SEGURIDAD INFORMATICA, Firewall, parches, vacunas, antivirus, anti troyanos, spyware etc > Seguridad Informatica - Firewall - Virus - Troyanos - Spyware - Ad Aware - Malware
spyware imposible de eliminar?
backkust:
aclarar que cuando pase el adware, estaba a la vez instalando de nuevo el java.
va el log
Ad-Aware SE Build 1.05
Logfile Created on:miércoles, 01 de diciembre de 2004 1:00:28
Created with Ad-Aware SE Personal, free for private use.
Using definitions file:SE1R20 25.11.2004
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
References detected during the scan:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
None
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Ad-Aware SE Settings
===========================
Set : Search for negligible risk entries
Set : Safe mode (always request confirmation)
Set : Scan active processes
Set : Scan registry
Set : Deep-scan registry
Set : Scan my IE Favorites for banned URLs
Set : Scan within archives
Set : Scan my Hosts file
Extended Ad-Aware SE Settings
===========================
Set : Unload recognized processes & modules during scan
Set : Scan registry for all users instead of current user only
Set : Always try to unload modules before deletion
Set : Let Windows remove files in use at next reboot
Set : Delete quarantined objects after restoring
Set : Include basic Ad-Aware settings in log file
Set : Include additional Ad-Aware settings in log file
Set : Include reference summary in log file
Set : Include alternate data stream details in log file
Set : Play sound at scan completion if scan locates critical objects
01-12-04 1:00:28 - Scan started. (Full System Scan)
Listing running processes
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
#:1 [KERNEL32.DLL]
FilePath : C:\WINDOWS\SYSTEM\
ProcessID : 4293896297
Threads : 8
Priority : High
FileVersion : 4.10.2222
ProductVersion : 4.10.2222
ProductName : Sistema operativo Microsoft(R) Windows(R)
CompanyName : Microsoft Corporation
FileDescription : Componente del núcleo del kernel Win32
InternalName : KERNEL32
LegalCopyright : Copyright (C) Microsoft Corp. 1991-1999
OriginalFilename : KERNEL32.DLL
#:2 [MSGSRV32.EXE]
FilePath : C:\WINDOWS\SYSTEM\
ProcessID : 4294962101
Threads : 1
Priority : Normal
FileVersion : 4.10.2222
ProductVersion : 4.10.2222
ProductName : Sistema operativo Microsoft(R) Windows(R)
CompanyName : Microsoft Corporation
FileDescription : Servidor de mensajes VxD de 32 bits de Windows
InternalName : MSGSRV32
LegalCopyright : Copyright (C) Microsoft Corp. 1992-1998
OriginalFilename : MSGSRV32.EXE
#:3 [MPREXE.EXE]
FilePath : C:\WINDOWS\SYSTEM\
ProcessID : 4294960645
Threads : 2
Priority : Normal
FileVersion : 4.10.1998
ProductVersion : 4.10.1998
ProductName : Microsoft(R) Windows(R) Operating System
CompanyName : Microsoft Corporation
FileDescription : WIN32 Network Interface Service Process
InternalName : MPREXE
LegalCopyright : Copyright (C) Microsoft Corp. 1993-1998
OriginalFilename : MPREXE.EXE
#:4 [NOD32KRN.EXE]
FilePath : C:\ARCHIVOS DE PROGRAMA\ESET\
ProcessID : 4292885865
Threads : 10
Priority : Normal
#:5 [mmtask.tsk]
FilePath : C:\WINDOWS\SYSTEM\
ProcessID : 4292882501
Threads : 1
Priority : Normal
FileVersion : 4.03.1998
ProductVersion : 4.03.1998
ProductName : Microsoft Windows
CompanyName : Microsoft Corporation
FileDescription : Multimedia background task support module
InternalName : mmtask.tsk
LegalCopyright : Copyright © Microsoft Corp. 1991-1998
OriginalFilename : mmtask.tsk
#:6 [EXPLORER.EXE]
FilePath : C:\WINDOWS\
ProcessID : 4292944565
Threads : 6
Priority : Normal
FileVersion : 4.72.3110.1
ProductVersion : 4.72.3110.1
ProductName : Sistema operativo Microsoft(R) Windows NT(R)
