Ante todo gracis por atenderme. No se que hacer, estando conectado a internet se me abren de pronto ventanas con las paginas 9ringtones, loadingwebsite y otras. He pasado el ad-aware y spybot, tambien el panda on-line y con el hijachThis he eliminado entradas que sabia que debia eliminar al leer algunos mensajes del foro y vuestras explicaciones. Todo ello desmarcando la opcion restaurar el sistema y mostrando todos los archivos ocultos.
Tambien he iniciado en modo a prueba de fallos y he pasado el ad-aware y spybot sin solucion.
Aqui os mando el log de HijackThis:


Logfile of HijackThis v1.99.1
Scan saved at 13:28:14, on 18/05/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Archivos de programa\Archivos comunes\Symantec Shared\ccEvtMgr.exe
C:\Archivos de programa\Norton Internet Security\NISUM.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Archivos de programa\Intel\NCS\PROSet\PRONoMgr.exe
C:\Archivos de programa\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Archivos de programa\Winamp\winampa.exe
C:\Archivos de programa\Archivos comunes\Symantec Shared\ccApp.exe
C:\Archivos de programa\Norton Internet Security\ccPxySvc.exe
C:\Archivos de programa\Archivos comunes\Microsoft Shared\VS7Debug\mdm.exe
C:\Archivos de programa\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Archivos de programa\Internet Explorer\iexplore.exe
C:\Archivos de programa\Messenger\msmsgs.exe
C:\Archivos de programa\HijackThis_1.99.1\HijackThis_1.99.1.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.es/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
R3 - URLSearchHook: (no name) - _{CA0E28FA-1AFD-4C21-A8DC-70EB5BE2F076} - (no file)
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Archivos de programa\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\System32\ie2cltr.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\windows\googletoolbar.dll
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Archivos de programa\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Archivos de programa\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Archivos de programa\Archivos comunes\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Archivos de programa\Winamp\winampa.exe
O4 - HKLM\..\Run: [ccApp] "C:\Archivos de programa\Archivos comunes\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Archivos de programa\Archivos comunes\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\ARCHIV~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKCU\..\Run: [Skype] "C:\Archivos de programa\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Global Startup: Microsoft Office.lnk = C:\Archivos de programa\Microsoft Office\Office10\OSA.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google Search - res://C:\WINDOWS\GoogleToolbar.dll/cmsearch.html
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Instantánea de caché de la página - res://C:\WINDOWS\GoogleToolbar.dll/cmcache.html
O8 - Extra context menu item: Páginas similares - res://C:\WINDOWS\GoogleToolbar.dll/cmsimilar.html
O8 - Extra context menu item: Páginas vinculadas - res://C:\WINDOWS\GoogleToolbar.dll/cmbacklinks.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\MSMSGS.EXE
O12 - Plugin for .mov: C:\Archivos de programa\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .mpeg: C:\Archivos de programa\Internet Explorer\PLUGINS\npqtplugin3.dll
O16 - DPF: {11212111-2121-1311-1141-115611111222} - ms-its:mhtml:file://d: oo.mht!http://195.95.218.82/users/zoom/web/axe/x.chm::/update.exe
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by21fd.bay21.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {563ED66E-531B-51D2-5DB0-5080C83DA4EE} - ms-its:mhtml:file://C:ie.mht!http://69.50.164.12/exp/mht/xsext01.chm::/MegaInstaller.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1109855152406
O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - http://toolbar.google.com/data/GoogleActivate.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab31267.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{30C952C6-F1CE-4474-ADD2-68EBD056CC5F}: NameServer = 69.50.176.156,195.225.176.31
O17 - HKLM\System\CCS\Services\Tcpip\..\{E1A709A5-346E-466E-BF0E-B9A00D0C690C}: NameServer = 69.50.176.156,195.225.176.31
O17 - HKLM\System\CS2\Services\Tcpip\..\{30C952C6-F1CE-4474-ADD2-68EBD056CC5F}: NameServer = 69.50.176.156,195.225.176.31
O17 - HKLM\System\CS3\Services\Tcpip\..\{30C952C6-F1CE-4474-ADD2-68EBD056CC5F}: NameServer = 69.50.176.156,195.225.176.31
O20 - Winlogon Notify: SMDEn - C:\WINDOWS\system32\d00mlad11d0.dll
O21 - SSODL: System - {9CF684A5-C369-49D0-B1BB-FAFBE26A90AF} - C:\WINDOWS\system32\system32.dll
O21 - SSODL: Web Event Logger - {7EFBAEFF-EE02-1333-ABDF-416572E5D639} - (no file)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Archivos de programa\Archivos comunes\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Archivos de programa\Archivos comunes\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Proxy Service (ccPxySvc) - Symantec Corporation - C:\Archivos de programa\Norton Internet Security\ccPxySvc.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Archivos de programa\Archivos comunes\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Archivos de programa\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Archivos de programa\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Norton Internet Security Accounts Manager (NISUM) - Symantec Corporation - C:\Archivos de programa\Norton Internet Security\NISUM.EXE
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\ARCHIV~1\ARCHIV~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Archivos de programa\Archivos comunes\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Archivos de programa\Archivos comunes\Symantec Shared\Security Center\SymWSC.exe



Espero no complicaros mucho la existencia . Gracias por vuestra ayuda.

Te doy la bienvenida al Foro de Spyware.

Antes de hacer nada en HijackThis proba descargandote el programa CWShredder 2.14 ejecutalo dandole FIX y despues nos contas los resultados.

Salu2

Gracias por tu ayuda, te lo agradezco de verdad... He pasado el programa que me dijiste y me elimino uno llamado CWS.Jksearch y otro llamado VX2.Look2Me pero al reiniciar el ordenador seguia estando, asi que arranque en modo seguro y volvi a pasar el programa con la opcion de restaurar el sistema desactivada y lo eliminó junto a otro llamado CWS.SysTime. Al reiniciar el ordenador, él sólo, se reinició dos veces y sigue estando ahi el VX2.Look2Me, asi que no se qué más hacer.
MMMMMUUUUUCHASSS GRAAAACIAASSS, espero tu respuesta...

