| xelia |  |
|
2010-10-29 01:47 - Respuestas: 12 - Tema nº: 2727814
aqui esta el nuevo informe
logfile of trend micro hijackthis v2.0.2
scan saved at 20:44:01, on 28/10/2010
platform: windows vista (winnt 6.00.1904)
msie: internet explorer v7.00 (7.00.6000.16385)
boot mode: normal
running processes:
c:\windows\system32\dwm.exe
c:\windows\explorer.exe
c:\windows\system32\taskeng.exe
c:\program files\windows defender\msascui.exe
c:\windows\rthdvcpl.exe
c:\program files\java\jre6\bin\jusched.exe
c:\program files\toshiba\utilities\kenotify.exe
c:\program files\microsoft office\office12\groovemonitor.exe
c:\program files\common files\installshield\updateservice\issch.exe
c:\windows\system32\hkcmd.exe
c:\windows\system32\igfxpers.exe
c:\program files\avg\avg9\avgtray.exe
c:\program files\elaborate bytes\virtualclonedrive\vcddaemon.exe
c:\program files\windows sidebar\sidebar.exe
c:\program files\toshiba\toscdspd\toscdspd.exe
c:\windows\ehome\ehtray.exe
c:\program files\google\googletoolbarnotifier\googletoolbarnotifier.exe
c:\program files\spybot - search & destroy\teatimer.exe
c:\program files\microsoft office\office12\onenotem.exe
c:\windows\system32\igfxsrvc.exe
c:\windows\ehome\ehmsas.exe
c:\program files\internet explorer\ieuser.exe
c:\windows\system32\wuauclt.exe
c:\program files\trend micro\hijackthis\hijackthis.exe
r1 - hklm\software\microsoft\internet explorer\main,default_page_url = http://go.microsoft.com/fwlink/?linkid=69157
r1 - hklm\software\microsoft\internet explorer\main,default_search_url = http://go.microsoft.com/fwlink/?linkid=54896
r1 - hklm\software\microsoft\internet explorer\main,search page = http://go.microsoft.com/fwlink/?linkid=54896
r0 - hklm\software\microsoft\internet explorer\main,start page = http://eis.esnips.com/page/search/?client_uuid=bda82ac0-85c3-4b48-b0d2-41fde8d1391d
r0 - hklm\software\microsoft\internet explorer\search,searchassistant =
r0 - hklm\software\microsoft\internet explorer\search,customizesearch =
r0 - hkcu\software\microsoft\internet explorer\main,local page =
r0 - hkcu\software\microsoft\internet explorer\toolbar,linksfoldername =
r3 - urlsearchhook: avg security toolbar bho - {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\ietoolbar.dll
r3 - urlsearchhook: barra yahoo! con bloqueador de ventanas emergentes - {ef99bd32-c1fb-11d2-892f-0090271d4f88} - (no file)
r3 - urlsearchhook: free-downloads.net toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - c:\program files\free-downloads.net\tbfree.dll
o1 - hosts: ::1 localhost
o2 - bho: acroiehelperstub - {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\acroiehelpershim.dll
o2 - bho: wormradar.com iesiteblocker.navfilter - {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
o2 - bho: spybot-s&d ie protection - {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\sdhelper.dll
o2 - bho: groove gfs browser helper - {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~3\office12\gra8e1~1.dll
o2 - bho: java(tm) plug-in ssv helper - {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
o2 - bho: avg security toolbar bho - {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\ietoolbar.dll
o2 - bho: google toolbar helper - {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\googletoolbar_32.dll
o2 - bho: google toolbar notifier bho - {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.6.5612.1312\swg.dll
o2 - bho: esnipbho - {b530a9a4-1722-4d16-aad6-aa85e3ad2ade} - (no file)
o2 - bho: java(tm) plug-in 2 ssv helper - {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