CompanyName : Microsoft Corporation
FileDescription : Explorador de Windows
InternalName : explorer
LegalCopyright : (C) Microsoft Corporation 1981-1997
OriginalFilename : EXPLORER.EXE
#:7 [MEMORYBOOST.EXE]
FilePath : C:\ARCHIVOS DE PROGRAMA\MEMORYBOOST\
ProcessID : 4292984165
Threads : 3
Priority : Normal
FileVersion : 0.10
ProductVersion : 0.10
ProductName : Tenebril Super-Application Architecture
CompanyName : Tenebril Incorporated
FileDescription : Architecture launch vehicle
InternalName : VehicleApp
LegalCopyright : Copyright (C) 2001 Tenebril Inc
OriginalFilename : VehicleApp.exe
Comments : Architecture launch vehicle
#:8 [PPCONTROL.EXE]
FilePath : C:\ARCHIVOS DE PROGRAMA\PESTPATROL\
ProcessID : 4292979801
Threads : 4
Priority : Normal
#:9 [COOKIEPATROL.EXE]
FilePath : C:\ARCHIVOS DE PROGRAMA\PESTPATROL\
ProcessID : 4292991409
Threads : 3
Priority : Normal
#:10 [NOD32KUI.EXE]
FilePath : C:\ARCHIVOS DE PROGRAMA\ESET\
ProcessID : 4292986789
Threads : 2
Priority : Normal
#:11 [VBPTASK.EXE]
FilePath : C:\PROGRAM FILES\FARSTONE\RESTOREIT_98\
ProcessID : 4293012625
Threads : 2
Priority : Normal
FileVersion : 2, 0, 0, 0
ProductVersion : 2, 0, 0, 0
ProductName : VBPTask Application
CompanyName : FarStone Tech. Inc.
FileDescription : VBPTask MFC Application
InternalName : VBPTask
LegalCopyright : Copyright (C) 2000-2002 FarStone Tech. Inc.
OriginalFilename : VBPTask.EXE
#:12 [EASYCLIP.EXE]
FilePath : C:\LOTUS\ORGANIZE\
ProcessID : 4293040285
Threads : 1
Priority : Normal
FileVersion : 5.0.1.0
ProductVersion : 5.01
ProductName : Lotus Organizer EasyClip
CompanyName : Lotus Development Corporation
FileDescription : EasyClip
InternalName : EasyClip
LegalCopyright : © 1999 Lotus Development Corporation. All rights reserved. This software is subject to the Lotus Software Agreement, Restricted Rights for U.S. government users, and applicable export regulations.
LegalTrademarks : Lotus Organizer is a trademark of Lotus Development Corporation
OriginalFilename : EasyClip.exe
#:13 [REMIND32.EXE]
FilePath : C:\LOTUS\REGISTER\
ProcessID : 4293039177
Threads : 1
Priority : Normal
#:14 [JAVA022.TMP.EXE]
FilePath : C:\WINDOWS\ESCRITORIO\NUEVA CARPETA\
ProcessID : 4293165601
Threads : 1
Priority : Normal
FileVersion : 1.4.2_06
ProductVersion : 1.4.2_06
ProductName : Java 2 Runtime Environment, SE v1.4.2_06
CompanyName : Sun Microsystems, Inc.
FileDescription : Setup Launcher
LegalCopyright : 751
Comments :
#:15 [MSIEXEC.EXE]
FilePath : C:\WINDOWS\SYSTEM\
ProcessID : 4293151253
Threads : 5
Priority : Normal
#:16 [AD-AWARE.EXE]
FilePath : C:\ARCHIVOS DE PROGRAMA\LAVASOFT\AD-AWARE SE PERSONAL\
ProcessID : 4293236833
Threads : 2
Priority : Normal
FileVersion : 6.2.0.206
ProductVersion : VI.Second Edition
ProductName : Lavasoft Ad-Aware SE
CompanyName : Lavasoft Sweden
FileDescription : Ad-Aware SE Core application
InternalName : Ad-Aware.exe
LegalCopyright : Copyright © Lavasoft Sweden
OriginalFilename : Ad-Aware.exe
Comments : All Rights Reserved
Memory scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 0
Started registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Registry Scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 0
Started deep registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Deep registry scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 0
Started Tracking Cookie scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Tracking cookie scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 0
Deep scanning and examining files (c:)
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Disk Scan Result for c:\
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 0
Scanning Hosts file......