Bien para eliminar el VX2.Look2Me vamos a usar otra herramienta:

Descarga la herramienta L2mfix

Guarda el archivo en el escritorio y hacele doble click en l2mfix.exe. Hace click en el botón Install para extraer los archivos y seguí las indicaciones. A continuación abrí la carpeta l2mfix que acaba de crearse en tu escritorio. Hacele doble click en l2mfix.bat y elegí la opción número 1 para ejecutar "Run Find Log" (Crear informe de búsqueda) pulsando 1 y >Enter. A continuación se realizará un análisis de tu sistema aunque puede parecer que no está sucediendo nada.

Transcurridos unos minutos se abrirá el bloc de notas con un informe. Copia el contenido de ese informe y pégalo aca.

¡IMPORTANTE: NO ejecutes la opción número 2 o ningún otro archivo de la carpeta l2mfix hasta que te lo indique!

Salu2

Me vas a perdonar pero me pierdo en la paguina y no encuentro el sitio donde poder descargar l2mfix... perdona mi torpeza..espero tu ayuda.
Muchas Gracias

ups parece que les cambiaron la pagina ya que esta no era la de las descargas de esa herramienta, de todas maneras ya cambie el link y esta para que te lo descargues directamente.

Salu2

Muchas gracias por tu ayuda ya consegui descargar el programa y hacer lo que me dijiste asi que aqui va el resultado del escaner espero sirva de ayuda:


L2MFIX find log 1.03
These are the registry keys present
************************************************** ********************************
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
"DLLName"="Ati2evxx.dll"
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000001
"Lock"="AtiLockEvent"
"Logoff"="AtiLogoffEvent"
"Logon"="AtiLogonEvent"
"Disconnect"="AtiDisConnectEvent"
"Reconnect"="AtiReConnectEvent"
"Safe"=dword:00000000
"Shutdown"="AtiShutdownEvent"
"StartScreenSaver"="AtiStartScreenSaverEvent"
"StartShell"="AtiStartShellEvent"
"Startup"="AtiStartupEvent"
"StopScreenSaver"="AtiStopScreenSaverEvent"
"Unlock"="AtiUnLockEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33, 00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e, 00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NetCache]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\en06l1ds1.dl l"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69, 00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74, 00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69, 00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEven t"
"Logoff"="UnregisterTicketExpiredNotificationEvent "
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

************************************************** ********************************
useragent:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Internet Settings\User Agent\Post Platform]
"{2A89493D-FBA9-44EE-88C6-4E5850AD85A5}"=""

************************************************** ********************************
Shell Extension key:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Shell Extensions\Approved]
"{00022613-0000-0000-C000-000000000046}"="Hoja de propiedades de archivos multimedia"
"{176d6597-26d3-11d1-b350-080036a75b03}"="Administraci¢n de esc*ner ICM"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="P*gina de seguridad NTFS"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="P*gina de propiedades del archivo de documentos OLE"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Extensiones de interfaz para uso compartido"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Extensi¢n CPL del adaptador de pantalla"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Extensi¢n CPL del monitor de pantalla"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Extensi¢n de paneo de pantalla del Panel de control"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="P*gina de seguridad DS"
"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="P*gina de compatibilidad"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Extensi¢n de copia de discos"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Extensiones del shell para objetos de la red de Microsoft Windows"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="Administraci¢n de monitor ICM"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="Administraci¢n de impresora ICM"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Extensiones del shell para compresi¢n de archivos"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Extensi¢n del shell de impresora en Web"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Men£ de contexto de cifrado"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Malet¡n"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="Extensi¢n de icono de HyperTerminal"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fuentes"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="Perfil de ICC"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="P*gina de seguridad de impresoras"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Extensiones de interfaz para uso compartido"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Extensi¢n PKO cifrada"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Extensi¢n de firma cifrada"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Conexiones de red"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Conexiones de red"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="&C*maras y esc*neres"
"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="&C*maras y esc*neres"
"{905667aa-acd6-11d2-8080-00805f6596d2}"="&C*maras y esc*neres"
"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="&C*maras y esc*neres"
"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="&C*maras y esc*neres"
"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Extensiones del shell para Windows Script Host"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="V¡nculos a datos de Microsoft"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Tareas programadas"
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Barra de tareas y men£ Inicio"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Buscar"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Ayuda y soporte t‚cnico"
"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Ayuda y soporte t‚cnico"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Ejecutar..."
"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="Correo electr¢nico"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Fuentes"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Herramientas administrativas"
"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Barra de herramientas de Microsoft Internet"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Estado de la descarga"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Carpeta Shell aumentada"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Carpeta 2 Shell aumentada"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Banda del explorador de Microsoft"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Banda de b£squeda"
"{32683183-48a0-441b-a342-7c2a440a9478}"="Banda multimedia"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="B£squeda en panel"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="B£squeda Web"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Utilidad de opciones del *rbol de Registro"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Direcci¢n"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="Cuadro de la direcci¢n"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Autocompletar de Microsoft"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="Lista autocompleta MRU"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Lista autocompleta MRU personalizada"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Barra de progreso emergente"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Analizador de Barra de direcciones"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Lista autocompleta de la historia de Microsoft"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Lista autocompleta de la carpeta Shell de Microsoft"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Contenedor de la Lista m£ltiple de Microsoft"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Men£ de sitio de bandas Shell"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Barra de escritorio Shell"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="Asistencia al usuario"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Configuraci¢n de carpeta global"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Servicio de Historial de las direcciones URL de Microsoft"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="Historial"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Archivos temporales de Internet"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Archivos temporales de Internet"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Hook de b£squeda de direcciones URL de Microsoft"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="Pantalla de bienvenida de IE4 Suite"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="Internet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Banda de Explorador"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="Carpeta del cach‚ de ActiveX"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Carpeta de suscripciones"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Administrador de aplicaciones de Shell"
"{0B124F8F-91F0-11D1-B8B5-006008059382}"="Enumerador de aplicaciones instaladas"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher"
"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="Extractor de vistas en miniatura de archivos GDI+"
"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Controlador de la informaci¢n de resumen para vistas en miniatura (DOCFILES)"
"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="Extractor de vistas en miniatura HTML"
"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Asistente para la publicaci¢n en Web"
"{add36aa8-751a-4579-a266-d66f5202ccbb}"="Pedido de impresiones v¡a web"
"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Objeto de Asistente de publicaci¢n de shell"
"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Asistente para obtener pasaporte"
"{7A9D77BD-5403-11d2-8785-2E0420524153}"="Cuentas de usuario"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Archivo de canal"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Acceso directo al canal"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Objeto de control de canal"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Carpeta de archivos sin conexi¢n"
"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
"{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="&Personas..."
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Carpetas Web"
"{0006F045-0000-0000-C000-000000000046}"="Microsoft Outlook Custom Icon Handler"
"{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler"
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}"="WinRAR shell extension"
"{640167b4-59b0-47a6-b335-a6b3c0695aea}"="Portable Media Devices"
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}"="Portable Media Devices Menu"
"{ECD970F2-829E-4B1F-BC2D-AA86ADFE8C55}"=""
"{885D4310-61E5-4CCB-B400-7D9B2D99F28B}"=""
"{02BD67DD-BD94-448D-814A-CF5BF88DDA4B}"=""
"{92D28E21-69DC-46F3-8BB3-38A69C6EEDDD}"=""

