - Hosts: 64.94.29.64 ww2.onlinebanking.lasallebank.com
O1 - Hosts: 64.94.29.64 wvw.totallyfreebanking.com
O1 - Hosts: 64.94.29.64 www.online.wellsfargo.com
O1 - Hosts: 64.94.29.64 www.onlinebanking.bankofoklahoma.com
O1 - Hosts: 64.94.29.64 accounts4.keybank.com
O1 - Hosts: 64.94.29.64 logon.bankone.com
O1 - Hosts: 64.94.29.64 www.secure.tdbanknorth.com
O1 - Hosts: 64.94.29.64 www.secure.mvnt4.com
O1 - Hosts: 64.94.29.64 ww.mynfbonline.com
O1 - Hosts: 64.94.29.64 login.forumcuonline.com
O1 - Hosts: 64.94.29.64 www.eds.usersonlnet.com
O1 - Hosts: 64.94.29.64 www.onlineid.bankofamerica.com
O1 - Hosts: 64.94.29.64 wvw.e-gold.com
O1 - Hosts: 64.94.29.64 pcbs.peoples.com
O1 - Hosts: 64.94.29.64 www.global1.onlinebank.com
O1 - Hosts: 64.94.29.64 ww2.mybranch.lafcu.com
O1 - Hosts: 64.94.29.64 login.webbanking.comerica.com
O1 - Hosts: 64.94.29.64 web.banking.firsttennessee.com
O1 - Hosts: 64.94.29.64 logon.members1st.org
O1 - Hosts: 64.94.29.64 www.cib.ibanking-services.com
O1 - Hosts: 64.94.29.64 www.miwebbusbank.ebanking-services.com
O1 - Hosts: 64.94.29.64 wvw.paypal.com
O1 - Hosts: 64.94.29.64 www.signin.ebay.com
O1 - Hosts: 64.94.29.64 wvw.etrade.com
O1 - Hosts: 64.94.29.64 ww4.fleethomelink.fleet.com
O1 - Hosts: 64.94.29.64 ww3.connect.skyfi.com
O1 - Hosts: 64.94.29.64 www6.usbank.com
O1 - Hosts: 64.94.29.64 www.bvi.bancodevalencia.es
O1 - Hosts: 64.94.29.64 extrant.banesto.es
O1 - Hosts: 64.94.29.64 banesnt.banesto.es
O1 - Hosts: 64.94.29.64 activia.caixagalicia.es
O1 - Hosts: 64.94.29.64 www.bancae.caixapenedes.com
O1 - Hosts: 64.94.29.64 login.caixasabadell.net
O1 - Hosts: 64.94.29.64 oii.cajamadrid.es
O1 - Hosts: 64.94.29.64 login.cajamar.es
O1 - Hosts: 64.94.29.64 login.ccm.es
O1 - Hosts: 64.94.29.64 ww.unicaja.es
O1 - Hosts: 64.94.29.64 www5.bancopopular.es
O1 - Hosts: 64.94.29.64 ww3.bbvanet.com
O1 - Hosts: 64.94.29.64 ww.bayernlb.de
O1 - Hosts: 64.94.29.64 ww2.berliner-volksbank.de
O1 - Hosts: 64.94.29.64 ww7.homebanking-berlin.de
O1 - Hosts: 64.94.29.64 portal09.commerzbanking.de
O1 - Hosts: 64.94.29.64 www.meine.deutsche-bank.de
O1 - Hosts: 64.94.29.64 ww2.dresdner-privat.de
O1 - Hosts: 64.94.29.64 ww.e-banking.helaba.de
O1 - Hosts: 64.94.29.64 ww.hsh-nordbank.de
O1 - Hosts: 64.94.29.64 www.my.hypovereinsbank.de
O1 - Hosts: 64.94.29.64 ww3.homebanking-berlin.de
O1 - Hosts: 64.94.29.64 ww3.homebanking-berlin.de
O1 - Hosts: 64.94.29.64 www.banking.lbbw.de
O1 - Hosts: 64.94.29.64 lrp.sparkasse-banking.de
O1 - Hosts: 64.94.29.64 ww3.homebanking-niedersachsen.de
O1 - Hosts: 64.94.29.64 www.onlinebanking.norisbank.de
O1 - Hosts: 64.94.29.64 www.banking.postbank.de
O1 - Hosts: 64.94.29.64 wvw.internetbanking.gad.de
O1 - Hosts: 64.94.29.64 ww1.portal.izb.de
O1 - Hosts: 64.94.29.64 wvw.kunden-service.lbs.de
O1 - Hosts: 64.94.29.64 ibanking.seb.de
O1 - Hosts: 64.94.29.64 bw7.sparkasse-banking.de
O1 - Hosts: 64.94.29.64 ww2.homebanking-sparkasse.de
O1 - Hosts: 64.94.29.64 ww2.vr-networld-ebanking.de
O1 - Hosts: 64.94.29.64 ww.bics.fr
O1 - Hosts: 64.94.29.64 www.co.caixabank.fr
O1 - Hosts: 64.94.29.64 ww.creditmutuel.fr
O1 - Hosts: 64.94.29.64 internetbank.intesabci.it
O1 - Hosts: 64.94.29.64 ww.extensive.bancalombarda.it
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Archivos de programa\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Microsoft Java Class - {6E28339B-7A2A-47B6-AEB2-46BA53782379} - C:\WINDOWS\System32\dllcache\java.dll
O3 - Toolbar: Barra de Herramientas MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Archivos de programa\MSN Toolbar\01.01.2607.0\es\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb0 5.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Archivos de programa\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avast!] C:\ARCHIV~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Zone Labs Client] C:\Archivos de programa\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Archivos de programa\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\ARCHIV~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Archivos de programa\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [NI.UWFX5Y_0001_LP] "C:\WINDOWS\Downloaded Program Files\UWFX5Y_0001_LPNetInstaller.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Archivos de programa\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Archivos de programa\Messenger\MSMSGS.EXE" /background
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\MSMSGS.EXE
O17 - HKLM\System\CCS\Services\Tcpip\..\{E5DDB8C0-D6FA-48FD-A3FB-357DAE0CEB21}: NameServer = 195.235.113.3 195.235.96.90
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\ARCHIV~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Archivos de programa\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Archivos de programa\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Archivos de programa\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Archivos de programa\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Performance Logs (Perfhmon) - Unknown owner - C:\WINDOWS\System32\Perfhmon.exe (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Hola, te doy la bienvenida al Foro de InfoSpyware, seguí estos pasos.

