imposible eliminar trojan.pakes.bpw

SEGURIDAD INFORMATICA, Firewall, parches, vacunas, antivirus, anti troyanos, spyware etc > Seguridad Informatica - Firewall - Virus - Troyanos - Spyware - Ad Aware - Malware

<< < (4/5) > >>

negrasombra:
Bueno ahora ya tengo el log del autoruns. ahi va.
un comentario que no se si será importante el AVGS no va, se queda colgado y no me deja ni instalarlo ni desinstalarlo, desde el primer momento.

HKLM\System\CurrentControlSet\Control\Terminal Server\Wds\rdpwd\StartupPrograms
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AppSetup
HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Startup
HKCU\Software\Policies\Microsoft\Windows\System\Scripts\Logon
HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Logon
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\Shell
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Shell
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Runonce
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\RunonceEx
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
+ !AVG Anti-Spyware   AVG Anti-Spyware   (Verified) GRISOFT LTD   c:\archivos de programa\grisoft\avg anti-spyware 7.5\avgas.exe
+ ANIWZCS2Service   ANIWZCS2 launcher for Windows.   (Not verified) Alpha Networks Inc.   c:\archivos de programa\ani\aniwzcs2 service\wzcsldr2.exe
+ Conceptronic Conceptronic 54Mbps Wireless Utility   Wireless LAN Monitor      c:\archivos de programa\conceptronic\conceptronic 54mbps wireless utility\wlanmon.exe
+ nwiz   NVIDIA nView Wizard, Version 110.60    (Not verified) NVIDIA Corporation   c:\windows\system32\nwiz.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
C:\Documents and Settings\All Users\Menú Inicio\Programas\Inicio
+ Server4PC.lnk   Server4PC   (Not verified) B2C2, Inc.   c:\archivos de programa\technisat dvb\bin\server4pc.exe
C:\Documents and Settings\MODESTO\Menú Inicio\Programas\Inicio
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Run
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Runonce
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\RunonceEx
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\SOFTWARE\Classes\Protocols\Filter
+ application/octet-stream   Microsoft .NET Runtime Execution Engine   (Not verified) Microsoft Corporation   c:\windows\system32\mscoree.dll
+ application/x-complus   Microsoft .NET Runtime Execution Engine   (Not verified) Microsoft Corporation   c:\windows\system32\mscoree.dll
+ application/x-msdownload   Microsoft .NET Runtime Execution Engine   (Not verified) Microsoft Corporation   c:\windows\system32\mscoree.dll
HKLM\SOFTWARE\Classes\Protocols\Handler
HKCU\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components
+ 0         File not found: About:Home
HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components
+ n/a   Microsoft .NET IE SECURITY REGISTRATION   (Not verified) Microsoft Corporation   c:\windows\system32\mscories.dll
HKCU\SOFTWARE\Microsoft\Active Setup\Installed Components
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
+ AVG Anti-Spyware 7.5   AVG Anti-Spyware shellexecutehook   (Verified) GRISOFT LTD   c:\archivos de programa\grisoft\avg anti-spyware 7.5\shellexecutehook.dll
HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
+ Desktop Explorer   NVIDIA Desktop Explorer, Version 110.60    (Not verified) NVIDIA Corporation   c:\windows\system32\nvshell.dll
+ Desktop Explorer Menu   NVIDIA Desktop Explorer, Version 110.60    (Not verified) NVIDIA Corporation   c:\windows\system32\nvshell.dll
+ Extensión de paneo de pantalla del Panel de control         File not found: deskpan.dll
+ nView Desktop Context Menu   NVIDIA Desktop Explorer, Version 110.60    (Not verified) NVIDIA Corporation   c:\windows\system32\nvshell.dll
+ Shell Icon Handler for Application References   Application Deployment Support Library   (Not verified) Microsoft Corporation   c:\windows\system32\dfshim.dll
+ ShellLink for Application References   Application Deployment Support Library   (Not verified) Microsoft Corporation   c:\windows\system32\dfshim.dll
+ WinRAR shell extension         c:\archivos de programa\winrar\rarext.dll
HKCU\Software\Classes\Folder\Shellex\ColumnHandlers