o2 - bho: free-downloads.net toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - c:\program files\free-downloads.net\tbfree.dll
o3 - toolbar: (no name) - {0bf43445-2f28-4351-9252-17fe6e806aa0} - (no file)
o3 - toolbar: traductor - {ff284f5c-7cf9-4682-8701-d467c1dbb99f} - c:\program files\prmt78\prmtie\prmtie.dll
o3 - toolbar: avg security toolbar - {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg9\toolbar\ietoolbar.dll
o3 - toolbar: free-downloads.net toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - c:\program files\free-downloads.net\tbfree.dll
o3 - toolbar: google toolbar - {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\googletoolbar_32.dll
o4 - hklm\..\run: [windows defender] %programfiles%\windows defender\msascui.exe -hide
o4 - hklm\..\run: [rthdvcpl] rthdvcpl.exe
o4 - hklm\..\run: [sunjavaupdatesched] "c:\program files\java\jre6\bin\jusched.exe"
o4 - hklm\..\run: [kenotify] c:\program files\toshiba\utilities\kenotify.exe
o4 - hklm\..\run: [hwsetup] c:\program files\toshiba\utilities\hwsetup.exe hwsetup
o4 - hklm\..\run: [groovemonitor] "c:\program files\microsoft office\office12\groovemonitor.exe"
o4 - hklm\..\run: [isusscheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
o4 - hklm\..\run: [igfxtray] c:\windows\system32\igfxtray.exe
o4 - hklm\..\run: [hotkeyscmds] c:\windows\system32\hkcmd.exe
o4 - hklm\..\run: [persistence] c:\windows\system32\igfxpers.exe
o4 - hklm\..\run: [adobe reader speed launcher] "c:\program files\adobe\reader 9.0\reader\reader_sl.exe"
o4 - hklm\..\run: [malwarebytes anti-malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanups-c-r-i-p-t
o4 - hklm\..\run: [avg9_tray] c:\progra~1\avg\avg9\avgtray.exe
o4 - hklm\..\run: [virtualclonedrive] "c:\program files\elaborate bytes\virtualclonedrive\vcddaemon.exe" /s
o4 - hkcu\..\run: [sidebar] c:\program files\windows sidebar\sidebar.exe
o4 - hkcu\..\run: [toscdspd] c:\program files\toshiba\toscdspd\toscdspd.exe
o4 - hkcu\..\run: [ehtray.exe] c:\windows\ehome\ehtray.exe
o4 - hkcu\..\run: [isuspm startup] "c:\program files\common files\installshield\updateservice\isuspm.exe" -startup
o4 - hkcu\..\run: [swg] "c:\program files\google\googletoolbarnotifier\googletoolbarnotifier.exe"
o4 - hkcu\..\run: [alcoholautomount] "c:\program files\alcohol soft\alcohol 52\axcmd.exe" /automount
o4 - hkcu\..\run: [spybotsd teatimer] c:\program files\spybot - search & destroy\teatimer.exe
o4 - hkus\s-1-5-19\..\run: [sidebar] %programfiles%\windows sidebar\sidebar.exe /detectmem (user '?')
o4 - hkus\s-1-5-19\..\run: [windowswelcomecenter] rundll32.exe oobefldr.dll,showwelcomecenter (user '?')
o4 - hkus\s-1-5-20\..\run: [sidebar] %programfiles%\windows sidebar\sidebar.exe /detectmem (user '?')
o4 - hkus\s-1-5-21-4123181606-2903483426-899468659-1000\..\run: [sidebar] c:\program files\windows sidebar\sidebar.exe (user '?')
o4 - hkus\s-1-5-21-4123181606-2903483426-899468659-1000\..\run: [swg] "c:\program files\google\googletoolbarnotifier\googletoolbarnotifier.exe" (user '?')
o4 - hkus\s-1-5-21-4123181606-2903483426-899468659-1000\..\run: [alcoholautomount] "c:\program files\alcohol soft\alcohol 52\axcmd.exe" /automount (user '?')
o4 - hkus\s-1-5-21-4123181606-2903483426-899468659-1000\..\run: [spybotsd teatimer] c:\program files\spybot - search & destroy\teatimer.exe (user '?')
o4 - s-1-5-21-4123181606-2903483426-899468659-1000 startup: recorte de pantalla e inicio rápido de onenote 2007.lnk = c:\program files\microsoft office\office12\onenotem.exe (user '?')