Paso 1- Apaga el "Restaurar Sistema"

Paso 2- Descarga el programa Spy Sweeper 4.5 , Actualízalo pero no lo ejecutes aun.

Paso 3- Con todos los programas cerrados ejecuta el HijackThis y dale a estas entradas:

O1 - Hosts: 64.94.29.64 onlineaccounts2.abbeynational.co.uk
O1 - Hosts: 64.94.29.64 www3.aibgbonline.co.uk
O1 - Hosts: 64.94.29.64 www.bank.alliance-leicester.co.uk
O1 - Hosts: 64.94.29.64 login.iblogin.com
O1 - Hosts: 64.94.29.64 ww2.bankofscotlandhalifax-online.co.uk
O1 - Hosts: 64.94.29.64 inet.barclays.co.uk
O1 - Hosts: 64.94.29.64 iibank.barclays.co.uk
O1 - Hosts: 64.94.29.64 iibank.cahoot.com
O1 - Hosts: 64.94.29.64 www3.coventrybuildingsociety.co.uk
O1 - Hosts: 64.94.29.64 ww.hsbc.co.uk
O1 - Hosts: 64.94.29.64 login.ebank.offshore.hsbc.co.je
O1 - Hosts: 64.94.29.64 ww3.online-offshore.lloydstsb.com
O1 - Hosts: 64.94.29.64 ww3.online-business.lloydstsb.co.uk
O1 - Hosts: 64.94.29.64 ww3.online.lloydstsb.co.uk
O1 - Hosts: 64.94.29.64 ww3.online.lloydstsb.co.uk
O1 - Hosts: 64.94.29.64 ww3.online-business.lloydstsb.co.uk
O1 - Hosts: 64.94.29.64 ob2.nationet.com
O1 - Hosts: 64.94.29.64 ww3.onlinebanking.natwestoffshore.com
O1 - Hosts: 64.94.29.64 ww1.nwolb.com
O1 - Hosts: 64.94.29.64 ww1.onlinebanking.iombank.com
O1 - Hosts: 64.94.29.64 ww1.www.rbsdigital.com
O1 - Hosts: 64.94.29.64 welcome.smile.co.uk
O1 - Hosts: 64.94.29.64 login.365online.com
O1 - Hosts: 64.94.29.64 wvw.citizensbankonline.com
O1 - Hosts: 64.94.29.64 esecure.regionsnet.com
O1 - Hosts: 64.94.29.64 rollb.associatedbank.com
O1 - Hosts: 64.94.29.64 upb.unionplanters.com
O1 - Hosts: 64.94.29.64 www.onlinebanking.huntington.com
O1 - Hosts: 64.94.29.64 inet.southtrustonlinebanking.com
O1 - Hosts: 64.94.29.64 logon.personal.wamu.com
O1 - Hosts: 64.94.29.64 login.compassweb.com
O1 - Hosts: 64.94.29.64 logon.firstmeritib.com
O1 - Hosts: 64.94.29.64 login.ccfcuonline.org
O1 - Hosts: 64.94.29.64 ww3.etimebanker.bankofthewest.com
O1 - Hosts: 64.94.29.64 ww2.onlinebanking.lasallebank.com
O1 - Hosts: 64.94.29.64 wvw.totallyfreebanking.com
O1 - Hosts: 64.94.29.64 www.online.wellsfargo.com
O1 - Hosts: 64.94.29.64 www.onlinebanking.bankofoklahoma.com
O1 - Hosts: 64.94.29.64 accounts4.keybank.com
O1 - Hosts: 64.94.29.64 logon.bankone.com
O1 - Hosts: 64.94.29.64 www.secure.tdbanknorth.com
O1 - Hosts: 64.94.29.64 www.secure.mvnt4.com
O1 - Hosts: 64.94.29.64 ww.mynfbonline.com
O1 - Hosts: 64.94.29.64 login.forumcuonline.com
O1 - Hosts: 64.94.29.64 www.eds.usersonlnet.com
O1 - Hosts: 64.94.29.64 www.onlineid.bankofamerica.com
O1 - Hosts: 64.94.29.64 wvw.e-gold.com
O1 - Hosts: 64.94.29.64 pcbs.peoples.com
O1 - Hosts: 64.94.29.64 www.global1.onlinebank.com
O1 - Hosts: 64.94.29.64 ww2.mybranch.lafcu.com
O1 - Hosts: 64.94.29.64 login.webbanking.comerica.com
