Como eliminar findamo.com como mi pagina de Inicio...

Que tal buen dia... soy nuevo en el foro porque no habia publicado nada, pues la verdad tengo el problema que mi pagina de inicio es Findamo.com y pongo otra pagina y una vez que cierro el explorador y lo vuelvo a abir aparece de nuevo esa pagina..

Ayuda.. no se si sea virus u otra cosa... tengo Windows 7, 64 bits... Saludos y espero me ayuden...

Que tal.. aqui dejo el informe de Malwarebytes y de combo fix.. espero me puedan ayudar....

Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Versión de la Base de Datos: v2012.06.07.04

Windows 7 x64 NTFS
Internet Explorer 8.0.7600.16385
USER :: USER-PC [administrador]

07/06/2012 11:35:49 a.m.
mbam-log-2012-06-07 (11-35-49).txt

Tipos de Análisis: Análisis Completo
Opciones de análisis activado: Memoria | Inicio | Registro | Sistema de archivos | Heurística/Extra | Heurística/Shuriken | PUP | PUM
Opciones de análisis desactivados: P2P
Objetos examinados: 532311
Tiempo transcurrido: 2 hora(s), 30 minuto(s), 54 segundo(s)

Procesos en Memoria Detectados: 0
(No se han detectado elementos maliciosos)

Módulos de Memoria Detectados: 0
(No se han detectado elementos maliciosos)

Claves del Registro Detectados: 18
HKCR\CLSID\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} (PUP.FunMoods) -> En cuarentena y eliminado con éxito.
HKCR\funmoods.funmoodsHlpr.1 (PUP.FunMoods) -> En cuarentena y eliminado con éxito.
HKCR\funmoods.funmoodsHlpr (PUP.FunMoods) -> En cuarentena y eliminado con éxito.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} (PUP.FunMoods) -> En cuarentena y eliminado con éxito.
HKCR\CLSID\{965B9DBE-B104-44AC-950A-8A5F97AFF439} (PUP.Funmoods) -> En cuarentena y eliminado con éxito.
HKCR\escort.escortIEPane.1 (PUP.Funmoods) -> En cuarentena y eliminado con éxito.
HKCR\escort.escortIEPane (PUP.Funmoods) -> En cuarentena y eliminado con éxito.
HKCR\CLSID\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} (PUP.Funmoods) -> En cuarentena y eliminado con éxito.
HKCR\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921} (PUP.Funmoods) -> En cuarentena y eliminado con éxito.
HKCR\funmoods.dskBnd.1 (PUP.Funmoods) -> En cuarentena y eliminado con éxito.
HKCR\funmoods.dskBnd (PUP.Funmoods) -> En cuarentena y eliminado con éxito.
HKCR\CLSID\{A9DB719C-7156-415E-B49D-BAD039DE4F13} (PUP.Funmoods) -> En cuarentena y eliminado con éxito.
HKCR\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800} (PUP.Funmoods) -> En cuarentena y eliminado con éxito.
HKCR\funmoodsApp.appCore.1 (PUP.Funmoods) -> En cuarentena y eliminado con éxito.
HKCR\funmoodsApp.appCore (PUP.Funmoods) -> En cuarentena y eliminado con éxito.
HKCR\CLSID\{F03FD9D0-4F2B-497C-8A71-DD41D70B07D9} (PUP.Funmoods) -> En cuarentena y eliminado con éxito.
HKCR\f (PUP.Funmoods) -> En cuarentena y eliminado con éxito.
HKLM\SOFTWARE\Google\chrome\Extensions\fdloijijlkoblmigdofommgnheckmaki (PUP.Funmoods) -> En cuarentena y eliminado con éxito.

Valores del Registro Detectados: 2
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar|{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} (PUP.Funmoods) -> datos: Funmoods Toolbar -> En cuarentena y eliminado con éxito.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} (PUP.Funmoods) -> datos: -> En cuarentena y eliminado con éxito.

