Foro de InfoSpyware - Foro de Hijackthis - Foro de Virus

Hola gallinita con el permiso de mi compañero Suerte realiza el siguiente procedimiento:

* Descarga RKill by Grinler del siguiente enlace: Download Link # 1.
* Guárdelo en su escritorio.
* Haga doble clic en el icono del escritorio RKill.
Si está utilizando Vista, haga clic derecho y ejecutar como Administrador!
* Una pantalla en negro se iluminará brevemente en lo que indica una ejecución exitosa.
* Si esto no ocurre por favor elimine la aplicación y descarguela nuevamente desde el enlace de descarga # 2.
* Continuar el proceso hasta que la herramienta se ejecute.
* Si la herramienta no se ejecuta desde cualquiera de los enlaces informar al respecto.

Una vez realizado esto intenta ejecutar nuevamente fs-fixbagle como lo indica su manual: Manual de FS-FixBagle

Nos comentas los resultados.

Gracias por las ayudas hay muy buena gente por aqui.
aqui esta el reporte


DDS (Ver_09-10-26.01) - NTFSx86
Run by silvia at 16:15:14,48 on 03/11/2009
Internet Explorer: 8.0.6001.18828 BrowserJavaVersion: 1.6.0_15
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.34.3082.18.2038.927 [GMT 1:00]

AV: Kaspersky Internet Security *On-access scanning enabled* (Outdated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
SP: Lavasoft Ad-Watch Live! *disabled* (Updated) {67844DAE-4F77-4D69-9457-98E8CFFDAA22}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
SP: Kaspersky Internet Security *enabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *enabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}

============== Running Processes ===============

C:\Windows\SYSTEM32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe
C:\Program Files\AskBarDis\bar\bin\AskService.exe
C:\Program Files\AskBarDis\bar\bin\ASKUpgrade.exe
C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.e xe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\TUProgSt.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\SYSTEM32\taskeng.exe
C:\Windows\SYSTEM32\taskeng.exe
C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Windows\System32\mobsync.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\WindowsMobile\wmdSync.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\svchost.exe -k WindowsMobile
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\wbem\unsecapp.exe
c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\hp\kbd\kbd.exe
C:\Windows\system32\DllHost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\explorer.exe
C:\Users\silvia\Desktop\dds.pif
C:\Windows\system32\conime.exe
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://google.es/
uWindow Title = Microsoft Internet Explorer
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=ES_ES&c=74&bd=Presario &pf=desktop
mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=ES_ES&c=74&bd=Presario &pf=desktop
uInternet Settings,ProxyOverride = local
BHO: Google Plus: {01677b4b-0610-4814-94a0-5f570dd7a88f} - c:\progra~1\google~1\17GOOG~1.DLL
BHO: Aplicación auxiliar de vínculos de Adobe PDF Reader: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
BHO: Windows Live Aplicación auxiliar de inicio de sesión: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: {B88F0A3B-663C-4342-A7CE-2D6F81032897} - No File
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
TB: {3041d03e-fd4b-44e0-b742-2d9b88305f98} - No File
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
TB: {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No File
TB: {FE063DB9-4EC0-403E-8DD8-394C54984B2C} - No File
TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [PC Suite Tray] "c:\program files\nokia\nokia pc suite 7\PCSuite.exe" -onlytray
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [EA Core] "c:\program files\electronic arts\eadm\Core.exe" -silent
uRun: [uTorrent] "c:\program files\utorrent\uTorrent.exe"
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
uRun: [flec003.exe] c:\users\silvia\appdata\roaming\hidires\flec003.ex e
mRun: [hpsysdrv] "c:\hp\support\hpsysdrv.exe"
mRun: [KBD] "c:\hp\kbd\KbdStub.EXE"
mRun: [OsdMaestro] "c:\program files\hewlett-packard\on-screen osd indicator\OSD.exe"
mRun: [RtHDVCpl] "RtHDVCpl.exe"
mRun: [NeroFilterCheck] "c:\program files\common files\nero\lib\NeroCheck.exe"
mRun: [HP Software Update] "c:\program files\hp\hp software update\HPWuSchd2.exe"
mRun: [IgfxTray] "c:\windows\system32\igfxtray.exe"
mRun: [HotKeysCmds] "c:\windows\system32\hkcmd.exe"
mRun: [Persistence] "c:\windows\system32\igfxpers.exe"
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [IAAnotif] "c:\program files\intel\intel matrix storage manager\Iaanotif.exe"
mRun: [Windows Mobile-based device management] "%windir%\WindowsMobile\wmdSync.exe"
mRun: [Ad-Watch] c:\program files\lavasoft\ad-aware\AAWTray.exe
mRun: [CamserviceDP] c:\program files\hercules\dualpix exchange\Camservice.exe /startup
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
mRunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
StartupFolder: c:\users\silvia\appdata\roaming\micros~1\windows\s tartm~1\programs\startup\realma~1.lnk - c:\program files\realmadrid\widget\realmadrid\Realmadrid.exe
StartupFolder: c:\users\silvia\appdata\roaming\micros~1\windows\s tartm~1\programs\startup\recort~1.lnk - c:\program files\microsoft office\office12\ONENOTEM.EXE
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: EnableLUA = 0 (0x0)
dPolicies-system: disableregistrytoosl = 0 (0x0)
IE: {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe
IE: {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1}
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
LSP: c:\program files\contraviro\siglsp.dll
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos-beta/OnlineScanner.cab
Notify: igfxcui - igfxdev.dll