Hosts file location:"C:\WINDOWS\hosts".
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Hosts file scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
1 entries scanned.
New critical objects:0
Objects found so far: 0
1:05:13 Scan Complete
Summary Of This Scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Total scanning time:00:04:45.120
Objects scanned:43754
Objects identified:0
Objects ignored:0
New critical objects:0
backkust:
el log del spybot 1.3.2 es el siguiente
--- Search result list ---
¡Felicidades!: No se ha encontrado ningún robot espía. ()
--- Spybot - Search & Destroy version: 1.3.2 ß (build: 20041027) ---
2004-11-28 unins000.exe (51.15.0.0)
2004-09-27 blindman.exe (1.0.0.0)
2004-10-29 SpybotSD.exe (1.3.2.15)
2004-10-27 TeaTimer.exe (1.3.0.14)
2004-09-27 Update.exe (1.3.0.0)
2004-10-04 advcheck.dll (1.0.1.0)
2004-09-27 borlndmm.dll (7.0.4.453)
2004-09-27 delphimm.dll (7.0.4.453)
2004-09-27 SDHelper.dll (1.3.0.12)
2004-09-27 Tools.dll (2.0.0.0)
2004-09-27 UnzDll.dll (1.73.1.1)
2004-09-27 ZipDll.dll (1.73.2.0)
2004-08-11 Includes\Cookies.sbi (*)
2004-11-17 Includes\Dialer.sbi (*)
2004-11-17 Includes\Hijackers.sbi (*)
2004-11-17 Includes\Keyloggers.sbi (*)
2004-11-17 Includes\Malware.sbi (*)
2004-10-05 Includes\Revision.sbi (*)
2004-10-25 Includes\Security.sbi (*)
2004-11-17 Includes\Spybots.sbi (*)
2004-11-17 Includes\Trojans.sbi (*)
2004-08-12 Includes\LSP.sbi (*)
2004-10-21 Includes\Tracks.uti
--- System information ---
Windows 98 (Build: 2222) A
/ DataAccess: Microsoft Data Access Components KB870669
/ DataAccess: Buffer Overrun in Microsoft Data Access Components Could Lead to Code Execution
/ DirectX: DirectX Update 819696
--- Startup entries list ---
Located: HK_LM:Run, CookiePatrol
command: C:\ARCHIV~1\PESTPA~1\CookiePatrol.exe
file: C:\ARCHIV~1\PESTPA~1\CookiePatrol.exe
size: 69632
MD5: bd0110a00ed856ad4601c20f82def09c
Located: HK_LM:Run, farstone
command:
file:
Located: HK_LM:Run, mdac_runonce
command: C:\WINDOWS\SYSTEM\runonce.exe
file: C:\WINDOWS\SYSTEM\runonce.exe
size: 36864
MD5: 2270a909e909b40b1e94f17157c650e3
Located: HK_LM:Run, MemoryBoost
command: "C:\Archivos de programa\MemoryBoost\MemoryBoost.exe"
file: C:\Archivos de programa\MemoryBoost\MemoryBoost.exe
size: 73845
MD5: 0854a3469b1a3082de55c038bc0ffa98
Located: HK_LM:Run, nod32kui
command: "C:\Archivos de programa\Eset\nod32kui.exe" /WAITSERVICE
file: C:\Archivos de programa\Eset\nod32kui.exe
size: 823296
MD5: 10393d361281ddb36b50e688ce3259c8
Located: HK_LM:Run, PestPatrol Control Center
command: C:\ARCHIV~1\PESTPA~1\PPControl.exe
file: C:\ARCHIV~1\PESTPA~1\PPControl.exe
size: 53248
MD5: e2362c0cb43d5911007775e2ef99b2ba
Located: HK_LM:Run, RestoreIT!
