Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

VTURO.DLL [RESOLVED]

Started by Sweetbones , Feb 06 2008 11:41 PM

This topic is locked

#1
Sweetbones

Posted 06 February 2008 - 11:41 PM

Member

Member
15 posts

Hello,
ive got the same problem that one girl/boy that's already posted.
vturo.dll was detected for my spybot, but it is not posible to delete. i run other antispyware and it didnt even find it.
i can see vturo.dll in system32. i read wt this person posted and downloaded hijiackThis and run it. vturo.dll never appeared.
i dont know wt to do. im afraid of doing step-by-step of wt this guy says because i cant see vturo.dll in the log. I hope someone could help me. thank u very much.

C:\Archivos de programa\McAfee\Common Framework\FrameworkService.exe
C:\Archivos de programa\Archivos comunes\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\VTTimer.exe
C:\WINDOWS\System32\VTtrayp.exe
C:\Archivos de programa\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Archivos de programa\Spybot - Search & Destroy\TeaTimer.exe
C:\Archivos de programa\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Archivos de programa\Microsoft Encarta\Biblioteca de Consulta Encarta 2005\EDICT.EXE
C:\Archivos de programa\MSN Messenger\usnsvc.exe
C:\Archivos de programa\Uniblue\SpyEraser\SpyEraser.exe
C:\WINDOWS\explorer.exe
C:\Archivos de programa\Internet Explorer\iexplore.exe
C:\Archivos de programa\Archivos comunes\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Archivos de programa\MSN Messenger\msnmsgr.exe
C:\Archivos de programa\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\archivos de programa\google\googletoolbar1.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [kav] "C:\Archivos de programa\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Archivos de programa\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Archivos de programa\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Archivos de programa\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Uniblue SpyEraser] "C:\Archivos de programa\Uniblue\SpyEraser\SpyEraser.exe" -m
O4 - HKCU\..\Policies\Explorer\Run: [Windows Printing Driver] WinSpooler.exe
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Antivirus de la Web - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Archivos de programa\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: Referencia - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARCHIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Investigador - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\Encarta Researcher\EROPROJ.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\usuario\Menú Inicio\Programas\IMVU\Run IMVU.lnk (file missing)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zon...kr.cab56986.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx...owserPlugin.cab
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://sympatico.zon...mjolauncher.cab
O16 - DPF: {83AFB5CA-ED35-11D4-A452-0080C8D85045} -
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn...ro.cab56649.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://zone.msn.com/...ploader_v10.cab
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Archivos de programa\Ares\chatServer.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Kaspersky Lab - C:\Archivos de programa\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Archivos de programa\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Archivos de programa\McAfee\Common Framework\FrameworkService.exe

--

#2
Rorschach112

Posted 07 February 2008 - 09:22 AM

Ralphie

Retired Staff
47,710 posts

Hello

Download ComboFix from one of the locations below, and save it to your Desktop.

Link 1
Link 2
Link 3

Double click combofix.exe and follow the prompts.
When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply
Note: Do not mouseclick combofix's window while its running. That may cause it to stall

#3
Sweetbones

Posted 09 February 2008 - 12:14 AM

Member

Topic Starter
Member
15 posts

thank u very much for ur help!!

ComboFix 08-02.05.3 - usuario 2008-02-08 23:38:29.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.1.1252.34.3082.18.116 [GMT 1:00]
Se ejecuta desde: C:\Documents and Settings\usuario\Escritorio\ComboFix.exe
* Creado un nuevo punto de restauración

ADVERTENCIA - ESTE EQUIPO NO TIENE INSTALADA LA CONSOLA DE RECUPERACION!
.

(((((((((((((((((((((((((((((((((((( Otras eliminaciones )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\System32\vturo.dll
C:\Archivos de programa\windows
C:\Archivos de programa\windows\Windows-KB890830-V1.30.exe
C:\WINDOWS\svchost.exe
C:\WINDOWS\system32\orutv.ini
C:\WINDOWS\system32\orutv.ini2
C:\WINDOWS\system32\vturo.dll

.
(((((((((((((((((( Archivos creados desde 2008-01-08 - 2008-02-08 )))))))))))))))))))))))))))))))))
.

