Hola, tengo un problema en la computadora de un amigo, le aparecen constantemente ventanas con propaganda de pharmacia y casinos, entre otras cosas, probe de sacarlo con el ad-adware, spybots, entre otras cosas y no logro que dejen de aparecer, pase el hijackThis y como tiene tantas cosas instaladas que no se que borrar y que no, algunos los encontre pero igual se que hay mas, por favor que alguien me de una mano, Muchas Gracias

Aca dejo el Log


Logfile of HijackThis v1.99.0
Scan saved at 17:19:01, on 30/05/2005
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\ARCHIVOS DE PROGRAMA\ALWIL SOFTWARE\AVAST4\ASHSERV.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\ARCHIVOS DE PROGRAMA\ALWIL SOFTWARE\AVAST4\ASHMAISV.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\GSICON.EXE
C:\PROGRAM FILES\SIEMENS\ADSL\DSLAGENT.EXE
C:\ARCHIVOS DE PROGRAMA\ALWIL SOFTWARE\AVAST4\ASHWEBSV.EXE
C:\ARCHIVOS DE PROGRAMA\THOMSON\DRAGDIAG.EXE
C:\ARCHIVOS DE PROGRAMA\WINPOET\WINPPPOVERETHERNET.EXE
C:\ARCHIVOS DE PROGRAMA\ALWIL SOFTWARE\AVAST4\SETUP\AVAST.SETUP
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\PROFILES\CARLOS\ESCRITORIO\NUEVA CARPETA\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL =
http://paypage.tux.nu
R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL =
http://paypage.tux.nu
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
http://ar.rd.yahoo.com/slv/ycheck/as/*http://
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
http://paypage.tux.nu
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =
http://ar.rd.yahoo.com/slv/ycheck/as/*http://search.yahoo.com/search?p=%s
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
Vínculos
R3 - URLSearchHook: (no name) - {39A5019F-FF54-3860-06C0-377BE43286C5} -
dialer423.dll (file missing)
N1 - Netscape 4: user_pref("browser.startup.homepage",
"http://www.gohip.com/browser/?pid=AAAAAAAAAAAAHR&ence=&pnce=&sid=7925B3C0D83411 D49D31444553540000&cat=&v=18");
(C:\Archivos de programa\Netscape\Users\crystalmusic\prefs.js)
O2 - BHO: (no name) - {EA6192FE-3EB6-1F43-2001-69C22BB4A8C1} -
C:\windows\system\nhsomwnm.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
C:\ARCHIVOS DE PROGRAMA\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: ActiveX Control - {8A43FA00-C8CA-11D9-9E11-000E50252B9E} -
C:\WINDOWS\SYSTEM\MSZWS.DLL
O2 - BHO: (no name) - {08BEC6AA-49FC-4379-3587-4B21E286C19E} -
C:\WINDOWS\SYSTEM\IE2CLTR.DLL
O2 - BHO: IE SP2 AddOn - {917EDE20-C8CA-11D9-9E11-000E50252B9E} -
C:\WINDOWS\SYSTEM\SPZYR.DLL
O2 - BHO: Cls - {CF021F40-3E14-23A5-CBA2-716D61783548} -
C:\WINDOWS\SYSTEM\MAX3548.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Archivos
de programa\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: (no name) - {08BEC6AA-49FC-4379-3587-4B21E286C19E} -
C:\WINDOWS\SYSTEM\IE2CLTR.DLL
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [The site you have requested doesn't ex]
c:\WINDOWS\System\The site you have requested doesn't exist.