command: "C:\Program Files\FarStone\RestoreIT_98\VBPTASK.EXE" VBStart
file: C:\Program Files\FarStone\RestoreIT_98\VBPTASK.EXE
size: 237568
MD5: 68ac4a9875b5f80ae70bcbd502cc706f
Located: HK_LM:RunServices, NOD32kernel
command: "C:\Archivos de programa\Eset\nod32krn.exe"
file: C:\Archivos de programa\Eset\nod32krn.exe
size: 286720
MD5: de2f3780eb228d0bedf8c87e32f05cd7
Located: HK_LM:Run, ATIPTA (DISABLED)
command: C:\Archivos de programa\ATI Technologies\ATI Control Panel\atiptaxx.exe
file: C:\Archivos de programa\ATI Technologies\ATI Control Panel\atiptaxx.exe
size: 335872
MD5: e7d70592d84fe14e4a6c1f09d9c1bd34
Located: HK_LM:Run, BrowserWebCheck (DISABLED)
command: loadwc.exe
file: C:\WINDOWS\SYSTEM\loadwc.exe
size: 15360
MD5: a68370eb9da6f4ac332a74e492d3ee74
Located: HK_LM:Run, LoadPowerProfile (DISABLED)
command: Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
file: C:\WINDOWS\Rundll32.exe
size: 24576
MD5: ef3897e3c533f016c3a446eae0f6cd84
Located: HK_LM:Run, NvCplDaemon (DISABLED)
command: RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
file: C:\WINDOWS\RUNDLL32.EXE
size: 24576
MD5: ef3897e3c533f016c3a446eae0f6cd84
Located: HK_LM:Run, nwiz (DISABLED)
command: nwiz.exe /install
file: C:\WINDOWS\SYSTEM\nwiz.exe
size: 360448
MD5: bf8da6a516b0244def95d50fbb6baa35
Located: HK_LM:Run, ScanRegistry (DISABLED)
command: C:\WINDOWS\scanregw.exe /autorun
file: C:\WINDOWS\scanregw.exe
size: 90112
MD5: d6e3cae0d92870b972377f7f29265ed7
Located: HK_LM:Run, SchedulingAgent (DISABLED)
command: mstinit.exe /logon
file: C:\WINDOWS\SYSTEM\mstinit.exe
size: 8464
MD5: 92cf410f43470d515de0ea5ff9e0c965
Located: HK_LM:RunServices, ATIPOLL (DISABLED)
command: ati2evxx.exe
file:
Located: HK_LM:RunServices, ATISmart (DISABLED)
command: C:\WINDOWS\SYSTEM\ati2s9ag.exe
file:
Located: HK_LM:RunServices, LoadPowerProfile (DISABLED)
command: Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
file: C:\WINDOWS\Rundll32.exe
size: 24576
MD5: ef3897e3c533f016c3a446eae0f6cd84
Located: HK_LM:RunServices, Machine Debug Manager (DISABLED)
command: C:\WINDOWS\SYSTEM\MDM.EXE
file: C:\WINDOWS\SYSTEM\MDM.EXE
size: 119400
MD5: 95d85d69ffc099c516d99cb9581e3fe2
Located: HK_LM:RunServices, SchedulingAgent (DISABLED)
command: mstask.exe
file: C:\WINDOWS\SYSTEM\mstask.exe
size: 113424
MD5: 450f388f2bed1a6bad36f4ecd8b0871c
Located: Inicio (usuario), Lotus Organizer EasyClip.lnk
command: C:\lotus\organize\easyclip.exe
file: C:\lotus\organize\easyclip.exe
size: 87040
MD5: 72f949692b2e8dafe96021f4cb56b1b9
Located: Inicio (usuario), Lotus SmartSuite 9.6 - Español Registro.lnk
command: C:\lotus\register\remind32.exe
file: C:\lotus\register\remind32.exe
size: 45056
MD5: 41efd9efcdc42f0f217f4be5e1592b7e
Located: Inicio (usuario), Microsoft Office.lnk
command: C:\Archivos de programa\Microsoft Office\Office\OSA9.EXE
file: C:\Archivos de programa\Microsoft Office\Office\OSA9.EXE
size: 65588
MD5: 74452af1c8ab4d762b3fca05dbf2a555
--- Browser helper object list ---
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
BHO name:
CLSID name: AcroIEHlprObj Class
description: Adobe Acrobat reader
classification: Legitimate
known filename: AcroIEhelper.ocx<br>AcroIEhelper.dll
info link: http://www.adobe.com/products/acrobat/readstep2.html
info source: TonyKlein
Path: C:\ARCHIVOS DE PROGRAMA\ADOBE\ACROBAT 5.0\READER\ACTIVEX\
Long name: AcroIEHelper.ocx
Short name: ACROIE~1.OCX
Date (created): 01/06/04 18:17:04
Date (last access): 01/12/04
Date (last write): 16/04/01 16:39:02
Filesize: 37808
Attributes: archive
MD5: 8394ABFC1BE196A62C9F532511936DF7
CRC32: 71D6E350
Version: 1.0.0.1
{53707962-6F74-2D53-2644-206D7942484F} ()
BHO name:
CLSID name:
description: Spybot-S&D IE Browser plugin
classification: Legitimate
