TENGO MUCHOS POPUPS Y EL PC ANDA LENTO Y EL NOD32 DETECTA ESTOS TROJANS

win32/BHO.G trojan

Win32/Adware.Virtumonde.KI application

Win32/Agent.ANR trojan
------------------------------------------------


Logfile of HijackThis v1.99.1
Scan saved at 12:00:14 PM, on 6/27/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Lexmark 3400 Series\lxcymon.exe
C:\Program Files\Lexmark 3400 Series\ezprint.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\bvgvhkbb.exe
C:\Program Files\Common Files\Command Software\dvpapi.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\lxcycoms.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\HJT\HijackThis.exe
C:\WINDOWS\system32\lhtUpWqT.exe
C:\WINDOWS\system32\K350471x.exe

O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [lxcymon.exe] "C:\Program Files\Lexmark 3400 Series\lxcymon.exe"
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 3400 Series\ezprint.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [icq.com] rundll32.exe "C:\WINDOWS\system32\ehcixead.dll",forkonce
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Microsoft Webcam Enhance V2.1] C:\WINDOWS\runtfs32.exe
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab50997.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by104fd.bay104.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {55027008-315F-4F45-BBC3-8BE119764741} (Slide Image Uploader Control) - http://www.slide.com/uploader/SlideImageUploader.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab50997.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} - http://download.abacast.com/download/files/abasetup163.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O20 - AppInit_DLLs:
O23 - Service: DomainService - - C:\WINDOWS\system32\bvgvhkbb.exe
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - C:\Program Files\Common Files\Command Software\dvpapi.exe
O23 - Service: lxcy_device - - C:\WINDOWS\system32\lxcycoms.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Power Manager (PowerManager) - Unknown owner - C:\WINDOWS\svchost.exe (file missing)
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

Hola laura lasso, te doy la bienvenida al Foro de InfoSpyware

Descarga CCleaner y ejecútalo usando primero su opción de "Limpiador" para borrar cookies, temporales de Internet y todos los archivos que este te muestre como obsoletos, y luego usa su opción de "Registro" para limpiar todo el registro de Windows (haciendo copia de seguridad).

Descarga, actualiza y ejecuta

• SUPERAntiSpyware

• Descarga la herramienta ComboFix.exe y guárdala en el escritorio de Win.
• Hace doble-click en el archivo combofix.exe y seguí los avisos.
• Cuando termine este generara un reporte que tendrías que pegar en este mismo mensaje.
  • Nota* Puede que algunos Antivirus como Panda detecten un falso positivo en ComboFix pero no hay que preocuparse por esto.

Reinicia y nos contas los resultados.

Salu2

mira el log..........y creo que se mejoro un poco bueno revisalo porfavor y me comentas graciasssssssssss por tu paciencia

"Administrator" - 2007-06-28 18:41:18 - ComboFix 07-06-27.7 - Service Pack 2 NTFS


(((((((((((((((((((((((((((((((((((((((((((( V Log )))))))))))))))))))))))))))))))))))))))))))))))))) )))))


C:\WINDOWS\system32\ppsru.bak1
C:\WINDOWS\system32\ppsru.bak2
C:\WINDOWS\system32\ppsru.ini
C:\WINDOWS\system32\ppsru.ini2
C:\WINDOWS\system32\ppsru.tmp
C:\WINDOWS\system32\ppsru.bak1
C:\WINDOWS\system32\ppsru.bak2
C:\WINDOWS\system32\ppsru.ini
C:\WINDOWS\system32\ppsru.ini2
C:\WINDOWS\system32\ppsru.tmp
C:\WINDOWS\system32\ppsru.bak1
C:\WINDOWS\system32\ppsru.bak2
C:\WINDOWS\system32\ppsru.ini
C:\WINDOWS\system32\ppsru.ini2
C:\WINDOWS\system32\ppsru.tmp
C:\WINDOWS\system32\urspp.dll


* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *



((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\DOCUME~1\ADMINI~1\APPLIC~1\Install.dat
C:\DOCUME~1\ADMINI~1\Desktop\internet.lnk
C:\WINDOWS\system32\2_exception.nls
C:\WINDOWS\system32\drivero.exe
C:\WINDOWS\system32\ewofmdfb.exe
C:\WINDOWS\system32\lhtUpWqT.exe
C:\WINDOWS\system32\lmgvmrwc.exe
C:\WINDOWS\tasks\At1.job
C:\WINDOWS\tasks\At10.job
C:\WINDOWS\tasks\At11.job
C:\WINDOWS\tasks\At12.job
C:\WINDOWS\tasks\At13.job
C:\WINDOWS\tasks\At14.job
C:\WINDOWS\tasks\At15.job
C:\WINDOWS\tasks\At16.job
C:\WINDOWS\tasks\At17.job
C:\WINDOWS\tasks\At18.job
C:\WINDOWS\tasks\At19.job
C:\WINDOWS\tasks\At2.job
C:\WINDOWS\tasks\At21.job
C:\WINDOWS\tasks\At22.job
C:\WINDOWS\tasks\At23.job
C:\WINDOWS\tasks\At24.job
C:\WINDOWS\tasks\At3.job
C:\WINDOWS\tasks\At4.job
C:\WINDOWS\tasks\At5.job
C:\WINDOWS\tasks\At6.job
C:\WINDOWS\tasks\At7.job
C:\WINDOWS\tasks\At8.job
C:\WINDOWS\tasks\At9.job
C:\WINDOWS\xmlhelper2.dll


((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


-------\LEGACY_DOMAINSERVICE
-------\LEGACY_GB
-------\LEGACY_RUNTIME
-------\DomainService


((((((((((((((((((((((((( Files Created from 2007-05-28 to 2007-06-28 )))))))))))))))))))))))))))))))


2007-06-28 18:40 49,152 --a------ C:\WINDOWS\nircmd.exe
2007-06-28 17:48 128,576 --a------ C:\WINDOWS\system32\xyaaytgi.dll
2007-06-28 17:45 66,112 --a------ C:\WINDOWS\system32\ouiswxkj.dll
2007-06-28 17:37 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo! Companion
2007-06-28 15:21 0 --a------ C:\WINDOWS\system32\CMMGR32.EXE
2007-06-28 14:26 <DIR> d-------- C:\Program Files\Yahoo!
2007-06-28 14:25 <DIR> d-------- C:\Program Files\CCleaner
2007-06-28 14:13 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2007-06-28 14:13 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\SUPERAntiSpyware.com
2007-06-28 14:13 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\SUPERAntiSpyware.com
2007-06-28 14:12 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-06-28 11:15 128,576 --a------ C:\WINDOWS\system32\bswmsnpo.dll
2007-06-27 20:56 <DIR> d-------- C:\Program Files\Ares
2007-06-27 20:03 128,576 --a------ C:\WINDOWS\system32\kgdriidp.dll
2007-06-27 16:34 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Incomplete
2007-06-27 15:16 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\LimeWire
2007-06-27 15:12 <DIR> d-------- C:\Program Files\LimeWire
2007-06-27 11:35 128,576 --a------ C:\WINDOWS\system32\ehcixead.dll
2007-06-27 11:15 128,576 --------- C:\WINDOWS\system32\yeaqlkhi.dll
2007-06-27 01:03 128,576 --------- C:\WINDOWS\system32\ecqlkuut.dll
2007-06-27 00:50 128,576 --------- C:\WINDOWS\system32\jcjjtioi.dll
2007-06-26 15:52 128,576 --a------ C:\WINDOWS\system32\nmvtuqhk.dll
2007-06-26 13:25 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Google
2007-06-26 13:18 <DIR> d-------- C:\Program Files\Google
2007-06-26 11:59 128,576 --a------ C:\WINDOWS\system32\yejdemvo.dll
2007-06-25 20:26 22,592 --a------ C:\WINDOWS\system32\K350471x.exe
2007-06-25 13:27 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-06-24 22:44 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Contacts
2007-06-23 13:57 <DIR> d-------- C:\Program Files\HJT
2007-06-23 10:41 4,672 --a------ C:\WINDOWS\system32\nyfrvyae.exe
2007-06-20 17:10 <DIR> d-------- C:\Program Files\Common Files\NSV
2007-06-20 16:56 <DIR> d-------- C:\WINDOWS\system32\NtmsData
2007-06-19 20:03 <DIR> d-------- C:\Program Files\MSN Messenger
2007-06-19 19:34 <DIR> d-------- C:\WINDOWS\pss
2007-06-15 13:32 16 --a------ C:\WINDOWS\popcinfot.dat
2007-06-15 13:32 1,524 --a------ C:\WINDOWS\system32\d3d8caps.dat
2007-06-14 17:19 737,280 --a------ C:\WINDOWS\iun6002.exe
2007-06-13 19:57 <DIR> d-------- C:\WINDOWS\.jagex_cache_32
2007-06-05 11:54 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
2007-06-02 20:47 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\FaxCtr
2007-06-02 20:40 98,345 --a------ C:\WINDOWS\system32\IMHOST32.DLL
2007-06-02 20:40 40,960 --a------ C:\WINDOWS\system32\LXPRMON.DLL
2007-06-02 20:40 339,968 --a------ C:\WINDOWS\system32\IMGMAN32.DLL
2007-06-02 20:40 32,768 --a------ C:\WINDOWS\system32\LXPMONUI.DLL
2007-06-02 20:40 12,288 --a------ C:\WINDOWS\system32\LXPMONRC.DLL
2007-06-02 20:40 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\FaxCtr
2007-06-02 20:39 <DIR> d-------- C:\Program Files\Lexmark Toolbar
2007-06-02 20:39 <DIR> d-------- C:\Program Files\Lexmark Fax Solutions
2007-06-02 20:39 <DIR> d-------- C:\Program Files\Lexmark 3400 Series
2007-06-02 20:37 233,472 --a------ C:\WINDOWS\system32\lxcyinst.dll
2007-06-02 20:26 303,104 -ra------ C:\WINDOWS\system32\lxcycoin.dll
2007-06-02 20:25 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys
2007-06-02 20:24 87,040 --a------ C:\WINDOWS\system32\wiafbdrv.dll
2007-06-02 20:24 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2007-06-02 20:24 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2007-06-02 20:23 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2007-05-28 15:29 18,688 --a------ C:\WINDOWS\system32\drivers\afc.sys