Elementos de Datos del Registro Detectados: 0
(No se han detectado elementos maliciosos)

Carpetas Detectadas: 0
(No se han detectado elementos maliciosos)

Archivos Detectados: 19
C:\Program Files (x86)\WinRAR\patch.exe (Malware.Packer.Gen) -> En cuarentena y eliminado con éxito.
C:\Users\USER\Documents\Descargas\SoftonicDownloader_para_realplayer-sp.exe (PUP.OfferBundler.ST) -> En cuarentena y eliminado con éxito.
C:\Users\USER\Documents\Descargas\Extraction.Pack.Rotam\Extraction.Pack.Rotam\Phx_data\Res\EmuCfg.exe (Trojan.Agent) -> En cuarentena y eliminado con éxito.
C:\Users\USER\Documents\Descargas\Extraction.Pack.Rotam\Extraction.Pack.Rotam\Phx_data\Res\GCFMgr.exe (Trojan.Agent) -> En cuarentena y eliminado con éxito.
C:\Users\USER\Documents\Descargas\Extraction.Pack.Rotam\Extraction.Pack.Rotam\Phx_data\Res\RICO.exe (Backdoor.Bot) -> En cuarentena y eliminado con éxito.
C:\Users\USER\Documents\Descargas\Extraction.Pack.Rotam\Extraction.Pack.Rotam\Phx_data\Res\ss.exe (Backdoor.Bot) -> En cuarentena y eliminado con éxito.
C:\Users\USER\Documents\Descargas\Phoenix\Phx_data\Res\EmuCfg.exe (Trojan.Agent) -> En cuarentena y eliminado con éxito.
C:\Users\USER\Documents\Descargas\Phoenix\Phx_data\Res\GCFMgr.exe (Trojan.Agent) -> En cuarentena y eliminado con éxito.
C:\Users\USER\Documents\Descargas\Phoenix\Phx_data\Res\RICO.exe (Backdoor.Bot) -> En cuarentena y eliminado con éxito.
C:\Users\USER\Documents\Descargas\Phoenix\Phx_data\Res\ss.exe (Backdoor.Bot) -> En cuarentena y eliminado con éxito.
C:\Users\USER\Downloads\Gestor de descargas para Letitbi\CheatEngine61.exe (PUP.BundleInstaller.BI) -> En cuarentena y eliminado con éxito.
C:\Users\USER\Downloads\hhhhhhh\SoftonicDownloader_para_vdownloader.exe (PUP.ToolbarDownloader) -> En cuarentena y eliminado con éxito.
C:\Users\USER\Downloads\Internet Download Manager 6.08\internet.download.manager.v6.08-patch.exe (PUP.Hacktool.Patcher) -> En cuarentena y eliminado con éxito.
C:\Users\USER\Downloads\Internet_Download_Manager_5.15_build_5\Patch.exe (PUP.Hacktool.Patcher) -> En cuarentena y eliminado con éxito.
C:\Users\USER\Downloads\PROGRAMAS\dddplus_setup.exe (Adware.Onlinegames) -> En cuarentena y eliminado con éxito.
C:\Users\USER\Downloads\PROGRAMAS\SoftonicDownloader_para_cd-dvd-data-recovery.exe (PUP.ToolbarDownloader) -> En cuarentena y eliminado con éxito.
C:\Users\USER\Downloads\PROGRAMAS\SoftonicDownloader_para_cdroller.exe (PUP.ToolbarDownloader) -> En cuarentena y eliminado con éxito.
C:\Users\USER\Downloads\PROGRAMAS\Monitorea tu PC\Award.Keylogger.v1.8\Award.Keylogger.v1.8.exe (PUP.AwardKeylogger) -> En cuarentena y eliminado con éxito.
C:\Users\USER\Downloads\PROGRAMAS\Monitorea tu PC\Award.Keylogger.v1.8\PARADOX\kl.exe (PUP.KeyLogger) -> En cuarentena y eliminado con éxito.