known filename: SDhelper.dll
info link: http://spybot.eon.net.au/
info source: Patrick M. Kolla
Path: C:\Archivos de programa\Spybot - Search & Destroy\
Long name: SDHelper.dll
Short name: SDHELPER.DLL
Date (created): 27/09/04 1:03:02
Date (last access): 01/12/04
Date (last write): 27/09/04 1:03:02
Filesize: 770560
Attributes: archive
MD5: 904E5E75C345E6BDE03370C9BE525E6A
CRC32: F6BCC9B5
Version: 1.3.0.12
--- ActiveX list ---
Microsoft XML Parser for Java (Microsoft XML Parser for Java)
DPF name: Microsoft XML Parser for Java
CLSID name:
Installer:
Codebase: file://C:\WINDOWS\Java\classes\xmldso.cab
description:
classification: Legitimate
known filename: %WINDIR%\Java\classes\xmldso.cab
info link:
info source: Patrick M. Kolla
DirectAnimation Java Classes (DirectAnimation Java Classes)
DPF name: DirectAnimation Java Classes
CLSID name:
Installer:
Codebase: file://C:\WINDOWS\SYSTEM\dajava.cab
description:
classification: Legitimate
known filename: %WINDIR%\Java\classes\dajava.cab
info link:
info source: Patrick M. Kolla
Internet Explorer Classes for Java (Internet Explorer Classes for Java)
DPF name: Internet Explorer Classes for Java
CLSID name:
Installer:
Codebase: file://C:\WINDOWS\SYSTEM\iejava.cab
description:
classification: Legitimate
known filename: %WINDIR%\Java\classes\iejava.cab
info link:
info source: Patrick M. Kolla
{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.4.2)
DPF name: Java Runtime Environment 1.4.2
CLSID name: Java Plug-in 1.4.2_01
Installer:
Codebase: http://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
Path: C:\Archivos de programa\Opera7\Program\Plugins\
Long name: NPJPI142_01.dll
{9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class)
DPF name:
CLSID name: Update Class
Installer: C:\WINDOWS\Downloaded Program Files\iuctl.inf
Codebase: http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?38320.5580671296
description: Windows Update
classification: Legitimate
known filename: %WINDIR%\System32\iuctl.dll,iuengine.dll
info link:
info source: Patrick M. Kolla
Path: C:\WINDOWS\SYSTEM\
Long name: iuctl.dll
Short name: IUCTL.DLL
Date (created): 21/08/03 16:47:54
Date (last access): 01/12/04
Date (last write): 21/08/03 16:47:54
Filesize: 162400
Attributes:
MD5: DB2F1F57D3057FEBC19C61AB9AA77198
CRC32: 5A03D776
Version: 5.3.3790.13
{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBA} (Java Runtime Environment 1.4.2)
DPF name: Java Runtime Environment 1.4.2
CLSID name: Java Plug-in 1.4.2_06
Installer:
Codebase: http://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
Path: C:\Archivos de programa\Java\j2re1.4.2_06\bin\
Long name: NPJPI142_06.dll
Short name: NPJPI1~1.DLL
Date (created): 28/09/04 20:26:10
Date (last access): 01/12/04
Date (last write): 28/09/04 20:26:00
Filesize: 65650
Attributes: archive
MD5: 69E5147BA901A9238C4EB08C84E1A85B
CRC32: 6CB34BCC
Version: 1.4.2.60
{8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.4.2)
DPF name: Java Runtime Environment 1.4.2
CLSID name: Java Plug-in 1.4.2_06
Installer:
Codebase: http://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
description: Sun Java
classification: Legitimate
known filename: %PROGRAM FILES%\JabaSoft\JRE\*\Bin\npjava131.dll
info link:
info source: Patrick M. Kolla
Path: C:\Archivos de programa\Java\j2re1.4.2_06\bin\
Long name: NPJPI142_06.dll
Short name: NPJPI1~1.DLL
Date (created): 28/09/04 20:26:10
Date (last access): 01/12/04
Date (last write): 28/09/04 20:26:00
Filesize: 65650
Attributes: archive
MD5: 69E5147BA901A9238C4EB08C84E1A85B
CRC32: 6CB34BCC
Version: 1.4.2.60
--- Process list ---
PID: -1070999 (2123372949) C:\WINDOWS\SYSTEM\KERNEL32.DLL
size: 479232
MD5: F02E46EEFFFAE43CCF96F3D76DAA5218
PID: -5195 (-1070999) C:\WINDOWS\SYSTEM\MSGSRV32.EXE
