| romodos |  |
|
2009-06-01 17:52 - Respuestas: 1 - Tema nº: 2597156
Windows XP Home ADM Athlo (TM) 64 3500+ 219 Ghz. 960 MB of RAM.
Me ayudan con esto?
Que y como debo hacer?. Veran que no se nada de esto.
Gracias a todos.
HijackThis.de Security Direct download
To the authors homepage
HijackThis log file analysis
HijackThis opens you a possibility to find and fix nasty entries on your computer easier.
Therefore it will scan special parts in the registry and on your harddisk and compare them with the default settings. If there is some abnormality detected on your computer HijackThis will save them into a logfile. In order to find out what entries are nasty and what are installed by the user, you need some background information.
A logfile is not so easy to analyze. Even for an advanced computer user. With the help of this automatic analyzer you are able to get some additional support. Just paste your complete logfile into the textbox at the bottom of this page.
Due to a few misunderstandings, I just want to make it clear that this site provides only an online analysis, and not HijackThis the program.
Service & Support
HijackThis.de Supportforum Deutsch | English
Forospyware.com (Spanish) www.-.com
Computerhilfen www.computerhilfen.com
Current information
Please note that this service is currently high frequented – especially in the evening hours (central european time). If the analyzer can't process another logfile, the analyze-button will be disabled. In this case you have to try it again later.
Log file
You can paste a logfile in this textbox
or you can choose a logfile from your computer
Show the visitors ratings
Help us to keep this free service online! Please give us a small donation via PayPal.
It seems that you don't use an anti-virus scanner or your scanner is not active. Only an anti-virus scanner can protect you against new viruses. You can look here for a good anti-virus scanner.
We didn't detect any active process of a firewall on your system. Reasons maybe:
(1.) You are using the windows firewall or a hardware firewall.
(2.) You are using a firewall of an unknown vendor.
(3.) You are using a firewall, but for unknown reasons it is disabled
(4.) You don't use any firewall at all.
We recommend you to use a firewall. Download and install one or activate windows xp´s own one. In case you got questions or you want us to add the firewall you use to our database, contact us at our forum.
Actions Entry Kind Visitor's assessment Information
Logfile of Trend Micro HijackThis v2.0.2
This should be the newest version.
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
This should be the newest version.
Boot mode: Normal
Very safe This entry was classified from our visitors as good.
C:\WINDOWS\System32\smss.exe
Very safe
This entry was classified from our visitors as good.
C:\WINDOWS\system32\winlogon.exe
Very safe
This entry was classified from our visitors as good.
C:\WINDOWS\system32\services.exe
Safe
This entry was classified from our visitors as good.
C:\WINDOWS\system32\lsass.exe
Very safe
This entry was classified from our visitors as good.
C:\WINDOWS\system32\Ati2evxx.exe
Very safe
This entry was classified from our visitors as good.
C:\WINDOWS\system32\svchost.exe
Safe
This entry was classified from our visitors as good.
C:\WINDOWS\System32\svchost.exe
Very safe
This entry was classified from our visitors as good.
C:\WINDOWS\system32\spoolsv.exe
Safe
This entry was classified from our visitors as good.
C:\Program Files\Trend Micro\BM\TMBMSRV.exe
Neutral Safe (4.48 / 5.00)
C:\Program Files\LSI SoftModem\agrsmsvc.exe
Possibly nasty! According to our database this process runs normally in c:\windows\system32\! Check if you know this process and arrange a viruscheck where required. Modem Driver
C:\Program Files\Java\jre6\bin\jqs.exe
Very safe Safe (4.17 / 5.00)
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
Safe
Hewlett-Packard Direct Disc Labeling Service
C:\Program Files\Common Files\Motive\McciCMService.exe
Safe (3.82 / 5.00)
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
Safe
Machine Debug Manager. Used by developers.
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
Very safe
Microsoft Webcam
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
Very safe
Possibly nasty! According to our database this process runs normally in c:\program\nero\nero 7\nero backitup\! Check if you know this process and arrange a viruscheck where required. This entry was classified from our visitors as good.