2008-02-08 23:04 . 2008-02-08 23:04 2,126 --a------ C:\WINDOWS\system32\wpa.dbl
2008-02-08 01:13 . 2008-02-08 01:13 <DIR> d-a------ C:\Documents and Settings\All Users\Datos de programa\TEMP
2008-02-07 23:41 . 2008-02-07 23:38 691,545 --a------ C:\WINDOWS\unins000.exe
2008-02-07 23:41 . 2008-02-07 23:41 3,456 --a------ C:\WINDOWS\unins000.dat
2008-02-06 23:03 . 2008-02-07 22:21 <DIR> d-------- C:\Archivos de programa\Trend Micro
2008-02-06 20:35 . 2008-02-07 22:21 <DIR> d-------- C:\Documents and Settings\Administrador\Plantillas
2008-02-06 20:35 . 2008-02-07 22:21 <DIR> d-------- C:\Documents and Settings\Administrador\Datos de programa
2008-02-06 20:35 . 2008-02-07 22:21 <DIR> d-------- C:\Documents and Settings\Administrador\Configuraci¢n local
2008-02-06 18:43 . 2004-08-30 21:00 1,470,464 --a------ C:\WINDOWS\system32\WinSpooler.exe
2008-02-05 20:48 . 2004-08-30 21:00 1,417,216 --------- C:\WINDOWS\system32\BTCPatcher.exe
2008-01-29 22:20 . 2008-01-29 22:20 <DIR> d-------- C:\Documents and Settings\All Users\Datos de programa\Uniblue
2008-01-28 13:29 . 2008-02-01 23:45 <DIR> d-------- C:\Documents and Settings\usuario\Datos de programa\Uniblue
2008-01-28 13:29 . 2008-02-01 23:45 <DIR> d-------- C:\Archivos de programa\Uniblue

.
(((((((((((((((((((((((((((((((((((((( Reporte Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-08 22:42 12,210,720 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-02-08 22:41 677,408 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-02-08 22:41 243,080 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-02-08 22:41 164,588 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-02-08 22:38 --------- d-----w C:\Archivos de programa\Kaspersky Lab
2008-02-08 00:21 --------- d-----w C:\Archivos de programa\Image-Line
2008-02-07 22:45 --------- d-----w C:\Documents and Settings\All Users\Datos de programa\Spybot - Search & Destroy
2008-02-07 22:43 --------- d-----w C:\Archivos de programa\Spybot - Search & Destroy
2008-02-07 22:32 --------- d-----w C:\Archivos de programa\VstPlugins
2008-02-07 22:31 --------- d-----w C:\Archivos de programa\Ares
2008-02-06 17:16 --------- d-----w C:\Archivos de programa\Soulseek
2008-02-06 16:54 --------- d-----w C:\Archivos de programa\FL
2007-12-15 12:35 --------- d-----w C:\Archivos de programa\subtitles
2007-12-12 09:19 --------- d-----w C:\Archivos de programa\DivX
2007-12-11 22:34 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2007-12-11 22:34 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2007-12-04 01:33 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2007-12-04 01:33 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2007-12-04 01:33 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2007-12-04 01:33 682,496 ----a-w C:\WINDOWS\system32\DivX.dll
2007-11-29 22:30 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2007-11-29 22:30 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2007-11-29 22:28 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2007-11-29 22:28 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2007-11-28 21:55 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2007-11-28 21:53 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2007-11-28 21:53 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2007-11-28 21:53 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2007-11-28 21:53 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2007-11-28 21:53 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2007-11-28 21:53 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2007-11-28 21:52 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
.

((((((((((((((((((((((((((((((((( Cargando Puntos Reg ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* entradas vac¡as & entradas leg¡timas predeterminadas no son mostradas

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="C:\Archivos de programa\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]
"msnmsgr"="C:\Archivos de programa\MSN Messenger\MsnMsgr.exe" [2007-01-19 11:55 5674352]
"Uniblue SpyEraser"="C:\Archivos de programa\Uniblue\SpyEraser\SpyEraser\SpyEraser.exe" [2008-01-29 10:13 1424648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VTTrayp"="VTtrayp.exe" [2006-07-10 19:33 176128 C:\WINDOWS\system32\VTTrayp.exe]
"kav"="C:\Archivos de programa\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" [2006-03-24 18:09 139367]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run]
"NTSpool"= NTSpool.exe
"Windows Printing Driver"= WinSpooler.exe