size: 12215
MD5: 65D940EB0831ACE8E462EBED7412013F
PID: -6651 (-5195) C:\WINDOWS\SYSTEM\MPREXE.EXE
size: 28672
MD5: 0B209ACF1143353A8EE42E980EF9038D
PID: -2081647 (-6651) C:\ARCHIVOS DE PROGRAMA\ESET\NOD32KRN.EXE
size: 286720
MD5: DE2F3780EB228D0BEDF8C87E32F05CD7
PID: -2084787 (-5195) C:\WINDOWS\SYSTEM\mmtask.tsk
size: 1184
MD5: 38BAE36E67C8B1AE3ABC077837953B89
PID: -2022723 (-5195) C:\WINDOWS\EXPLORER.EXE
size: 180224
MD5: 52AF7902128D03E8C894E33FE09738EB
PID: -1983123 (-2022723) C:\ARCHIVOS DE PROGRAMA\MEMORYBOOST\MEMORYBOOST.EXE
size: 73845
MD5: 0854A3469B1A3082DE55C038BC0FFA98
PID: -1979267 (-2022723) C:\ARCHIVOS DE PROGRAMA\ESET\NOD32KUI.EXE
size: 823296
MD5: 10393D361281DDB36B50E688CE3259C8
PID: -1950387 (-2022723) C:\PROGRAM FILES\FARSTONE\RESTOREIT_98\VBPTASK.EXE
size: 237568
MD5: 68AC4A9875B5F80AE70BCBD502CC706F
PID: -1931619 (-2022723) C:\LOTUS\ORGANIZE\EASYCLIP.EXE
size: 87040
MD5: 72F949692B2E8DAFE96021F4CB56B1B9
PID: -1942147 (-2022723) C:\LOTUS\REGISTER\REMIND32.EXE
size: 45056
MD5: 41EFD9EFCDC42F0F217F4BE5E1592B7E
PID: -1925299 (-2022723) C:\ARCHIVOS DE PROGRAMA\SPYBOT - SEARCH & DESTROY\SPYBOTSD.EXE
size: 4284928
MD5: 59C41681A1D3BDF2324EAE1A0264824F
--- Browser start & search pages list ---
Spybot - Search && Destroy browser pages report, 01/12/04 1:23:04
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Local Page
C:\WINDOWS\SYSTEM\blank.htm
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Page
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page
http://www.google.es/
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl\@
http://www.google.com/keyword/%s
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Local Page
C:\WINDOWS\SYSTEM\blank.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Search Page
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Start Page
http://www.google.es
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Page_URL
http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Search_URL
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\SearchAssistant
http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\CustomizeSearch
http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchUrl\@
http://www.google.com/keyword/%s
--- Winsock Layered Service Provider list ---
Protocol 0: MS.w95.spi.osp
GUID: {FF017DE1-CAE9-11CF-8A99-00AA0062C609}
Filename: C:\WINDOWS\SYSTEM\mswsosp.dll
Description: Microsoft Windows 9x/ME name space provider
DB filename: %windir%\system\mswsosp.dll
DB protocol: MS.w95.spi.*
Protocol 1: MS.w95.spi.tcp
GUID: {FF017DE0-CAE9-11CF-8A99-00AA0062C609}
Filename: C:\WINDOWS\SYSTEM\msafd.dll
Description: Microsoft Windows 9x/ME network protocol
DB filename: %windir%\system\msafd.dll
DB protocol: MS.w95.spi.*
Protocol 2: MS.w95.spi.udp
GUID: {FF017DE0-CAE9-11CF-8A99-00AA0062C609}
Filename: C:\WINDOWS\SYSTEM\msafd.dll
Description: Microsoft Windows 9x/ME network protocol
DB filename: %windir%\system\msafd.dll
DB protocol: MS.w95.spi.*
Protocol 3: MS.w95.spi.raw
GUID: {FF017DE0-CAE9-11CF-8A99-00AA0062C609}
Filename: C:\WINDOWS\SYSTEM\msafd.dll
Description: Microsoft Windows 9x/ME network protocol
DB filename: %windir%\system\msafd.dll
DB protocol: MS.w95.spi.*
Protocol 4: MS.w95.spi.rsvptcp
GUID: {ECBDCBA0-334A-11D0-BD88-0000C082E69A}
Filename: C:\WINDOWS\SYSTEM\rsvpsp.dll
Description: Microsoft Windows 9x/ME network protocol
DB filename: %windir%\system\rsvoso.dll
DB protocol: MS.w95.spi.*
Protocol 5: MS.w95.spi.rsvpudp
GUID: {ECBDCBA0-334A-11D0-BD88-0000C082E69A}
Filename: C:\WINDOWS\SYSTEM\rsvpsp.dll
Description: Microsoft Windows 9x/ME network protocol
DB filename: %windir%\system\rsvoso.dll
DB protocol: MS.w95.spi.*
Namespace Provider 0: DNS Name Space Provider.