fin)

Informe de Combo Fix:

ComboFix 12-06-03.05 - USER 07/06/2012 14:25:35.1.2 - x64
Microsoft Windows 7 Ultimate 6.1.7600.0.1252.52.3082.18.2046.943 [GMT -5:00]
Running from: c:\users\USER\Desktop\ComboFix.exe
AV: Kaspersky Internet Security *Disabled/Updated* {56547CC9-C9B2-849D-8FEF-A496150D6A06}
FW: Kaspersky Internet Security *Disabled* {6E6FFDEC-83DD-85C5-A4B0-0DA3EBDE2D7D}
SP: Kaspersky Internet Security *Disabled/Updated* {ED359D2D-EF88-8B13-B55F-9FE46E8A20BB}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\install.exe
c:\programdata\Amazon.ico
c:\programdata\MercadoLivre.ico
c:\users\USER\AppData\Roaming\inst.exe
c:\users\USER\AppData\Roaming\vso_ts_preview.xml
c:\users\USER\Documents\~WRL0001.tmp
c:\windows\Fonts\UNWISE.EXE
c:\windows\SysWow64\Packet.dll
c:\windows\SysWow64\pthreadVC.dll
c:\windows\SysWow64\testdll.dll
c:\windows\SysWow64\tmpDDF3.tmp
c:\windows\SysWow64\tmpDE42.tmp
c:\windows\SysWow64\wpcap.dll
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_NPF
-------\Service_npf
.
.
((((((((((((((((((((((((( Files Created from 2012-05-07 to 2012-06-07 )))))))))))))))))))))))))))))))
.
.
2012-06-07 19:37 . 2012-06-07 19:37 -------- d-----w- c:\windows\SysWow64\Extensions
2012-06-07 19:36 . 2012-06-07 19:36 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2012-06-07 19:36 . 2012-06-07 19:36 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-06-07 16:33 . 2012-06-07 16:33 -------- d-----w- c:\users\USER\AppData\Roaming\Malwarebytes
2012-06-07 16:31 . 2012-06-07 16:31 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2012-06-07 16:31 . 2012-06-07 16:31 -------- d-----w- c:\programdata\Malwarebytes
2012-06-07 16:31 . 2012-04-04 20:56 24904 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-06-06 13:50 . 2012-06-06 13:50 770384 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcr100.dll
2012-06-06 13:50 . 2012-06-06 13:50 421200 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcp100.dll
2012-06-06 02:46 . 2012-06-06 02:46 -------- d-----w- c:\program files (x86)\Real Alternative
2012-06-04 23:11 . 2012-06-04 23:11 -------- d-----w- c:\users\USER\AppData\Local\Google
2012-06-04 23:11 . 2012-06-04 23:13 -------- d-----w- c:\users\USER\AppData\Local\MassTube
2012-06-04 23:08 . 2012-06-04 23:08 -------- d-----w- c:\program files (x86)\Yontoo
2012-06-04 23:00 . 2012-06-04 23:00 -------- d-----w- c:\programdata\IBUpdaterService
2012-06-04 23:00 . 2012-06-04 23:00 -------- d-----w- c:\programdata\bProtectorForWindows
2012-06-02 21:00 . 2010-09-16 16:26 40408 ----a-w- c:\windows\system32\CleanMFT64.exe
2012-06-02 21:00 . 2008-04-02 20:54 1101824 ----a-w- c:\windows\SysWow64\UniBox210.ocx
2012-06-02 21:00 . 2008-04-02 20:53 212992 ----a-w- c:\windows\SysWow64\UniBoxVB12.ocx
2012-06-02 21:00 . 2008-04-02 20:53 880640 ----a-w- c:\windows\SysWow64\UniBox10.ocx
2012-06-02 21:00 . 2004-08-04 12:00 506368 ----a-w- c:\windows\SysWow64\msxml.dll
2012-06-02 21:00 . 2012-06-02 21:00 -------- d-----w- c:\program files (x86)\Common Files\PC Tools
2012-06-02 20:49 . 2012-06-02 20:49 -------- d-----w- c:\users\USER\AppData\Roaming\Nitro PDF
2012-06-02 20:49 . 2012-06-02 20:49 -------- d-----w- c:\programdata\Nitro PDF
2012-06-02 20:39 . 2012-06-04 23:53 -------- d-----w- c:\users\USER\AppData\Roaming\VDownloader
2012-06-02 20:39 . 2012-06-02 20:51 -------- d-----w- c:\users\USER\AppData\Local\VDownloader
2012-06-02 20:39 . 2012-06-02 20:39 -------- d-----w- c:\program files\WinPcap