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE"
-atboottime
O4 - HKLM\..\Run: [] c:\WINDOWS\System\}
O4 - HKLM\..\Run: [// Browser Detec] c:\WINDOWS\System\// Browser Detection
O4 - HKLM\..\Run: [NS4 = (document.layers) ? true : fa]
c:\WINDOWS\System\NS4 = (document.layers) ? true : false;
O4 - HKLM\..\Run: [IEmac = ((document.all)&&(isMac)) ? true : fa]
c:\WINDOWS\System\IEmac = ((document.all)&&(isMac)) ? true : false;
O4 - HKLM\..\Run: [IE4plus = (document.all) ? true : fa]
c:\WINDOWS\System\IE4plus = (document.all) ? true : false;
O4 - HKLM\..\Run: [ver4 = (NS4 || IE4plus) ? true : fa]
c:\WINDOWS\System\ver4 = (NS4 || IE4plus) ? true : false;
O4 - HKLM\..\Run: [NS6 = (!document.layers) &&
(navigator.userAgent.indexOf('Netscape')!=-1)?true:fa] c:\WINDOWS\System\NS6
= (!document.layers) &&
(navigator.userAgent.indexOf('Netscape')!=-1)?true:false;
O4 - HKLM\..\Run: [IE5plus = IE5 || ] c:\WINDOWS\System\IE5plus = IE5 ||
IE6;
O4 - HKLM\..\Run: [IEMajor ] c:\WINDOWS\System\IEMajor = 0;
O4 - HKLM\..\Run: [if (IE4p] c:\WINDOWS\System\if (IE4plus)
O4 - HKLM\..\Run: [ IEMajor =
parseInt(navigator.appVersion.substring(start+5,en]
c:\WINDOWS\System\ IEMajor =
parseInt(navigator.appVersion.substring(start+5,en d));
O4 - HKLM\..\Run: [// Body onload utility (supports multiple onload functi]
c:\WINDOWS\System\// Body onload utility (supports multiple onload
functions)
O4 - HKLM\..\Run: [var gSafeOnload = new Arra] c:\WINDOWS\System\var
gSafeOnload = new Array();
O4 - HKLM\..\Run: [function SafeAddOnloa] c:\WINDOWS\System\function
SafeAddOnload(f)
O4 - HKLM\..\Run: [function SafeOnlo] c:\WINDOWS\System\function
SafeOnload()
O4 - HKLM\..\Run: [ gSafeOnload[i] c:\WINDOWS\System\ gSafeOnload[i]();
O4 - HKLM\..\Run: [function isInt(nu] c:\WINDOWS\System\function
isInt(numIn)
O4 - HKLM\..\Run: [ var checknum = parseInt(num] c:\WINDOWS\System\ var
checknum = parseInt(numIn);
O4 - HKLM\..\Run: [ return !isNaN(checkn] c:\WINDOWS\System\ return
!isNaN(checknum);
O4 - HKLM\..\Run: [function PUW_In] c:\WINDOWS\System\function PUW_Init()
O4 - HKLM\..\Run: [ if (gPopupWindow.CheckFrequenc] c:\WINDOWS\System\ if
(gPopupWindow.CheckFrequency())
O4 - HKLM\..\Run: [function PUW_Sh] c:\WINDOWS\System\function PUW_Show()
O4 - HKLM\..\Run: [ var newWin = window.open(this.url,this.name,settin]
c:\WINDOWS\System\ var newWin = window.open(this.url,this.name,settings);
O4 - HKLM\..\Run: [ if (! this.on] c:\WINDOWS\System\ if (! this.ontop)
O4 - HKLM\..\Run: [ window.focu] c:\WINDOWS\System\ window.focus();
O4 - HKLM\..\Run: [function PUW_CheckFrequen] c:\WINDOWS\System\function
PUW_CheckFrequency()
O4 - HKLM\..\Run: [ var shouldShow = this.frequency !]