(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))

2007-06-28 19:21:40 -------- d-----w C:\Program Files\Messenger
2007-06-28 01:45:20 -------- d-----w C:\Program Files\Common Files\Command Software
2007-06-20 21:09:45 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-06-20 21:09:45 -------- d-----w C:\Program Files\Common Files\InstallShield
2007-06-20 21:08:29 -------- d-----w C:\Program Files\Common Files\Symantec Shared
2007-06-20 19:00:56 1,636 ----a-w C:\WINDOWS\system32\d3d9caps.dat
2007-06-15 22:04:45 29 ----a-w C:\WINDOWS\popcinfo.dat
2007-04-30 20:55:28 299,392 ----a-w C:\WINDOWS\system32\imon.dll
2007-04-30 20:55:23 512,096 ----a-w C:\WINDOWS\system32\drivers\amon.sys
2007-04-30 20:55:17 15,424 ----a-w C:\WINDOWS\system32\drivers\nod32drv.sys
2007-04-21 03:23:39 1,032 ----a-w C:\b.dat
2007-04-21 03:23:39 1,032 ----a-w C:\a.dat
2007-04-16 02:44:13 77,312 ----a-w C:\WINDOWS\ua2.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Browser Helper Objects]
{02478D38-C3F9-4EFB-9B51-7695ECA05670}=C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [2006-10-26 10:28]
{58FE4633-3D0A-4464-BD5B-939C19B57011}=C:\WINDOWS\system32\drivero.dll []
{5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB}=C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dl l []
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 03:43]
{85589B5D-D53D-4237-A677-46B82EA275F3}=C:\WINDOWS\xmlhelper2.dll []
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}=C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\sw g.dll [2007-06-26 13:20]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-04-30 16:55]
"lxcymon.exe"="C:\Program Files\Lexmark 3400 Series\lxcymon.exe" [2006-03-06 13:48]
"EzPrint"="C:\Program Files\Lexmark 3400 Series\ezprint.exe" [2006-02-07 01:10]
"FaxCenterServer"="C:\Program Files\Lexmark Fax Solutions\fm3032.exe" [2006-02-02 04:11]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 19:56]
"Microsoft Webcam Enhance V2.1"="C:\WINDOWS\runtfs32.exe" []
"ares"="C:\Program Files\Ares\Ares.exe" [2007-05-14 18:37]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-06-28 17:36]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"="C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2006-12-20 12:55]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\hggebcd]
hggebcd.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=


HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\Microsoft Webcam Enhance V2.1
C:\WINDOWS\runtfs32.exe

Contents of the 'Scheduled Tasks' folder
2007-06-26 23:00:31 C:\WINDOWS\tasks\At20.job
2007-06-28 04:00:30 C:\WINDOWS\tasks\At25.job
2007-06-28 05:00:31 C:\WINDOWS\tasks\At26.job
2007-06-28 06:00:30 C:\WINDOWS\tasks\At27.job
2007-06-28 07:00:30 C:\WINDOWS\tasks\At28.job
2007-06-26 00:26:23 C:\WINDOWS\tasks\At29.job
2007-06-26 00:26:23 C:\WINDOWS\tasks\At30.job
2007-06-26 00:26:23 C:\WINDOWS\tasks\At31.job
2007-06-26 00:26:23 C:\WINDOWS\tasks\At32.job
2007-06-26 00:26:23 C:\WINDOWS\tasks\At33.job
2007-06-26 00:26:23 C:\WINDOWS\tasks\At34.job
2007-06-26 00:26:24 C:\WINDOWS\tasks\At35.job
2007-06-26 00:26:24 C:\WINDOWS\tasks\At36.job
2007-06-28 16:00:31 C:\WINDOWS\tasks\At37.job
2007-06-28 17:00:30 C:\WINDOWS\tasks\At38.job
2007-06-28 18:00:30 C:\WINDOWS\tasks\At39.job
2007-06-28 19:00:30 C:\WINDOWS\tasks\At40.job
2007-06-28 20:00:33 C:\WINDOWS\tasks\At41.job
2007-06-28 21:00:31 C:\WINDOWS\tasks\At42.job
2007-06-28 22:00:30 C:\WINDOWS\tasks\At43.job
2007-06-26 23:01:45 C:\WINDOWS\tasks\At44.job
2007-06-28 00:00:34 C:\WINDOWS\tasks\At45.job
2007-06-28 01:00:42 C:\WINDOWS\tasks\At46.job
2007-06-28 02:00:31 C:\WINDOWS\tasks\At47.job
2007-06-28 03:00:32 C:\WINDOWS\tasks\At48.job

************************************************** ************************

catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-06-28 18:49:19
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

************************************************** ************************

Completion time: 2007-06-28 18:51:17 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-06-28 18:51

--- E O F ---

Hola, solo te quedadarian borrar estos archivos con el programa "FileASSASSIN" copia y pegar estos archivos con sus rutas para ser eliminados:


C:\WINDOWS\tasks\At20.job
C:\WINDOWS\tasks\At25.job
C:\WINDOWS\tasks\At26.job
C:\WINDOWS\tasks\At27.job
C:\WINDOWS\tasks\At28.job
C:\WINDOWS\tasks\At29.job
C:\WINDOWS\tasks\At30.job
C:\WINDOWS\tasks\At31.job
C:\WINDOWS\tasks\At32.job
C:\WINDOWS\tasks\At33.job
C:\WINDOWS\tasks\At34.job
C:\WINDOWS\tasks\At35.job
C:\WINDOWS\tasks\At36.job
C:\WINDOWS\tasks\At37.job
C:\WINDOWS\tasks\At38.job
C:\WINDOWS\tasks\At39.job
C:\WINDOWS\tasks\At40.job
C:\WINDOWS\tasks\At41.job
C:\WINDOWS\tasks\At42.job
C:\WINDOWS\tasks\At43.job
C:\WINDOWS\tasks\At44.job
C:\WINDOWS\tasks\At45.job
C:\WINDOWS\tasks\At46.job
C:\WINDOWS\tasks\At47.job
C:\WINDOWS\tasks\At48.job