HKLM\Software\Classes\Folder\Shellex\ColumnHandlers
HKCU\Software\Microsoft\Ctf\LangBarAddin
HKLM\Software\Microsoft\Ctf\LangBarAddin
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
+ {0369BD48-AA22-4F0A-826F-8EC565B1F41F}         c:\windows\system32\comsnapj.dll
+ {C67A4149-B457-4154-85D9-B9929C765B39}         c:\windows\system32\confmspd.dll
HKCU\Software\Microsoft\Internet Explorer\UrlSearchHooks
HKLM\Software\Microsoft\Internet Explorer\Toolbar
HKCU\Software\Microsoft\Internet Explorer\Explorer Bars
HKLM\Software\Microsoft\Internet Explorer\Explorer Bars
HKCU\Software\Microsoft\Internet Explorer\Extensions
HKLM\Software\Microsoft\Internet Explorer\Extensions
Task Scheduler
HKLM\System\CurrentControlSet\Services
+ ANIWZCSdService   ANIWZCS2 Service Launcher   (Not verified) Alpha Networks Inc.   c:\archivos de programa\ani\aniwzcs2 service\aniwzcsds.exe
+ AVG Anti-Spyware Guard   AVG Anti-Spyware guard   (Verified) GRISOFT LTD   c:\archivos de programa\grisoft\avg anti-spyware 7.5\guard.exe
+ EPSONStatusAgent2   EPSON Printer Status Agent   (Not verified) SEIKO EPSON CORPORATION   c:\archivos de programa\archivos comunes\epson\ebapi\sagent2.exe
+ fonnxeug   Controller for AGP Bus mdc52      c:\windows\system32\confmspd.dll
HKLM\System\CurrentControlSet\Services
+ ANIO   ANIO (NT5) Driver    (Not verified) Alpha Networks Inc.   c:\windows\system32\anio.sys
+ AVG Anti-Spyware Driver      (Verified) GRISOFT LTD   c:\archivos de programa\grisoft\avg anti-spyware 7.5\guard.sys
+ AvgAsCln   AVG7 Clean Driver   (Verified) GRISOFT LTD   c:\windows\system32\drivers\avgascln.sys
+ Changer         File not found: C:\WINDOWS\System32\Drivers\Changer.sys
+ Cinemsup   SW CineMaster Support   (Not verified) Sonic Solutions   c:\windows\system32\drivers\cinemsup.sys
+ eboexnfa         File not found: system32\drivers\nrtesqfm.dat
+ i2omgmt         File not found: C:\WINDOWS\System32\Drivers\i2omgmt.sys
+ lbrtfdc         File not found: C:\WINDOWS\System32\Drivers\lbrtfdc.sys
+ PCIDump         File not found: C:\WINDOWS\System32\Drivers\PCIDump.sys
+ PDCOMP         File not found: C:\WINDOWS\System32\Drivers\PDCOMP.sys
+ PDFRAME         File not found: C:\WINDOWS\System32\Drivers\PDFRAME.sys
+ PDRELI         File not found: C:\WINDOWS\System32\Drivers\PDRELI.sys
+ PDRFRAME         File not found: C:\WINDOWS\System32\Drivers\PDRFRAME.sys
+ SKYNET   B2C2, Inc. DVB4PC NDIS 5.0 driver   (Not verified) B2C2, Inc.   c:\windows\system32\drivers\skynet.sys
+ Tcpip   Controlador de protocolo TCP/IP   (Not verified) Microsoft Corporation   c:\windows\system32\drivers\tcpip.sys
+ TSP         File not found: C:\WINDOWS\system32\drivers\klif.sys
+ WDICA         File not found: C:\WINDOWS\System32\Drivers\WDICA.sys
+ WFsys   WinFox Control I/O Driver   (Not verified) Leadtek Research Inc.   c:\windows\system32\drivers\wfsys.sys
HKLM\System\CurrentControlSet\Control\Session Manager\BootExecute
HKLM\System\CurrentControlSet\Control\Session Manager\SetupExecute
HKLM\System\CurrentControlSet\Control\Session Manager\Execute
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKLM\Software\Microsoft\Command Processor\Autorun
HKCU\Software\Microsoft\Command Processor\Autorun
HKLM\SOFTWARE\Classes\Exefile\Shell\Open\Command\(Default)
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls
HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\System
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UIHost
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
+ lonkigjr         c:\windows\system32\confmspd.dll
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GinaDLL
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman
HKCU\Control Panel\Desktop\Scrnsave.exe
HKLM\System\CurrentControlSet\Control\BootVerificationProgram\ImageName
HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9
HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors
HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders
HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages
HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages
HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages
HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order