================= FIREFOX ===================

FF - ProfilePath - c:\users\silvia\appdata\roaming\mozilla\firefox\pr ofiles\6cydmx1r.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - prefs.js: browser.search.selectedEngine - Google Search Community
FF - prefs.js: browser.startup.homepage - hxxp://google.es
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - component: c:\program files\mozilla firefox\components\GooglePlusVideosXPCOM.dll
FF - component: c:\program files\mozilla firefox\components\SuperSearchXPCOM.dll
FF - plugin: c:\program files\microsoft\office live\npOLW.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npOGAPlugin.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npracplug.dll
FF - plugin: c:\program files\real\realarcade\plugins\mozilla\npracplug.dl l
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-4-27 64160]
R1 sK9Ou0s;sK9Ou0s;c:\windows\system32\srosa2.sys [2009-11-2 7168]
R1 tdifw_drv;tdifw_drv;c:\windows\system32\drivers\td ifw_drv.sys [2009-9-12 23552]
R2 AdobeActiveFileMonitor7.0;Adobe Active File Monitor V7;c:\program files\adobe\photoshop elements 7.0\PhotoshopElementsFileAgent.exe [2008-9-16 169312]
R2 ASKService;ASKService;c:\program files\askbardis\bar\bin\AskService.exe [2009-3-22 464264]
R2 ASKUpgrade;ASKUpgrade;c:\program files\askbardis\bar\bin\ASKUpgrade.exe [2009-3-22 234888]
R2 DQLWinService;DQLWinService;c:\program files\common files\intel\inteldh\nms\adpplugins\DQLWinService.e xe [2006-9-3 208896]
R2 SeaPort;SeaPort;c:\program files\microsoft\search enhancement pack\seaport\SeaPort.exe [2009-5-19 240512]
R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\system32\TUProgSt.exe [2009-5-9 604488]
R3 camfilt2;camfilt2;c:\windows\system32\drivers\camf ilt2.sys [2009-5-19 94208]
S2 IntelDHSvcConf;Intel DH Service;c:\program files\intel\inteldh\intel media server\tools\IntelDHSvcConf.exe [2006-5-10 29696]
S2 kdcom32;Kernel Debugger HW Extension DLL;rundll32.exe c:\windows\system32\kdcom32.dll,ozyp --> rundll32.exe c:\windows\system32\kdcom32.dll,ozyp [?]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-1-18 1028432]
S3 fssfltr;FssFltr;c:\windows\system32\drivers\fssflt r.sys [2009-10-3 54632]
S3 fsssvc;Servicio de Windows Live Protección infantil;c:\program files\windows live\family safety\fsssvc.exe [2009-8-5 704864]