c:\WINDOWS\System\ var shouldShow = this.frequency != 0;
O4 - HKLM\..\Run: [ var allCookies = document.coo] c:\WINDOWS\System\ var
allCookies = document.cookie;
O4 - HKLM\..\Run: [ end = allCookies.len] c:\WINDOWS\System\ end =
allCookies.length;
O4 - HKLM\..\Run: [ var freqStr = allCookies.substring(start+9,e]
c:\WINDOWS\System\ var freqStr = allCookies.substring(start+9,end);
O4 - HKLM\..\Run: [ if (isInt(freqS] c:\WINDOWS\System\ if
(isInt(freqStr))
O4 - HKLM\..\Run: [ this.frequency = parseInt(freqS]
c:\WINDOWS\System\ this.frequency = parseInt(freqStr);
O4 - HKLM\..\Run: [function PopupWindow(url,width,hei]
c:\WINDOWS\System\function PopupWindow(url,width,height)
O4 - HKLM\..\Run: [ this.width = wi] c:\WINDOWS\System\ this.width = width;
O4 - HKLM\..\Run: [ this.height = hei] c:\WINDOWS\System\ this.height =
height;
O4 - HKLM\..\Run: [ this.top = screen.availHeight/2 - height/2; // ce]
c:\WINDOWS\System\ this.top = screen.availHeight/2 - height/2; // center
O4 - HKLM\..\Run: [ this.left = screen.availWidth/2 - width/2; // ce]
c:\WINDOWS\System\ this.left = screen.availWidth/2 - width/2; // center
O4 - HKLM\..\Run: [ this.url = ] c:\WINDOWS\System\ this.url = url;
O4 - HKLM\..\Run: [ this.showDelay = 2] c:\WINDOWS\System\ this.showDelay =
2000;
O4 - HKLM\..\Run: [ this.frequency = 1; // how many times show per renewal
time pe] c:\WINDOWS\System\ this.frequency = 1; // how many times show per
renewal time period
O4 - HKLM\..\Run: [ this.renew = 1; // renew showing every x h]
c:\WINDOWS\System\ this.renew = 1; // renew showing every x hours
O4 - HKLM\..\Run: [ this.scrollbars= fa] c:\WINDOWS\System\ this.scrollbars=
false;
O4 - HKLM\..\Run: [ this.toolbar= fa] c:\WINDOWS\System\ this.toolbar=
false;
O4 - HKLM\..\Run: [function PUWSta] c:\WINDOWS\System\function PUWStart()
O4 - HKLM\..\Run: [SafeAddOnload(PUWSta]
c:\WINDOWS\System\SafeAddOnload(PUWStart);
O4 - HKLM\..\Run: [ashMaiSv] C:\ARCHIV~1\ALWILS~1\AVAST4\ashmaisv.exe
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [GSICONEXE] gsicon.exe
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\Siemens\Adsl\dslagent.exe
O4 - HKLM\..\Run: [function redirec] c:\WINDOWS\System\function redirect(){
O4 - HKLM\..\Run: [var strT] c:\WINDOWS\System\var strTemp;
O4 - HKLM\..\Run: [var strP] c:\WINDOWS\System\var strPort;
O4 - HKLM\..\Run: [ top.location.replace(strTe]
c:\WINDOWS\System\ top.location.replace(strTemp);
O4 - HKLM\..\Run: [avast! Web Scanner]
C:\ARCHIV~1\ALWILS~1\AVAST4\ASHWEBSV.EXE
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Archivos de
programa\thomson\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [a-winpoet-service] "C:\Archivos de
programa\WinPoET\winpppoverethernet.exe"
O4 - HKLM\..\Run: [CToolBar] cmon14.exe
O4 - HKLM\..\Run: [KeywordFinder] TForm1.exe
O4 - HKLM\..\RunServices: [avast!] C:\Archivos de programa\Alwil
Software\Avast4\ashServ.exe
O4 - HKCU\..\Run: [<H] c:\WINDOWS\System\<HEAD>
O4 - HKCU\..\Run: [ <TITLE>Error</TI] c:\WINDOWS\System\
<TITLE>Error</TITLE>
O4 - HKCU\..\Run: [</H] c:\WINDOWS\System\</HTML>
O4 - HKCU\..\Run: [<B] c:\WINDOWS\System\<BODY>
O4 - HKCU\..\Run: [] c:\WINDOWS\System\}
O4 - HKCU\..\Run: [// Browser Detec] c:\WINDOWS\System\// Browser Detection
O4 - HKCU\..\Run: [NS4 = (document.layers) ? true : fa]
c:\WINDOWS\System\NS4 = (document.layers) ? true : false;
O4 - HKCU\..\Run: [IEmac = ((document.all)&&(isMac)) ? true : fa]
c:\WINDOWS\System\IEmac = ((document.all)&&(isMac)) ? true : false;