2012-06-02 20:39 . 2010-01-26 16:11 444283 ----a-w- c:\program files (x86)\Common Files\WinPcapNmap.exe
2012-06-02 20:39 . 2012-06-02 20:52 -------- d-----w- c:\program files (x86)\VDownloader
2012-06-02 20:00 . 2012-06-04 22:59 -------- d-----w- C:\Videotodogf
2012-05-29 00:09 . 2012-05-29 00:11 -------- d-----w- c:\users\USER\AppData\Local\Facebook
2012-05-26 23:02 . 2012-05-26 23:02 -------- d-----w- c:\users\USER\FrostWire
2012-05-26 23:02 . 2012-06-02 14:58 -------- d-----w- c:\users\USER\.frostwire5
2012-05-26 23:02 . 2012-05-26 23:02 -------- d-----w- c:\program files (x86)\FrostWire 5
2012-05-26 22:53 . 2012-06-04 23:08 -------- d-----w- c:\programdata\Tarma Installer
2012-05-26 22:53 . 2012-06-02 20:53 -------- d-----w- c:\users\USER\AppData\Roaming\OpenCandy
2012-05-26 22:52 . 2012-03-22 18:43 2557952 ----a-w- c:\windows\SysWow64\QtCore4.dll
2012-05-26 22:52 . 2012-04-18 18:49 405176 ----a-w- c:\windows\SysWow64\Newtonsoft.Json.Net20.dll
2012-05-20 16:22 . 2012-05-20 16:22 419488 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-05-14 20:24 . 2012-05-14 20:24 -------- d-----w- c:\program files (x86)\Capcom
2012-05-10 23:08 . 2012-05-10 23:08 -------- d-----w- c:\program files (x86)\Ask.com
2012-05-10 23:07 . 2012-05-10 23:07 -------- d-----w- c:\program files (x86)\VirtualDJ
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-20 16:22 . 2011-06-29 14:05 70304 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-03-29 16:11 . 2011-07-13 17:39 82816 ----a-w- c:\users\USER\AppData\Roaming\pcouffin.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2011-02-02 1487240]
.
[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
2011-05-09 08:49 176936 ----a-w- c:\program files (x86)\DVDVideoSoftTB\prxtbDVD0.dll
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2011-02-02 00:17 1487240 ----a-w- c:\program files (x86)\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\program files (x86)\DVDVideoSoftTB\prxtbDVD0.dll" [2011-05-09 176936]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2011-02-02 1487240]
.
[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~3\bProtectorForWindows\2.0.392.106\protector.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 8.0\Reader\Reader_sl.exe"
"YouCam Tray"="c:\program files (x86)\CyberLink\YouCam\YouCamTray.exe" /s
"TkBellExe"="c:\program files (x86)\Real\RealPlayer\update\realsched.exe" -osboot
"YouCam Mirage"="c:\program files (x86)\CyberLink\YouCam\YCMMirage.exe"
"HostManager"=c:\program files (x86)\Common Files\AOL\1299687661\ee\AOLSoftware.exe
"Guard.Mail.ru.gui"="c:\program files (x86)\Mail.Ru\Guard\GuardMailRu.exe" /gui
"Iminent"=c:\program files (x86)\Iminent\Iminent.exe /warmup "F77F87E5-A6BD-4922-A530-EDF63D7E9F8C"
"IminentMessenger"=c:\program files (x86)\Iminent\Iminent.Messengers.exe /startup
"SSDMonitor"=c:\program files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe
"VDownloader"=c:\program files (x86)\VDownloaderñ\VDownloader.exe /silent
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-20 257696]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-06-06 113120]
R3 OXSDIDRV_x64;Oxford Semi eSATA Filter (x64);c:\windows\system32\DRIVERS\OXSDIDRV_x64.sys [x]
R3 OXUDIDRV;OXUDIDRV;c:\windows\system32\Drivers\OXUDIDRV_X64.sys [x]
R3 pcouffin;VSO Software pcouffin;c:\windows\system32\Drivers\pcouffin.sys [x]
R3 XBox;XBox Filter;c:\windows\system32\DRIVERS\XBox.sys [2007-12-28 34992]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]
