El software XoftSpy, detecto es spyware, pero lo pongo en quarente y de nuevo sale el virus o spyware , dice que es de alto riesgo para la màquina, como puedo saber donde borrarlo definitivamente.
Le adjunto alguna informaciòn adicional
Gracias
Logfile of HijackThis v1.99.1
Scan saved at 9:57:35 a.m., on 13/06/06
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\ARCHIV~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Archivos de programa\Ahead\InCD\InCD.exe
C:\WINDOWS\system32\ctfmon.exe
C:\ARCHIV~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\ARCHIV~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\cisvc.exe
C:\Archivos de programa\Ahead\InCD\InCDsrv.exe
C:\Archivos de programa\Archivos comunes\Microsoft Shared\VS7Debug\mdm.exe
C:\Archivos de programa\Canon\MultiPASS4\MPSERVIC.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\ntvdm.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Administrador\Mis documentos\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://antivirus.cableonda.net/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://antivirus.cableonda.net/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARCHIV~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\\NeroCheck.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\ARCHIV~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [InCD] C:\Archivos de programa\Ahead\InCD\InCD.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Archivos de programa\Microsoft Office\Office10\OSA.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O12 - Plugin for .spop: C:\Archivos de programa\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab
O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E} (Microsoft PID Sniffer) - https://support.microsoft.com/OAS/ActiveX/odc.cab
O16 - DPF: {32305793-C19A-48E7-AD2F-D87FF7B264A4} (TenebrilSpywareScanner Control) - http://www.tenebril.com/scanner/TestScanner.ocx
O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} - http://www.xblock.com/download/xclean_micro.exe
O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www3.ca.com/securityadvisor/p...n/pestscan.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - http://www.bitdefender-es.com/scan8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1122649196343
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} - http://housecall65.trendmicro.com/ho...vex/hcImpl.cab
O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zonelabs.com/bin/pro...anner37240.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} - http://www.bitdefender-es.com/scan/Msie/bitdefender.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} (SABScanProcesses Class) - http://www.superadblocker.com/activex/sabspx.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/is...71/mcfscan.cab
O17 - HKLM\System\CS2\Services\Tcpip\..\{BD3D25DB-1F89-4C9E-809A-CBC2EC339B17}: NameServer = 123.123.123.123,223.0.0.0
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\ARCHIV~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\ARCHIV~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: InCD File System Service (InCDsrv) - Unknown owner - C:\Archivos de programa\Ahead\InCD\InCDsrv.exe
O23 - Service: MpService - Canon Inc. - C:\Archivos de programa\Canon\MultiPASS4\MPSERVIC.EXE
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Archivos de programa\TuneUp Utilities 2006\WinStylerThemeSvc.exe
Otra informaciòn:
ScanningRegValues>
</SW>
<SW NAME = "Winpcap">
<REGVALUE VALUE = "Winpcap software\classes\clsid\{d413c502-3faa-11d0-b254-444553540000}\:@:nppagent"/>
<REGVALUEFOUND NAME = "software\classes\clsid\{d413c502-3faa-11d0-b254-444553540000}\:@:nppagent"/>
</SW>
<SW NAME = "Winpcap">
<REGVALUE VALUE = "Winpcap software\classes\clsid\{d413c502-3faa-11d0-b254-444553540000}\appid:@:{d413c502-3faa-11d0-b254-444553540000}"/>
<REGVALUEFOUND NAME = "software\classes\clsid\{d413c502-3faa-11d0-b254-444553540000}\appid:@:{d413c502-3faa-11d0-b254-444553540000}"/>
</SW>
<SW NAME = "Winpcap">
<REGVALUE VALUE = "Winpcap software\classes\clsid\{d413c502-3faa-11d0-b254-444553540000}\localserver32\:@:c:\windows\system32 \npp\nppagent.exe"/>
<REGVALUEFOUND NAME = "software\classes\clsid\{d413c502-3faa-11d0-b254-444553540000}\localserver32\:@:c:\windows\system32 \npp\nppagent.exe"/>
</SW>
<SW NAME = "Winpcap">
<REGVALUE VALUE = "Winpcap software\classes\clsid\{d413c502-3faa-11d0-b254-444553540000}\localserver32\threadingmodel:@:apart ment"/>
<REGVALUEFOUND NAME = "software\classes\clsid\{d413c502-3faa-11d0-b254-444553540000}\localserver32\threadingmodel:@:apart ment"/>
</SW>
<SW NAME = "Winpcap">
<REGVALUE VALUE = "Winpcap software\classes\appid\{d413c502-3faa-11d0-b254-444553540000}\"/>
<REGVALUEFOUND NAME = "software\classes\appid\{d413c502-3faa-11d0-b254-444553540000}\"/>
</SW>
<SW NAME = "Winpcap">
<REGVALUE VALUE = "Winpcap software\classes\clsid\{944ad531-b09d-11ce-b59c-00aa006cb37d}\:@:psfactorybuffer"/>
<REGVALUEFOUND NAME = "software\classes\clsid\{944ad531-b09d-11ce-b59c-00aa006cb37d}\:@:psfactorybuffer"/>
</SW>
<SW NAME = "Winpcap">
<REGVALUE VALUE = "Winpcap software\classes\clsid\{944ad531-b09d-11ce-b59c-00aa006cb37d}\inprocserver32\:@:c:\windows\system3 2\psnppagn.dll"/>
<REGVALUEFOUND NAME = "software\classes\clsid\{944ad531-b09d-11ce-b59c-00aa006cb37d}\inprocserver32\:@:c:\windows\system3 2\psnppagn.dll"/>
</SW>
<SW NAME = "Winpcap">
<REGVALUE VALUE = "Winpcap software\classes\clsid\{944ad531-b09d-11ce-b59c-00aa006cb37d}\inprocserver32\threadingmodel:@:both "/>
<REGVALUEFOUND NAME = "software\classes\clsid\{944ad531-b09d-11ce-b59c-00aa006cb37d}\inprocserver32\threadingmodel:@:both "/>
</SW>
<SW NAME = "Winpcap">
<REGVALUE VALUE = "Winpcap system\currentcontrolset\services\nm\parameters\"/>
<REGVALUEFOUND NAME = "system\currentcontrolset\services\nm\paramete rs\"/>
</SW>
<SW NAME = "Winpcap">
<REGVALUE VALUE = "Winpcap system\currentcontrolset\control\safeboot\network\ nm\:@:service"/>
<REGVALUEFOUND NAME = "system\currentcontrolset\control\safeboot\network \nm\:@:service"/>
</SW>
<SW NAME = "Winpcap">
<REGVALUE VALUE = "Winpcap system\currentcontrolset\control\safeboot\network\ nm.sys\:@:driver"/>
<REGVALUEFOUND NAME = "system\currentcontrolset\control\safeboot\network \nm.sys\:@:driver"/>
</ScanningRegValues>
<ScanningRegValuesChanged>
<Information Message = "Scan Aborted by User"/>
</ScanningRegValuesChanged>
</Scanning>
