Foro de InfoSpyware - Foro de Hijackthis - Foro de Virus

Hey que tal.

Mi problema es este, tengo estos archivos (II22.exe, -1.exe) que intentan conectarce a internet , me los detecta mi firewall, y el problema con IE es que al terminar de cargar las pag. como que se traba IE por unos segundos, si alguien puede resolver mi problema se lo agradeceria mucho.

Mi Log:

Logfile of HijackThis v1.99.1
Scan saved at 03:54:36 p.m., on 28/06/2005
Platform: Windows 2000 SP1 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 (5.00.2920.0000)

Running processes:
C:\winnt\System32\smss.exe
C:\winnt\SYSTEM32\winlogon.exe
C:\winnt\system32\services.exe
C:\winnt\system32\lsass.exe
C:\winnt\system32\svchost.exe
C:\winnt\System32\svchost.exe
C:\winnt\system32\spoolsv.exe
C:\winnt\system32\regsvc.exe
C:\winnt\system32\MSTask.exe
C:\winnt\System32\snmp.exe
C:\winnt\system32\stisvc.exe
C:\WINNT\system32\ZONELABS\vsmon.exe
C:\WINNT\System32\inetsrv\inetinfo.exe
C:\Archivos de programa\Zone Labs\ZoneAlarm\zapro.exe
C:\winnt\Explorer.exe
C:\Archivos de programa\Internet Explorer\IEXPLORE.EXE
C:\Spy\HijackThis_1.99.1.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.isearch.com/index.php?app=SE&affjump=1&affiliate=ODQ6NTo5&Term s=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.isearch.com/index.php?app=SE&affjump=1&affiliate=ODQ6NTo5&Term s=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.isearch.com/index.php?app=SE&affjump=1&affiliate=ODQ6NTo5&Term s=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://searchbar.findthewebsiteyouneed.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\arturo\CONFIG~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\arturo\CONFIG~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.isearch.com/index.php?app=SE&affjump=1&affiliate=ODQ6NTo5&Term s=
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://adipics.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.isearch.com/index.php?app=SE&affjump=1&affiliate=ODQ6NTo5&Term s=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,SearchURL = http://search-all.net/sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O2 - BHO: (no name) - {0C9A74FF-C35B-4709-B480-754EACEB3FD6} - C:\winnt\System32\makmff.dll (file missing)
O2 - BHO: ohb - {98640C3B-0699-4D51-ADB4-A6FC48ACB966} - C:\winnt\System32\nso11.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\ARCHIV~1\FLASHGET\jccatch.dll
O2 - BHO: IEHlprObj Class - {CD4C3CF0-4B15-11D1-ABED-709549C10000} - C:\Archivos de programa\Go!Zilla\GoIEHlp.dll (file missing)
O3 - Toolbar: @msdxmLC.dll,-1@3082,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\ARCHIV~1\FLASHGET\fgiebar.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - Startup: Adobe Gamma Loader.exe.lnk = C:\Archivos de programa\Archivos comunes\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Archivos de programa\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: ZoneAlarm Pro.lnk = C:\Archivos de programa\Zone Labs\ZoneAlarm\zapro.exe
O8 - Extra context menu item: Descargar con Fl&ashGet - C:\Archivos de programa\FlashGet\jc_link.htm
O8 - Extra context menu item: Descargar todo con Flas&hGet - C:\Archivos de programa\FlashGet\jc_all.htm
O8 - Extra context menu item: Download with Go!Zilla - file://C:\Archivos de programa\Go!Zilla\download-with-gozilla.html
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\ARCHIV~1\FLASHGET\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\ARCHIV~1\FLASHGET\flashget.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.microsoft.com/spanish/msn
O14 - IERESET.INF: MS_START_PAGE_URL=http://www.microsoft.com/spanish/msn
O16 - DPF: {10003000-1000-0000-1000-000000000000} - ms-its:mhtml:file://C:\foo.mht!http://195.225.177.13/20646/online.chm::/on-line.exe
O16 - DPF: {11311111-1111-1111-1111-111111111157} - file://C:\Recycled\Q330995.exe
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20030530/qtinstall.info.apple.com/bonnie/us/win/QuickTimeInstaller.exe
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {DE910060-8EFB-44B9-B492-75180696643F} (iiittt Class) - http://www.hotsearchbar.com/toolbar30/hsrb.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{7E2A27B4-819C-4A8A-9A78-F8A1CA98E44F}: NameServer = 200.33.146.193 200.33.146.201
O18 - Filter: text/html - {9304DBC4-9B3D-4E04-AD51-E3C077B93E20} - C:\winnt\System32\makmff.dll
O18 - Filter: text/plain - {9304DBC4-9B3D-4E04-AD51-E3C077B93E20} - C:\winnt\System32\makmff.dll
O23 - Service: Servicio del administrador de discos lógicos (dmadmin) - VERITAS Software Corp. - C:\winnt\System32\dmadmin.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINNT\system32\ZONELABS\vsmon.exe