O4 - HKCU\..\Run: [IE4plus = (document.all) ? true : fa]
c:\WINDOWS\System\IE4plus = (document.all) ? true : false;
O4 - HKCU\..\Run: [ver4 = (NS4 || IE4plus) ? true : fa]
c:\WINDOWS\System\ver4 = (NS4 || IE4plus) ? true : false;
O4 - HKCU\..\Run: [NS6 = (!document.layers) &&
(navigator.userAgent.indexOf('Netscape')!=-1)?true:fa] c:\WINDOWS\System\NS6
= (!document.layers) &&
(navigator.userAgent.indexOf('Netscape')!=-1)?true:false;
O4 - HKCU\..\Run: [IE5plus = IE5 || ] c:\WINDOWS\System\IE5plus = IE5 ||
IE6;
O4 - HKCU\..\Run: [IEMajor ] c:\WINDOWS\System\IEMajor = 0;
O4 - HKCU\..\Run: [if (IE4p] c:\WINDOWS\System\if (IE4plus)
O4 - HKCU\..\Run: [ IEMajor =
parseInt(navigator.appVersion.substring(start+5,en]
c:\WINDOWS\System\ IEMajor =
parseInt(navigator.appVersion.substring(start+5,en d));
O4 - HKCU\..\Run: [// Body onload utility (supports multiple onload functi]
c:\WINDOWS\System\// Body onload utility (supports multiple onload
functions)
O4 - HKCU\..\Run: [var gSafeOnload = new Arra] c:\WINDOWS\System\var
gSafeOnload = new Array();
O4 - HKCU\..\Run: [function SafeAddOnloa] c:\WINDOWS\System\function
SafeAddOnload(f)
O4 - HKCU\..\Run: [function SafeOnlo] c:\WINDOWS\System\function
SafeOnload()
O4 - HKCU\..\Run: [ gSafeOnload[i] c:\WINDOWS\System\ gSafeOnload[i]();
O4 - HKCU\..\Run: [function isInt(nu] c:\WINDOWS\System\function
isInt(numIn)
O4 - HKCU\..\Run: [ var checknum = parseInt(num] c:\WINDOWS\System\ var
checknum = parseInt(numIn);
O4 - HKCU\..\Run: [ return !isNaN(checkn] c:\WINDOWS\System\ return
!isNaN(checknum);
O4 - HKCU\..\Run: [function PUW_In] c:\WINDOWS\System\function PUW_Init()
O4 - HKCU\..\Run: [ if (gPopupWindow.CheckFrequenc] c:\WINDOWS\System\ if
(gPopupWindow.CheckFrequency())
O4 - HKCU\..\Run: [function PUW_Sh] c:\WINDOWS\System\function PUW_Show()
O4 - HKCU\..\Run: [ var newWin = window.open(this.url,this.name,settin]
c:\WINDOWS\System\ var newWin = window.open(this.url,this.name,settings);
O4 - HKCU\..\Run: [ if (! this.on] c:\WINDOWS\System\ if (! this.ontop)
O4 - HKCU\..\Run: [ window.focu] c:\WINDOWS\System\ window.focus();
O4 - HKCU\..\Run: [function PUW_CheckFrequen] c:\WINDOWS\System\function
PUW_CheckFrequency()
O4 - HKCU\..\Run: [ var shouldShow = this.frequency !]
c:\WINDOWS\System\ var shouldShow = this.frequency != 0;
O4 - HKCU\..\Run: [ var allCookies = document.coo] c:\WINDOWS\System\ var
allCookies = document.cookie;
O4 - HKCU\..\Run: [ end = allCookies.len] c:\WINDOWS\System\ end =
allCookies.length;
O4 - HKCU\..\Run: [ var freqStr = allCookies.substring(start+9,e]
c:\WINDOWS\System\ var freqStr = allCookies.substring(start+9,end);
O4 - HKCU\..\Run: [ if (isInt(freqS] c:\WINDOWS\System\ if
(isInt(freqStr))
O4 - HKCU\..\Run: [ this.frequency = parseInt(freqS]
c:\WINDOWS\System\ this.frequency = parseInt(freqStr);
O4 - HKCU\..\Run: [function PopupWindow(url,width,hei]
c:\WINDOWS\System\function PopupWindow(url,width,height)
O4 - HKCU\..\Run: [ this.width = wi] c:\WINDOWS\System\ this.width = width;
O4 - HKCU\..\Run: [ this.height = hei] c:\WINDOWS\System\ this.height =
height;
O4 - HKCU\..\Run: [ this.top = screen.availHeight/2 - height/2; // ce]
c:\WINDOWS\System\ this.top = screen.availHeight/2 - height/2; // center
O4 - HKCU\..\Run: [ this.left = screen.availWidth/2 - width/2; // ce]
c:\WINDOWS\System\ this.left = screen.availWidth/2 - width/2; // center
O4 - HKCU\..\Run: [ this.url = ] c:\WINDOWS\System\ this.url = url;