=============== Created Last 30 ================

2009-11-02 22:00:31 0 d-s---w- C:\Combo--fix
2009-11-02 21:48:46 0 d-----w- c:\programdata\Kaspersky Lab Setup Files
2009-11-02 17:53:10 0 d--h--w- c:\users\silvia\appdata\roaming\m
2009-11-02 17:36:08 0 d-----w- c:\program files\Skyler Lyon
2009-11-02 15:23:51 0 d--h--w- c:\users\silvia\appdata\roaming\drivers
2009-11-02 15:06:24 0 d-----w- C:\_QBagle
2009-11-02 14:46:50 7168 ----a-w- c:\windows\system32\srosa2.sys
2009-11-02 12:11:28 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-11-02 12:11:26 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-11-02 00:46:33 0 d-----w- c:\programdata\WindowsSearch
2009-11-01 14:57:12 72704 ----a-w- c:\windows\system32\admparse.dll
2009-11-01 14:38:47 0 d-----w- c:\users\silvia\DoctorWeb
2009-10-31 15:05:36 0 d-----w- c:\windows\system32\EventProviders
2009-10-31 14:55:18 0 d--h--w- c:\windows\system32\GroupPolicy
2009-10-29 05:48:33 2421760 ----a-w- c:\windows\system32\wucltux.dll
2009-10-29 05:48:19 87552 ----a-w- c:\windows\system32\wudriver.dll
2009-10-29 05:48:13 33792 ----a-w- c:\windows\system32\wuapp.exe
2009-10-29 05:48:13 171608 ----a-w- c:\windows\system32\wuwebv.dll
2009-10-28 11:39:09 310784 ----a-w- c:\windows\system32\unregmp2.exe
2009-10-28 11:39:06 8147456 ----a-w- c:\windows\system32\wmploc.DLL
2009-10-25 15:53:12 0 d-----w- c:\users\silvia\appdata\roaming\Big Fish Games
2009-10-21 22:04:25 0 d-----w- c:\windows\Treasure Masters Inc
2009-10-19 19:15:47 0 d-----w- c:\users\silvia\appdata\roaming\YoudaGames
2009-10-19 19:02:28 0 d-----w- c:\users\silvia\appdata\roaming\TMInc
2009-10-18 21:39:43 0 d-----w- c:\users\silvia\appdata\roaming\V-Games
2009-10-18 15:24:13 0 d-----w- c:\users\silvia\appdata\roaming\Artogon
2009-10-18 00:06:26 0 d-----w- c:\users\silvia\appdata\roaming\Lost in the City
2009-10-17 00:25:00 0 d-----w- c:\users\silvia\appdata\roaming\BloodTies
2009-10-16 00:18:30 0 d-----w- c:\users\silvia\uspy
2009-10-15 23:14:23 0 d-----w- c:\program files\GooglePlusVideos
2009-10-15 16:38:33 213504 ----a-w- c:\windows\system32\msv1_0.dll
2009-10-15 16:38:14 3597896 ----a-w- c:\windows\system32\ntkrnlpa.exe
2009-10-15 16:38:13 3546184 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-10-15 16:38:03 428544 ----a-w- c:\windows\system32\EncDec.dll
2009-10-15 16:38:03 217088 ----a-w- c:\windows\system32\psisrndr.ax
2009-10-15 16:38:01 80896 ----a-w- c:\windows\system32\MSNP.ax
2009-10-15 16:38:01 293376 ----a-w- c:\windows\system32\psisdecd.dll
2009-10-15 16:38:01 177664 ----a-w- c:\windows\system32\mpg2splt.ax
2009-10-15 16:37:50 61440 ----a-w- c:\windows\system32\msasn1.dll
2009-10-15 16:37:49 144896 ----a-w- c:\windows\system32\drivers\srv2.sys
2009-10-15 16:37:46 604672 ----a-w- c:\windows\system32\WMSPDMOD.DLL
2009-10-08 21:13:47 140800 ----a-w- c:\windows\system32\MSCMCES.DLL
2009-10-08 21:13:47 101888 ----a-w- c:\windows\system32\VB6STKIT.DLL
2009-10-08 21:13:46 33280 ----a-w- c:\windows\system32\CMDLGES.DLL
2009-10-08 21:13:46 119568 ------w- c:\windows\system32\VB6es.DLL
2009-10-04 17:51:07 2004 ----a-w- c:\users\silvia\appdata\roaming\SCPSP7.DLL
2009-10-04 17:51:00 0 d-----w- c:\program files\Photocopier Expert

