Hola a todos.
Esta es la primera vez que posteo acá, así que tendrán que perdonar si no soy muy instruida en estos temas.
Bien, hace un par de días me infecté con "sysprotection page" y logré eliminar la conexión directa a esta página desde el explorer con el smitfraudfix y pasando spybot y nod32 en modo seguro, pero desde entonces mi antivirus (NOD32 2.5) me envía alertas del IMON por un par de troyanos que parecen querer conectarse a-no-sé-dónde. Los troyanos están en la cuarentena del Nod, pero las alertas aparecen a cada instante...
estos son los bichos
WIN32/TrojanDownloader.Delf.Ambtrojan
WIN32/TrojanDownloader.Ani.gen trojan
Además, mientras estoy trabajando, mi pantalla se deforma, se estira horizontalmente dejando cosas fuera del campo del monitor. En el Windows Task Manager detuve el proceso Win2ED.tmp.exe sólo porque me pareció raro y todo volvió a la normalidad. No sé si esto tenga que ver con los troyanos, pero de todos lo dejo como información adicional.
Este es el log del hijackthis

Logfile of HijackThis v1.99.1
Scan saved at 21:01:29, on 10-07-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\Eset\nod32kui.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_ 3dsmax8server.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\BitTorrent\bittorrent.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\paulina\Desktop\HijackThis\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [F-StopW] C:\Program Files\FSI\F-Prot\F-StopW.EXE
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [Lexmark X74-X75] "C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramewor...o.cab34246.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/dim2/def...ploader_v6.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: MsgPlusLoader.dll
O20 - Winlogon Notify: winbjt32 - C:\WINDOWS\SYSTEM32\winbjt32.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: RaySat_3dsmax8 Server (mi-raysat_3dsmax8) - Unknown owner - C:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_ 3dsmax8server.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

Mi tesis de grado en proceso y yo le agradecemos cualquier ayuda que nos den!
Saludos.

Ah! me olvidé decirles que el log está tomado en modo normal (no sé si esta información sirve de algo, pero por si acaso...)

Hola y Bienvenid@ a Forospyware!


Tu log solo muestra un archivo a borrar, así que sigue estos pasos, más adelante, te pediré que hagas unos chequeos con antivirus online, por favor, hazlos y dejas acá los reportes


Descarga las siguientes herramientas:

• Killbox
  
• Regseeker
  
• Disk Cleaner

Paso 1:

• Desactiva la restauración del sistema
  
• Configura el sistema para ver todos los archivos ocultos

Paso 2:

Ejecuta el hijackthis sin tener ningún otro programa abierto, marca y dale FixChecked a las siguientes entradas:

O20 - Winlogon Notify: winbjt32 - C:\WINDOWS\SYSTEM32\winbjt32.dll



Paso 3:

• Reinicia el sistema en modo a prueba de fallos (modo seguro)

Copia y pega las siguientes entradas en el Killbox (una a la vez) donde dice "Full Path of File to Delete" y le das click al boton rojo con cruz blanca del programa para eliminar el archivo:

C:\WINDOWS\SYSTEM32\winbjt32.dll


Limpia los temporales y cookies con el Disk Cleaner

Limpia el registro de windows con el Regseeker (pásalo varias veces hasta que no quede nada por limpiar)



Paso 4:

Reincia el sistema en modo normal

Haz un chequeo con los antivirus online Kaspersky y Ewido


Nos comentas como te fue y dejas un nuevo log para ver como quedó



Salu2

Hola Acron:
Muchas gracias por la ayuda!!
Hice todo lo que me posteaste, paso a paso, lo único que no resultó fue eliminar de una vez el archivo winbjt32.dll,así que le puse al killbox que lo eliminara al reiniciar.

Escaneé con Ewido y no encontró nada. El kaspersky arrojó esto:

Tuesday, July 11, 2006 2:11:11 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 11/07/2006
Kaspersky Anti-Virus database records: 194281
Scan Settings
Scan using the following antivirus database standard
Scan Archives true
Scan Mail Bases true
Scan Target My Computer
A:\
C:\
D:\
E:\
F:\
Scan Statistics
Total number of scanned objects 88527
Number of viruses found 3
Number of infected objects 5 / 0
Number of suspicious objects 0
Duration of the scan process 00:38:44

