Hola amigos!!!!


Tengo un servidor W2000 Advanced server en la compañia donde trabajo que tiene el virus DesktopHijack "asi lo llama Symantec pues me lo detecta el norton Corporate", a pesar de que tengo la firma del antivirus a la fecha, el norton no puede limpiar el virus porque infectó el archivo Wininet.dll, manualmente he tratado de reemplazar la dll, renombrarla y me ha sido imposible, se que esta dll es genuina del Windows y sirve para hacer cache de respuestas http, pero no consigo manera de resolver este problema, he leido en este foro que otra persona ha tenido el problema y la comunidad lo ha logrado resolver, en su caso Panda reconocio al virus como SmthFraud, pero me parece que es identica a mi situacion, he ejecutado el Hijackthis pero no se interpretar las entradas, por esto les posteo el LOG agradeciendoles encarecidamente cualquier orientacion al respecto.


Logfile of HijackThis v1.99.0
Scan saved at 10:46:56 AM, on 7/15/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\Documents and Settings\cleaner.CIBERDYNE\WINDOWS\System32\smss.e xe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\msdtc.exe
C:\WINNT\system32\drivers\CDAC11BA.EXE
C:\Program Files\Dell\OpenManage\ihv\CIO\IOMGR.EXE
C:\Program Files\Dell\OpenManage\OMSA\bin\dcevt32.exe
C:\Program Files\Dell\OpenManage\OMSA\bin\dcstor32.exe
C:\WINNT\system32\Dfssvc.exe
C:\WINNT\System32\svchost.exe
D:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
C:\PROGRA~1\HACKTR~1\HTSERVICE.exe
C:\WINNT\System32\llssrv.exe
C:\Program Files\Dell\OpenManage\Array Manager\mr2kserv.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINNT\system32\ntfrs.exe
C:\WINNT\System32\locator.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\Dell\OpenManage\iws\bin\win32\omaws32.exe
C:\Program Files\Dell\OpenManage\Array Manager\VxSvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\Program Files\Dell\OpenManage\ihv\CIO\CIONOTIFIER.EXE
C:\WINNT\system32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\System\MSSearch\Bin\mssearch.exe
C:\WINNT\system32\MsgSys.EXE
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\Atiptaxx.exe
C:\Program Files\NavNT\vptray.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Documents and Settings\cleaner.CIBERDYNE\Desktop\HijackThis_1.99 .0.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://localhost/rutabdpda/login.asp
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://localhost/rutabdpda/login.asp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINNT\system32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINNT\system32\blank.htm
F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe,
O4 - HKLM\..\Run: [AtiPTA] Atiptaxx.exe
O4 - HKLM\..\Run: [AuCaption] DSA OMSA Reminder
O4 - HKLM\..\Run: [AuFlag] 
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [ulmpotel] C:\WINNT\ulmpotel.exe
O4 - HKLM\..\Run: [I3pbRKyJ] C:\Documents and Settings\ezerpa\WINDOWS\besdphm123456.exe
O4 - HKLM\..\Run: [killdhcp] C:\WINNT\system32\killdhcpclient.exe
O4 - HKLM\..\Run: [killoleadm] C:\WINNT\system32\killoleadm.exe
O4 - HKLM\..\Run: [killddeclnt] C:\WINNT\system32\killddeclnt.exe
O4 - HKLM\..\RunServices: [Micr Update] soundblaster1234567.exe
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [killdhcpclient] C:\WINNT\system32\killdhcpclient.exe
O4 - HKCU\..\Run: [killoleadm] C:\WINNT\system32\killoleadm.exe
O4 - HKCU\..\Run: [killnetddeclnt] C:\WINNT\system32\killddeclnt.exe
