Hola,

Se me ha colado adaware en mi pc Me saltan ventanas del Firefox abriendo páginas de publicidad (casinos, www.888, etc) y animaciones en flash

He seguido los pasos del buen limpiador y me ha borrado alguna basurilla de cookies, pero no ha arreglado el problema de las ventanas emergentes.


Mi log es el siguiente:


Logfile of HijackThis v1.99.1
Scan saved at 20:22:12, on 18/11/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Archivos de programa\Archivos comunes\Symantec Shared\ccSetMgr.exe
C:\Archivos de programa\Archivos comunes\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\rundll32.exe
C:\Archivos de programa\Archivos comunes\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Archivos de programa\Winamp\winampa.exe
C:\Archivos de programa\D-Tools\daemon.exe
C:\ARCHIV~1\WINDOW~4\WScheduler.exe
C:\Archivos de programa\Archivos comunes\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Archivos de programa\p2phazard\P2PHazard.exe
C:\Archivos de programa\Conceptronic\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\Archivos de programa\Archivos comunes\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\System32\nprotect.exe
C:\Archivos de programa\Norton AntiVirus\navapsvc.exe
C:\Archivos de programa\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Archivos de programa\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Archivos de programa\Archivos comunes\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Archivos de programa\HJT\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
R3 - Default URLSearchHook is missing
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Archivos de programa\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [WinampAgent] C:\Archivos de programa\Winamp\winampa.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [EPSON Stylus Photo RX420 Series (Copiar 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9 CE.EXE /P42 "EPSON Stylus Photo RX420 Series (Copiar 1)" /O6 "USB001" /M "Stylus Photo RX420"
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Archivos de programa\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [WScheduler] C:\ARCHIV~1\WINDOW~4\WScheduler.exe /LOGON
O4 - HKLM\..\Run: [ccApp] "C:\Archivos de programa\Archivos comunes\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Archivos de programa\Archivos comunes\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\ARCHIV~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [stnospy] C:\Archivos de programa\SinEspias\no-spy.exe /autorun
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [Sin Espias] "C:\Archivos de programa\SinEspias\no-spy.exe" /autorun
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - Startup: P2PHazard.lnk = C:\Archivos de programa\p2phazard\P2PHazard.exe
O8 - Extra context menu item: + Offline &Explorer: Download the link - file://C:\Archivos de programa\Offline Explorer Enterprise\Add_UrlO.htm
O8 - Extra context menu item: + Offline E&xplorer: Download the current page - file://C:\Archivos de programa\Offline Explorer Enterprise\Add_AllO.htm
O8 - Extra context menu item: Descargar con Net Transport - C:\Archivos de programa\Xi\NetTransport 2\NTAddLink.html
O8 - Extra context menu item: Descargar todo con Net Transport - C:\Archivos de programa\Xi\NetTransport 2\NTAddList.html
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: View Link Source - C:\windows\web\viewsource.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
O16 - DPF: {F78C46AA-052C-40CA-9F75-65C45900070C} - http://www.seagate.com/support/disc/asp/tools/es/bin/npseatools.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{6BA950E3-13A1-433C-BE59-804D59ED7834}: NameServer = 80.58.61.250,80.58.61.254
O17 - HKLM\System\CCS\Services\Tcpip\..\{9C58E8C6-4A12-4393-8D67-D7D8CF076A48}: NameServer = 80.58.61.250,80.58.61.254
O20 - Winlogon Notify: SharedDLLs - C:\WINDOWS\system32\n44s0eh7eh4.dll
O21 - SSODL: SysTray.Exys - {7368D5FC-6F5C-4f5b-B964-E67214F67852} - C:\WINDOWS\System32\hcimdcbl.dll (file missing)
O23 - Service: Bluetooth Service (btwdins) - Unknown owner - C:\Archivos de programa\Conceptronic\Bluetooth Software\bin\btwdins.exe
O23 - Service: C-DillaCdaC11BA - C-Dilla Ltd - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Archivos de programa\Archivos comunes\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Archivos de programa\Archivos comunes\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Archivos de programa\Archivos comunes\Symantec Shared\ccSetMgr.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Archivos de programa\Archivos comunes\EPSON\EBAPI\SAgent2.exe
O23 - Service: Protected Exchange (MainService) - Unknown owner - C:\WINDOWS\System32\nprotect.exe
O23 - Service: Servicio Auto-Protect de Norton AntiVirus (navapsvc) - Symantec Corporation - C:\Archivos de programa\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Archivos de programa\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: SAVScan - Symantec Corporation - C:\Archivos de programa\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\ARCHIV~1\ARCHIV~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Archivos de programa\Archivos comunes\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Archivos de programa\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Archivos de programa\Archivos comunes\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Archivos de programa\Archivos comunes\Symantec Shared\CCPD-LC\symlcsvc.exe