Infected Object Name Virus Name Last Action
C:\!KillBox\winbjt32.dll Infected: Packed.Win32.Klone.g skipped
C:\!KillBox\winbjt32.dll( 1) Infected: Packed.Win32.Klone.g skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\paulina\Application Data\Mozilla\Firefox\Profiles\z990slwm.default\his tory.dat Object is locked skipped
C:\Documents and Settings\paulina\Application Data\Mozilla\Firefox\Profiles\z990slwm.default\par ent.lock Object is locked skipped
C:\Documents and Settings\paulina\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\paulina\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\paulina\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\paulina\Local Settings\Application Data\Mozilla\Firefox\Profiles\z990slwm.default\Cac he\_CACHE_001_ Object is locked skipped
C:\Documents and Settings\paulina\Local Settings\Application Data\Mozilla\Firefox\Profiles\z990slwm.default\Cac he\_CACHE_002_ Object is locked skipped
C:\Documents and Settings\paulina\Local Settings\Application Data\Mozilla\Firefox\Profiles\z990slwm.default\Cac he\_CACHE_003_ Object is locked skipped
C:\Documents and Settings\paulina\Local Settings\Application Data\Mozilla\Firefox\Profiles\z990slwm.default\Cac he\_CACHE_MAP_ Object is locked skipped
C:\Documents and Settings\paulina\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\paulina\Local Settings\History\History.IE5\MSHist012006071120060 712\index.dat Object is locked skipped
C:\Documents and Settings\paulina\Local Settings\Temp\Perflib_Perfdata_d50.dat Object is locked skipped
C:\Documents and Settings\paulina\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\paulina\ntuser.dat Object is locked skipped
C:\Documents and Settings\paulina\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\paulina\UserData\index.dat Object is locked skipped
C:\Program Files\ESET\cache\CACHE.NDB Object is locked skipped
C:\Program Files\ESET\infected\BLIGMBAA.NQF Infected: Trojan-Downloader.Win32.Zlob.xz skipped
C:\Program Files\ESET\infected\OF55NYBA.NQF Infected: Trojan-Downloader.Win32.Delf.amb skipped
C:\Program Files\ESET\infected\TOYLBSAA.NQF Infected: Trojan-Downloader.Win32.Delf.amb skipped
C:\Program Files\ESET\logs\virlog.dat Object is locked skipped
C:\Program Files\ESET\logs\warnlog.dat Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.lo g Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MA P Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MA P Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DAT A Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log
D:\01 tesis\tesis work\transitoriedad em.dwg Object is locked skipped
D:\01 tesis\tesis work\transitoriedad em.dwl Object is locked skipped
D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
F:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
F:\System Volume Information\_restore{192F3431-5E7F-4956-A1DA-D9AF359CBF70}\RP85\A0023404.exe Object is locked skipped
F:\System Volume Information\_restore{192F3431-5E7F-4956-A1DA-D9AF359CBF70}\RP85\A0023405.dll Object is locked skipped
F:\System Volume Information\_restore{192F3431-5E7F-4956-A1DA-D9AF359CBF70}\RP85\A0023406.dll Object is locked skipped
F:\System Volume Information\_restore{192F3431-5E7F-4956-A1DA-D9AF359CBF70}\RP85\A0023407.exe Object is locked skipped
F:\System Volume Information\_restore{192F3431-5E7F-4956-A1DA-D9AF359CBF70}\RP85\A0023408.dll Object is locked skipped
F:\System Volume Information\_restore{192F3431-5E7F-4956-A1DA-D9AF359CBF70}\RP85\A0023409.exe Object is locked skipped
F:\System Volume Information\_restore{192F3431-5E7F-4956-A1DA-D9AF359CBF70}\RP85\A0023410.dll Object is locked skipped
F:\System Volume Information\_restore{192F3431-5E7F-4956-A1DA-D9AF359CBF70}\RP85\A0023411.exe Object is locked skipped
F:\System Volume Information\_restore{192F3431-5E7F-4956-A1DA-D9AF359CBF70}\RP85\A0023412.ver Object is locked skipped
F:\System Volume Information\_restore{192F3431-5E7F-4956-A1DA-D9AF359CBF70}\RP85\A0023413.inf Object is locked skipped
F:\System Volume Information\_restore{192F3431-5E7F-4956-A1DA-D9AF359CBF70}\RP85\A0023414.cat

hacia abajo hay una infinidad de archivos de F:/System Volume Information...



y el log que me quedó es este:
Logfile of HijackThis v1.99.1
Scan saved at 14:15:13, on 11-07-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_ 3dsmax8server.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe
C:\Documents and Settings\paulina\Desktop\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [Lexmark X74-X75] "C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://zone.msn.com/bingame/dim2/default/popcaploader_v6.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: MsgPlusLoader.dll
O20 - Winlogon Notify: winbjt32 - winbjt32.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: RaySat_3dsmax8 Server (mi-raysat_3dsmax8) - Unknown owner - C:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_ 3dsmax8server.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