************************************************** ********************************
HKEY ROOT CLASSIDS:
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{ECD970F2-829E-4B1F-BC2D-AA86ADFE8C55}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{ECD970F2-829E-4B1F-BC2D-AA86ADFE8C55}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{ECD970F2-829E-4B1F-BC2D-AA86ADFE8C55}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{ECD970F2-829E-4B1F-BC2D-AA86ADFE8C55}\InprocServer32]
@="C:\\WINDOWS\\system32\\nhshrui.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{885D4310-61E5-4CCB-B400-7D9B2D99F28B}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{885D4310-61E5-4CCB-B400-7D9B2D99F28B}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{885D4310-61E5-4CCB-B400-7D9B2D99F28B}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{885D4310-61E5-4CCB-B400-7D9B2D99F28B}\InprocServer32]
@="C:\\WINDOWS\\system32\\iirtprio.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{02BD67DD-BD94-448D-814A-CF5BF88DDA4B}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{02BD67DD-BD94-448D-814A-CF5BF88DDA4B}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{02BD67DD-BD94-448D-814A-CF5BF88DDA4B}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{02BD67DD-BD94-448D-814A-CF5BF88DDA4B}\InprocServer32]
@="C:\\WINDOWS\\system32\\dAd8thk.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{92D28E21-69DC-46F3-8BB3-38A69C6EEDDD}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{92D28E21-69DC-46F3-8BB3-38A69C6EEDDD}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{92D28E21-69DC-46F3-8BB3-38A69C6EEDDD}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{92D28E21-69DC-46F3-8BB3-38A69C6EEDDD}\InprocServer32]
@="C:\\WINDOWS\\system32\\tlemeui.dll"
"ThreadingModel"="Apartment"

************************************************** ********************************
Files Found are not all bad files:

C:\WINDOWS\SYSTEM32\
akcore.dll Wed 2 Mar 2005 20:18:58 A.... 188.416 184,00 K
amptif.dll Tue 22 Feb 2005 17:14:22 ..S.R 225.005 219,73 K
aosnt.dll Fri 25 Feb 2005 9:54:30 ..S.R 225.776 220,48 K
ariddc.dll Wed 18 May 2005 20:16:54 ..S.R 222.860 217,64 K
awiddc.dll Mon 21 Feb 2005 11:14:12 ..S.R 225.763 220,47 K
dad8thk.dll Thu 19 May 2005 13:48:08 A.... 225.597 220,31 K
dadskres.dll Thu 17 Mar 2005 10:12:26 ..S.R 224.006 218,75 K
dbsshlex.dll Wed 2 Mar 2005 20:23:56 ..S.R 223.124 217,89 K
dr240.dll Tue 17 May 2005 20:13:46 ..S.R 222.782 217,56 K
dvdskres.dll Mon 21 Feb 2005 16:53:24 ..S.R 225.767 220,47 K
dy210.dll Wed 23 Feb 2005 10:31:42 ..S.R 225.229 219,95 K
dzskmon.dll Wed 18 May 2005 20:03:36 ..... 225.966 220,67 K
efts.dll Fri 25 Feb 2005 20:24:00 ..S.R 223.077 217,85 K
ement.dll Wed 23 Feb 2005 17:11:36 ..S.R 225.005 219,73 K
en06l1~1.dll Thu 19 May 2005 13:47:38 ..S.R 226.120 220,82 K
ie2cltr.dll Sun 24 Apr 2005 18:50:36 A.... 155.648 152,00 K
ixmontr.dll Fri 25 Feb 2005 11:35:10 ..S.R 223.101 217,87 K
j26m0c~1.dll Wed 2 Mar 2005 19:44:36 ..S.R 223.802 218,55 K
kt06l7~1.dll Wed 2 Mar 2005 20:19:48 ..S.R 223.124 217,89 K
m6820g~1.dll Tue 17 May 2005 20:13:14 ..S.R 222.782 217,56 K
mfcshext.dll Thu 24 Feb 2005 11:12:08 ..S.R 225.776 220,48 K
mfg4dmod.dll Wed 18 May 2005 20:13:02 ..S.R 222.860 217,64 K
mvsip32.dll Thu 19 May 2005 13:46:38 ..... 226.120 220,82 K
mwawt.dll Fri 18 Feb 2005 13:29:20 ..S.R 222.391 217,18 K
o2660c~1.dll Tue 22 Feb 2005 11:49:20 ..S.R 223.864 218,62 K
onbc16gt.dll Sat 19 Feb 2005 21:08:30 ..S.R 225.763 220,47 K
p48q0e~1.dll Tue 17 May 2005 10:13:42 ..S.R 224.305 219,05 K
polmon.dll Fri 25 Feb 2005 14:04:36 ..S.R 224.904 219,63 K
rhaenh.dll Thu 24 Feb 2005 17:25:44 ..S.R 225.005 219,73 K
s6pulg~1.dll Thu 19 May 2005 23:18:44 ..S.R 223.196 217,96 K
sgi.dll Mon 21 Feb 2005 2:23:54 ..S.R 223.866 218,62 K
smlgntfy.dll Sat 19 Feb 2005 11:15:12 ..S.R 223.866 218,62 K
sporder.dll Wed 2 Mar 2005 20:19:00 A.... 8.464 8,27 K
ssfolder.dll Mon 21 Feb 2005 18:46:54 ..S.R 225.763 220,47 K
symneti.dll Tue 5 Apr 2005 11:17:04 A.... 517.848 505,71 K
symredir.dll Tue 5 Apr 2005 11:17:04 A.... 132.824 129,71 K
tlemeui.dll Thu 19 May 2005 23:18:44 ..S.R 226.120 220,82 K
wqavusd.dll Wed 18 May 2005 20:09:00 ..S.R 222.860 217,64 K

