| las3lunas |  |
|
2007-10-10 02:32 - Respuestas: 2 - Tema nº: 2475022
Características: Windows XP Home, AMD Turion 64, 1024 System Memory, 60GB Hard Drive.
aqui el informe de hijackthis
se que el problema esta en esto R0 - HKCU\\Software\\Microsoft\\Internet Explorer\\Main,Start Page = http://www.*******.com
de hecho encontre esta pagina porque el chico que tenia como tema que su cpu estaba alto tambien tiene ese file, pero el dice que no usa IE sino moxilla
Ya he pasado Ad-aware, Kapersky, CCleaner y ahora HijackThis, solo este es el que detecta la cosa esa
Logfile of HijackThis v1.99.1
Scan saved at 7:49:36 PM, on 10/9/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\\WINDOWS\\System32\\smss.exe
C:\\WINDOWS\\SYSTEM32\\winlogon.exe
C:\\WINDOWS\\system32\\services.exe
C:\\WINDOWS\\system32\\lsass.exe
C:\\WINDOWS\\system32\\Ati2evxx.exe
C:\\WINDOWS\\system32\\svchost.exe
C:\\WINDOWS\\System32\\svchost.exe
C:\\WINDOWS\\system32\\brsvc01a.exe
C:\\WINDOWS\\system32\\spoolsv.exe
C:\\WINDOWS\\system32\\brss01a.exe
C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 7.0\\avp.exe
C:\\WINDOWS\\system32\\Brmfrmps.exe
C:\\Program Files\\Common Files\\LightScribe\\LSSrvc.exe
c:\\Program Files\\Microsoft SQL Server\\90\\Shared\\sqlwriter.exe
C:\\WINDOWS\\system32\\svchost.exe
C:\\WINDOWS\\SYSTEM32\\Ati2evxx.exe
C:\\WINDOWS\\Explorer.EXE
C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe
C:\\Program Files\\Java\\jre1.6.0_02\\bin\\jusched.exe
C:\\Program Files\\Hp\\HP Software Update\\HPWuSchd2.exe
C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe
C:\\Program Files\\hpq\\HP Wireless Assistant\\HP Wireless Assistant.exe
C:\\Program Files\\iTunes\\iTunesHelper.exe
C:\\Program Files\\QuickTime\\qttask.exe
C:\\Program Files\\HPQ\\Quick Launch Buttons\\EabServr.exe
C:\\Program Files\\ScanSoft\\PaperPort\\pptd40nt.exe
C:\\Program Files\\Brother\\ControlCenter2\\brctrcen.exe
C:\\Program Files\\iPod\\bin\\iPodService.exe
C:\\Program Files\\Common Files\\Ulead Systems\\AutoDetector\\monitor.exe
C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 7.0\\avp.exe
C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe
C:\\WINDOWS\\system32\\ctfmon.exe
C:\\Program Files\\Skype\\Phone\\Skype.exe
C:\\Program Files\\Google\\GoogleToolbarNotifier\\GoogleToolbarNotifier.exe
C:\\Program Files\\LimeWire\\LimeWire.exe
C:\\Program Files\\Common Files\\Microsoft Shared\\Works Shared\\WkCalRem.exe
C:\\Program Files\\HPQ\\SHARED\\HPQWMI.exe
C:\\Program Files\\MSN Messenger\\usnsvc.exe
C:\\Program Files\\Internet Explorer\\iexplore.exe
C:\\Program Files\\Adobe\\Acrobat 7.0\\Reader\\AcroRd32.exe
C:\\Program Files\\Internet Explorer\\iexplore.exe
C:\\WINDOWS\\system32\\wuauclt.exe
C:\\Documents and Settings\\Adawilda Caraballo\\Desktop\\downloads\\de utilidad\\hijackthis\\HijackThis.exe
R0 - HKCU\\Software\\Microsoft\\Internet Explorer\\Main,Start Page = http://www.finderg.com
R1 - HKLM\\Software\\Microsoft\\Internet Explorer\\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q405&bd=presario&pf=laptop
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\\Program Files\\Adobe\\Acrobat 7.0\\ActiveX\\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\\Program Files\\Java\\jre1.6.0_02\\bin\\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\\program files\\google\\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\\Program Files\\Google\\GoogleToolbarNotifier\\2.0.301.7164\\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\\program files\\google\\googletoolbar4.dll
O4 - HKLM\\..\\Run: [ATIPTA] \"C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe\"
O4 - HKLM\\..\\Run: [SunJavaUpdateSched] \"C:\\Program Files\\Java\\jre1.6.0_02\\bin\\jusched.exe\"
O4 - HKLM\\..\\Run: [HP Software Update] C:\\Program Files\\Hp\\HP Software Update\\HPWuSchd2.exe
O4 - HKLM\\..\\Run: [SynTPEnh] C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe
O4 - HKLM\\..\\Run: [hpWirelessAssistant] C:\\Program Files\\hpq\\HP Wireless Assistant\\HP Wireless Assistant.exe