Por lo que he leído, la entrada O20 no tiene buena pinta. ¿Me podeis ayudar a retorcerle el pescuezo al bicho?


Gracias mil.

Me autocontesto. He pasado el Spy Sweeper 4.5 y me ha detectado los bichos...

********
22:17: | Start of Session, viernes, 18 de noviembre de 2005 |
22:17: Spy Sweeper started
22:17: Sweep initiated using definitions version 574
22:17: Found Adware: icannnews
22:17: HKLM\software\microsoft\windows nt\currentversion\winlogon\notify\shareddlls\ || dllname (ID = 359349)
22:17: n44s0eh7eh4.dll (ID = 359349)
22:17: Starting Memory Sweep
22:18: Detected running threat: C:\WINDOWS\system32\puchdprf.dll (ID = 83)
22:18: Detected running threat: C:\WINDOWS\system32\n44s0eh7eh4.dll (ID = 83)
22:19: Memory Sweep Complete, Elapsed Time: 00:01:32
22:19: Starting Registry Sweep
22:19: Found System Monitor: password spectator
22:19: HKLM\software\microsoft\windows\currentversion\uni nstall\password spectator lite\ (9 subtraces) (ID = 136581)
22:19: HKLM\software\microsoft\windows nt\currentversion\winlogon\notify\shareddlls\ (6 subtraces) (ID = 359347)
22:19: Found Trojan Horse: spamrelayer_alpiok
22:19: HKCR\clsid\{7368d5fc-6f5c-4f5b-b964-e67214f67852}\ (3 subtraces) (ID = 913291)
22:19: HKLM\software\microsoft\windows\currentversion\she llserviceobjectdelayload\ || systray.exys (ID = 913416)
22:19: HKLM\software\classes\clsid\{7368d5fc-6f5c-4f5b-b964-e67214f67852}\ (3 subtraces) (ID = 913513)
22:19: Found Adware: dollarrevenue
22:19: HKLM\software\microsoft\drsmartload\ (1 subtraces) (ID = 916795)
22:19: HKU\S-1-5-21-117609710-1993962763-839522115-1003\software\microsoft\windows\currentversion\exp lorer\menuorder\start menu\programs\password spectator lite\ (ID = 754075)
22:19: Registry Sweep Complete, Elapsed Time:00:00:11
22:19: Starting Cookie Sweep
22:19: Found Spy Cookie: yieldmanager cookie
22:19: eny@ad.yieldmanager[1].txt (ID = 3751)
22:19: Cookie Sweep Complete, Elapsed Time: 00:00:00
22:19: Starting File Sweep
22:19: Found Adware: look2me
22:19: u0ru0a99ed.dll (ID = 159)
22:19: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:19: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:19: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:19: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:20: n44s0eh7eh4.dll (ID = 159)
22:21: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:21: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:21: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:21: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:21: puchdprf.dll (ID = 159)
22:22: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:22: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:22: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:22: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:23: oebcjt32.dll (ID = 159)
22:23: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:23: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:23: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:23: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:24: drwsockx.dll (ID = 159)
22:24: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:24: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:24: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:24: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:26: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:26: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:26: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:26: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:27: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:27: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:27: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:27: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:28: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:28: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:28: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:28: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:29: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:29: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:29: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:29: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:30: File Sweep Complete, Elapsed Time: 00:11:36
22:30: Full Sweep has completed. Elapsed time 00:13:27
22:30: Traces Found: 39
22:31: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:31: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:31: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:31: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:32: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:32: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:32: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:32: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:33: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:33: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:33: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:33: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:35: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:35: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:35: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:35: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:36: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:36: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:36: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:36: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:37: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:37: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:37: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:37: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:38: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:38: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:38: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:38: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:38: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:38: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:38: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:38: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:39: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:39: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:39: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:39: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:39: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:39: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:39: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:39: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:39: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:39: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:39: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:39: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:40: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:40: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:40: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:40: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:41: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:41: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:41: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:41: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:41: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:41: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:41: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:41: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:41: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:41: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:41: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:41: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:42: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:42: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:42: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:42: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:42: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:42: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:42: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:42: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:42: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:42: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:42: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:42: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:43: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:43: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:43: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:43: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:43: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:43: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:43: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:43: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:43: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:43: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:43: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:43: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:44: Removal process initiated
22:44: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:44: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:44: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:44: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:45: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:45: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:45: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:45: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:45: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:45: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
22:45: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:45: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
22:45: Quarantining All Traces: icannnews
22:45: icannnews is in use. It will be removed on reboot.
22:45: n44s0eh7eh4.dll is in use. It will be removed on reboot.
22:45: C:\WINDOWS\system32\puchdprf.dll is in use. It will be removed on reboot.
22:45: C:\WINDOWS\system32\n44s0eh7eh4.dll is in use. It will be removed on reboot.
22:45: Quarantining All Traces: look2me
22:45: look2me is in use. It will be removed on reboot.
22:45: u0ru0a99ed.dll is in use. It will be removed on reboot.
22:45: n44s0eh7eh4.dll is in use. It will be removed on reboot.
22:45: puchdprf.dll is in use. It will be removed on reboot.
22:45: Quarantining All Traces: password spectator
22:45: Quarantining All Traces: spamrelayer_alpiok
22:45: Quarantining All Traces: dollarrevenue
22:45: Quarantining All Traces: yieldmanager cookie
22:45: Warning: Launched explorer.exe
22:45: Warning: Quarantine process could not restart Explorer.
22:46: Preparing to restart your computer. Please wait...
22:46: Removal process completed. Elapsed time 00:01:43
********
22:16: | Start of Session, viernes, 18 de noviembre de 2005 |
22:16: Spy Sweeper started
22:16: Messenger service has been disabled.
22:17: Your spyware definitions have been updated.
22:17: | End of Session, viernes, 18 de noviembre de 2005 |