C:\WINDOWS\system32\HPZipm12.exe
Very safe
HP Taskbar Utility
C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
Safe Safe (4.54 / 5.00)
C:\WINDOWS\system32\svchost.exe
Safe
This entry was classified from our visitors as good.
C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
Very safe
Possibly nasty! According to our database this process runs normally in c:\programme\trendm~1\intern~1\! Check if you know this process and arrange a viruscheck where required. Trend Micro Internet Security
C:\Program Files\Windows Live\Messenger\usnsvc.exe
Safe
Windows Live Messenger
C:\WINDOWS\Explorer.EXE
Very safe
This entry was classified from our visitors as good.
C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe
Very safe Safe (4.5 / 5.00)
C:\HP\KBD\KBD.EXE
Safe This is a unknown process.
This entry was classified from our visitors as good.
C:\Program Files\Java\jre6\bin\jusched.exe
Very safe
This entry was classified from our visitors as good.
C:\WINDOWS\system32\ctfmon.exe
Very safe
This entry was classified from our visitors as good.
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
Safe
Associated with GoogleToolbarNotifier from Google Inc.
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
Very safe
HP Digital Imaging
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
Safe Remember that Hijackthis must be run in an own folder. Only if Hijackthis run in an own folder it will create backups! This entry was classified from our visitors as good.
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.es/webhp?sourceid=navclient&ie=UTF-8
This page has been identified as safe.
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
Safe This entry was classified from our visitors as good.
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
Safe This entry was classified from our visitors as good.
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
Safe This entry was classified from our visitors as good.
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
Safe This entry was classified from our visitors as good.
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
Safe This entry was classified from our visitors as good.
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
Safe This entry was classified from our visitors as good.
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
Very safe This entry was classified from our visitors as good.
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
Safe googletoolbar.dll, googletoolbar*.dll (* = number), googletoolbar_en_*.**-big.dll, Googletoolbar_en_*.*.**-deleon.dll. - Google toolbar, http://toolbar.google.com/
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
swg.dll - Google Toolbar Notifier, http://googlesystem.blogspot.com/2006/07 /google-is-your-default-search.html
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
Safe (3.79 / 5.00)
O2 - BHO: System Search Dispatcher - {CDBFB47B-58A8-4111-BF95-06178DCE326D} - (no file)
Must be fixed!
Unnecessary (deactivated) entry that can be fixed. stb1.dll - "Desktop_Smiley_Toolbar", http://desktopsmiley.com/ - ad/spyware
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
Safe jp2ssv.dll - Sun_Java, http://java.sun.com/javase/downloads/ind ex.jsp browser plugin
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
Very safe jqs_plugin.dll - Java Quick Starter, https://jdk6.dev.java.net/testQS.html
O3 - Toolbar: HP view - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
Very safe This entry was classified from our visitors as good.
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
googletoolbar.dll, googletoolbar*.dll (* = digit), googlenav.dll, googlenav*.dll, googletoolbar_en_*.**-big.dll, googletoolbar_en_*.*.**-deleon.dll - Google Toolbar
O4 - HKLM\..\Run: [UfSeAgnt.exe] "C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe"
Very safe It seems that the name of this program is the same as the name of the file. In the most cases this is the result of trojans. To be sure, you should check this file.
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
Safe This entry was classified from our visitors as good.
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
Safe Java von Sun
O4 - HKCU\..\Run: [Internet Explorer] C:\Program Files\Internet Explorer\iexplore.exe
Must be fixed! Added by the RBOT-EY WORM! Note - this is not the legitimate Internet Explorer iexplore.exe process which is always located in the Program FilesInternet Explorer folder and should not normally figure in Msconfig/Startup! This file is located in the System (9x/Me) or System32 (NT/2K/XP) folder
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
Very safe Microsoft s MSN Messenger 6
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
Safe This entry was classified from our visitors as good.
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
Neutral Associated with GoogleToolbarNotifier from Google Inc.
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
Safe Not dangerous, but unnecessary. HP digital imaging monitor; can apparently be launched manually.
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000
Very safe The entry E&xport to Microsoft Excel has been identified as safe.
O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEB utton\support.htm
The entry Connection Help has been identified as safe.
O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEB utton\support.htm
The entry Connection Help has been identified as safe.