O4 - Global Startup: Administrador de servicios.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O4 - Global Startup: Hack Tracer Startup.lnk = C:\Program Files\Hack Tracer\HTTray.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Referencia - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O10 - Broken Internet access because of LSP provider 'c:\documents and settings\cleaner.ciberdyne\windows\system32\rnr20. dll' missing
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {91433D86-9F27-402C-B5E3-DEBDD122C339} - http://www.netvenda.com/sites/games-intl/ve/games3.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = ciberdyne.net
O17 - HKLM\System\CCS\Services\Tcpip\..\{523719A8-777F-4F15-905F-3D6BA80A0DEC}: NameServer = 200.31.4.70,200.31.4.71
O17 - HKLM\System\CCS\Services\Tcpip\..\{907E1E89-E296-48E1-A690-205C857016BC}: NameServer = 200.31.4.70,200.31.4.71
O17 - HKLM\System\CCS\Services\Tcpip\..\{B0374685-39C5-450A-B9CF-B08CB3C52944}: NameServer = 127.0.0.1
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = ciberdyne.net
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = ciberdyne.net
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = ciberdyne.net
O23 - Service: Alerter - Unknown - C:\Documents and Settings\cleaner.CIBERDYNE\WINDOWS\System32\servic es.exe (file missing)
O23 - Service: Application Management - Unknown - C:\Documents and Settings\cleaner.CIBERDYNE\WINDOWS\system32\servic es.exe (file missing)
O23 - Service: Background Intelligent Transfer Service - Unknown - C:\Documents and Settings\cleaner.CIBERDYNE\WINDOWS\System32\svchos t.exe (file missing)
O23 - Service: Computer Browser - Unknown - C:\Documents and Settings\cleaner.CIBERDYNE\WINDOWS\System32\servic es.exe (file missing)
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINNT\system32\drivers\CDAC11BA.EXE
O23 - Service: CIO Array Management Service 4.01 - Adaptec, Inc. - C:\Program Files\Dell\OpenManage\ihv\CIO\IOMGR.EXE
O23 - Service: CIOArrayManager RPC Command - Unknown - C:\Program Files\Dell\OpenManage\ihv\CIO\IOMRPCCM.EXE
O23 - Service: CIOArrayManager RPC Event - Unknown - C:\Program Files\Dell\OpenManage\ihv\CIO\IOMRPCEV.EXE
O23 - Service: CIO Event Notifier - Unknown - C:\Program Files\Dell\OpenManage\ihv\CIO\CIONOTIFIER.EXE
O23 - Service: ClipBook - Unknown - C:\Documents and Settings\cleaner.CIBERDYNE\WINDOWS\system32\clipsr v.exe (file missing)
O23 - Service: Dell OpenManage Server Agent Event Monitor - Dell Computer Corporation. - C:\Program Files\Dell\OpenManage\OMSA\bin\dcevt32.exe
O23 - Service: Dell OpenManage Server Agent - Dell Computer Corporation. - C:\Program Files\Dell\OpenManage\OMSA\bin\dcstor32.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: Distributed File System - Unknown - C:\Documents and Settings\cleaner.CIBERDYNE\WINDOWS\system32\Dfssvc .exe (file missing)
O23 - Service: DHCP Client - Unknown - C:\Documents and Settings\cleaner.CIBERDYNE\WINDOWS\System32\servic es.exe (file missing)
O23 - Service: DNS Server - Unknown - C:\Documents and Settings\cleaner.CIBERDYNE\WINDOWS\System32\dns.ex e (file missing)
O23 - Service: DNS Client - Unknown - C:\Documents and Settings\cleaner.CIBERDYNE\WINDOWS\System32\servic es.exe (file missing)
O23 - Service: Event Log - Unknown - C:\Documents and Settings\cleaner.CIBERDYNE\WINDOWS\system32\servic es.exe (file missing)
O23 - Service: GhostStartService - Symantec Corporation - D:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
O23 - Service: Hack Tracer Monitor - Unknown - C:\PROGRA~1\HACKTR~1\HTSERVICE.exe
O23 - Service: Intersite Messaging - Unknown - C:\Documents and Settings\cleaner.CIBERDYNE\WINDOWS\System32\ismser v.exe (file missing)
O23 - Service: Kerberos Key Distribution Center - Unknown - C:\Documents and Settings\cleaner.CIBERDYNE\WINDOWS\System32\lsass. exe (file missing)