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menú Inicio^Programas^Inicio^Adobe Reader Synchronizer.lnk.disabled]
backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnk.disabledCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menú Inicio^Programas^Inicio^Inicio rápido de Adobe Reader.lnk.disabled]
backup=C:\WINDOWS\pss\Inicio rápido de Adobe Reader.lnk.disabledCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^usuario^Menú Inicio^Programas^Inicio^IMVU.lnk]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdVantage]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\McAfeeUpdaterUI]
--a------ 2006-11-17 12:39 136768 C:\Archivos de programa\McAfee\Common Framework\UdaterUI.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MessengerPlus3]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2007-08-03 15:18 286720 C:\Archivos de programa\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ShStatEXE]
C:\Archivos de programa\McAfee\VirusScan Enterprise\SHSTAT.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
-r------- 2006-03-02 00:22 577536 C:\WINDOWS\soundman.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
--a------ 2007-07-05 19:28 68856 C:\Archivos de programa\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2007-08-29 18:57 185632 C:\Archivos de programa\Archivos comunes\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"McAfeeFramework"=2 (0x2)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"msnmsgr"="C:\Archivos de programa\MSN Messenger\MsnMsgr.Exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"VTTimer"=VTTimer.exe

R0 videX32;videX32;C:\WINDOWS\System32\DRIVERS\videX32.sys [2006-02-23 04:38]
R0 xfilt;VIA SATA IDE Hot-plug Driver;C:\WINDOWS\System32\DRIVERS\xfilt.sys [2006-02-23 04:39]
R3 PSXGamepadEnabler;Psx Hid to Gamepad Port Enabler;C:\WINDOWS\System32\drivers\psxpad.sys [2006-07-24 13:11]
R3 PsxPortEnumerator;Psx Port Enumerator;C:\WINDOWS\System32\Drivers\psxenum.sys [2006-07-24 13:11]

.
Contenido de carpeta 'Tareas Programadas'
"2007-10-17 21:57:32 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Archivos de programa\Apple Software Update\SoftwareUpdate.exe
"2007-06-25 17:58:46 C:\WINDOWS\Tasks\Spybot - Search & Destroy - Scheduled Task.job"
- C:\Archivos de programa\Spybot - Search & Destroy\SpybotSD.exe
"2008-02-01 22:45:42 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC Nag.job"
- C:\Archivos de programa\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
"2008-02-01 22:45:42 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC.job"
- C:\Archivos de programa\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
"2008-02-08 00:13:29 C:\WINDOWS\Tasks\Uniblue SpyEraser.job"
- C:\Archivos de programa\Uniblue\SpyEraser\SpyEraser\SpyEraser.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-08 23:42:28
Windows 5.1.2600 Service Pack 1 NTFS

escaneando procesos ocultos ...

escaneando entradas ocultas de autostart ...

escaneando archivos ocultos ...

el escaneo se completo con exito
archivos ocultos: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Archivos de programa\McAfee\Common Framework\FrameworkService.exe
C:\Archivos de programa\Archivos comunes\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\wdfmgr.exe
C:\Archivos de programa\McAfee\Common Framework\naPrdMgr.exe
.
**************************************************************************
.
Tiempo completado: 2008-02-08 23:48:00 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-08 22:47:51

HijackThis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:58:59 p.m., on 08/02/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Archivos de programa\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Archivos de programa\McAfee\Common Framework\FrameworkService.exe
C:\Archivos de programa\Archivos comunes\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\VTtrayp.exe
C:\Archivos de programa\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Archivos de programa\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Archivos de programa\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O2 - BHO: Aplicación auxiliar de vínculos de Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Archivos de programa\Archivos comunes\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARCHIV~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\archivos de programa\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\archivos de programa\google\googletoolbar1.dll
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [kav] "C:\Archivos de programa\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Archivos de programa\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Archivos de programa\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Uniblue SpyEraser] "C:\Archivos de programa\Uniblue\SpyEraser\SpyEraser\SpyEraser.exe" -m
O4 - HKCU\..\Policies\Explorer\Run: [NTSpool] NTSpool.exe
O4 - HKCU\..\Policies\Explorer\Run: [Windows Printing Driver] WinSpooler.exe
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Antivirus de la Web - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Archivos de programa\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: Referencia - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARCHIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Investigador - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\Encarta Researcher\EROPROJ.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARCHIV~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARCHIV~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zon...kr.cab56986.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx...owserPlugin.cab
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://sympatico.zon...mjolauncher.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn...ro.cab56649.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://zone.msn.com/...ploader_v10.cab
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Kaspersky Lab - C:\Archivos de programa\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Archivos de programa\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Archivos de programa\McAfee\Common Framework\FrameworkService.exe

