Foro de InfoSpyware - Foro de Hijackthis - Foro de Virus

Hola, tengo un problema que ya he visto han solucionado en varias ocasiones de Spyware, fondo rojo con mesaje de virus, continuos pop-ups y mensajes de virus y un mensaje VIRUS ALERT! junto al reloj
Este es el log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:07: VIRUS ALERT!, on 27/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\USBMonit.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.forospyware.com/
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Gene USB Monitor] C:\WINDOWS\system32\USBMonit.exe
O4 - HKLM\..\Run: [Client Access Service] "C:\Program Files\IBM\Client Access\cwbsvstr.exe"
O4 - HKLM\..\Run: [Client Access PC5250 Sound] "C:\Program Files\IBM\Client Access\Emulator\pcssnd.exe"
O4 - HKLM\..\Run: [Client Access Help Update] "C:\Program Files\IBM\Client Access\cwbinhlp.exe"
O4 - HKLM\..\Run: [Client Access Express Welcome] "C:\Program Files\IBM\Client Access\cwbwlwiz.exe"
O4 - HKLM\..\Run: [Client Access Check Version] "C:\Program Files\IBM\Client Access\cwbckver.exe" LOGIN
O4 - HKLM\..\Run: [64cbe8dc] rundll32.exe "C:\WINDOWS\system32\npngbkbt.dll",b
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICIO LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Servicio de red')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Pol icies\System, DisableRegedit=1
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/spanish/kavwebscan_unicode.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1140098272890
O17 - HKLM\System\CCS\Services\Tcpip\..\{496F0DE7-A464-45CA-B866-CE353B3B78FA}: NameServer = 192.168.0.90,192.168.0.91
O21 - SSODL: vltdfabw - {658ED220-B9E1-4381-97C2-EC10FBB84D4E} - C:\WINDOWS\vltdfabw.dll
O21 - SSODL: vregfwlx - {7093C4A2-059E-4605-974D-7A55EE140932} - C:\WINDOWS\vregfwlx.dll
O21 - SSODL: RamCD - {03859cf3-a8b2-41b6-a823-a06e4a412384} - C:\WINDOWS\Resources\RamCD.dll
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Servicio de registro de McAfee (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe

--
End of file - 5133 bytes

Hola Mardigan, te doy la bienvenida al Foro de InfoSpyware.

Paso 1- Descarga, Instala y/o actualiza estas herramientas: (pero no los ejecutes aun)

• ComboFix.exe
• Malwarebytes' Anti-Malware

Paso 2- Con todos los programas cerrados, ejecuta HijackThis y dale a las siguientes entradas:


O4 - HKLM\..\Run: [64cbe8dc] rundll32.exe "C:\WINDOWS\system32\npngbkbt.dll",b

O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Pol icies\System, DisableRegedit=1

O21 - SSODL: vltdfabw - {658ED220-B9E1-4381-97C2-EC10FBB84D4E} - C:\WINDOWS\vltdfabw.dll

O21 - SSODL: vregfwlx - {7093C4A2-059E-4605-974D-7A55EE140932} - C:\WINDOWS\vregfwlx.dll




Paso 3- Ejecuta estas herramientas, de a una:

• Malwarebytes' Anti-Malware
  *Nota* Es importante que envíes a "Cuarentena" todo lo que este detecte antes de copiar y pegarnos su reporte.

• Antes de usar ComboFix....
• Desactiva temporalmente el Antivirus y/o Antispyware.
• Cierra todas las ventanas abiertas.
• Hacele doble clic al archivo ComboFix.exe y seguí las instrucciones.
• Cuando termine, generara un registro en C:\ComboFix.txt.
  • *Nota* Mientras CF este trabajando no mover el mouse ya que pararía su proceso.
  • *Nota* ComboFix puede reiniciar automáticamente el PC para completar el proceso de eliminación.

Paso 4- Descarga CCleaner y ejecútalo usando primero su opción de "Limpiador" para borrar cookies, temporales de Internet y todos los archivos que este te muestre como obsoletos, y luego usa su opción de "Registro" para limpiar todo el registro de Windows (haciendo copia de seguridad).

Reinicia y nos contas los resultados. junto con el reporte de

Paso 5- Reinicia en modo normal y nos dejas los reportes de:

• Malwarebytes' Anti-Malware
• C:\ComboFix.txt en este mismo mensaje.