De momento, no saltan más ventanas.




El nuevo log del Hijackthis es este...



Logfile of HijackThis v1.99.1
Scan saved at 22:50:33, on 18/11/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Archivos de programa\Archivos comunes\Symantec Shared\ccSetMgr.exe
C:\Archivos de programa\Archivos comunes\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Archivos de programa\Archivos comunes\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Archivos de programa\Winamp\winampa.exe
C:\Archivos de programa\D-Tools\daemon.exe
C:\ARCHIV~1\WINDOW~4\WScheduler.exe
C:\Archivos de programa\Archivos comunes\Symantec Shared\ccApp.exe
C:\Archivos de programa\Archivos comunes\Symantec Shared\Security Center\UsrPrmpt.exe
C:\Archivos de programa\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Archivos de programa\p2phazard\P2PHazard.exe
C:\Archivos de programa\Conceptronic\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\Archivos de programa\Archivos comunes\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\System32\nprotect.exe
C:\Archivos de programa\Norton AntiVirus\navapsvc.exe
C:\Archivos de programa\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Archivos de programa\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Archivos de programa\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Archivos de programa\Archivos comunes\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Archivos de programa\HJT\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
R3 - Default URLSearchHook is missing
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Archivos de programa\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [WinampAgent] C:\Archivos de programa\Winamp\winampa.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [EPSON Stylus Photo RX420 Series (Copiar 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9 CE.EXE /P42 "EPSON Stylus Photo RX420 Series (Copiar 1)" /O6 "USB001" /M "Stylus Photo RX420"
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Archivos de programa\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [WScheduler] C:\ARCHIV~1\WINDOW~4\WScheduler.exe /LOGON
O4 - HKLM\..\Run: [ccApp] "C:\Archivos de programa\Archivos comunes\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Archivos de programa\Archivos comunes\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\ARCHIV~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [stnospy] C:\Archivos de programa\SinEspias\no-spy.exe /autorun
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [Sin Espias] "C:\Archivos de programa\SinEspias\no-spy.exe" /autorun
O4 - HKLM\..\Run: [SpySweeper] "C:\Archivos de programa\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - Startup: P2PHazard.lnk = C:\Archivos de programa\p2phazard\P2PHazard.exe
O8 - Extra context menu item: + Offline &Explorer: Download the link - file://C:\Archivos de programa\Offline Explorer Enterprise\Add_UrlO.htm
O8 - Extra context menu item: + Offline E&xplorer: Download the current page - file://C:\Archivos de programa\Offline Explorer Enterprise\Add_AllO.htm
O8 - Extra context menu item: Descargar con Net Transport - C:\Archivos de programa\Xi\NetTransport 2\NTAddLink.html
O8 - Extra context menu item: Descargar todo con Net Transport - C:\Archivos de programa\Xi\NetTransport 2\NTAddList.html
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: View Link Source - C:\windows\web\viewsource.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
O16 - DPF: {F78C46AA-052C-40CA-9F75-65C45900070C} - http://www.seagate.com/support/disc/asp/tools/es/bin/npseatools.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{6BA950E3-13A1-433C-BE59-804D59ED7834}: NameServer = 80.58.61.250,80.58.61.254
O17 - HKLM\System\CCS\Services\Tcpip\..\{9C58E8C6-4A12-4393-8D67-D7D8CF076A48}: NameServer = 80.58.61.250,80.58.61.254
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Bluetooth Service (btwdins) - Unknown owner - C:\Archivos de programa\Conceptronic\Bluetooth Software\bin\btwdins.exe
O23 - Service: C-DillaCdaC11BA - C-Dilla Ltd - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Archivos de programa\Archivos comunes\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Archivos de programa\Archivos comunes\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Archivos de programa\Archivos comunes\Symantec Shared\ccSetMgr.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Archivos de programa\Archivos comunes\EPSON\EBAPI\SAgent2.exe
O23 - Service: Protected Exchange (MainService) - Unknown owner - C:\WINDOWS\System32\nprotect.exe
O23 - Service: Servicio Auto-Protect de Norton AntiVirus (navapsvc) - Symantec Corporation - C:\Archivos de programa\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Archivos de programa\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: SAVScan - Symantec Corporation - C:\Archivos de programa\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\ARCHIV~1\ARCHIV~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Archivos de programa\Archivos comunes\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Archivos de programa\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Archivos de programa\Archivos comunes\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Archivos de programa\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Archivos de programa\Archivos comunes\Symantec Shared\CCPD-LC\symlcsvc.exe




Si veis alguna infección, avisad plis

Hola Slayyer

Ejecuta el hijackthis y con todos lo programas cerrados marca las siguientes entradas y pulsa en FIX Checked:

R3 - Default URLSearchHook is missing
O4 - HKLM\..\Run: [stnospy] C:\Archivos de programa\SinEspias\no-spy.exe /autorun
O8 - Extra context menu item: View Link Source - C:\windows\web\viewsource.html

O16 - DPF: {F78C46AA-052C-40CA-9F75-65C45900070C} - http://www.seagate.com/support/disc/asp/tools/es/bin/npseatools.cab

Sin reiniciar,busca y elimina estos archivos/carpetas.Utiliza el KillBox si no puedes eliminarlos.

Le vas poniendo que NO a reiniciar hasta que pongas el ultimo y ahi le pones que SI para que reinicie y elimine estos archivos infectados.

C:\Archivos de programa\SinEspias\no-spy.exe /autorun
C:\windows\web\viewsource.html

Pasa estas herramientas:

*Spybot S.D. y el manual y te inmunidizas.

*Disk Cleaner para limpiar cookis y temporales

* RegSeeker para limpiar el registro y su manual pasalo varias veces hasta q ya no te salga nada.