38 items found: 38 files (30 H/S), 0 directories.
Total of file sizes: 8.408.745 bytes 8,02 M
Locate .tmp files:

No matches found.
************************************************** ********************************
Directory Listing of system files:
El volumen de la unidad C es WinXP
El n£mero de serie del volumen es: 64AF-03A5

Directorio de C:\WINDOWS\System32

19/05/2005 23:23 <DIR> dllcache
19/05/2005 23:18 226.120 tlemeui.dll
19/05/2005 23:18 223.196 s6pulg7916.dll
19/05/2005 13:47 226.120 en06l1ds1.dll
18/05/2005 20:16 222.860 ARIDDC.DLL
18/05/2005 20:13 222.860 mfg4dmod.dll
18/05/2005 20:08 222.860 wqavusd.dll
17/05/2005 20:13 222.782 DR240.dll
17/05/2005 20:13 222.782 m6820gloe6qc0.dll
17/05/2005 10:13 224.305 p48q0el5ehq.dll
22/04/2005 00:59 56 F9D02D37E4.sys
22/04/2005 00:59 1.682 KGyGaAvL.sys
02/04/2005 19:29 7.168 Thumbs.db
17/03/2005 10:12 224.006 dadskres.dll
02/03/2005 20:23 223.124 dbsshlex.dll
02/03/2005 20:19 223.124 kt06l7ds1.dll
02/03/2005 19:44 223.802 j26m0cj1efo.dll
25/02/2005 20:23 223.077 efts.dll
25/02/2005 14:04 224.904 polmon.dll
25/02/2005 11:35 223.101 ixmontr.dll
25/02/2005 09:54 225.776 aosnt.dll
24/02/2005 17:25 225.005 rhaenh.dll
24/02/2005 11:12 225.776 mfcshext.dll
23/02/2005 17:11 225.005 ement.dll
23/02/2005 10:31 225.229 DY210.dll
22/02/2005 17:14 225.005 amptif.dll
22/02/2005 11:49 223.864 o2660cjsefo60.dll
21/02/2005 18:46 225.763 ssfolder.dll
21/02/2005 16:53 225.767 dvdskres.dll
21/02/2005 11:14 225.763 AWIDDC.DLL
21/02/2005 02:23 223.866 sgi.dll
19/02/2005 21:08 225.763 onbc16gt.dll
19/02/2005 11:15 223.866 smlgntfy.dll
18/02/2005 13:29 222.391 mwawt.dll
17/02/2005 14:07 222.391 cnmaddin.dll
16/02/2005 14:26 226.090 wdninet.dll
15/02/2005 15:40 226.090 kzdcz.dll
12/02/2005 17:21 226.090 mputilse.dll
10/02/2005 13:42 223.141 pmisdecd.dll
06/02/2005 15:14 224.124 lsghours.dll
29/01/2005 14:30 224.078 svmsg.dll
25/01/2005 19:47 223.874 acsmsext.dll
25/01/2005 14:18 223.493 swbcsp.dll
22/01/2005 17:52 226.006 dflay.dll
22/01/2005 00:45 224.139 mljetoledb40.dll
16/01/2005 18:20 224.765 scmpsnap.dll
09/01/2005 20:02 223.157 t8r8li9u18.dll
09/01/2005 11:41 225.781 ipircl.dll
07/01/2005 17:40 224.503 mcdmo.dll
07/01/2005 15:02 223.622 wynsrv.dll
06/01/2005 20:46 223.956 clprops.dll
06/01/2005 17:49 223.622 mnls31.dll
06/01/2005 14:42 223.225 nqtrap.dll
05/01/2005 21:37 224.199 krdusx.dll
05/01/2005 19:41 223.225 dMdramp.dll
05/01/2005 18:40 225.483 ACHPRXY.DLL
05/01/2005 18:40 225.543 i0600ajmedoa0.dll
04/01/2005 10:43 222.685 hrnu0559e.dll
03/01/2005 19:47 224.263 mvr2l99o1.dll
03/01/2005 19:44 224.263 xwsp1res.dll
31/12/2004 12:24 226.008 m0ju0a19ed.dll
31/12/2004 12:22 32 {3D47EDDA-4757-43E9-99D7-9399C09F89A9}.dat
31/12/2004 12:22 32 {0A5BEBF0-A7CC-48D1-A789-667D824CB937}.dat
31/12/2004 11:36 224.753 dnr6019se.dll
22/12/2004 21:23 389.120 ?hkntfs.exe
13/12/2003 12:36 <DIR> Microsoft
64 archivos 13.408.521 bytes
2 dirs 43.710.988.288 bytes libres


Te agradezco de veras lo que estas haciendo por mi no quiero ser pesado pero muchas gracias...