O23 - Service: Server - Unknown - C:\Documents and Settings\cleaner.CIBERDYNE\WINDOWS\System32\servic es.exe (file missing)
O23 - Service: Workstation - Unknown - C:\Documents and Settings\cleaner.CIBERDYNE\WINDOWS\System32\servic es.exe (file missing)
O23 - Service: License Logging Service - Unknown - C:\Documents and Settings\cleaner.CIBERDYNE\WINDOWS\System32\llssrv .exe (file missing)
O23 - Service: TCP/IP NetBIOS Helper Service - Unknown - C:\Documents and Settings\cleaner.CIBERDYNE\WINDOWS\System32\servic es.exe (file missing)
O23 - Service: mr2kserv - Unknown - C:\Program Files\Dell\OpenManage\Array Manager\mr2kserv.exe
O23 - Service: Network DDE - Unknown - C:\Documents and Settings\cleaner.CIBERDYNE\WINDOWS\system32\netdde .exe (file missing)
O23 - Service: Network DDE DSDM - Unknown - C:\Documents and Settings\cleaner.CIBERDYNE\WINDOWS\system32\netdde .exe (file missing)
O23 - Service: Net Logon - Unknown - C:\Documents and Settings\cleaner.CIBERDYNE\WINDOWS\System32\lsass. exe (file missing)
O23 - Service: Network Connections - Unknown - C:\Documents and Settings\cleaner.CIBERDYNE\WINDOWS\System32\svchos t.exe (file missing)
O23 - Service: NobleNet Portmapper - Unknown - C:\Program Files\Dell\OpenManage\ihv\CIO\PORTSERV.EXE
O23 - Service: Norton AntiVirus Client - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: File Replication Service - Unknown - C:\Documents and Settings\cleaner.CIBERDYNE\WINDOWS\system32\ntfrs. exe (file missing)
O23 - Service: NT LM Security Support Provider - Unknown - C:\Documents and Settings\cleaner.CIBERDYNE\WINDOWS\System32\lsass. exe (file missing)
O23 - Service: Removable Storage - Unknown - C:\Documents and Settings\cleaner.CIBERDYNE\WINDOWS\System32\svchos t.exe (file missing)
O23 - Service: Plug and Play - Unknown - C:\Documents and Settings\cleaner.CIBERDYNE\WINDOWS\system32\servic es.exe (file missing)
O23 - Service: IPSEC Policy Agent - Unknown - C:\Documents and Settings\cleaner.CIBERDYNE\WINDOWS\System32\lsass. exe (file missing)
O23 - Service: HP Printserver - Unknown - C:\WINNT\system32\printserver.exe (file missing)
O23 - Service: Protected Storage - Unknown - C:\Documents and Settings\cleaner.CIBERDYNE\WINDOWS\system32\servic es.exe (file missing)
O23 - Service: Remote Access Auto Connection Manager - Unknown - C:\Documents and Settings\cleaner.CIBERDYNE\WINDOWS\System32\svchos t.exe (file missing)
O23 - Service: Remote Access Connection Manager - Unknown - C:\Documents and Settings\cleaner.CIBERDYNE\WINDOWS\System32\svchos t.exe (file missing)
O23 - Service: Routing and Remote Access - Unknown - C:\Documents and Settings\cleaner.CIBERDYNE\WINDOWS\System32\svchos t.exe (file missing)
O23 - Service: Remote Registry Service - Unknown - C:\Documents and Settings\cleaner.CIBERDYNE\WINDOWS\system32\regsvc .exe (file missing)
O23 - Service: Remote Procedure Call (RPC) Client - Unknown - C:\WINNT\system32\ggg.exe (file missing)
O23 - Service: Remote Procedure Call (RPC) Locator - Unknown - C:\Documents and Settings\cleaner.CIBERDYNE\WINDOWS\System32\locato r.exe (file missing)
O23 - Service: Remote Procedure Call (RPC) - Unknown - C:\Documents.exe (file missing)
O23 - Service: QoS RSVP - Unknown - C:\Documents and Settings\cleaner.CIBERDYNE\WINDOWS\System32\rsvp.e xe (file missing)
O23 - Service: Remote Administrator Service - Unknown - C:\WINNT\system32\r_server.exe (file missing)
O23 - Service: Security Accounts Manager - Unknown - C:\Documents and Settings\cleaner.CIBERDYNE\WINDOWS\system32\lsass. exe (file missing)
O23 - Service: Smart Card Helper - Unknown - C:\Documents and Settings\cleaner.CIBERDYNE\WINDOWS\System32\SCardS vr.exe (file missing)