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
Safe This entry was classified from our visitors as good.
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
Safe This entry was classified from our visitors as good.
O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEB utton\support.htm (HKCU)
The entry Connection Help has been identified as safe.
O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEB utton\support.htm (HKCU)
The entry Connection Help has been identified as safe.
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab
Neutral This entry has been identified as safe.
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site .cab?1242100573337
This entry has been identified as safe.
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_si te.cab?1242103366671
This entry has been identified as safe.
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
Very safe Check if you know this site and fix it if you do not. This entry was classified from our visitors as good.
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} (GMNRev Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab
Neutral Safe (3.67 / 5.00)
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game10.zylom.com/activex/zylomgamesplayer.cab
This entry has been identified as safe.
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Safe This entry was classified from our visitors as good.
O17 - HKLM\System\CCS\Services\Tcpip\..\{E0946FE3-A441-47DF-8307-051C5B1F9563}: NameServer = 207.164.234.193 207.164.234.129
Do you know the IP or Domain '207.164.234.193 207.164.234.129'? If not, fix this entry.
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
Neutral Safe (3.79 / 5.00)
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Program Files\LSI SoftModem\agrsmsvc.exe
This service (agrsmsvc.exe) was identified as a good one.
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
Safe This service (Ati2evxx.exe) was identified as a good one. This entry was classified from our visitors as good.
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
Very safe This service (ati2sgag.exe) was identified as a good one. This entry was classified from our visitors as good.
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
Very safe This service (GoogleUpdaterService.exe) was identified as a good one.
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
Safe This service (IDriverT.exe) was identified as a good one.
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
Safe Unknown service. (jqs.exe) This entry was classified from our visitors as good.
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
Very safe This service (LSSrvc.exe) was identified as a good one.
O23 - Service: McciCMService - Motive Communications, Inc. - C:\Program Files\Common Files\Motive\McciCMService.exe
Safe Safe (3.82 / 5.00)
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
Very safe This service (NBService.exe) was identified as a good one.
O23 - Service: Nero BackItUp Scheduler 4.0 - Unknown owner - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe (file missing)
This service (NBService.exe) was identified as a good one.
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
Safe This service (NMIndexingService.exe) was identified as a good one.
O23 - Service: PLFlash DeviceIoControl Service - Unknown owner - C:\Program Files\Nero\Nero BackItUp 4\IoctlSvc.exe (file missing)
This service (IoctlSvc.exe) was identified as a good one.
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
Safe This service (HPZipm12.exe) was identified as a good one. This entry was classified from our visitors as good.
O23 - Service: Trend Micro Central Control Component (SfCtlCom) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
Very safe Safe (4.54 / 5.00)
O23 - Service: Trend Micro Unauthorized Change Prevention Service (TMBMServer) - Trend Micro Inc. - C:\Program Files\Trend Micro\BM\TMBMSRV.exe
Very safe Unknown service. (TMBMSRV.exe) This entry was classified from our visitors as good.
O23 - Service: Trend Micro Proxy Service (TmProxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
Very safe This service (TmProxy.exe) was identified as a good one.
Short analysis
Use these tips at your own risk!
© 2004 - 2009 Mathias Mattner | Contact
| |
|
|
| swissman |  |
|
Re: Iexplore.exe cosume gran cantidad de memori a - 2009-06-01 21:09 - Respuesta 2
antes de pegar el log haz lo siguiente, y cuando pegues el log, hazlo tal y como sale en el txt.
Inicia tu pc en modo seguro con conexiones de red y pasa algún antivirus actualizado on-line
descarga y actualiza los siguientes programas y los vas pasando uno a uno, un par de veces cada uno:
Malwarebytes' Anti-Malware 1.3
Spyware Doctor 6
Regcleaner
Spybot
cwshredder.exe
ad-aware
SUPERAntiSpyware
Ccleaner (limpiar temporales y registro)
descarga, pero no instales hijackthis versión 2.02
reinicias en modo normal e instalas el hijackthis, lo ejecutas y pulsa “do a system scan and save a log”, se te abrirá un fichero txt, el contenido del cual debes copiar al portapapeles y pegas a continuación. | |
|
|
|