Hola, sigue estos pasos:

1 - Con todos los programas cerrados, ejecuta HijackThis, marca las siguientes entradas y haces FIX:

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.isearch.com/index.php?app=SE&affjump=1&affiliate=ODQ6NTo5&Term s=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.isearch.com/index.php?app=SE&affjump=1&affiliate=ODQ6NTo5&Term s=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.isearch.com/index.php?app=SE&affjump=1&affiliate=ODQ6NTo5&Term s=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://searchbar.findthewebsiteyouneed.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\arturo\CONFIG~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\arturo\CONFIG~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.isearch.com/index.php?app=SE&affjump=1&affiliate=ODQ6NTo5&Term s=
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://adipics.com/ R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.isearch.com/index.php?app=SE&affjump=1&affiliate=ODQ6NTo5&Term s=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,SearchURL = http://search-all.net/sp.html

O2 - BHO: (no name) - {0C9A74FF-C35B-4709-B480-754EACEB3FD6} - C:\winnt\System32\makmff.dll (file missing)
O2 - BHO: ohb - {98640C3B-0699-4D51-ADB4-A6FC48ACB966} - C:\winnt\System32\nso11.dll

O2 - BHO: IEHlprObj Class - {CD4C3CF0-4B15-11D1-ABED-709549C10000} - C:\Archivos de programa\Go!Zilla\GoIEHlp.dll (file missing)

O16 - DPF: {10003000-1000-0000-1000-000000000000} - ms-its:mhtml:file://C:\foo.mht!http://195.225.177.13/20646/online.chm::/on-line. exe
O16 - DPF: {11311111-1111-1111-1111-111111111157} - file://C:\Recycled\Q330995.exe

O16 - DPF: {DE910060-8EFB-44B9-B492-75180696643F} (iiittt Class) - http://www.hotsearchbar.com/toolbar30/hsrb.cab

O18 - Filter: text/html - {9304DBC4-9B3D-4E04-AD51-E3C077B93E20} - C:\winnt\System32\makmff.dll
O18 - Filter: text/plain - {9304DBC4-9B3D-4E04-AD51-E3C077B93E20} - C:\winnt\System32\makmff.dll

2 - Localiza y elimina usando KillBox :

C:\DOCUME~1\arturo\CONFIG~1\Temp\sp.html
C:\winnt\System32\makmff.dll
C:\winnt\System32\nso11.dll
C:\Recycled\Q330995.exe

3 - Luego limpia el registro con un programa como RegSeeker por ejemplo.

4 - Reinicia en "Modo a prueba de fallos" o "Modo seguro" y escanea el equipo con Ad-Aware SE y Spybot Search&Destroy.

5 - Usa el Disk Cleaner para limpiar cookies y temporales.

6 - Reinicia y nos cuentas los resultados.

**NOTA: Actualiza el sistema operativo (a SP4) y el navegador.

Saludos.