**Nota**
- Para mayor comodidad imprime los pasos.
- Recuerda regresar y contarnos los resultados.

Salu2

Muchísimas gracias
no me lo podía creer, todo perfecto, salvo una cosilla, no puedo apagar el equipo
de la forma ortodoxa, cuando pulso apagar equipo se queda una aplicación colgada llamada Sysfader (si me decís como solucionar esto ya sería la bomba), por lo demás todo perfecto...
Os dejo aquí los informes solicitados

Malwarebytes' Anti-Malware 1.12
Versión de la Base de Datos: 722

Tipo de examen : Examen Rápido
Objetos examinados: 38626
Tiempo transcurrido: 7 minute(s), 33 second(s)

Procesos en Memoria Infectados: 0
Módulos en Memoria Infectados: 0
Claves del Registro Infectadas: 6
Valores del Registro Infectados: 1
Elementos de Datos del Registro Infectados: 0
Carpetas Infectadas: 2
Ficheros Infectados: 19

Procesos en Memoria Infectados:
(No se han detectado elementos maliciosos)

Módulos en Memoria Infectados:
(No se han detectado elementos maliciosos)

Claves del Registro Infectadas:
HKEY_CLASSES_ROOT\CLSID\{03859cf3-a8b2-41b6-a823-a06e4a412384} (Trojan.Clicker) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

Valores del Registro Infectados:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\ShellServiceObjectDelayLoad\RamCD (Trojan.Clicker) -> Quarantined and deleted successfully.

Elementos de Datos del Registro Infectados:
(No se han detectado elementos maliciosos)

Carpetas Infectadas:
C:\WINDOWS\privacy_danger (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\privacy_danger\images (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Ficheros Infectados:
C:\WINDOWS\system32\fofwpksc.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\cskpwfof.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\privacy_danger\index.htm (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\privacy_danger\images\capt.gif (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\privacy_danger\images\danger.jpg (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\privacy_danger\images\down.gif (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\privacy_danger\images\spacer.gif (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\Resources\RamCD.dll (Trojan.Clicker) -> Quarantined and deleted successfully.
C:\Program Files\tmp105000.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Program Files\tmp105015.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrator\Favorites\Error Cleaner.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrator\Favorites\Privacy Protector.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrator\Favorites\Spyware&Malware Protection.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\JMART\Desktop\Spyware&Malware Protection.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\JMART\Desktop\Privacy Protector.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\JMART\Desktop\Error Cleaner.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\JMART\Favorites\Error Cleaner.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\JMART\Favorites\Privacy Protector.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\JMART\Favorites\Spyware&Malware Protection.url (Rogue.Link) -> Quarantined and deleted successfully.

ComboFix 08-05-27.4 - Administrator 2008-05-28 9:38:49.1 - NTFSx86 MINIMAL
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.806 [GMT 2:00]
Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Start Menu\Programs\BulletProofSoft.com
C:\Documents and Settings\All Users\Start Menu\Programs\BulletProofSoft.com\BPS Spyware Remover\BPS Spyware-Adware Remover.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\BulletProofSoft.com\BPS Spyware Remover\Help.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\BulletProofSoft.com\BPS Spyware Remover\Uninstall.lnk
C:\Documents and Settings\JMART\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus-2008pro.lnk
C:\Program Files\BulletProofSoft.com
C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\Box.bps
C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\Core.dll
C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\DataBase.ini
C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\DB.bps
C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\DB1.bps
C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\DB2.bps
C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\DB3.bps
C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\DB4.bps
C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\DB5.bps
C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\English.inf
C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\English.jpg
C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\Errors.txt
C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\Espanol.inf
C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\Espanol.jpg
C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\Francais.inf
C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\Francais.jpg
C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\guard.bps
C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\Help.chm
C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\home.bps
C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\hosts
C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\Italiano.inf
C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\Italiano.jpg
C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\Mask.skn
C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\Purchase.bps
C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\Scan Session.txt
C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\Splash.spl
C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\SpyRem.exe
C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\unins000.dat
C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\unins000.exe
C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\update.cli
C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\update.exe
C:\WINDOWS\atfxqogp.dll
C:\WINDOWS\boqnrwdmkrs.dll
C:\WINDOWS\system32\818646
C:\WINDOWS\system32\818646\818646.dll
C:\WINDOWS\system32\bjdjpumk.ini
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\regsvr.exe
C:\WINDOWS\system32\tbkbgnpn.ini
C:\WINDOWS\system32\UDcIOXbc.ini
C:\WINDOWS\system32\UDcIOXbc.ini2
C:\WINDOWS\vltdfabw.dll
C:\WINDOWS\vregfwlx.dll
C:\WINDOWS\xmpstean.exe

.
((((((((((((((((((((((((( Files Created from 2008-04-28 to 2008-05-28 )))))))))))))))))))))))))))))))
.