--
End of file - 4643 bytes

#4
Rorschach112

Posted 09 February 2008 - 07:45 AM

Ralphie

Retired Staff
47,710 posts

Hello

1. Please re-open HiJackThis and choose do a system scan only. Check the boxes next to ONLY the entries listed below(if present):

O4 - HKCU\..\Policies\Explorer\Run: [NTSpool] NTSpool.exe
O4 - HKCU\..\Policies\Explorer\Run: [Windows Printing Driver] WinSpooler.exe

2. Now close all windows other than HiJackThis, including browsers, so that nothing other than HijackThis is open, then click Fix Checked. A box will pop up asking you if you wish to fix the selected items. Please choose YES. Once it has fixed them, please exit/close HijackThis.

1. Close any open browsers.

2. Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\WINDOWS\system32\WinSpooler.exe
C:\WINDOWS\system32\BTCPatcher.exe

Registry::
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run]
"NTSpool"=-
"Windows Printing Driver"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdVantage]

Save this as CFScript.txt, in the same location as ComboFix.exe

Posted Image

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at "C:\ComboFix.txt"

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Reboot and post a new HijackThis log

#5
Sweetbones

Posted 09 February 2008 - 08:21 PM

Member

Topic Starter
Member
15 posts

Thank u very much ^^ my thanks wont ever be enough...

Here it is

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:19:18 p.m., on 09/02/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\VTtrayp.exe
C:\Archivos de programa\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Archivos de programa\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Archivos de programa\McAfee\Common Framework\FrameworkService.exe
C:\Archivos de programa\Spybot - Search & Destroy\TeaTimer.exe
C:\Archivos de programa\Archivos comunes\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Archivos de programa\MSN Messenger\MsnMsgr.Exe
C:\Archivos de programa\Uniblue\SpyEraser\SpyEraser\SpyEraser.exe
C:\Archivos de programa\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Archivos de programa\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\System32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O2 - BHO: Aplicación auxiliar de vínculos de Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Archivos de programa\Archivos comunes\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARCHIV~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\archivos de programa\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\archivos de programa\google\googletoolbar1.dll
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [kav] "C:\Archivos de programa\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Archivos de programa\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Archivos de programa\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Uniblue SpyEraser] "C:\Archivos de programa\Uniblue\SpyEraser\SpyEraser\SpyEraser.exe" -m
O4 - HKCU\..\Run: [swg] C:\Archivos de programa\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Antivirus de la Web - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Archivos de programa\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: Referencia - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARCHIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Investigador - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\Encarta Researcher\EROPROJ.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARCHIV~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARCHIV~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zon...kr.cab56986.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx...owserPlugin.cab
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://sympatico.zon...mjolauncher.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn...ro.cab56649.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://zone.msn.com/...ploader_v10.cab
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Kaspersky Lab - C:\Archivos de programa\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Archivos de programa\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Archivos de programa\McAfee\Common Framework\FrameworkService.exe

--
End of file - 4808 bytes

#6
Rorschach112

Posted 10 February 2008 - 07:14 AM

Ralphie

Retired Staff
47,710 posts

Could you post the ComboFix log and do this

Download and scan with SUPERAntiSpyware Free for Home Users

Double-click SUPERAntiSpyware.exe and use the default settings for installation.
An icon will be created on your desktop. Double-click that icon to launch the program.
If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download and unzip them from here.)
Under "Configuration and Preferences", click the Preferences button.
Click the Scanning Control tab.
Under Scanner Options make sure the following are checked (leave all others unchecked):
- Close browsers before scanning.
- Scan for tracking cookies.
- Terminate memory threats before quarantining.
Click the "Close" button to leave the control center screen.
Back on the main screen, under "Scan for Harmful Software" click Scan your computer.
On the left, make sure you check C:\Fixed Drive.
On the right, under "Complete Scan", choose Perform Complete Scan.
Click "Next" to start the scan. Please be patient while it scans your computer.
After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
Make sure everything has a checkmark next to it and click "Next".
A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
If asked if you want to reboot, click "Yes".
To retrieve the removal information after reboot, launch SUPERAntispyware again.
- Click Preferences, then click the Statistics/Logs tab.
- Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
- If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
- Please copy and paste the Scan Log results in your next reply.
Click Close to exit the program.