Mr_X:
¿Deshabilitaste el 'Restaurar el sistema'? Haz copia de seguridad del registro usando el ERUNT. Reinicia en Modo seguro, ingresa con una cuenta con privilegios administrativos, ejecuta el Autoruns, selecciona con el botón derecho las siguientes entradas y dale a 'Delete':

--- Código: ---
+ {0369BD48-AA22-4F0A-826F-8EC565B1F41F} c:\windows\system32\comsnapj.dll
+ {C67A4149-B457-4154-85D9-B9929C765B39} c:\windows\system32\confmspd.dll

+ fonnxeug Controller for AGP Bus mdc52 c:\windows\system32\confmspd.dll

+ eboexnfa File not found: system32\drivers\nrtesqfm.dat

+ lonkigjr c:\windows\system32\confmspd.dll

--- Fin del código ---

Reinicia normal, actualiza el antivirus y pásalo reiniciando en Modo seguro... Nuevos logs...

negrasombra:
Hola de nuevo, he seguido las instrucciones y elautruns no puede eliminar las lineas
+ {0369BD48-AA22-4F0A-826F-8EC565B1F41F} c:\windows\system32\comsnapj.dll
+ {C67A4149-B457-4154-85D9-B9929C765B39} c:\windows\system32\confmspd.dll

+ lonkigjr c:\windows\system32\confmspd.dll
me repsonde que tiene acceso denegado
las otras dos si.
sigue sin poder conectarse a internet. La conexion parece todo correcto excepto que no hay IPs,mascara subred, etc..
El AVGS sigue colgandose y retrasando el arranque del ordenador. los logs
hitjack:
Logfile of HijackThis v1.99.1
Scan saved at 21:05:43, on 11/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Archivos de programa\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
E:\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {0369BD48-AA22-4F0A-826F-8EC565B1F41F} - C:\WINDOWS\system32\comsnapj.dll
O2 - BHO: (no name) - {C67A4149-B457-4154-85D9-B9929C765B39} - c:\windows\system32\confmspd.dll
O4 - HKLM\..\Run: [Conceptronic Conceptronic 54Mbps Wireless Utility] C:\Archivos de programa\Conceptronic\Conceptronic 54Mbps Wireless Utility\WLANmon.exe
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Archivos de programa\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE
O4 - Global Startup: Server4PC.lnk = C:\Archivos de programa\TechniSat DVB\bin\Server4PC.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O20 - Winlogon Notify: lonkigjr - C:\WINDOWS\SYSTEM32\confmspd.dll
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Archivos de programa\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Archivos de programa\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Archivos de programa\Archivos comunes\EPSON\EBAPI\SAgent2.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