S1 kl2;kl2;c:\windows\system32\DRIVERS\kl2.sys [x]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [x]
S2 bProtector;bProtector;c:\programdata\bProtectorForWindows\2.0.392.106\bProtect.exe [2012-06-04 1441784]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2012-03-01 2348352]
S2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe [2011-01-28 632792]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-02-29 382272]
S2 TeamViewer7;TeamViewer 7;c:\program files (x86)\TeamViewer\Version7\TeamViewer_Service.exe [2012-02-23 2886528]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe [2009-12-10 1394504]
S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys [x]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys [x]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [x]
S3 PPJoyBus;Parallel Port Joystick Bus Enumerator;c:\windows\system32\DRIVERS\PPJoyBus64.sys [x]
S3 PPortJoystick;Parallel Port Joystick Device Driver;c:\windows\system32\DRIVERS\PPortJoy64.sys [x]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesDriver64.sys [2009-10-14 11856]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - WS2IFSL
.
Contents of the 'Scheduled Tasks' folder
.
2012-06-07 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-20 16:22]
.
2012-06-07 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3897906702-2730804883-194078876-1000Core.job
- c:\users\USER\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-05-29 00:09]
.
2012-06-07 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3897906702-2730804883-194078876-1000UA.job
- c:\users\USER\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-05-29 00:09]
.
2012-06-07 c:\windows\Tasks\RMSchedule.job
- c:\program files (x86)\Registry Mechanic\RegMech.exe [2012-06-02 15:02]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"combofix"="c:\combofix\CF5015.3XE" [2009-07-14 344576]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://es.ask.com/?l=dis&o=41647960&gct=hp
mStart Page = hxxp://start.funmoods.com/?f=1&a=tube&chnl=tube&cd=2XzutAtN2Y1L1QzutC0CyC0FyCyDyDzzyDyC0CyCtAtAyB0DtN0D0TzutBtDtCtBtDyCtDyE&cr=292895984
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Descargar con Mipony - file://c:\program files (x86)\MiPony\Browser\IEContext.htm
IE: E&xportar a Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: Free YouTube Download - c:\users\USER\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm
IE: Free YouTube to MP3 Converter - c:\users\USER\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
TCP: DhcpNameServer = 192.168.1.254
FF - ProfilePath - c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\347r3kyu.default\
FF - prefs.js: browser.search.defaulturl - hxxp://go.mail.ru/search?q={searchTerms}&utf8in=1&fr=ietb
FF - prefs.js: browser.search.selectedEngine - Search The Web
FF - prefs.js: browser.startup.homepage - hxxp://www.findamo.com?ch=10
FF - prefs.js: keyword.URL - hxxp://www.findamo.com/search.html?ch=10&q=
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=100789
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar_i.id - 0cbf337d0000000000001c6f655856c6
FF - user.js: extensions.BabylonToolbar_i.hardId - 0cbf337d0000000000001c6f655856c6
FF - user.js: extensions.BabylonToolbar_i.instlDay - 15431
FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.179:29
FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar_i.tlbrId - base
FF - user.js: extensions.BabylonToolbar_i.instlRef - sst
FF - user.js: extensions.autoDisableScopes - 14