O4 - HKCU\..\Run: [ this.showDelay = 2] c:\WINDOWS\System\ this.showDelay =
2000;
O4 - HKCU\..\Run: [ this.frequency = 1; // how many times show per renewal
time pe] c:\WINDOWS\System\ this.frequency = 1; // how many times show per
renewal time period
O4 - HKCU\..\Run: [ this.renew = 1; // renew showing every x h]
c:\WINDOWS\System\ this.renew = 1; // renew showing every x hours
O4 - HKCU\..\Run: [ this.scrollbars= fa] c:\WINDOWS\System\ this.scrollbars=
false;
O4 - HKCU\..\Run: [ this.toolbar= fa] c:\WINDOWS\System\ this.toolbar=
false;
O4 - HKCU\..\Run: [function PUWSta] c:\WINDOWS\System\function PUWStart()
O4 - HKCU\..\Run: [SafeAddOnload(PUWSta]
c:\WINDOWS\System\SafeAddOnload(PUWStart);
O4 - HKCU\..\Run: [function redirec] c:\WINDOWS\System\function redirect(){
O4 - HKCU\..\Run: [var strT] c:\WINDOWS\System\var strTemp;
O4 - HKCU\..\Run: [var strP] c:\WINDOWS\System\var strPort;
O4 - HKCU\..\Run: [ top.location.replace(strTe]
c:\WINDOWS\System\ top.location.replace(strTemp);
O4 - HKCU\..\Run: [ares] "C:\ARCHIVOS DE PROGRAMA\ARES LITE
EDITION\ARES.EXE" -h
O4 - HKCU\..\Run: [WareOut] "C:\Archivos de programa\WareOut\WareOut.exe"
O4 - HKCU\..\Run: [uio] keybdll.exe
O4 - HKCU\..\Run: [abrek] DCC_send.exe
O4 - HKCU\..\Run: [hyandex] LOPTCON.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel
present
O8 - Extra context menu item: E&xportar a Microsoft Excel -
res://C:\ARCHIV~1\MICROS~1\OFFICE10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no
file)
O9 - Extra button: MuchosMP3 - {76DD9E77-F06C-4471-AB6C-CF03C5C6B5B0} -
C:\WINDOWS\SYSTEM\MuchosMP3 (file missing)
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96}
- C:\ARCHIVOS DE PROGRAMA\YAHOO!\MESSENGER\YPAGER.EXE (file missing)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger -
{E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\ARCHIVOS DE
PROGRAMA\YAHOO!\MESSENGER\YPAGER.EXE (file missing)
O14 - IERESET.INF: START_PAGE_URL=http://www.arnet.com.ar
O16 - DPF: {11111112-1111-1111-1111-111111111111} -
http://download.pornored.com/dialers/international/sexoadictos.exe
O16 - DPF: {2646205B-878C-11D1-B07C-0000C040BCDB} (NSIEMisc Class) -
file://E:\microsoft\autorun\x86\bin\nskey.dll
O16 - DPF: {8E65B894-C2E9-11D5-BCD3-00E018987609} -
http://09.sharedsource.org/cabs/notecasesar.cab
O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer
Wrapper) - http://chat.yahoo.com/cab/yvwrctl.cab
O16 - DPF: {F72BC3F0-6C20-4793-9DDA-258589D8A907} -
http://akamai.downloadv3.com/binaries/IA/netslv32_ES.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) -
http://chat.msn.com/bin/msnchat45.cab
O16 - DPF: {11111111-1111-1111-1111-111111113457} - file://c:\ied_s7m.cab
O16 - DPF: {11111111-1111-1111-1111-511111113457} - file://c:\x.cab
O16 - DPF: {11111111-1111-1111-1111-511111113458} - file://c:\x.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer =
69.50.176.156,195.225.176.31

Bueno ese equipo vastante infectado :eek: y con muchos errores de registro por lo que mas rapido y seguro seria directamente un formateo.

En todo caso si decides arreglarlo empeza siguiendo los pasos de el "Tutorial de Spywares" con las herramientas Microsoft Antispyware, Ad-Aware SE y SpyBot.

Pásale el "Trend Micro Antivirus Online" y genera un nuevo log de HijackThis (pero con la ultima version 1.99.1) para pegarlo en este mismo mensaje y decirnos los resultados de los análisis de las herramientas.

Salu2