Foro de InfoSpyware - Foro de Hijackthis - Foro de Virus

Logfile of HijackThis v1.99.1
Scan saved at 20:02:53, on 23/08/06
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\KERNELS8.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\XPUPDATE.EXE
C:\WINDOWS\SYSTEM\WINOA386.MOD
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\DLH9JKDQ2.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\VXGAME4.EXE
C:\ARCHIVOS DE PROGRAMA\INTERNET EXPLORER\IEXPLORE.EXE
C:\ARCHIVOS DE PROGRAMA\HJT\HIJACKTHIS.EXE
C:\WINDOWS\SYSTEM\UPNP.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://69.50.182.88/?qq=
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.es/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://69.50.182.88/?qq=
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyServer = proxy.wanadoo.es:80
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O1 - Hosts: 69.50.136.245 www.madthumbs.com
O1 - Hosts: 69.50.136.245 madthumbs.com www.sexocean.com sexocean.com www.cowlist.com cowlist.com www.easygals.com easygals.com www.muyzorras.com muyzorras.com www.xnxx.com xnxx.com
O1 - Hosts: 69.50.136.245 www.pichunter.com pichunter.com www.88by88.com 88by88.com www.rubias19.com rubias19.com hqgal.com www.hqgal.com petiteteenager.com www.petiteteenager.com petardas.com www.petardas.com
O1 - Hosts: 69.50.136.245 puppykibble.com www.puppykibble.com www.sweetiestgp.com sweetiestgp.com www.bunnyteens.com bunnyteens.com www.amateurcurves.com amateurcurves.com thumbzilla.com www.thumbzilla.com
O1 - Hosts: 69.50.136.245 sexape.com www.sexape.com picwarehouse.com www.picwarehouse.com sublimedirectory.com www.sublimedirectory.com fuckk.com www.fuckk.com youngerbabes.com www.youngerbabes.com 1storgasm.com www.1storgasm.com slickgalleries.com
O1 - Hosts: 69.50.136.245 www.madteenies.com madteenies.com www.slickgalleries.com 10fuck.com www.10fuck.com smashingthumbs.com www.thumbnailseries.com thumbnailseries.com goatlist.com www.goatlist.com teentiger.com www.teentiger.com
O1 - Hosts: 69.50.136.245 amandalist.com www.amandalist.com www.absolut-series.com absolut-series.com lloronas.com www.lloronas.com p0rno.org www.p0rno.org www.starslist.com starslist.com gigagalleries.com
O1 - Hosts: 69.50.136.245 dianapost.com www.dianapost.com www.zadina.com zadina.com www.frogsex.com frogsex.com teenagesecrets.biz www.teenagesecrets.biz ratemycameltoe.com www.mature-post.com mature-post.com www.call-kelly.com
O1 - Hosts: 69.50.136.245 elreyano.com www.elreyano.com purextc.com www.purextc.com officespy.com www.officespy.com www.secretarygalleries.com www.gigagalleries.com www.croseries.com croseries.com www.top-galleries.com top-galleries.com
O1 - Hosts: 69.50.136.245 pussy.org www.pussy.org freesmutseries.net www.freesmutseries.net porno-pics-free.com www.porno-pics-free.com catlist.com www.smashingthumbs.com call-kelly.com www.boneme.com boneme.com www.series-xxx.com series-xxx.com
O1 - Hosts: 69.50.136.245 teeniefiles.com www.teeniefiles.com jpeg4free.com www.jpeg4free.com www.catlist.com www.ratemycameltoe.com sleazydream.com www.sleazydream.com www.justacthard.com justacthard.com
O1 - Hosts: 69.50.136.245 sexyfotky.cz www.sexyfotky.cz hammervideo.com www.hammervideo.com rawpussy.com www.rawpussy.com teeniesxxx.com www.teeniesxxx.com porn-view.com www.porn-view.com dailybasis.com www.dailybasis.com
O1 - Hosts: 69.50.136.245 pornstarfinder.net www.pornstarfinder.net jennysbookmarks.com www.jennysbookmarks.com babes4free.com www.babes4free.com 3pic.com www.3pic.com www.freefoto.cz freefoto.cz
O1 - Hosts: 69.50.136.245 searchgals.com www.searchgals.com picsmonster.com www.picsmonster.com sublimepie.com www.sublimepie.com pornhelious.com www.pornhelious.com galleries4free.com www.galleries4free.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\ARCHIVOS DE PROGRAMA\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [Upnp] c:\windows\system\upnp.exe
O4 - HKLM\..\Run: [System] C:\WINDOWS\SYSTEM\kernels8.exe
O4 - HKLM\..\Run: [stonedrv] c:\windows\system\stonedrv.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [SystemTools] C:\WINDOWS\SYSTEM\kernels8.exe
O4 - HKLM\..\RunServices: [stonedrv] c:\windows\system\stonedrv.exe
O4 - HKCU\..\Run: [Windows update loader] C:\Windows\xpupdate.exe
O4 - HKCU\..\Run: [stonedrv] c:\windows\system\stonedrv.exe
O4 - Startup: Gestion de Tienda.pif = C:\TPV.BAT
O4 - Startup: Microsoft Office.lnk = C:\Archivos de programa\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Get siteinfo data (fsc) - C:\Archivos de programa\EMS Free Surfer Companion\fslauncher.htm
O9 - Extra button: Free Surfer - {AFC3FA82-AD07-45cd-8B57-983435B9899E} - C:\Archivos de programa\EMS Free Surfer Companion\FS30.exe
O9 - Extra 'Tools' menuitem: Free Surfer - {AFC3FA82-AD07-45cd-8B57-983435B9899E} - C:\Archivos de programa\EMS Free Surfer Companion\FS30.exe
O15 - Trusted Zone: http://marcawas5.recoletos.es
O16 - DPF: {261EE805-4893-45A3-8E9E-AD90914CB39A} (VacPro.internazionale_98_ver11) - http://www9.advnt01.com/dialer/internazionale_98_ver11.CAB
O21 - SSODL: efkwKS - {1D1C19F4-B7B6-B35E-E239-322858240FCC} - C:\WINDOWS\SYSTEM\DBT.DLL
O21 - SSODL: SysTray.Exgl - {636821FC-6F5C-2f1b-B164-E67214F678E2} - C:\WINDOWS\SYSTEM\gkjcdnfa.dll