En lo que llevo de aplicada tu solución, las ventanitas del IMON del nod no han vuelto a aparecer, aunque aún tengo los siguientes bichos en el log como amenazas:

Time Module Object Name Threat Action User Information
11-07-2006 11:54:34 IMON file http://ownusa.info/fdial2.php?o=cj_|dt Win32/TrojanDownloader.Delf.AMB trojan quarantined - Connection terminated WILDHONEYPIE\paulina
11-07-2006 11:34:33 IMON file http://ownusa.info/fdial2.php?o=cj_|dt Win32/TrojanDownloader.Delf.AMB trojan quarantined - Connection terminated WILDHONEYPIE\paulina
11-07-2006 11:14:33 IMON file http://ownusa.info/fdial2.php?o=cj_|dt Win32/TrojanDownloader.Delf.AMB trojan quarantined - Connection terminated WILDHONEYPIE\paulina
11-07-2006 9:40:08 IMON file http://ownusa.info/fdial2.php?o=cj_|dt Win32/TrojanDownloader.Delf.AMB trojan Connection terminated WILDHONEYPIE\paulina
11-07-2006 2:03:50 IMON file http://netincap.com/traff2/curs.anr Win32/TrojanDownloader.Ani.gen trojan Connection terminated WILDHONEYPIE\paulina
11-07-2006 2:03:42 AMON file C:\Documents and Settings\paulina\Local Settings\Temporary Internet Files\Content.IE5\01234567\xpl[1].wmf a variant of Win32/Exploit.WMF trojan quarantined - deleted WILDHONEYPIE\paulina Event occurred on a new file created by the application: C:\WINDOWS\TEMP\win995.tmp.exe. The file was moved to quarantine. You may close this window.
11-07-2006 2:03:34 AMON file C:\Documents and Settings\paulina\Local Settings\Temporary Internet Files\Content.IE5\01234567\xpl[1].wmf a variant of Win32/Exploit.WMF trojan deleted WILDHONEYPIE\paulina Event occurred at an attempt to access the file by the application: C:\WINDOWS\TEMP\win995.tmp.exe.
11-07-2006 2:03:28 IMON file http://netincap.com/traff2/BlackBox.class Java/ClassLoader.B trojan quarantined - Connection terminated WILDHONEYPIE\paulina
11-07-2006 2:03:03 IMON file http://netincap.com/traff2/curs.anr Win32/TrojanDownloader.Ani.gen trojan quarantined - Connection terminated WILDHONEYPIE\paulina
11-07-2006 2:02:59 IMON file http://netincap.com/traff2/xpl.wmf a variant of Win32/Exploit.WMF trojan WILDHONEYPIE\paulina
11-07-2006 1:18:49 IMON file http://ownusa.info/fdial2.php?o=cj_|dt Win32/TrojanDownloader.Delf.AMB trojan quarantined - Connection terminated WILDHONEYPIE\paulina
11-07-2006 1:00:16 IMON file http://ownusa.info/fdial2.php?o=cj_|dt Win32/TrojanDownloader.Delf.AMB trojan Connection terminated WILDHONEYPIE\paulina
11-07-2006 0:33:31 IMON file http://ownusa.info/fdial2.php?o=cj_|dt Win32/TrojanDownloader.Delf.AMB trojan Connection terminated WILDHONEYPIE\paulina

No sé si esto último tenga alguna importancia, pero te lo posteo por si acaso... Otra vez, muchas gracias por todo!

Bien, los reportes en realidad solo muestran archivos movidos a la cuarentena así que no es para preocuparse


Lo último que te podría decir es que para eliminar esos archivos que aparecen en F:\System Volume Information\ deberás hacer lo siguiente:


- Desactivas la restauración del sistema

- Reinicias el sistema

- Activas de nuevo la restauración

- Reinicias nuevamente



Bueno, ya me dirás si continúan los problemas o no dado que el log ya no muestra infecciones




Salu2

Acron:
gracias otra vez!
La verdad es que ya no he vuelto a tener ningún problema, borré los archivos de la cuarentena del nod y todo ha vuelto a la normalidad, ninguna ventana ni pantalla rara. Podré terminar mi tesis tranquila...
Aprovechando la oportunidad quería felicitarlos por el foro, en verdad es de gran ayuda y se agradece lo rápido de las respuestas y las instrucciones para novat@s como yo.
Bien, espero no tener que volver muy pronto, jeje
Suerte a todos!