2008-05-27 15:18 . 2008-05-27 15:20 <DIR> d-------- C:\Escritorio
2008-05-27 13:41 . 2008-05-27 15:11 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-05-27 13:15 . 2008-04-27 17:33 <DIR> d-------- C:\Program Files\DelPSGuard
2008-05-27 12:59 . 2008-05-27 12:59 <DIR> d-------- C:\Program Files\Trend Micro
2008-05-27 12:28 . 2008-04-28 08:15 <DIR> d-------- C:\cuarentena
2008-05-27 09:38 . 2008-05-27 09:47 7,680 --ahs---- C:\WINDOWS\Thumbs.db
2008-05-26 20:18 . 2008-04-28 08:14 <DIR> d-------- C:\Documents and Settings\JMART\Application Data\TmpRecentIcons
2008-05-26 18:23 . 2008-05-26 15:23 94,208 --a------ C:\WINDOWS\edma.exe
2008-05-14 10:32 . 2008-05-14 10:32 <DIR> d-------- C:\Program Files\HachaPro
2008-05-06 16:53 . 2008-05-27 11:27 256 --a------ C:\WINDOWS\RENT2007.INI
2008-04-28 09:26 . 2008-04-28 09:26 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-04-28 09:26 . 2008-04-28 09:26 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-04-28 09:26 . 2008-04-28 09:26 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Malwarebytes
2008-04-28 09:26 . 2008-05-05 20:46 27,048 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-04-28 09:26 . 2008-05-05 20:46 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-04-28 08:45 . 2008-04-28 08:45 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\TmpRecentIcons

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2008-05-27 11:32 --------- d-----w C:\Program Files\Winamp
2008-05-27 10:56 --------- d-----w C:\Program Files\GNU
2008-05-27 09:29 --------- d-----w C:\Program Files\URUSoft
2008-05-27 09:28 --------- d-----w C:\Program Files\AviSynth 2.5
2008-05-27 07:40 --------- d-----w C:\Program Files\NCH Swift Sound
2008-05-27 07:39 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-27 07:39 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-05-27 04:00 --------- d-----w C:\Program Files\Soulseek
2008-05-13 10:28 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-04-28 06:29 --------- d-----w C:\Program Files\ESET
2008-04-27 15:47 512,096 ----a-w C:\WINDOWS\system32\drivers\amon.sys
2008-04-27 15:47 15,424 ----a-w C:\WINDOWS\system32\drivers\nod32drv.sys
2008-04-27 15:36 --------- d-----w C:\Program Files\Yahoo!
2008-04-27 15:36 --------- d-----w C:\Program Files\Google
2008-04-27 15:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-04-27 15:08 --------- d-----w C:\Program Files\Lavasoft
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{29625431-52CE-45BF-9882-9008B56CE76B}]
C:\WINDOWS\system32\cbXOIcDU.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BCBEB0EB-744A-4F05-99A5-636B721C318E}]
C:\WINDOWS\system32\efcCssQg.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 08:00 15360]
"BPS Spyware Remover"="C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\SpyRem.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 15:42 1404928]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-09-20 11:35 94208]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-09-20 11:36 114688]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-09-20 11:32 77824]
"Gene USB Monitor"="C:\WINDOWS\system32\USBMonit.exe" [2006-05-06 13:18 36864]
"Client Access Service"="C:\Program Files\IBM\Client Access\cwbsvstr.exe" [2005-03-04 06:30 20530]
"Client Access PC5250 Sound"="C:\Program Files\IBM\Client Access\Emulator\pcssnd.exe" [2005-03-04 06:30 40960]
"Client Access Help Update"="C:\Program Files\IBM\Client Access\cwbinhlp.exe" [2005-03-04 06:30 24626]
"Client Access Express Welcome"="C:\Program Files\IBM\Client Access\cwbwlwiz.exe" [2005-03-04 06:30 20480]
"Client Access Check Version"="C:\Program Files\IBM\Client Access\cwbckver.exe" [2005-03-04 06:30 45056]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2008-04-27 17:47 949376]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 08:00 15360]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-11-08 11:55:33 110592]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\policies\system]
"dontdisplaylockeduserid"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source= file:///C:\WINDOWS\privacy_danger\index.htm
FriendlyName= Privacy Protection