#7
Sweetbones

Posted 10 February 2008 - 08:29 PM

Member

Topic Starter
Member
15 posts

Hello

ComboFix 08-02.05.3 - usuario 2008-02-09 20:11:08.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.1.1252.34.3082.18.223 [GMT 1:00]
Se ejecuta desde: C:\Documents and Settings\usuario\Escritorio\ComboFix.exe
Command switches used :: C:\Documents and Settings\usuario\Escritorio\CFScript.txt
* Creado un nuevo punto de restauración

ADVERTENCIA - ESTE EQUIPO NO TIENE INSTALADA LA CONSOLA DE RECUPERACION!

FILE
C:\WINDOWS\system32\BTCPatcher.exe
C:\WINDOWS\system32\WinSpooler.exe
.

(((((((((((((((((((((((((((((((((((( Otras eliminaciones )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\BTCPatcher.exe
C:\WINDOWS\system32\WinSpooler.exe

.
(((((((((((((((((( Archivos creados desde 2008-01-09 - 2008-02-09 )))))))))))))))))))))))))))))))))
.

2008-02-08 23:48 . 2008-02-08 23:48 <DIR> d-------- C:\WINDOWS\system32\config\systemprofile\Configuraci¾n local
2008-02-08 23:48 . 2008-02-08 23:48 <DIR> d-------- C:\Documents and Settings\usuario\Configuraci¾n local
2008-02-08 23:48 . 2008-02-08 23:48 <DIR> d-------- C:\Documents and Settings\NetworkService\Configuraci¾n local
2008-02-08 23:48 . 2008-02-08 23:48 <DIR> d-------- C:\Documents and Settings\LocalService\Configuraci¾n local
2008-02-08 23:48 . 2008-02-08 23:48 <DIR> d-------- C:\Documents and Settings\Invitado\Configuraci¾n local
2008-02-08 23:48 . 2008-02-08 23:48 <DIR> d-------- C:\Documents and Settings\Default User\Configuraci¾n local
2008-02-08 23:48 . 2008-02-08 23:48 <DIR> d-------- C:\Documents and Settings\Administrador\Configuraci¾n local
2008-02-08 23:36 . 2001-08-24 11:00 390,144 --a------ C:\kmd.exe
2008-02-08 23:04 . 2008-02-08 23:04 2,126 --a------ C:\WINDOWS\system32\wpa.dbl
2008-02-08 01:13 . 2008-02-08 01:13 <DIR> d-a------ C:\Documents and Settings\All Users\Datos de programa\TEMP
2008-02-07 23:41 . 2008-02-07 23:38 691,545 --a------ C:\WINDOWS\unins000.exe
2008-02-07 23:41 . 2008-02-07 23:41 3,456 --a------ C:\WINDOWS\unins000.dat
2008-02-06 23:03 . 2008-02-07 22:21 <DIR> d-------- C:\Archivos de programa\Trend Micro
2008-02-06 20:35 . 2008-02-07 22:21 <DIR> d-------- C:\Documents and Settings\Administrador\Plantillas
2008-02-06 20:35 . 2008-02-07 22:21 <DIR> d-------- C:\Documents and Settings\Administrador\Datos de programa
2008-02-06 20:35 . 2008-02-07 22:21 <DIR> d-------- C:\Documents and Settings\Administrador\Configuración local
2008-01-29 22:20 . 2008-01-29 22:20 <DIR> d-------- C:\Documents and Settings\All Users\Datos de programa\Uniblue
2008-01-28 13:29 . 2008-02-01 23:45 <DIR> d-------- C:\Documents and Settings\usuario\Datos de programa\Uniblue
2008-01-28 13:29 . 2008-02-01 23:45 <DIR> d-------- C:\Archivos de programa\Uniblue