O1 - Hosts: 64.94.29.64 web.banking.firsttennessee.com
O1 - Hosts: 64.94.29.64 logon.members1st.org
O1 - Hosts: 64.94.29.64 www.cib.ibanking-services.com
O1 - Hosts: 64.94.29.64 www.miwebbusbank.ebanking-services.com
O1 - Hosts: 64.94.29.64 wvw.paypal.com
O1 - Hosts: 64.94.29.64 www.signin.ebay.com
O1 - Hosts: 64.94.29.64 wvw.etrade.com
O1 - Hosts: 64.94.29.64 ww4.fleethomelink.fleet.com
O1 - Hosts: 64.94.29.64 ww3.connect.skyfi.com
O1 - Hosts: 64.94.29.64 www6.usbank.com
O1 - Hosts: 64.94.29.64 www.bvi.bancodevalencia.es
O1 - Hosts: 64.94.29.64 extrant.banesto.es
O1 - Hosts: 64.94.29.64 banesnt.banesto.es
O1 - Hosts: 64.94.29.64 activia.caixagalicia.es
O1 - Hosts: 64.94.29.64 www.bancae.caixapenedes.com
O1 - Hosts: 64.94.29.64 login.caixasabadell.net
O1 - Hosts: 64.94.29.64 oii.cajamadrid.es
O1 - Hosts: 64.94.29.64 login.cajamar.es
O1 - Hosts: 64.94.29.64 login.ccm.es
O1 - Hosts: 64.94.29.64 ww.unicaja.es
O1 - Hosts: 64.94.29.64 www5.bancopopular.es
O1 - Hosts: 64.94.29.64 ww3.bbvanet.com
O1 - Hosts: 64.94.29.64 ww.bayernlb.de
O1 - Hosts: 64.94.29.64 ww2.berliner-volksbank.de
O1 - Hosts: 64.94.29.64 ww7.homebanking-berlin.de
O1 - Hosts: 64.94.29.64 portal09.commerzbanking.de
O1 - Hosts: 64.94.29.64 www.meine.deutsche-bank.de
O1 - Hosts: 64.94.29.64 ww2.dresdner-privat.de
O1 - Hosts: 64.94.29.64 ww.e-banking.helaba.de
O1 - Hosts: 64.94.29.64 ww.hsh-nordbank.de
O1 - Hosts: 64.94.29.64 www.my.hypovereinsbank.de
O1 - Hosts: 64.94.29.64 ww3.homebanking-berlin.de
O1 - Hosts: 64.94.29.64 ww3.homebanking-berlin.de
O1 - Hosts: 64.94.29.64 www.banking.lbbw.de
O1 - Hosts: 64.94.29.64 lrp.sparkasse-banking.de
O1 - Hosts: 64.94.29.64 ww3.homebanking-niedersachsen.de
O1 - Hosts: 64.94.29.64 www.onlinebanking.norisbank.de
O1 - Hosts: 64.94.29.64 www.banking.postbank.de
O1 - Hosts: 64.94.29.64 wvw.internetbanking.gad.de
O1 - Hosts: 64.94.29.64 ww1.portal.izb.de
O1 - Hosts: 64.94.29.64 wvw.kunden-service.lbs.de
O1 - Hosts: 64.94.29.64 ibanking.seb.de
O1 - Hosts: 64.94.29.64 bw7.sparkasse-banking.de
O1 - Hosts: 64.94.29.64 ww2.homebanking-sparkasse.de
O1 - Hosts: 64.94.29.64 ww2.vr-networld-ebanking.de
O1 - Hosts: 64.94.29.64 ww.bics.fr
O1 - Hosts: 64.94.29.64 www.co.caixabank.fr
O1 - Hosts: 64.94.29.64 ww.creditmutuel.fr
O1 - Hosts: 64.94.29.64 internetbank.intesabci.it
O1 - Hosts: 64.94.29.64 ww.extensive.bancalombarda.it

O2 - BHO: Microsoft Java Class - {6E28339B-7A2A-47B6-AEB2-46BA53782379} - C:\WINDOWS\System32\dllcache\java.dll

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm


Paso 4- Ejecuta Spy Sweeper 4.5

Paso 5- Usa el Disk Cleaner para limpiar cookies y temporales y RegSeeker para limpiar el registro de Win.

Reinicia y nos contas los resultados.

Salu2