[hkey_local_machine\software\microsoft\windows\curr entversion\explorer\shellexecutehooks]
"{BCBEB0EB-744A-4F05-99A5-636B721C318E}"= C:\WINDOWS\system32\efcCssQg.dll [ ]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\efcCssQg]
efcCssQg.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.divxa32"= msaud32_divx.acm
"VIDC.YV12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\group policy\state\S-1-5-21-172240133-2049398255-165283079-10954\Scripts\Logon\0\0]
"Script"=screenid.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\group policy\state\S-1-5-21-172240133-2049398255-165283079-10954\Scripts\Logon\1\0]
"Script"=eblogin.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\group policy\state\S-1-5-21-172240133-2049398255-165283079-22466\Scripts\Logon\0\0]
"Script"=screenid.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\group policy\state\S-1-5-21-172240133-2049398255-165283079-22466\Scripts\Logon\1\0]
"Script"=eblogin.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\group policy\state\S-1-5-21-172240133-2049398255-165283079-22466\Scripts\Logon\2\0]
"Script"=eblogin.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\group policy\state\S-1-5-21-172240133-2049398255-165283079-72851\Scripts\Logon\0\0]
"Script"=screenid.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\group policy\state\S-1-5-21-172240133-2049398255-165283079-72851\Scripts\Logon\1\0]
"Script"=eblogin.bat

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\64cbe8dc]
C:\WINDOWS\system32\fofwpksc.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Network Associates Error Reporting Service]
--a------ 2003-10-07 10:48 147514 C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ShStatEXE]
--a------ 2004-09-22 21:00 94208 C:\Program Files\Network Associates\VirusScan\SHSTAT.exe

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=

S3 ASPI;Advanced SCSI Programming Interface Driver;C:\WINDOWS\System32\DRIVERS\ASPI32.sys [2002-07-17 10:05]
S3 MBAMCatchMe;MBAMCatchMe;C:\WINDOWS\system32\driver s\mbamcatchme.sys [2008-05-05 20:46]

[HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{8aaa71bd-e8c6-11db-8901-0014225291a7}]
\Shell\AutoRun\command - E:\LaunchU3.exe

*Newly Created Service* - ENTDRV51
.
************************************************** ************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-28 09:43:29
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

************************************************** ************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\lsass.exe
-> C:\Program Files\Eset\pr_imon.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\ESET\nod32krn.exe
C:\WINDOWS\system32\WgaTray.exe
.
************************************************** ************************
.
Completion time: 2008-05-28 9:47:28 - machine was rebooted [JMART]
ComboFix-quarantined-files.txt 2008-05-28 07:47:20