GUID: {FF017DE2-CAE9-11CF-8A99-00AA0062C609}
Filename: C:\WINDOWS\SYSTEM\rnr20.dll
Description: Microsoft Windows 9x/ME name space provider
DB filename: %windir%\system\rnr20.dll
DB protocol: DNS Name Space Provider.
--- System Services ---
Service (registry key): Class
Start: 0
Type: 0
Error Control: 0
Service (registry key): VxD
Start: 0
Type: 0
Error Control: 0
Service (registry key): Winsock
Start: 0
Type: 0
Error Control: 0
Service (registry key): WDMFS
Display name: WDM Windows File System Mapper
Image path: \SystemRoot\System32\Drivers\wdmfs.sys
Start: 0
Type: 0
Error Control: 0
Service (registry key): RemoteAccess
Start: 0
Type: 0
Error Control: 0
Service (registry key): ACPI
Start: 0
Type: 0
Error Control: 0
Service (registry key): USB
Start: 0
Type: 0
Error Control: 0
Service (registry key): NPSTUB
Start: 0
Type: 0
Error Control: 0
Service (registry key): EventLog
Start: 0
Type: 0
Error Control: 0
Service (registry key): W3SVC
Start: 0
Type: 0
Error Control: 0
Service (registry key): MSNP32
Start: 0
Type: 0
Error Control: 0
Service (registry key): wdmaud
Image path: \SystemRoot\system32\drivers\wdmaud.sys
Start: 0
Type: 0
Error Control: 0
Service (registry key): redbook
Image path: \SystemRoot\system32\drivers\redbook.sys
Start: 0
Type: 0
Error Control: 0
Service (registry key): sbemul
Image path: \SystemRoot\system32\drivers\sbemul.sys
Start: 0
Type: 0
Error Control: 0
Service (registry key): Arbitrators
Start: 0
Type: 0
Error Control: 0
Service (registry key): ProtectedStorage
Start: 0
Type: 0
Error Control: 0
Service (registry key): WinSock2
Start: 0
Type: 0
Error Control: 0
Service (registry key): VFILT
Start: 0
Type: 0
Error Control: 0
backkust:
lo ultimo que he instentado es reinstalar el windows por encima del ya existente. conservo todos los programas configuraciones y tambien el puñetero spyware en cuestion.
ahora mismo estoy bastante desesperado. creo que optare por formatear de cero y reinstalar todo , aunque es una labor en mis caso de chinos (por mis conocimientos mas que nada y porque no se donde estan los drivers de este equipo fujitsu un poco antiguo ya) el equipo no es mio es de un amigo por lo que no puedo tenerselo ya muchos mas dias...
¿que opinais? ¿no creeis que aunque muy latoso y dificil puede ser la mejor solucion para un spyware que en principio parece imposible de eliminar?
me vendria muy bien vuestra opinion
backkust:
ante todo muchisimas gracias por toda vuestra ayuda.
al final el spyware me ha podido, me he rendido, y he formateado para ir reinstalando todo de nuevo (estoy por intentar pasarme a linux que parece que es inmune a todas estas plagas...)
gracias por todo
un abrazo
:lol:
Navegación
[*] Página Anterior
Ir a la versión completa