Foros del Web - Ver Mensaje Individual - computador completamente infectado,..ahi va el log hijackthis

hendrix · #2 (**permalink**) 13/02/2005, 19:36

O4 - HKLM\..\Run: [Norton eMail Protect] C:\Archivos de programa\Norton SystemWorks\Norton AntiVirus\POPROXY.EXE

O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime

O4 - HKLM\..\Run: [sp2ctr] c:\windows\system\sp2ctr.exe /nocomm

O4 - HKLM\..\Run: [KNIENYEQ] c:\windows\system\knienyeq.exe /install

O4 - HKLM\..\RunServices: [inetinfo.exe] C:\WINDOWS\SYSTEM\inetsrv\inetinfo.exe -e w3svc

O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme

O4 - HKLM\..\RunServices: [MSDTC] msdtcw -start

O4 - HKLM\..\RunServices: [SAgent2ExePath] C:\Archivos de programa\Archivos comunes\EPSON\EBAPI\SAgent2.exe

O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe

O4 - HKLM\..\RunServices: [NPROTECT] C:\Archivos de programa\Norton SystemWorks\Norton Utilities\NPROTECT.EXE

O4 - HKLM\..\RunServices: [CSINJECT.EXE] C:\Archivos de programa\Norton SystemWorks\Norton CleanSweep\CSINJECT.EXE

O4 - HKLM\..\RunServices: [SymTray - Norton SystemWorks] C:\Archivos de programa\Archivos comunes\Symantec Shared\SymTray.exe "Norton SystemWorks"

O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Archivos de programa\Archivos comunes\Symantec Shared\Script Blocking\SBServ.exe" -reg

O4 - HKCU\..\Run: [Instant Access] rundll32.exe p2esocks_1023.dll,InstantAccess

O4 - Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\SYSTEM\E_SRCV02.EXE

O4 - Startup: Microsoft Office.lnk = C:\Archivos de programa\Microsoft Office\Office\OSA9.EXE

O4 - Startup: Norton System Doctor.lnk = C:\Archivos de programa\Norton SystemWorks\Norton Utilities\SYSDOC32.EXE

O4 - Startup: Smart Sweep-Internet Sweep de CleanSweep.lnk = C:\Archivos de programa\Norton SystemWorks\Norton CleanSweep\csinsm32.exe

O4 - Startup: Software Kodak EasyShare.lnk = C:\Archivos de programa\Kodak\Kodak Utilities\kodnotif.exe

O4 - Startup: KODAK Software Updater.lnk = C:\Archivos de programa\Kodak\KODAK Software Updater\7288971\Program\backWeb-7288971.exe

O9 - Extra button: xxx - {14051602-5C4E-11d6-916B-00E02964E8E3} - C:\temp\acc\CELOSAS\CELOSAS.EXE (file missing)

O9 - Extra button: +18 - {14051600-5C4E-11d6-916B-00E02964E8E3} - C:\WINDOWS\SYSTEM\SuperOrgias (file missing)

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll

O16 - DPF: {6986A6CF-9D58-11D6-91C2-00E02964E8E3} (IntPagomaster Class) - http://livecamx.com/muyzorras/pagomast.cab

O16 - DPF: {92FF37C4-A5E8-4FC2-8DBF-DED7BA52D439} - http://www.viendosexo.com/sexo/viendosexo.cab

O16 - DPF: {067D7797-04FC-42B1-92DB-81FC6CD318FD} (Dlctrl) - http://www.eingang69.de/EroticAccess/ocx/dlctrl.ocx

O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe

O16 - DPF: {94118C19-B178-4E43-BBE8-0EFDBB391BDB} (SysWebTelecom Class) - http://www.sponsoradulto.com/SysWebTelecom.cab

O16 - DPF: {2C1651EF-8827-11D6-91A2-00E02964E8E3} (IntRuboskizo Class) - http://www.videos666.com/contenido/ruboskizo.cab

O16 - DPF: {23273A1C-C870-43C4-A3E3-67DC98630AC6} (IntSOFTEC Class) - http://213.229.160.209/dialers/it.cab

O16 - DPF: {5C3A9EA6-4068-46B8-8B5A-692FB10607B1} (IntDialerData Class) - http://www.grupox.com/perf/DialerData.cab

O16 - DPF: {0000A0A0-0000-0000-0000-000000000000} - http://www.empollonas.com/celosas.cab

O16 - DPF: {6ED16EFF-3B18-11D6-9139-00E02964E8E3} (SCDataDialer Class) - http://www.dinerotica.com/download/1,2,0,4/cabdll.cab

O16 - DPF: {421A63BA-4632-43E0-A942-3B4AB645BE51} - http://i.rn11.com/iwasher/pptproacta...twasherpro.cab

O16 - DPF: {0DCABC94-5086-4E08-A4C9-BF284A614E81} (WwwPlugin Class) - http://www.estoeslaselva.com/dist/1/WwwPlugin.cab

O16 - DPF: {1CC506A7-1B8D-11D4-BDD5-0060977007E0} (CrazyTalk Player) - http://plug-in.reallusion.com/CrazyTalk.cab

O16 - DPF: {A8739816-022C-11D6-A85D-00C04F9AEAFB} (Web Camera Server Control) - http://webcam.uoct.cl:8080/wg_webeye.cab

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab

O16 - DPF: {CEFB7B49-9652-464F-8AFD-A577C0500F39} - http://akamai.downloadv3.com/binarie...TH_1011_ES.cab

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...tatsClient.cab

O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab

O16 - DPF: {093F9CF8-0DE1-491C-95D5-5EC257BD4CA3} - http://akamai.downloadv3.com/binaries/IA/dtc32_ES.cab

O16 - DPF: {1EB17D1C-141D-4D9D-91CB-24D99215851D} - http://akamai.downloadv3.com/binaries/IA/netia32_ES.cab

O16 - DPF: {94F5DCB7-816C-4B94-A2C1-856C6E323C5B} - http://akamai.downloadv3.com/binarie...rvice_4_ES.cab

O16 - DPF: {469C7080-8EC8-43A6-AD97-45848113743C} - http://akamai.downloadv3.com/binaries/IA/nethv32_ES.cab

O16 - DPF: {50AD557E-3426-41FD-AFDD-2AF39BB1C387} - http://akamai.downloadv3.com/binarie...rvice_5_ES.cab

O16 - DPF: {0594AF7E-573B-40DF-8165-E47AB2EAEFE8} - http://akamai.downloadv3.com/binarie...TH_1023_ES.cab
AHI VA LA SEGUBDA PARTE DEL LOG,..AYUDENME PLEASE,.......VALE

SALUDIOS Y GRACIAS

O16 - DPF: {F72BC3F0-6C20-4793-9DDA-258589D8A907} - http://akamai.downloadv3.com/binarie...etslv32_ES.cab

O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = ispch.cl

O17 - HKLM\System\CCS\Services\VxD\MSTCP: SearchList = ispch.cl

O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 209.47.15.118,64.157.143.38

O18 - Filter: text/html - {E19F3023-7506-11D9-956F-0001E960B8E2} - C:\WINDOWS\SYSTEM\DKMFCG.DLL

O18 - Filter: text/plain - {E19F3023-7506-11D9-956F-0001E960B8E2} - C:\WINDOWS\SYSTEM\DKMFCG.DLL