O4 - HKLM\\..\\Run: [iTunesHelper] C:\\Program Files\\iTunes\\iTunesHelper.exe
O4 - HKLM\\..\\Run: [QuickTime Task] \"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime
O4 - HKLM\\..\\Run: [LSBWatcher] c:\\hp\\drivers\\hplsbwatcher\\lsburnwatcher.exe
O4 - HKLM\\..\\Run: [eabconfg.cpl] C:\\Program Files\\HPQ\\Quick Launch Buttons\\EabServr.exe /Start
O4 - HKLM\\..\\Run: [Cpqset] C:\\Program Files\\HPQ\\Default Settings\\cpqset.exe
O4 - HKLM\\..\\Run: [SSBkgdUpdate] \"C:\\Program Files\\Common Files\\Scansoft Shared\\SSBkgdUpdate\\SSBkgdupdate.exe\" -Embedding -boot
O4 - HKLM\\..\\Run: [PaperPort PTD] C:\\Program Files\\ScanSoft\\PaperPort\\pptd40nt.exe
O4 - HKLM\\..\\Run: [IndexSearch] C:\\Program Files\\ScanSoft\\PaperPort\\IndexSearch.exe
O4 - HKLM\\..\\Run: [SetDefPrt] C:\\Program Files\\Brother\\Brmfl04a\\BrStDvPt.exe
O4 - HKLM\\..\\Run: [ControlCenter2.0] C:\\Program Files\\Brother\\ControlCenter2\\brctrcen.exe /autorun
O4 - HKLM\\..\\Run: [Ulead AutoDetector v2] C:\\Program Files\\Common Files\\Ulead Systems\\AutoDetector\\monitor.exe
O4 - HKLM\\..\\Run: [AVP] \"C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 7.0\\avp.exe\"
O4 - HKCU\\..\\Run: [MsnMsgr] \"C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background
O4 - HKCU\\..\\Run: [ctfmon.exe] C:\\WINDOWS\\system32\\ctfmon.exe
O4 - HKCU\\..\\Run: [Skype] \"C:\\Program Files\\Skype\\Phone\\Skype.exe\" /nosplash /minimized
O4 - HKCU\\..\\Run: [swg] C:\\Program Files\\Google\\GoogleToolbarNotifier\\GoogleToolbarNotifier.exe
O4 - Startup: LimeWire On Startup.lnk = C:\\Program Files\\LimeWire\\LimeWire.exe
O4 - Startup: wkcalrem.LNK = C:\\Program Files\\Common Files\\Microsoft Shared\\Works Shared\\WkCalRem.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\\Program Files\\Adobe\\Acrobat 7.0\\Reader\\reader_sl.exe
O8 - Extra context menu item: Add to EverNote - res://C:\\Program Files\\EverNote\\EverNote\\enbar.dll/2000
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\\PROGRA~1\\MICROS~4\\OFFICE11\\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\\Program Files\\Java\\jre1.6.0_02\\bin\\ssv.dll
O9 - Extra \'Tools\' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\\Program Files\\Java\\jre1.6.0_02\\bin\\ssv.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 7.0\\SCIEPlgn.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\\PROGRA~1\\MICROS~4\\OFFICE11\\REFIEBAR.DLL
O9 - Extra button: Add to EverNote - {A5ABA0BB-F195-40d8-A5E9-0801153E6597} - C:\\Program Files\\EverNote\\EverNote\\enbar.dll
O9 - Extra \'Tools\' menuitem: Add to EverNote - {A5ABA0BB-F195-40d8-A5E9-0801153E6597} - C:\\Program Files\\EverNote\\EverNote\\enbar.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\\Network Diagnostic\\xpnetdiag.exe (file missing)
O9 - Extra \'Tools\' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\\Network Diagnostic\\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\\Program Files\\Messenger\\msmsgs.exe
O9 - Extra \'Tools\' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\\Program Files\\Messenger\\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q405&bd=presario&pf=laptop
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab55579.cab
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/cabs/MSDcode.cab
O16 - DPF: {14C1B87C-3342-445F-9B5E-365FF330A3AC} (Hewlett-Packard Online Support Services) - http://h20278.www2.hp.com/HPISWeb/Customer/cabs/HPISDataManager.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (MSN Games – Buddy Invite) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab55579.cab
O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://zone.msn.com/bingame/rtlw/default/ReflexiveWebGameLoader.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab55579.cab
O16 - DPF: {639658F3-B141-4D6B-B936-226F75A5EAC3} (CPlayFirstDinerDash2Control Object) - http://zone.msn.com/bingame/dsh2/default/DinerDash2.1.0.0.68.cab
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://zone.msn.com/bingame/chnz/default/mjolauncher.cab