.
(((((((((((((((((((((((((((((((((((((( Reporte Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-09 19:14 12,321,824 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-02-09 19:13 681,248 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-02-08 23:46 243,224 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-02-08 23:46 165,236 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-02-08 22:38 --------- d-----w C:\Archivos de programa\Kaspersky Lab
2008-02-08 00:21 --------- d-----w C:\Archivos de programa\Image-Line
2008-02-07 22:45 --------- d-----w C:\Documents and Settings\All Users\Datos de programa\Spybot - Search & Destroy
2008-02-07 22:43 --------- d-----w C:\Archivos de programa\Spybot - Search & Destroy
2008-02-07 22:32 --------- d-----w C:\Archivos de programa\VstPlugins
2008-02-07 22:31 --------- d-----w C:\Archivos de programa\Ares
2008-02-06 17:16 --------- d-----w C:\Archivos de programa\Soulseek
2008-02-06 16:54 --------- d-----w C:\Archivos de programa\FL
2007-12-15 12:35 --------- d-----w C:\Archivos de programa\subtitles
2007-12-12 09:19 --------- d-----w C:\Archivos de programa\DivX
2007-12-11 22:34 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2007-12-11 22:34 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2007-12-04 01:33 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2007-12-04 01:33 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2007-12-04 01:33 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2007-12-04 01:33 682,496 ----a-w C:\WINDOWS\system32\DivX.dll
2007-11-29 22:30 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2007-11-29 22:30 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2007-11-29 22:28 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2007-11-29 22:28 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2007-11-28 21:55 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2007-11-28 21:53 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2007-11-28 21:53 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2007-11-28 21:53 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2007-11-28 21:53 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2007-11-28 21:53 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2007-11-28 21:53 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2007-11-28 21:52 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
.

((((((((((((((((((((((((((((((((( Cargando Puntos Reg ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* entradas vacías & entradas legítimas predeterminadas no son mostradas

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="C:\Archivos de programa\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]
"msnmsgr"="C:\Archivos de programa\MSN Messenger\MsnMsgr.exe" [2007-01-19 11:55 5674352]
"Uniblue SpyEraser"="C:\Archivos de programa\Uniblue\SpyEraser\SpyEraser\SpyEraser.exe" [2008-01-29 10:13 1424648]
"swg"="C:\Archivos de programa\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-05 19:28 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VTTrayp"="VTtrayp.exe" [2006-07-10 19:33 176128 C:\WINDOWS\system32\VTTrayp.exe]
"kav"="C:\Archivos de programa\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" [2006-03-24 18:09 139367]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menú Inicio^Programas^Inicio^Adobe Reader Synchronizer.lnk.disabled]
backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnk.disabledCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menú Inicio^Programas^Inicio^Inicio rápido de Adobe Reader.lnk.disabled]
backup=C:\WINDOWS\pss\Inicio rápido de Adobe Reader.lnk.disabledCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^usuario^Menú Inicio^Programas^Inicio^IMVU.lnk]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\McAfeeUpdaterUI]
--a------ 2006-11-17 12:39 136768 C:\Archivos de programa\McAfee\Common Framework\UdaterUI.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MessengerPlus3]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2007-08-03 15:18 286720 C:\Archivos de programa\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ShStatEXE]
C:\Archivos de programa\McAfee\VirusScan Enterprise\SHSTAT.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
-r------- 2006-03-02 00:22 577536 C:\WINDOWS\soundman.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
--a------ 2007-07-05 19:28 68856 C:\Archivos de programa\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2007-08-29 18:57 185632 C:\Archivos de programa\Archivos comunes\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"McAfeeFramework"=2 (0x2)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"msnmsgr"="C:\Archivos de programa\MSN Messenger\MsnMsgr.Exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"VTTimer"=VTTimer.exe

R0 videX32;videX32;C:\WINDOWS\System32\DRIVERS\videX32.sys [2006-02-23 04:38]
R0 xfilt;VIA SATA IDE Hot-plug Driver;C:\WINDOWS\System32\DRIVERS\xfilt.sys [2006-02-23 04:39]
R3 PSXGamepadEnabler;Psx Hid to Gamepad Port Enabler;C:\WINDOWS\System32\drivers\psxpad.sys [2006-07-24 13:11]
R3 PsxPortEnumerator;Psx Port Enumerator;C:\WINDOWS\System32\Drivers\psxenum.sys [2006-07-24 13:11]