Pre-Run: 2,739,310,592 bytes free
Post-Run: 2,660,069,376 bytes free

195 --- E O F --- 2008-05-21 01:01:41
1996-03-22 13:58 7216 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\REGSVR.EXE .vir
2002-11-20 23:01 700416 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\update.exe.vir
2004-12-02 13:57 222720 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\Splash.spl.vir
2005-09-24 15:23 663 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\English.jpg.vir
2006-02-16 11:06 38048 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\update.cli.vir
2006-03-06 17:51 576730 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\Help.chm.vir
2006-03-09 05:23 13093 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\Espanol.jpg.vir
2006-03-09 05:25 13151 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\Francais.jpg.vir
2006-03-15 04:28 45392 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\Box.bps.vir
2006-03-15 05:23 61208 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\Purchase.bps.vir
2006-03-19 02:42 768 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\Italiano.jpg.vir
2006-04-04 08:53 95329 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\guard.bps.vir
2006-04-09 14:48 1661106 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\Mask.skn.vir
2006-06-05 06:38 512731 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\home.bps.vir
2006-08-17 15:27 47214 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\Espanol.inf.vir
2006-08-17 15:28 48314 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\Francais.inf.vir
2006-08-17 15:29 50088 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\Italiano.inf.vir
2006-08-17 16:09 774144 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\Core.dll.vir
2006-08-17 16:11 21652 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\English.inf.vir
2006-08-17 16:32 6880 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\DB.bps.vir
2006-09-18 15:19 606208 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\SpyRem.exe.vir
2008-04-27 18:01 635401 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\unins000.exe.vir
2008-04-27 18:02 829 --a------ C:\Qoobox\Quarantine\C\Documents and Settings\All Users\Start Menu\Programs\BulletProofSoft.com\BPS Spyware Remover\Help.lnk.vir
2008-04-27 18:02 841 --a------ C:\Qoobox\Quarantine\C\Documents and Settings\All Users\Start Menu\Programs\BulletProofSoft.com\BPS Spyware Remover\BPS Spyware-Adware Remover.lnk.vir
2008-04-27 18:02 8510 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\unins000.dat.vir
2008-04-27 18:02 853 --a------ C:\Qoobox\Quarantine\C\Documents and Settings\All Users\Start Menu\Programs\BulletProofSoft.com\BPS Spyware Remover\Uninstall.lnk.vir
2008-04-28 08:18 179587 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\UDcIOXbc.i ni2.vir
2008-04-28 08:19 179689 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\UDcIOXbc.i ni.vir
2008-04-28 08:53 145 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\Scan Session.txt.vir
2008-04-28 08:53 151 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\DataBase.ini.vir
2008-04-28 08:53 4018 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\Errors.txt.vir
2008-04-28 08:53 686 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\hosts.vir
2008-05-25 11:39 706512 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\DB1.bps.vir
2008-05-25 11:56 751152 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\DB2.bps.vir
2008-05-25 12:05 759040 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\DB3.bps.vir
2008-05-25 12:41 651264 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\DB4.bps.vir
2008-05-25 12:46 341840 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\DB5.bps.vir
2008-05-26 15:22 180224 --a------ C:\Qoobox\Quarantine\C\WINDOWS\vregfwlx.dll.vir
2008-05-26 15:22 229376 --a------ C:\Qoobox\Quarantine\C\WINDOWS\vltdfabw.dll.vir
2008-05-26 15:23 155648 --a------ C:\Qoobox\Quarantine\C\WINDOWS\atfxqogp.dll.vir
2008-05-26 15:23 221184 --a------ C:\Qoobox\Quarantine\C\WINDOWS\boqnrwdmkrs.dll.vir
2008-05-26 15:23 81920 --a------ C:\Qoobox\Quarantine\C\WINDOWS\xmpstean.exe.vir
2008-05-26 18:31 1163016 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\bjdjpumk.i ni.vir
2008-05-27 00:24 13824 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\818646\818 646.dll.vir
2008-05-27 09:27 781 --a------ C:\Qoobox\Quarantine\C\Documents and Settings\JMART\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus-2008pro.lnk.vir
2008-05-27 14:55 143 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\mcrh.tmp.v ir
2008-05-27 15:38 1164036 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\tbkbgnpn.i ni.vir
2008-05-28 09:40 54 --a------ C:\Qoobox\Quarantine\catchme.log



De nuevo muchas gracias, por todo...

Hola, ComboFix detecto y elimino ya algunos Malwares, pero todavía le quedaron algunas cosas para sacar siguiendo estos pasos:

A) - Abrir el Notepad (Bloc de Notas)

• Ir a INICIO > EJECUTAR >
• Y ahí pones notepad.exe y ACEPTAR

B) - Ahora copia y pega estos archivos dentro del Notepad

C) - Graba este archivo con el nombre CFScript.txt y déjalo en tu escritorio.

D) - Arrastrar y soltar el archivo CFScript.txt dentro del archivo ComboFix.exe como lo muestra la animación de abajo. Esto activara ComboFix nuevamente.

• Reinicia tu PC y nos dejas un el nuevo reporte de ComboFix, comentándonos como esta funcionado todo actualmente?

Salu2

¿Tengo que hacer esta última operación en el modo seguro o a prueba de fallos?

Hola, no siempre en modo normal a menos que se marque lo contrario.

Salu2