Bien ya que esta herramienta es nueva te recomiendo hacer una copia de seguridad de tu sistema por si hay algún inconveniente.

Después cerrar cualquier programa que tengas abierto ya que después de realizar estos pasos se va a reiniciar el sistema.

En la carpeta de l2mfix de tu escritorio hacele doble click en l2mfix.bat y selecciona la opción numero 2 (Run Fix) y dale Enter y luego cualquier tecla para que se reinicie el sistema.

Después que reinicie el Pc puede que los iconos y parte del escritorio no se vean (esto es normal). L2mfix continuará explorando el sistema y cuando termine se abre nuevamente el Notepad con un nuevo registro el cual tenes que pegarlo en este mensaje a ver como quedo la cosa junto con un nuevo log de HijackThis. y contanos como funciona el sistema.

¡IMPORTANTE: NO ejecutes ninguna otra opción u otro archivo de la carpeta l2mfix hasta que te lo indique!

Tengo buenas noticias llevo casi una hora conectado a internet y no se ha abierto ninguna ventana no deseada estoy muy contento.
De todas formas siguiendo tus indicaciones aqui te mando el log de L2mfix:


L2Mfix 1.03

Running From:
C:\Documents and Settings\Usuario\Escritorio\l2mfix



RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(ID-NI) ALLOW Read BUILTIN\Usuarios
(ID-IO) ALLOW Read BUILTIN\Usuarios
(ID-NI) ALLOW Read BUILTIN\Usuarios avanzados
(ID-IO) ALLOW Read BUILTIN\Usuarios avanzados
(ID-NI) ALLOW Full access BUILTIN\Administradores
(ID-IO) ALLOW Full access BUILTIN\Administradores
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER



Setting registry permissions:


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!


Denying C(CI) access for predefined group "Administrators"
- adding new ACCESS DENY entry


Registry Permissions set too:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(CI) DENY --C------- BUILTIN\Administradores
(ID-NI) ALLOW Read BUILTIN\Usuarios
(ID-IO) ALLOW Read BUILTIN\Usuarios
(ID-NI) ALLOW Read BUILTIN\Usuarios avanzados
(ID-IO) ALLOW Read BUILTIN\Usuarios avanzados
(ID-NI) ALLOW Full access BUILTIN\Administradores
(ID-IO) ALLOW Full access BUILTIN\Administradores
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER



Setting up for Reboot


Starting Reboot!

C:\Documents and Settings\Usuario\Escritorio\l2mfix
System Rebooted!

Running From:
C:\Documents and Settings\Usuario\Escritorio\l2mfix

killing explorer and rundll32.exe

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 1284 'explorer.exe'
Killing PID 1284 'explorer.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 1632 'rundll32.exe'

Scanning First Pass. Please Wait!