.
Contenido de carpeta 'Tareas Programadas'
"2007-10-17 21:57:32 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Archivos de programa\Apple Software Update\SoftwareUpdate.exe
"2007-06-25 17:58:46 C:\WINDOWS\Tasks\Spybot - Search & Destroy - Scheduled Task.job"
- C:\Archivos de programa\Spybot - Search & Destroy\SpybotSD.exe
"2008-02-01 22:45:42 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC Nag.job"
- C:\Archivos de programa\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
"2008-02-01 22:45:42 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC.job"
- C:\Archivos de programa\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
"2008-02-08 00:13:29 C:\WINDOWS\Tasks\Uniblue SpyEraser.job"
- C:\Archivos de programa\Uniblue\SpyEraser\SpyEraser\SpyEraser.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-09 20:14:07
Windows 5.1.2600 Service Pack 1 NTFS

escaneando procesos ocultos ...

escaneando entradas ocultas de autostart ...

escaneando archivos ocultos ...

el escaneo se completo con exito
archivos ocultos: 0

**************************************************************************
.
Tiempo completado: 2008-02-09 20:14:56
ComboFix-quarantined-files.txt 2008-02-09 19:14:47
ComboFix2.txt 2008-02-08 22:48:01

Antispyware

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 02/10/2008 at 08:12 PM

Application Version : 3.9.1008

Core Rules Database Version : 3399
Trace Rules Database Version: 1391

Scan type : Complete Scan
Total Scan Time : 01:14:37

Memory items scanned : 384
Memory threats detected : 0
Registry items scanned : 4493
Registry threats detected : 0
File items scanned : 56522
File threats detected : 11

Adware.Tracking Cookie
C:\Documents and Settings\usuario\Cookies\usuario@atdmt[2].txt
C:\Documents and Settings\Invitado\Cookies\invitado@2o7[2].txt
C:\Documents and Settings\Invitado\Cookies\[email protected][2].txt
C:\Documents and Settings\Invitado\Cookies\[email protected][2].txt
C:\Documents and Settings\Invitado\Cookies\invitado@atdmt[2].txt
C:\Documents and Settings\Invitado\Cookies\invitado@doubleclick[1].txt
C:\Documents and Settings\Invitado\Cookies\[email protected][1].txt
C:\Documents and Settings\Invitado\Cookies\invitado@questionmarket[2].txt
C:\Documents and Settings\Invitado\Cookies\invitado@revenue[2].txt

Adware.Vundo-Variant/PolyMorph-A
C:\SYSTEM VOLUME INFORMATION\_RESTORE{0B9507DE-1CC8-4E67-9B28-ABF88BB95CE7}\RP23\A0030628.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{0B9507DE-1CC8-4E67-9B28-ABF88BB95CE7}\RP25\A0033264.DLL

thanks a lot!

#8
Rorschach112

Posted 11 February 2008 - 08:37 AM

Ralphie

Retired Staff
47,710 posts

Your logs are clean ! We need to do a few things

Now lets uninstall Combofix:

Click START then RUN
Now type Combofix /u in the runbox and click OK

The above procedure will do the following:

Delete ComboFix and its associated files and folders.
Delete VundoFix backups, if present
Delete the C:\Deckard folder, if present
Delete the C:_OtMoveIt folder, if present
Reset the clock settings.
Hide file extensions, if required.
Hide System/Hidden files, if required.
Reset System Restore.

Below I have included a number of recommendations for how to protect your computer against malware infections.

* Keep Windows updated by regularly checking their website at :
http://windowsupdate.microsoft.com/
This will ensure your computer has always the latest security updates available installed on your computer.

* To reduce re-infection for malware in the future, I strongly recommend installing these free programs:
SpywareBlaster protects against bad ActiveX
IE-SPYAD puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all
Have a look at this tutorial for IE-Spyad here

* SpywareGuard offers realtime protection from spyware installation attempts.

Make Internet Explorer more secure

Click Start > Run
Type Inetcpl.cpl & click OK
Click on the Security tab
Click Reset all zones to default level
Make sure the Internet Zone is selected & Click Custom level
In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
Next Click OK, then Apply button and then OK to exit the Internet Properties page.

* MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.

* Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more
secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in pop up
blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from
Here

* Take a good look at the following suggestions for malware prevention by reading Tony Klein’s article 'How Did I Get Infected In The First Place'
Here

Thank you for your patience, and performing all of the procedures requested.

#9
Sweetbones

Posted 11 February 2008 - 11:46 AM

Member

Topic Starter
Member
15 posts

Thank u soo much.
thanks for doing all this, for helping ppl like me.
my best wishes for u and all the staff in here. ^ ^
ciao

#10
Rorschach112

Posted 11 February 2008 - 11:48 AM

Ralphie

Retired Staff
47,710 posts

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.