autoruns
HKLM\System\CurrentControlSet\Control\Terminal Server\Wds\rdpwd\StartupPrograms
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AppSetup
HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Startup
HKCU\Software\Policies\Microsoft\Windows\System\Scripts\Logon
HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Logon
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\Shell
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Shell
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Runonce
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\RunonceEx
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
+ ANIWZCS2Service   ANIWZCS2 launcher for Windows.   (Not verified) Alpha Networks Inc.   c:\archivos de programa\ani\aniwzcs2 service\wzcsldr2.exe
+ Conceptronic Conceptronic 54Mbps Wireless Utility   Wireless LAN Monitor      c:\archivos de programa\conceptronic\conceptronic 54mbps wireless utility\wlanmon.exe
+ nwiz   NVIDIA nView Wizard, Version 110.60    (Not verified) NVIDIA Corporation   c:\windows\system32\nwiz.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
C:\Documents and Settings\All Users\Menú Inicio\Programas\Inicio
+ Server4PC.lnk   Server4PC   (Not verified) B2C2, Inc.   c:\archivos de programa\technisat dvb\bin\server4pc.exe
C:\Documents and Settings\Administrador\Menú Inicio\Programas\Inicio
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Run
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Runonce
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\RunonceEx
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\SOFTWARE\Classes\Protocols\Filter
+ application/octet-stream   Microsoft .NET Runtime Execution Engine   (Not verified) Microsoft Corporation   c:\windows\system32\mscoree.dll
+ application/x-complus   Microsoft .NET Runtime Execution Engine   (Not verified) Microsoft Corporation   c:\windows\system32\mscoree.dll
+ application/x-msdownload   Microsoft .NET Runtime Execution Engine   (Not verified) Microsoft Corporation   c:\windows\system32\mscoree.dll
HKLM\SOFTWARE\Classes\Protocols\Handler
HKCU\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components
HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components
+ n/a   Microsoft .NET IE SECURITY REGISTRATION   (Not verified) Microsoft Corporation   c:\windows\system32\mscories.dll
HKCU\SOFTWARE\Microsoft\Active Setup\Installed Components
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
+ AVG Anti-Spyware 7.5   AVG Anti-Spyware shellexecutehook   (Verified) GRISOFT LTD   c:\archivos de programa\grisoft\avg anti-spyware 7.5\shellexecutehook.dll
HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
+ Desktop Explorer   NVIDIA Desktop Explorer, Version 110.60    (Not verified) NVIDIA Corporation   c:\windows\system32\nvshell.dll
+ Desktop Explorer Menu   NVIDIA Desktop Explorer, Version 110.60    (Not verified) NVIDIA Corporation   c:\windows\system32\nvshell.dll
+ Extensión de paneo de pantalla del Panel de control         File not found: deskpan.dll
+ nView Desktop Context Menu   NVIDIA Desktop Explorer, Version 110.60    (Not verified) NVIDIA Corporation   c:\windows\system32\nvshell.dll
+ Shell Icon Handler for Application References   Application Deployment Support Library   (Not verified) Microsoft Corporation   c:\windows\system32\dfshim.dll
+ ShellLink for Application References   Application Deployment Support Library   (Not verified) Microsoft Corporation   c:\windows\system32\dfshim.dll
+ WinRAR shell extension         c:\archivos de programa\winrar\rarext.dll
HKCU\Software\Classes\Folder\Shellex\ColumnHandlers
HKLM\Software\Classes\Folder\Shellex\ColumnHandlers
HKCU\Software\Microsoft\Ctf\LangBarAddin
HKLM\Software\Microsoft\Ctf\LangBarAddin
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
+ {0369BD48-AA22-4F0A-826F-8EC565B1F41F}         c:\windows\system32\comsnapj.dll
+ {C67A4149-B457-4154-85D9-B9929C765B39}         c:\windows\system32\confmspd.dll
HKCU\Software\Microsoft\Internet Explorer\UrlSearchHooks
HKLM\Software\Microsoft\Internet Explorer\Toolbar
HKCU\Software\Microsoft\Internet Explorer\Explorer Bars
HKLM\Software\Microsoft\Internet Explorer\Explorer Bars
HKCU\Software\Microsoft\Internet Explorer\Extensions
HKLM\Software\Microsoft\Internet Explorer\Extensions
Task Scheduler
HKLM\System\CurrentControlSet\Services
+ ANIWZCSdService   ANIWZCS2 Service Launcher   (Not verified) Alpha Networks Inc.   c:\archivos de programa\ani\aniwzcs2 service\aniwzcsds.exe
+ AVG Anti-Spyware Guard   AVG Anti-Spyware guard   (Verified) GRISOFT LTD   c:\archivos de programa\grisoft\avg anti-spyware 7.5\guard.exe
+ EPSONStatusAgent2   EPSON Printer Status Agent   (Not verified) SEIKO EPSON CORPORATION   c:\archivos de programa\archivos comunes\epson\ebapi\sagent2.exe
+ fonnxeug   Monitor for AGP Bus ldfc0      c:\windows\system32\confmspd.dll
HKLM\System\CurrentControlSet\Services
+ ANIO   ANIO (NT5) Driver    (Not verified) Alpha Networks Inc.   c:\windows\system32\anio.sys
+ AVG Anti-Spyware Driver      (Verified) GRISOFT LTD   c:\archivos de programa\grisoft\avg anti-spyware 7.5\guard.sys
+ AvgAsCln   AVG7 Clean Driver   (Verified) GRISOFT LTD   c:\windows\system32\drivers\avgascln.sys
+ Changer         File not found: C:\WINDOWS\System32\Drivers\Changer.sys
+ Cinemsup   SW CineMaster Support   (Not verified) Sonic Solutions   c:\windows\system32\drivers\cinemsup.sys
+ eboexnfa         File not found: system32\drivers\nrtesqfm.dat
+ i2omgmt         File not found: C:\WINDOWS\System32\Drivers\i2omgmt.sys
+ lbrtfdc         File not found: C:\WINDOWS\System32\Drivers\lbrtfdc.sys
+ PCIDump         File not found: C:\WINDOWS\System32\Drivers\PCIDump.sys
+ PDCOMP         File not found: C:\WINDOWS\System32\Drivers\PDCOMP.sys
+ PDFRAME         File not found: C:\WINDOWS\System32\Drivers\PDFRAME.sys
+ PDRELI         File not found: C:\WINDOWS\System32\Drivers\PDRELI.sys
+ PDRFRAME         File not found: C:\WINDOWS\System32\Drivers\PDRFRAME.sys
+ SKYNET   B2C2, Inc. DVB4PC NDIS 5.0 driver   (Not verified) B2C2, Inc.   c:\windows\system32\drivers\skynet.sys
+ Tcpip   Controlador de protocolo TCP/IP   (Not verified) Microsoft Corporation   c:\windows\system32\drivers\tcpip.sys
+ TSP         File not found: C:\WINDOWS\system32\drivers\klif.sys
+ WDICA         File not found: C:\WINDOWS\System32\Drivers\WDICA.sys
+ WFsys   WinFox Control I/O Driver   (Not verified) Leadtek Research Inc.   c:\windows\system32\drivers\wfsys.sys
HKLM\System\CurrentControlSet\Control\Session Manager\BootExecute
HKLM\System\CurrentControlSet\Control\Session Manager\SetupExecute
HKLM\System\CurrentControlSet\Control\Session Manager\Execute
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKLM\Software\Microsoft\Command Processor\Autorun
HKCU\Software\Microsoft\Command Processor\Autorun
HKLM\SOFTWARE\Classes\Exefile\Shell\Open\Command\(Default)
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls
HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\System
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UIHost
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
+ lonkigjr         c:\windows\system32\confmspd.dll
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GinaDLL
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman
HKCU\Control Panel\Desktop\Scrnsave.exe
HKLM\System\CurrentControlSet\Control\BootVerificationProgram\ImageName
HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9
HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors
HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders
HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages
HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages
HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages
HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order