O23 - Service: Smart Card - Unknown - C:\Documents and Settings\cleaner.CIBERDYNE\WINDOWS\System32\SCardS vr.exe (file missing)
O23 - Service: Task Scheduler - Unknown - C:\Documents and Settings\cleaner.CIBERDYNE\WINDOWS\system32\MSTask .exe (file missing)
O23 - Service: RunAs Service - Unknown - C:\Documents and Settings\cleaner.CIBERDYNE\WINDOWS\system32\servic es.exe (file missing)
O23 - Service: System Event Notification - Unknown - C:\Documents and Settings\cleaner.CIBERDYNE\WINDOWS\system32\svchos t.exe (file missing)
O23 - Service: Serv-U FTP Server - Unknown - c:\winnt\system32\svchost1.exe (file missing)
O23 - Service: Server Administrator - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\iws\bin\win32\omaws32.exe
O23 - Service: Internet Connection Sharing - Unknown - C:\Documents and Settings\cleaner.CIBERDYNE\WINDOWS\System32\svchos t.exe (file missing)
O23 - Service: SNMP Service - Unknown - C:\Documents and Settings\cleaner.CIBERDYNE\WINDOWS\System32\snmp.e xe (file missing)
O23 - Service: SNMP Trap Service - Unknown - C:\Documents and Settings\cleaner.CIBERDYNE\WINDOWS\System32\snmptr ap.exe (file missing)
O23 - Service: Print Spooler - Unknown - C:\Documents and Settings\cleaner.CIBERDYNE\WINDOWS\system32\spools v.exe (file missing)
O23 - Service: Performance Logs and Alerts - Unknown - C:\Documents and Settings\cleaner.CIBERDYNE\WINDOWS\system32\smlogs vc.exe (file missing)
O23 - Service: Telephony - Unknown - C:\Documents and Settings\cleaner.CIBERDYNE\WINDOWS\System32\svchos t.exe (file missing)
O23 - Service: Terminal Services - Unknown - C:\Documents and Settings\cleaner.CIBERDYNE\WINDOWS\System32\termsr v.exe (file missing)
O23 - Service: Terminal Services Licensing - Unknown - C:\Documents and Settings\cleaner.CIBERDYNE\WINDOWS\System32\lserve r.exe (file missing)
O23 - Service: Distributed Link Tracking Server - Unknown - C:\Documents and Settings\cleaner.CIBERDYNE\WINDOWS\system32\servic es.exe (file missing)
O23 - Service: Distributed Link Tracking Client - Unknown - C:\Documents and Settings\cleaner.CIBERDYNE\WINDOWS\system32\servic es.exe (file missing)
O23 - Service: Uninterruptible Power Supply - Unknown - C:\Documents and Settings\cleaner.CIBERDYNE\WINDOWS\System32\ups.ex e (file missing)
O23 - Service: Utility Manager - Unknown - C:\Documents and Settings\cleaner.CIBERDYNE\WINDOWS\System32\UtilMa n.exe (file missing)
O23 - Service: Disk Management Service - VERITAS Software Corp. - C:\Program Files\Dell\OpenManage\Array Manager\VxSvc.exe
O23 - Service: Windows Time - Unknown - C:\Documents and Settings\cleaner.CIBERDYNE\WINDOWS\System32\servic es.exe (file missing)
O23 - Service: Window Recycler - Unknown - C:\WINNT\system32\recycler.dll (file missing)
O23 - Service: Windows Management Instrumentation - Unknown - C:\Documents and Settings\cleaner.CIBERDYNE\WINDOWS\System32\WBEM\W inMgmt.exe (file missing)
O23 - Service: Windows Management Instrumentation Driver Extensions - Unknown - C:\Documents and Settings\cleaner.CIBERDYNE\WINDOWS\system32\Servic es.exe (file missing)
O23 - Service: Wireless Configuration - Unknown - C:\Documents and Settings\cleaner.CIBERDYNE\WINDOWS\System32\svchos t.exe (file missing)


Gracias de antemano
Eudy

Hola te doy la bienvenida al Foro de InfoSpyware, empeza siguiendo los pasos de el "Tutorial de Spywares" con las herramientas Microsoft Antispyware, Ad-Aware SE y SpyBot.

Dale FIX a todas las entradas que terminan en (file missing)

Pásale al menos dos de estos "Antivirus Online" y genera un nuevo log de HijackThis (pero con la ultima version 1.99.1) para pegarlo en este mismo mensaje y decirnos los resultados de los análisis de las herramientas.

Salu2