Hola y Bienvenid@ a Forospyware!



Descarga las siguientes herramientas:

• DelPSGuard v4.1.4
  
• Look2Me-Destroyer --> Copia la nota sobre como utililzarlo
  
• Killbox
  
• Regseeker
  
• Disk Cleaner

Paso 1:

• Configura el sistema para ver todos los archivos ocultos

Paso 2:

Ejecuta el hijackthis sin tener ningn otro programa abierto, marca y dale FixChecked a las siguientes entradas:

O1 - Hosts: 69.50.136.245 www.madthumbs.com
O1 - Hosts: 69.50.136.245 madthumbs.com www.sexocean.com sexocean.com www.cowlist.com cowlist.com www.easygals.com easygals.com www.muyzorras.com muyzorras.com www.xnxx.com xnxx.com
O1 - Hosts: 69.50.136.245 www.pichunter.com pichunter.com www.88by88.com 88by88.com www.rubias19.com rubias19.com hqgal.com www.hqgal.com petiteteenager.com www.petiteteenager.com petardas.com www.petardas.com
O1 - Hosts: 69.50.136.245 puppykibble.com www.puppykibble.com www.sweetiestgp.com sweetiestgp.com www.bunnyteens.com bunnyteens.com www.amateurcurves.com amateurcurves.com thumbzilla.com www.thumbzilla.com
O1 - Hosts: 69.50.136.245 sexape.com www.sexape.com picwarehouse.com www.picwarehouse.com sublimedirectory.com www.sublimedirectory.com fuckk.com www.fuckk.com youngerbabes.com www.youngerbabes.com 1storgasm.com www.1storgasm.com slickgalleries.com
O1 - Hosts: 69.50.136.245 www.madteenies.com madteenies.com www.slickgalleries.com 10fuck.com www.10fuck.com smashingthumbs.com www.thumbnailseries.com thumbnailseries.com goatlist.com www.goatlist.com teentiger.com www.teentiger.com
O1 - Hosts: 69.50.136.245 amandalist.com www.amandalist.com www.absolut-series.com absolut-series.com lloronas.com www.lloronas.com p0rno.org www.p0rno.org www.starslist.com starslist.com gigagalleries.com
O1 - Hosts: 69.50.136.245 dianapost.com www.dianapost.com www.zadina.com zadina.com www.frogsex.com frogsex.com teenagesecrets.biz www.teenagesecrets.biz ratemycameltoe.com www.mature-post.com mature-post.com www.call-kelly.com
O1 - Hosts: 69.50.136.245 elreyano.com www.elreyano.com purextc.com www.purextc.com officespy.com www.officespy.com www.secretarygalleries.com www.gigagalleries.com www.croseries.com croseries.com www.top-galleries.com top-galleries.com
O1 - Hosts: 69.50.136.245 pussy.org www.pussy.org freesmutseries.net www.freesmutseries.net porno-pics-free.com www.porno-pics-free.com catlist.com www.smashingthumbs.com call-kelly.com www.boneme.com boneme.com www.series-xxx.com series-xxx.com