==================== Find3M ====================

2009-11-02 22:15:40 667728 ----a-w- c:\windows\system32\perfh00A.dat
2009-11-02 22:15:40 129514 ----a-w- c:\windows\system32\perfc00A.dat
2009-10-01 09:29:14 195440 ------w- c:\windows\system32\MpSigStub.exe
2009-09-24 17:51:07 1533 --sh--r- c:\users\silvia\appdata\roaming\SCPSS7.DLL
2009-09-24 17:46:38 1533 --sh--r- c:\users\silvia\appdata\roaming\SCPSS6.DLL
2009-09-21 21:56:30 15688 ----a-w- c:\windows\system32\lsdelete.exe
2009-09-19 10:24:57 51200 ----a-w- c:\windows\inf\infpub.dat
2009-09-19 10:24:56 143360 ----a-w- c:\windows\inf\infstrng.dat
2009-09-12 10:31:56 86016 ----a-w- c:\windows\inf\infstor.dat
2009-08-28 12:39:07 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2009-08-28 10:15:30 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2009-08-27 05:22:28 916480 ----a-w- c:\windows\system32\wininet.dll
2009-08-27 05:17:43 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-08-27 05:17:43 109056 ----a-w- c:\windows\system32\iesysprep.dll
2009-08-27 03:42:29 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-08-18 19:39:58 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-08-17 21:33:52 1193832 ----a-w- c:\windows\system32\FM20.DLL
2009-08-14 16:29:41 17920 ----a-w- c:\windows\system32\netevent.dll
2009-08-14 16:29:41 104960 ----a-w- c:\windows\system32\netiohlp.dll
2009-08-14 14:16:55 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE
2009-08-14 14:16:55 17920 ----a-w- c:\windows\system32\ROUTE.EXE
2009-08-14 14:16:52 11264 ----a-w- c:\windows\system32\MRINFO.EXE
2009-08-14 14:16:51 27136 ----a-w- c:\windows\system32\NETSTAT.EXE
2009-08-14 14:16:50 19968 ----a-w- c:\windows\system32\ARP.EXE
2009-08-14 14:16:49 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE
2009-08-14 14:16:49 10240 ----a-w- c:\windows\system32\finger.exe
2008-08-29 22:09:54 174 --sha-w- c:\program files\desktop.ini
2008-08-29 21:56:34 665600 ----a-w- c:\windows\inf\drvindex.dat
2007-01-03 10:48:57 40258 ----a-w- c:\windows\inf\perflib\0c0a\perfd.dat
2007-01-03 10:48:57 40258 ----a-w- c:\windows\inf\perflib\0c0a\perfc.dat
2007-01-03 10:48:57 336930 ----a-w- c:\windows\inf\perflib\0c0a\perfi.dat
2007-01-03 10:48:57 336930 ----a-w- c:\windows\inf\perflib\0c0a\perfh.dat
2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfc.dat
2009-04-19 12:09:22 22 --sha-w- c:\windows\sminst\HPCD.sys
2007-01-03 11:06:39 8192 --sha-w- c:\windows\users\default\NTUSER.DAT

============= FINISH: 16:17:02,51 ===============

@gallinita tienes que hacer los pasos que te dio el Moderador GuillermoTell

Muchas gracias por vuestras ayudas, pero al final me he decidido por formatear estaba el asunto muy mal. Muchas gracias de verdad. Saludos.

Hola, bueno si decidiste el formateo, también es una solución, no es la que mas nos gusta.

Te envio saludos de GuillermoTell y mios

Tema terminado, formateo