o4 - startup: recorte de pantalla e inicio rápido de onenote 2007.lnk = c:\program files\microsoft office\office12\onenotem.exe
o8 - extra context menu item: add to google photos screensa&ver - res://c:\windows\system32\gphotos.scr/200
o8 - extra context menu item: e&xportar a microsoft excel - res://c:\progra~1\micros~3\office12\excel.exe/3000
o8 - extra context menu item: google sidewiki... - res://c:\program files\google\google toolbar\component\googletoolbardynamic_mui_en_89d8574934b26ac4.dll/cmsidewiki.html
o9 - extra button: (no name) - {7a2efd41-e6b3-11d2-89e3-00e0292ee574} - c:\program files\prmt78\prmtie\prmtie5.htm
o9 - extra 'tools' menuitem: traducir - {7a2efd41-e6b3-11d2-89e3-00e0292ee574} - c:\program files\prmt78\prmtie\prmtie5.htm
o9 - extra button: (no name) - {7a2efd41-e6b3-11d2-89e3-00e0292ee575} - c:\program files\prmt78\prmtie\options.htm
o9 - extra 'tools' menuitem: personalizar las opciones de traducción - {7a2efd41-e6b3-11d2-89e3-00e0292ee575} - c:\program files\prmt78\prmtie\options.htm
o9 - extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - c:\windows\bdoscandel.exe
o9 - extra 'tools' menuitem: uninstall bitdefender online scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - c:\windows\bdoscandel.exe
o9 - extra button: (no name) - {dfb852a3-47f8-48c4-a200-58cab36fd2a2} - c:\program files\spybot - search & destroy\sdhelper.dll
o9 - extra 'tools' menuitem: spybot - search && destroy configuration - {dfb852a3-47f8-48c4-a200-58cab36fd2a2} - c:\program files\spybot - search & destroy\sdhelper.dll
o13 - gopher prefix:
o16 - dpf: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (yinststarter class) - c:\program files\yahoo!\common\yinsthelper.dll
o16 - dpf: {3860dd98-0549-4d50-aa72-5d17d200ee10} (windows live onecare safety scanner control) - http://cdn.scan.onecare.live.com/resource/download/scanner/es-es/wlscctrl2.cab
o16 - dpf: {5d86ddb5-bdf9-441b-9e9e-d4730f4ee499} (bdscanonline control) - http://download.bitdefender.com/resources/scanner/sources/es/scan8/oscan8.cab
o16 - dpf: {7530bfb8-7293-4d34-9923-61a11451afc5} (onlinescanner control) - http://download.eset.com/special/eos-beta/onlinescanner.cab
o16 - dpf: {9191f686-7f0a-441d-8a98-2fe3ac1bd913} (activescan 2.0 installer class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
o18 - protocol: avgsecuritytoolbar - {f2dde6b2-9684-4a55-86d4-e255e237b77c} - c:\program files\avg\avg9\toolbar\ietoolbar.dll
o18 - protocol: groovelocalgws - {88fed34c-f0ca-4636-a375-3cb6248b04cd} - c:\progra~1\micros~3\office12\gr99d3~1.dll
o18 - protocol: linkscanner - {f274614c-63f8-47d5-a4d1-fbdde494f8d1} - c:\program files\avg\avg9\avgpp.dll
o20 - appinit_dlls: avgrsstx.dll
o23 - service: avg security toolbar service - unknown owner - c:\program files\avg\avg9\toolbar\toolbarbroker.exe
o23 - service: avg free watchdog (avg9wd) - avg technologies cz, s.r.o. - c:\program files\avg\avg9\avgwdsvc.exe
o23 - service: servicio google update (gupdate) (gupdate) - google inc. - c:\program files\google\update\googleupdate.exe
o23 - service: google software updater (gusvc) - google - c:\program files\google\common\google updater\googleupdaterservice.exe
o23 - service: protexislicensing - unknown owner - c:\program files\common files\protexis\license service\psiservice.exe
o23 - service: starwind ae service (starwindserviceae) - rocket division software - c:\program files\alcohol soft\alcohol 52\starwind\starwindserviceae.exe
o23 - service: ulead burning helper (uleadburninghelper) - ulead systems, inc. - c:\program files\common files\ulead systems\dvd\ulcdrsvr.exe
end of file - 11023 bytes
| |
|
|
| marinalope |  |
|
Re: Troyano Generic18.BNYJ(El objeto es inaccesible.) (solucionado) - 2010-10-29 10:55 - Respuesta 12
Cierra todos los programas incluido el navegador,abre el HijackThis,pulsa do a system scan only y marca estas entradas:
r0 - hklm\software\microsoft\internet explorer\main,start page = http://eis.esnips.com/page/search/?client_uuid=bda82ac0-85c3-4b48-b0d2-41fde8d13 91d
Pulsa fix checked.
No veo nada mas,solo te aconsejo que si no teson imprescindibles desinstalas las toolbars que tiene,(son las que en el log empiezan por O3),desde panel de control,programas y características.
Cuando pongas una pregunta,recuerda refrescar la página para ver si has tenido alguna respuesta.Puedes hacerlo pulsando F5. | |
|
|
| xelia | |
|
Re: Troyano Generic18.BNYJ(El objeto es inaccesible.) (solucionado) - 2010-11-03 23:52 - Respuesta 13
hice lo que dijistes, y ya la maquina funciona bien, muchas gracias por tu ayuda te saluda xelia | |
|
|
|