First Pass Completed

Second Pass Scanning

Second pass Completed!
Backing Up: C:\WINDOWS\system32\ACHPRXY.DLL
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\acsmsext.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\amptif.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\aosnt.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\ARIDDC.DLL
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\AWIDDC.DLL
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\clprops.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\cnmaddin.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\dAd8thk.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\dadskres.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\dbsshlex.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\dflay.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\dMdramp.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\dnr4019qe.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\dnr6019se.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\DR240.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\dvdskres.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\DY210.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\dzskmon.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\efts.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\ement.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\hrnu0559e.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\i0600ajmedoa0.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\ipircl.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\ixmontr.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\j26m0cj1efo.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\jt2q07f5e.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\krdusx.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\kt06l7ds1.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\kzdcz.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\lGprxy.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\lsghours.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\m0ju0a19ed.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\m6820gloe6qc0.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\mcdmo.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\mfcshext.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\mfg4dmod.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\mljetoledb40.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\mnls31.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\mputilse.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\mvr2l99o1.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\mvsip32.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\mwawt.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\nqtrap.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\o2660cjsefo60.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\onbc16gt.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\p48q0el5ehq.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\pmisdecd.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\polmon.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\rhaenh.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\rzgwizc.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\scmpsnap.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\sgi.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\smlgntfy.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\ssfolder.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\svmsg.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\swbcsp.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\t8r8li9u18.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\wdninet.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\wqavusd.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\wynsrv.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\xwsp1res.dll
1 archivos copiados.
deleting: C:\WINDOWS\system32\ACHPRXY.DLL
Successfully Deleted: C:\WINDOWS\system32\ACHPRXY.DLL
deleting: C:\WINDOWS\system32\acsmsext.dll
Successfully Deleted: C:\WINDOWS\system32\acsmsext.dll
deleting: C:\WINDOWS\system32\amptif.dll
Successfully Deleted: C:\WINDOWS\system32\amptif.dll
deleting: C:\WINDOWS\system32\aosnt.dll
Successfully Deleted: C:\WINDOWS\system32\aosnt.dll
deleting: C:\WINDOWS\system32\ARIDDC.DLL
Successfully Deleted: C:\WINDOWS\system32\ARIDDC.DLL
deleting: C:\WINDOWS\system32\AWIDDC.DLL
Successfully Deleted: C:\WINDOWS\system32\AWIDDC.DLL
deleting: C:\WINDOWS\system32\clprops.dll
Successfully Deleted: C:\WINDOWS\system32\clprops.dll
deleting: C:\WINDOWS\system32\cnmaddin.dll
Successfully Deleted: C:\WINDOWS\system32\cnmaddin.dll
deleting: C:\WINDOWS\system32\dAd8thk.dll
Successfully Deleted: C:\WINDOWS\system32\dAd8thk.dll
deleting: C:\WINDOWS\system32\dadskres.dll
Successfully Deleted: C:\WINDOWS\system32\dadskres.dll
deleting: C:\WINDOWS\system32\dbsshlex.dll
Successfully Deleted: C:\WINDOWS\system32\dbsshlex.dll
deleting: C:\WINDOWS\system32\dflay.dll
Successfully Deleted: C:\WINDOWS\system32\dflay.dll
deleting: C:\WINDOWS\system32\dMdramp.dll
Successfully Deleted: C:\WINDOWS\system32\dMdramp.dll
deleting: C:\WINDOWS\system32\dnr4019qe.dll
Successfully Deleted: C:\WINDOWS\system32\dnr4019qe.dll
deleting: C:\WINDOWS\system32\dnr6019se.dll
Successfully Deleted: C:\WINDOWS\system32\dnr6019se.dll
deleting: C:\WINDOWS\system32\DR240.dll
Successfully Deleted: C:\WINDOWS\system32\DR240.dll
deleting: C:\WINDOWS\system32\dvdskres.dll
Successfully Deleted: C:\WINDOWS\system32\dvdskres.dll
deleting: C:\WINDOWS\system32\DY210.dll
Successfully Deleted: C:\WINDOWS\system32\DY210.dll
deleting: C:\WINDOWS\system32\dzskmon.dll
Successfully Deleted: C:\WINDOWS\system32\dzskmon.dll
deleting: C:\WINDOWS\system32\efts.dll
Successfully Deleted: C:\WINDOWS\system32\efts.dll
deleting: C:\WINDOWS\system32\ement.dll
Successfully Deleted: C:\WINDOWS\system32\ement.dll
deleting: C:\WINDOWS\system32\hrnu0559e.dll
Successfully Deleted: C:\WINDOWS\system32\hrnu0559e.dll
deleting: C:\WINDOWS\system32\i0600ajmedoa0.dll
Successfully Deleted: C:\WINDOWS\system32\i0600ajmedoa0.dll
deleting: C:\WINDOWS\system32\ipircl.dll
Successfully Deleted: C:\WINDOWS\system32\ipircl.dll
deleting: C:\WINDOWS\system32\ixmontr.dll
Successfully Deleted: C:\WINDOWS\system32\ixmontr.dll
deleting: C:\WINDOWS\system32\j26m0cj1efo.dll
Successfully Deleted: C:\WINDOWS\system32\j26m0cj1efo.dll
deleting: C:\WINDOWS\system32\jt2q07f5e.dll
Successfully Deleted: C:\WINDOWS\system32\jt2q07f5e.dll
deleting: C:\WINDOWS\system32\krdusx.dll
Successfully Deleted: C:\WINDOWS\system32\krdusx.dll
deleting: C:\WINDOWS\system32\kt06l7ds1.dll
Successfully Deleted: C:\WINDOWS\system32\kt06l7ds1.dll
deleting: C:\WINDOWS\system32\kzdcz.dll
Successfully Deleted: C:\WINDOWS\system32\kzdcz.dll
deleting: C:\WINDOWS\system32\lGprxy.dll
Successfully Deleted: C:\WINDOWS\system32\lGprxy.dll
deleting: C:\WINDOWS\system32\lsghours.dll
Successfully Deleted: C:\WINDOWS\system32\lsghours.dll
deleting: C:\WINDOWS\system32\m0ju0a19ed.dll
Successfully Deleted: C:\WINDOWS\system32\m0ju0a19ed.dll
deleting: C:\WINDOWS\system32\m6820gloe6qc0.dll
Successfully Deleted: C:\WINDOWS\system32\m6820gloe6qc0.dll
deleting: C:\WINDOWS\system32\mcdmo.dll
Successfully Deleted: C:\WINDOWS\system32\mcdmo.dll
deleting: C:\WINDOWS\system32\mfcshext.dll
Successfully Deleted: C:\WINDOWS\system32\mfcshext.dll
deleting: C:\WINDOWS\system32\mfg4dmod.dll
Successfully Deleted: C:\WINDOWS\system32\mfg4dmod.dll
deleting: C:\WINDOWS\system32\mljetoledb40.dll
Successfully Deleted: C:\WINDOWS\system32\mljetoledb40.dll
deleting: C:\WINDOWS\system32\mnls31.dll
Successfully Deleted: C:\WINDOWS\system32\mnls31.dll
deleting: C:\WINDOWS\system32\mputilse.dll
Successfully Deleted: C:\WINDOWS\system32\mputilse.dll
deleting: C:\WINDOWS\system32\mvr2l99o1.dll
Successfully Deleted: C:\WINDOWS\system32\mvr2l99o1.dll
deleting: C:\WINDOWS\system32\mvsip32.dll
Successfully Deleted: C:\WINDOWS\system32\mvsip32.dll
deleting: C:\WINDOWS\system32\mwawt.dll
Successfully Deleted: C:\WINDOWS\system32\mwawt.dll
deleting: C:\WINDOWS\system32\nqtrap.dll
Successfully Deleted: C:\WINDOWS\system32\nqtrap.dll
deleting: C:\WINDOWS\system32\o2660cjsefo60.dll
Successfully Deleted: C:\WINDOWS\system32\o2660cjsefo60.dll
deleting: C:\WINDOWS\system32\onbc16gt.dll
Successfully Deleted: C:\WINDOWS\system32\onbc16gt.dll
deleting: C:\WINDOWS\system32\p48q0el5ehq.dll
Successfully Deleted: C:\WINDOWS\system32\p48q0el5ehq.dll
deleting: C:\WINDOWS\system32\pmisdecd.dll
Successfully Deleted: C:\WINDOWS\system32\pmisdecd.dll
deleting: C:\WINDOWS\system32\polmon.dll
Successfully Deleted: C:\WINDOWS\system32\polmon.dll
deleting: C:\WINDOWS\system32\rhaenh.dll
Successfully Deleted: C:\WINDOWS\system32\rhaenh.dll
deleting: C:\WINDOWS\system32\rzgwizc.dll
Successfully Deleted: C:\WINDOWS\system32\rzgwizc.dll
deleting: C:\WINDOWS\system32\scmpsnap.dll
Successfully Deleted: C:\WINDOWS\system32\scmpsnap.dll
deleting: C:\WINDOWS\system32\sgi.dll
Successfully Deleted: C:\WINDOWS\system32\sgi.dll
deleting: C:\WINDOWS\system32\smlgntfy.dll
Successfully Deleted: C:\WINDOWS\system32\smlgntfy.dll
deleting: C:\WINDOWS\system32\ssfolder.dll
Successfully Deleted: C:\WINDOWS\system32\ssfolder.dll
deleting: C:\WINDOWS\system32\svmsg.dll
Successfully Deleted: C:\WINDOWS\system32\svmsg.dll
deleting: C:\WINDOWS\system32\swbcsp.dll
Successfully Deleted: C:\WINDOWS\system32\swbcsp.dll
deleting: C:\WINDOWS\system32\t8r8li9u18.dll
Successfully Deleted: C:\WINDOWS\system32\t8r8li9u18.dll
deleting: C:\WINDOWS\system32\wdninet.dll
Successfully Deleted: C:\WINDOWS\system32\wdninet.dll
deleting: C:\WINDOWS\system32\wqavusd.dll
Successfully Deleted: C:\WINDOWS\system32\wqavusd.dll
deleting: C:\WINDOWS\system32\wynsrv.dll
Successfully Deleted: C:\WINDOWS\system32\wynsrv.dll
deleting: C:\WINDOWS\system32\xwsp1res.dll
Successfully Deleted: C:\WINDOWS\system32\xwsp1res.dll