FF - user.js: extentions.y2layers.installId - b17cd950-f989-4457-b594-891cb7dc6663
FF - user.js: extentions.y2layers.defaultEnableAppsList - ezLooker,pagerage,buzzdock,toprelatedtopics,twittube
FF - user.js: extensions.funmoods.hmpg - true
FF - user.js: extensions.funmoods.hmpgUrl - hxxp://start.funmoods.com/?f=1&a=tube&chnl=tube&cd=2XzutAtN2Y1L1QzutC0CyC0FyCyDyDzzyDyC0CyCtAtAyB0DtN0D0TzutBtDtCtBtDyCtDyE&cr=292895984
FF - user.js: extensions.funmoods.dfltSrch - true
FF - user.js: extensions.funmoods.srchPrvdr - Search
FF - user.js: extensions.funmoods.dnsErr - true
FF - user.js: extensions.funmoods_i.newTab - true
FF - user.js: extensions.funmoods.newTabUrl - hxxp://start.funmoods.com/?f=2&a=tube&chnl=tube&cd=2XzutAtN2Y1L1QzutC0CyC0FyCyDyDzzyDyC0CyCtAtAyB0DtN0D0TzutBtDtCtBtDyCtDyE&cr=292895984
FF - user.js: extensions.funmoods.tlbrSrchUrl -
FF - user.js: extensions.funmoods.id - 0cbf337d0000000000001c6f655856c6
FF - user.js: extensions.funmoods.instlDay - 15495
FF - user.js: extensions.funmoods.vrsn - 1.5.23.22
FF - user.js: extensions.funmoods.vrsni - 1.5.23.22
FF - user.js: extensions.funmoods_i.vrsnTs - 1.5.23.2218:13
FF - user.js: extensions.funmoods.prtnrId - funmoods
FF - user.js: extensions.funmoods.prdct - funmoods
FF - user.js: extensions.funmoods.aflt - tube
FF - user.js: extensions.funmoods_i.smplGrp - none
FF - user.js: extensions.funmoods.tlbrId - base
FF - user.js: extensions.funmoods.instlRef - tube
FF - user.js: extensions.funmoods.dfltLng -
FF - user.js: extensions.funmoods.excTlbr - false
FF - user.js: extensions.funmoods.autoRvrt - false
FF - user.js: extensions.funmoods.envrmnt - production
FF - user.js: extensions.funmoods.isdcmntcmplt - true
FF - user.js: extensions.funmoods.mntrvrsn - 1.3.0
.
- - - - ORPHANS REMOVED - - - -
.
WebBrowser-{872B5B88-9DB5-4310-BDD0-AC189557E5F5} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
AddRemove-Usb Joypad - c:\windows\Fonts\UNWISE.EXE
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-3897906702-2730804883-194078876-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{BDCC39E4-8833-FFCA-77B4-5F5756FD74E4}*]
"gaiagagoohddmo"=hex:63,61,70,65,6e,70,00,02
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash9e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.9"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash9e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash9e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash9e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil9e.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil9e.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}]
@Denied: (A 2) (Everyone)
@="IFlashBroker"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\Common Files\AOL\ACS\AOLAcsd.exe
c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe
c:\program files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
c:\program files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
c:\program files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
.
**************************************************************************
.
Completion time: 2012-06-07 14:44:33 - machine was rebooted
ComboFix-quarantined-files.txt 2012-06-07 19:44
.
Pre-Run: 137,874,419,712 bytes libres
Post-Run: 137,312,604,160 bytes libres
.
- - End Of File - - 80E6323CA6112E2E42D836565195724D

.. De antemano Saludos..

Que tal... hice todo el procedimiento y aun no se elimina esa pagina como mi pagina de inicio... porfa ayudenme...