O16 - DPF: {809A6301-7B40-4436-A02C-87B8D3D7D9E3} (ZPA_DMNO Object) - http://sympatico.zone.msn.com/bingame/zpagames/zpa_dmno.cab55579.cab
O16 - DPF: {9BDF4724-10AA-43D5-BD15-AEA0D2287303} (MSN Games – Texas Holdem Poker) - http://zone.msn.com/bingame/zpagames/zpa_txhe.cab60231.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
O16 - DPF: {BAE1D8DF-0B35-47E3-A1E7-EEB3FF2ECD19} (CPlayFirstddfotgControl Object) - http://zone.msn.com/bingame/fotg/default/ddfotg.1.0.0.37.cab
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://player.virtools.com/downloads/player/Install3.0/Installer.exe
O16 - DPF: {CAC181B0-4D70-402D-B571-C596A47D0CE0} (CBankshotZoneCtrl Class) - http://zone.msn.com/bingame/zpagames/zpa_pool.cab56649.cab
O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} (SproutLauncherCtrl Class) - http://zone.msn.com/bingame/feed/default/SproutLauncher.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (MSN Games – Game Communicator) - http://zone.msn.com/binframework/v10/StProxy.cab55579.cab
O16 - DPF: {DC75FEF6-165D-4D25-A518-C8C4BDA7BAA6} (CPlayFirstDinerDashControl Object) - http://zone.msn.com/bingame/dash/default/DinerDash.1.0.0.94.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/popcaploader_v10.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\\PROGRA~1\\MSNMES~1\\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\\PROGRA~1\\MSNMES~1\\MSGRAP~1.DLL
O20 - Winlogon Notify: klogon - C:\\WINDOWS\\system32\\klogon.dll
O20 - Winlogon Notify: WgaLogon - C:\\WINDOWS\\SYSTEM32\\WgaLogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\\WINDOWS\\system32\\Ati2evxx.exe
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Unknown owner - C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 7.0\\avp.exe\" -r (file missing)
O23 - Service: Brother Popup Suspend service for Resource manager (brmfrmps) - Unknown owner - C:\\WINDOWS\\system32\\Brmfrmps.exe\" -service (file missing)
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\\WINDOWS\\system32\\brsvc01a.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\\Program Files\\Google\\Common\\Google Updater\\GoogleUpdaterService.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\\Program Files\\HPQ\\SHARED\\HPQWMI.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\\Program Files\\Common Files\\InstallShield\\Driver\\11\\Intel 32\\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\\Program Files\\iPod\\bin\\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\\Program Files\\Common Files\\LightScribe\\LSSrvc.exe
O23 - Service: SQL Server (MSSMLBIZ) (MSSQL$MSSMLBIZ) - Unknown owner - c:\\Program Files\\Microsoft SQL Server\\MSSQL.1\\MSSQL\\Binn\\sqlservr.exe\" -sMSSMLBIZ (file missing)
Comentarios adicionales: El problema surgió justo despues de instalar un programa.
-
[Mensaje editado por josito con fecha: 10-10-2007 08:50:08]. | |
|
|
| tordanxa |  |
|
Re: Www.*****.org se robo mi pagina inicial en IE (Solucionado) - 2007-10-10 09:39 - Respuesta 2
Cierra todos los programas. Ejecuta el HijackThis (Do a system scan only y marca las siguientes entradas, después las eliminas utilizando la opción Fix checked
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.finderg.com
saludoss | |
|
|
| las3lunas | |
|
Re: Www.*****.org se robo mi pagina inicial en IE (Solucionado) - 2007-10-10 17:53 - Respuesta 3
Gracias por tu respuesta, pero eso ya lo había intentado y entonces se iba a una página en blanco, igual no podia cambiar los parámetros a otra página que no fuera eso.
Aunque para cualquier otro que tenga el problema, ya que soy obsesiva compulsiva seguí dale que dale y encontre como recuperar mi página inicial de las garras de ese predador :)
Encontré un programa el cual primero chequee en buscadores para estar segura de que existía antes de dar ejecutar por que no aprendo y ya lo había bajado. Beno, el programa se llama System Spyware Investigator. Detectó el problema y le dió solución.
Igual nuevamente agradezco tu diligencia en ayudar a otros con estos problemitas.
Saludos desde la Isla del Encanto. | |
|
|
|