Desktop.ini sucessfully removed

Zipping up files for submission:
adding: ACHPRXY.DLL (164 bytes security) (deflated 5%)
adding: acsmsext.dll (164 bytes security) (deflated 4%)
adding: amptif.dll (164 bytes security) (deflated 4%)
adding: aosnt.dll (164 bytes security) (deflated 5%)
adding: ARIDDC.DLL (164 bytes security) (deflated 4%)
adding: AWIDDC.DLL (164 bytes security) (deflated 5%)
adding: clprops.dll (164 bytes security) (deflated 4%)
adding: cnmaddin.dll (164 bytes security) (deflated 3%)
adding: dAd8thk.dll (164 bytes security) (deflated 5%)
adding: dadskres.dll (164 bytes security) (deflated 4%)
adding: dbsshlex.dll (164 bytes security) (deflated 4%)
adding: dflay.dll (164 bytes security) (deflated 5%)
adding: dMdramp.dll (164 bytes security) (deflated 4%)
adding: dnr4019qe.dll (164 bytes security) (deflated 4%)
adding: dnr6019se.dll (164 bytes security) (deflated 4%)
adding: DR240.dll (164 bytes security) (deflated 4%)
adding: dvdskres.dll (164 bytes security) (deflated 5%)
adding: DY210.dll (164 bytes security) (deflated 5%)
adding: dzskmon.dll (164 bytes security) (deflated 5%)
adding: efts.dll (164 bytes security) (deflated 4%)
adding: ement.dll (164 bytes security) (deflated 4%)
adding: hrnu0559e.dll (164 bytes security) (deflated 3%)
adding: i0600ajmedoa0.dll (164 bytes security) (deflated 5%)
adding: ipircl.dll (164 bytes security) (deflated 5%)
adding: ixmontr.dll (164 bytes security) (deflated 4%)
adding: j26m0cj1efo.dll (164 bytes security) (deflated 4%)
adding: jt2q07f5e.dll (164 bytes security) (deflated 3%)
adding: krdusx.dll (164 bytes security) (deflated 4%)
adding: kt06l7ds1.dll (164 bytes security) (deflated 4%)
adding: kzdcz.dll (164 bytes security) (deflated 5%)
adding: lGprxy.dll (164 bytes security) (deflated 5%)
adding: lsghours.dll (164 bytes security) (deflated 4%)
adding: m0ju0a19ed.dll (164 bytes security) (deflated 5%)
adding: m6820gloe6qc0.dll (164 bytes security) (deflated 4%)
adding: mcdmo.dll (164 bytes security) (deflated 4%)
adding: mfcshext.dll (164 bytes security) (deflated 5%)
adding: mfg4dmod.dll (164 bytes security) (deflated 4%)
adding: mljetoledb40.dll (164 bytes security) (deflated 4%)
adding: mnls31.dll (164 bytes security) (deflated 4%)
adding: mputilse.dll (164 bytes security) (deflated 5%)
adding: mvr2l99o1.dll (164 bytes security) (deflated 4%)
adding: mvsip32.dll (164 bytes security) (deflated 5%)
adding: mwawt.dll (164 bytes security) (deflated 3%)
adding: nqtrap.dll (164 bytes security) (deflated 4%)
adding: o2660cjsefo60.dll (164 bytes security) (deflated 4%)
adding: onbc16gt.dll (164 bytes security) (deflated 5%)
adding: p48q0el5ehq.dll (164 bytes security) (deflated 4%)
adding: pmisdecd.dll (164 bytes security) (deflated 4%)
adding: polmon.dll (164 bytes security) (deflated 4%)
adding: rhaenh.dll (164 bytes security) (deflated 4%)
adding: rzgwizc.dll (164 bytes security) (deflated 5%)
adding: scmpsnap.dll (164 bytes security) (deflated 4%)
adding: sgi.dll (164 bytes security) (deflated 4%)
adding: smlgntfy.dll (164 bytes security) (deflated 4%)
adding: ssfolder.dll (164 bytes security) (deflated 5%)
adding: svmsg.dll (164 bytes security) (deflated 4%)
adding: swbcsp.dll (164 bytes security) (deflated 4%)
adding: t8r8li9u18.dll (164 bytes security) (deflated 4%)
adding: wdninet.dll (164 bytes security) (deflated 5%)
adding: wqavusd.dll (164 bytes security) (deflated 4%)
adding: wynsrv.dll (164 bytes security) (deflated 4%)
adding: xwsp1res.dll (164 bytes security) (deflated 4%)
adding: clear.reg (164 bytes security) (deflated 56%)
adding: echo.reg (164 bytes security) (deflated 10%)
adding: desktop.ini (164 bytes security) (deflated 15%)
adding: direct.txt (164 bytes security) (deflated 2%)
adding: lo2.txt (164 bytes security) (deflated 87%)
adding: readme.txt (164 bytes security) (deflated 49%)
adding: report.txt (164 bytes security) (deflated 67%)
adding: test.txt (164 bytes security) (deflated 84%)
adding: test2.txt (164 bytes security) (deflated 38%)
adding: test3.txt (164 bytes security) (deflated 38%)
adding: test5.txt (164 bytes security) (deflated 38%)
adding: xfind.txt (164 bytes security) (deflated 79%)
adding: backregs/02BD67DD-BD94-448D-814A-CF5BF88DDA4B.reg (164 bytes security) (deflated 70%)
adding: backregs/885D4310-61E5-4CCB-B400-7D9B2D99F28B.reg (164 bytes security) (deflated 70%)
adding: backregs/92D28E21-69DC-46F3-8BB3-38A69C6EEDDD.reg (164 bytes security) (deflated 70%)
adding: backregs/9935CA6E-E3B3-4726-B9A1-DD5989415BCE.reg (164 bytes security) (deflated 70%)
adding: backregs/ECD970F2-829E-4B1F-BC2D-AA86ADFE8C55.reg (164 bytes security) (deflated 70%)
adding: backregs/shell.reg (164 bytes security) (deflated 73%)