Y te instalas el *SpywareBlaster 3.4 manual

Reinicia

Y nos cuentas los resultados

saludos

Logfile of HijackThis v1.99.1
Scan saved at 21:19:04, on 21/11/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Archivos de programa\Archivos comunes\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Archivos de programa\Archivos comunes\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Archivos de programa\Archivos comunes\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Archivos de programa\Winamp\winampa.exe
C:\Archivos de programa\D-Tools\daemon.exe
C:\ARCHIV~1\WINDOW~4\WScheduler.exe
C:\Archivos de programa\Archivos comunes\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Archivos de programa\p2phazard\P2PHazard.exe
C:\Archivos de programa\Conceptronic\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\Archivos de programa\Archivos comunes\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\System32\nprotect.exe
C:\Archivos de programa\Norton AntiVirus\navapsvc.exe
C:\Archivos de programa\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Archivos de programa\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Archivos de programa\Archivos comunes\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Archivos de programa\HJT\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARCHIV~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Archivos de programa\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [WinampAgent] C:\Archivos de programa\Winamp\winampa.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [EPSON Stylus Photo RX420 Series (Copiar 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9 CE.EXE /P42 "EPSON Stylus Photo RX420 Series (Copiar 1)" /O6 "USB001" /M "Stylus Photo RX420"
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Archivos de programa\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [WScheduler] C:\ARCHIV~1\WINDOW~4\WScheduler.exe /LOGON
O4 - HKLM\..\Run: [ccApp] "C:\Archivos de programa\Archivos comunes\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Archivos de programa\Archivos comunes\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\ARCHIV~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - Startup: P2PHazard.lnk = C:\Archivos de programa\p2phazard\P2PHazard.exe
O8 - Extra context menu item: + Offline &Explorer: Download the link - file://C:\Archivos de programa\Offline Explorer Enterprise\Add_UrlO.htm
O8 - Extra context menu item: + Offline E&xplorer: Download the current page - file://C:\Archivos de programa\Offline Explorer Enterprise\Add_AllO.htm
O8 - Extra context menu item: Descargar con Net Transport - C:\Archivos de programa\Xi\NetTransport 2\NTAddLink.html
O8 - Extra context menu item: Descargar todo con Net Transport - C:\Archivos de programa\Xi\NetTransport 2\NTAddList.html
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: View Link Source - C:\windows\web\viewsource.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1132390817345
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{6BA950E3-13A1-433C-BE59-804D59ED7834}: NameServer = 80.58.61.250,80.58.61.254
O17 - HKLM\System\CCS\Services\Tcpip\..\{9C58E8C6-4A12-4393-8D67-D7D8CF076A48}: NameServer = 80.58.61.250,80.58.61.254
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Bluetooth Service (btwdins) - Unknown owner - C:\Archivos de programa\Conceptronic\Bluetooth Software\bin\btwdins.exe
O23 - Service: C-DillaCdaC11BA - C-Dilla Ltd - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Archivos de programa\Archivos comunes\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Archivos de programa\Archivos comunes\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Archivos de programa\Archivos comunes\Symantec Shared\ccSetMgr.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Archivos de programa\Archivos comunes\EPSON\EBAPI\SAgent2.exe
O23 - Service: Protected Exchange (MainService) - Unknown owner - C:\WINDOWS\System32\nprotect.exe
O23 - Service: Servicio Auto-Protect de Norton AntiVirus (navapsvc) - Symantec Corporation - C:\Archivos de programa\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Archivos de programa\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: SAVScan - Symantec Corporation - C:\Archivos de programa\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\ARCHIV~1\ARCHIV~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Archivos de programa\Archivos comunes\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Archivos de programa\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Archivos de programa\Archivos comunes\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Archivos de programa\Archivos comunes\Symantec Shared\CCPD-LC\symlcsvc.exe


Ese es el resultado. Confirmo que ya no me saltan ventanas

La entrada O8 no la borré porque eso lo instalé yo, no es ninguna infección


Gracias

Hola Slayyer

No hay ya entradas sospechosas,pero lo q si tienes q hacer es actualizar tu s.o. y el explore.

Damos el tema por solucionado.

saludos