O1 - Hosts: 69.50.136.245 teeniefiles.com www.teeniefiles.com jpeg4free.com www.jpeg4free.com www.catlist.com www.ratemycameltoe.com sleazydream.com www.sleazydream.com www.justacthard.com justacthard.com
O1 - Hosts: 69.50.136.245 sexyfotky.cz www.sexyfotky.cz hammervideo.com www.hammervideo.com rawpussy.com www.rawpussy.com teeniesxxx.com www.teeniesxxx.com porn-view.com www.porn-view.com dailybasis.com www.dailybasis.com
O1 - Hosts: 69.50.136.245 pornstarfinder.net www.pornstarfinder.net jennysbookmarks.com www.jennysbookmarks.com babes4free.com www.babes4free.com 3pic.com www.3pic.com www.freefoto.cz freefoto.cz
O1 - Hosts: 69.50.136.245 searchgals.com www.searchgals.com picsmonster.com www.picsmonster.com sublimepie.com www.sublimepie.com pornhelious.com www.pornhelious.com galleries4free.com www.galleries4free.com

O4 - HKLM\..\Run: [Upnp] c:\windows\system\upnp.exe
O4 - HKLM\..\Run: [System] C:\WINDOWS\SYSTEM\kernels8.exe
O4 - HKLM\..\Run: [stonedrv] c:\windows\system\stonedrv.exe
O4 - HKLM\..\RunServices: [SystemTools] C:\WINDOWS\SYSTEM\kernels8.exe
O4 - HKLM\..\RunServices: [stonedrv] c:\windows\system\stonedrv.exe
O4 - HKCU\..\Run: [Windows update loader] C:\Windows\xpupdate.exe
O4 - HKCU\..\Run: [stonedrv] c:\windows\system\stonedrv.exe

O16 - DPF: {261EE805-4893-45A3-8E9E-AD90914CB39A} (VacPro.internazionale_98_ver11) - http://www9.advnt01.com/dialer/internazionale_98_ver11.CAB

O21 - SSODL: efkwKS - {1D1C19F4-B7B6-B35E-E239-322858240FCC} - C:\WINDOWS\SYSTEM\DBT.DLL
O21 - SSODL: SysTray.Exgl - {636821FC-6F5C-2f1b-B164-E67214F678E2} - C:\WINDOWS\SYSTEM\gkjcdnfa.dll



Paso 3:

• Reinicia el sistema en modo a prueba de fallos (modo seguro)

Copia y pega las siguientes entradas en el Killbox (una a la vez) donde dice "Full Path of File to Delete" y le das click al boton rojo con cruz blanca del programa para eliminar el archivo:

c:\windows\system\upnp.exe

C:\WINDOWS\SYSTEM\kernels8.exe

c:\windows\system\stonedrv.exe

C:\Windows\xpupdate.exe

C:\WINDOWS\SYSTEM\DBT.DLL

C:\WINDOWS\SYSTEM\gkjcdnfa.dll



Ejecuta la herramienta DelPSGuard.exe


Limpia los temporales y cookies con el Disk Cleaner

Limpia el registro de windows con el Regseeker (pasalo varias veces hasta que no quede nada por limpiar)



Paso 4:

Reincia el sistema en modo normal y ejecuta la herramienta Look2me-Destroyer siguiendo los
pasos de la nota que te pedi copiar

Haz un chequeo con el antivirus online TrendMicro


Nos comentas como te fue y dejas un nuevo log para ver como quedo



Salu2