Restoring Registry Permissions:


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!


Revoking access for predefined group "Administrators"
Inherited ACE can not be revoked here!
Inherited ACE can not be revoked here!


Registry permissions set too:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(ID-NI) ALLOW Read BUILTIN\Usuarios
(ID-IO) ALLOW Read BUILTIN\Usuarios
(ID-NI) ALLOW Read BUILTIN\Usuarios avanzados
(ID-IO) ALLOW Read BUILTIN\Usuarios avanzados
(ID-NI) ALLOW Full access BUILTIN\Administradores
(ID-IO) ALLOW Full access BUILTIN\Administradores
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER


Restoring Sedebugprivilege:

Granting SeDebugPrivilege to Administrators ... failed (GetAccountSid(Administrators)=1332

deleting local copy: ACHPRXY.DLL
deleting local copy: acsmsext.dll
deleting local copy: amptif.dll
deleting local copy: aosnt.dll
deleting local copy: ARIDDC.DLL
deleting local copy: AWIDDC.DLL
deleting local copy: clprops.dll
deleting local copy: cnmaddin.dll
deleting local copy: dAd8thk.dll
deleting local copy: dadskres.dll
deleting local copy: dbsshlex.dll
deleting local copy: dflay.dll
deleting local copy: dMdramp.dll
deleting local copy: dnr4019qe.dll
deleting local copy: dnr6019se.dll
deleting local copy: DR240.dll
deleting local copy: dvdskres.dll
deleting local copy: DY210.dll
deleting local copy: dzskmon.dll
deleting local copy: efts.dll
deleting local copy: ement.dll
deleting local copy: hrnu0559e.dll
deleting local copy: i0600ajmedoa0.dll
deleting local copy: ipircl.dll
deleting local copy: ixmontr.dll
deleting local copy: j26m0cj1efo.dll
deleting local copy: jt2q07f5e.dll
deleting local copy: krdusx.dll
deleting local copy: kt06l7ds1.dll
deleting local copy: kzdcz.dll
deleting local copy: lGprxy.dll
deleting local copy: lsghours.dll
deleting local copy: m0ju0a19ed.dll
deleting local copy: m6820gloe6qc0.dll
deleting local copy: mcdmo.dll
deleting local copy: mfcshext.dll
deleting local copy: mfg4dmod.dll
deleting local copy: mljetoledb40.dll
deleting local copy: mnls31.dll
deleting local copy: mputilse.dll
deleting local copy: mvr2l99o1.dll
deleting local copy: mvsip32.dll
deleting local copy: mwawt.dll
deleting local copy: nqtrap.dll
deleting local copy: o2660cjsefo60.dll
deleting local copy: onbc16gt.dll
deleting local copy: p48q0el5ehq.dll
deleting local copy: pmisdecd.dll
deleting local copy: polmon.dll
deleting local copy: rhaenh.dll
deleting local copy: rzgwizc.dll
deleting local copy: scmpsnap.dll
deleting local copy: sgi.dll
deleting local copy: smlgntfy.dll
deleting local copy: ssfolder.dll
deleting local copy: svmsg.dll
deleting local copy: swbcsp.dll
deleting local copy: t8r8li9u18.dll
deleting local copy: wdninet.dll
deleting local copy: wqavusd.dll
deleting local copy: wynsrv.dll
deleting local copy: xwsp1res.dll

The following Is the Current Export of the Winlogon notify key:
************************************************** **************************
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
"DLLName"="Ati2evxx.dll"
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000001
"Lock"="AtiLockEvent"
"Logoff"="AtiLogoffEvent"
"Logon"="AtiLogonEvent"
"Disconnect"="AtiDisConnectEvent"
"Reconnect"="AtiReConnectEvent"
"Safe"=dword:00000000
"Shutdown"="AtiShutdownEvent"
"StartScreenSaver"="AtiStartScreenSaverEvent"
"StartShell"="AtiStartShellEvent"
"Startup"="AtiStartupEvent"
"StopScreenSaver"="AtiStopScreenSaverEvent"
"Unlock"="AtiUnLockEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33, 00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e, 00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"