Liamngls:

--- Cita de: negrasombra en 11 de Diciembre de 2007, 09:02:04 pm ---las otras dos si.
sigue sin poder conectarse a internet. La conexion parece todo correcto excepto que no hay IPs,mascara subred, etc..

--- Fin de la cita ---

Es curioso esto que comentas, mira:

--- Cita de: Liamngls en 09 de Diciembre de 2007, 04:25:27 pm ---Te ha faltado el log del Autoruns :destroyer:

Sigue estas instrucciones:
http://www.forospyware.com/t70006.html

Necesitarás tener a mano la configuración TCP/IP de tu conexión para poder introducirla manualmente si después de pasar ese programa no fuese el internet, concretamente las DNS ... si tu conexión las asigna automáticamente no deberías tener mayores problemas (lo más probable es que sea así, pero por si acaso).

Después saca nuevos logs y comenta si funciona o no.

--- Fin de la cita ---

Y un poco más tarde:

--- Cita de: Liamngls en 09 de Diciembre de 2007, 06:45:48 pm ---Para eliminar archivos rebeldes usa este programa: http://www.malwarebytes.org/fa-esp-setup.exe

Aquí explican como usarlo: http://www.forospyware.com/t68195.html#post298547

Vamos a probar de la siguiente forma, desactiva restaurar sistema:
http://www.windowsfacil.com/manuales1/desactivar-restaurar-sistema/desactivar-restaurar-sistema.htm

Vuelve a ejecutar el FixWareout, recuerda lo que te comentaba de que después de ejecutarlo quizás tengas que reconfigurar la conexión a internet para que funcione, prueba eso si ves que no funciona.

Vuelve a pegar el log del FixWareout y uno nuevo del HijackThis :)

--- Fin de la cita ---

Saludos :)

Mr_X:
¿Ya tienes la copia de seguridad del registro?
Abre el registro de Windows, baja a la clave:

--- Código: ---[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0369BD48-AA22-4F0A-826F-8EC565B1F41F}]

--- Fin del código ---

Selecciónala, menú Edición, Permisos, dale permiso de 'Control total' a tu usuario (que debe tener permisos administrativos)... Haz lo mismo con las claves:

--- Código: ---[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C67A4149-B457-4154-85D9-B9929C765B39}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\lonkigjr]

--- Fin del código ---

Cierra el registro e intenta eliminarlas otra vez con el Autoruns...

Navegación

[0] Índice de Mensajes

[#] Página Siguiente

[*] Página Anterior

Ir a la versión completa