vicks
Topic Starter
I don't know if I have or not a malware. My computer is going slow and sometimes when I'm watching movies or chating with windows messenger, the computer get's cold, don't do anything and I have to restart it. I download runscanner and that's what it show me, I don't know if it serves or not, please help me.
000 General info
RunScanner Version 1.6.1.0
Creation time 25/12/2007 1:14:40
User rights Administrator
OS Microsoft Windows XP
OS Build 2600
OS SP Service Pack 2
User Language Español (alfabetización internacional)
IE version 7.0.5730.11
Windows folder C:\WINDOWS
Hosts file location %SystemRoot%\System32\drivers\etc
Hosts <> 127.0.0.1 0
001 Running Processes
coolsrv.exe c: \ archivos de programa \ cpucool \ coolsrv.exe -
MMKbd c: \ archivos de programa \ multimedia hotkey program \ mmkbd.exe - SITECSOFT Co., LTD.
ADIMON MFC Application c: \ archivos de programa \ telefonica \ kit adsl usb \ dslmon.exe -
Ares p2p for windows c: \ archivos de programa \ ares \ ares.exe - Ares Development Group
003 Autorun registry entries Current User
SpeedStartup c: \ archivos de programa \ speed startup \ speedstartup.exe -
005 Current user startup startmenu
ADIMON MFC Application c: \ archiv~1 \ telefo~1 \ kitads~1 \ dslmon.exe -
010 Installed services
Ares Chatroom server c: \ archivos de programa \ ares \ chatserver.exe - Ares Development Group
CPUCooLServer Service c: \ archivos de programa \ cpucool \ coolsrv.exe -
Windows Live Setup Service c: \ archivos de programa \ windows live \ installer \ wlsetupsvc.exe -
011 Installed drivers
Creative AC3 Software Decoder C: \ WINDOWS \ system32 \ drivers \ ctac32k.sys - Creative Technology Ltd
Creative Proxy Driver C: \ WINDOWS \ system32 \ drivers \ ctprxy2k.sys - Creative Technology Ltd
Creative SoundFont Management Device Driver C: \ WINDOWS \ system32 \ drivers \ ctsfm2k.sys - Creative Technology Ltd
Dev_UNIDRV c: \ windows \ system32 \ drivers \ unidrv.sys - TwinSSoft Co.
E-mu Plug-in Architecture Driver C: \ WINDOWS \ system32 \ drivers \ emupia2k.sys - Creative Technology Ltd
Creative P16V HAL Driver C: \ WINDOWS \ system32 \ drivers \ hap16v2k.sys - Creative Technology Ltd
ntiopnp c: \ windows \ system32 \ drivers \ ntiopnp.sys -
036 Internet Explorer Components
Mi página de inicio actual About:Home
041 Internet Explorer Toolbars
Knight Online Toolbar {E7D38ED4-2933-43B8-B0B9-52D11CE9CA10} c: \ archivos de programa \ knight online toolbar \ v3.2.0.0 \ knight_… -
045 Internet Explorer\Toolbar\WebBrowser
Knight Online Toolbar {E7D38ED4-2933-43B8-B0B9-52D11CE9CA10} c: \ archivos de programa \ knight online toolbar \ v3.2.0.0 \ knight_… -
048 ESC Trusted zones
Zone: *.update.microsoft.com http://*.update.microsoft.com
Zone: *.update.microsoft.com https://*.update.microsoft.com
050 Explorer ShellExecuteHooks
MSCAT ShellHook Module {5A834547-7166-4A89-88B0-B92CC015F6DC… c: \ windows \ system32 \ kbddus.dll -
052 Explorer Browser Helper Objects (BHO)
{3F272861-97F6-45AA-90F0-5ECB6C852A85} GUID / CLSID not found
{7E853D72-626A-48EC-A868-BA8D5E23E045} GUID / CLSID not found
Knight Online Toolbar {9D006D63-579B-4D77-9C12-15623661ADDA} c: \ archivos de programa \ knight online toolbar \ v3.2.0.0 \ knight_… -
061 Shell Approved Extensions
MSCAT ShellHook Module {5A834547-7166-4A89-88B0-B92CC015F6DC… c: \ windows \ system32 \ kbddus.dll -
063 BootExecute
autocheck autochk * autocheck autochk *
100 Internet Explorer settings
Start Page HKCU http://www.hotmail.com/
Start Page HKLM http://go.microsoft.com/fwlink/?LinkId=69157
Search Page HKCU http://www.microsoft.com/isapi/redir.dll?p…amp;ar=iesearch
Search Page HKLM http://go.microsoft.com/fwlink/?LinkId=54896
Default_Page_URL HKLM http://go.microsoft.com/fwlink/?LinkId=69157
Default_Search_URL HKLM http://go.microsoft.com/fwlink/?LinkId=54896
SearchAssistant HKLM http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
CustomizeSearch HKLM http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
ShellNext HKCU iexplore
102 Explorer Bars
{32683183-48a0-441b-a342-7c2a440a9478} GUID / CLSID not found
104 ActiveX controls (Distribution Units)
{33564D57-0000-0010-8000-00AA00389B71} GUID / CLSID not found
105 IE Menu extensions
E&xportar a Microsoft Excel res://C:\ARCHIV~1\MICROS~2\Office10\EXCEL.EXE/3000
106 URL hijacking
Default http://
ftp ftp://
gopher gopher://
home http://
mosaic http://
www http://
120 Domain/Dns Hijacking
NameServer {93277E8F-888D-4C18-913F-460D7EFC9B9B} 80.58.61.250 80.58.61.254
136 Local Machine Runonce (+subkeys)
SpeedStartup c: \ archivos de programa \ speed startup \ speedstartup.exe -
160 HKCU System Policies
DisableRegistryTools 0
161 HKLM System Policies
dontdisplaylastusername 0
shutdownwithoutlogon 1
undockwithoutlogon 1
170 Explorer MountPoints
{a5bc4a56-7bc6-11dc-a680-4d6564696130} F:\LaunchU3.exe -a
173 ContextMenuHandlers
{548773BA-874E-4C02-9DC7-B7A096772C7D} {548773BA-874E-4C02-9… c: \ archivos de programa \ mp3 player utilities 3.57 \ amvtools \ src… -
174 Winlogon\VmApplet
rundll32 shell32,Control_RunDLL "sysdm.cpl" rundll32 shell32,Control_RunDLL "sysdm.cpl"
180 FileType Hijacking
HKEY_CLASSES_ROOT batfile "%1" %*
HKEY_CLASSES_ROOT cmdfile "%1" %*
HKEY_CLASSES_ROOT comfile "%1" %*
HKEY_CLASSES_ROOT exefile "%1" %*
HKEY_CLASSES_ROOT htafile C:\WINDOWS\system32\mshta.exe "%1" %*
HKEY_CLASSES_ROOT piffile "%1" %*
HKEY_CLASSES_ROOT scrfile "%1" /S
000 General info
RunScanner Version 1.6.1.0
Creation time 25/12/2007 1:14:40
User rights Administrator
OS Microsoft Windows XP
OS Build 2600
OS SP Service Pack 2
User Language Español (alfabetización internacional)
IE version 7.0.5730.11
Windows folder C:\WINDOWS
Hosts file location %SystemRoot%\System32\drivers\etc
Hosts <> 127.0.0.1 0
001 Running Processes
coolsrv.exe c: \ archivos de programa \ cpucool \ coolsrv.exe -
MMKbd c: \ archivos de programa \ multimedia hotkey program \ mmkbd.exe - SITECSOFT Co., LTD.
ADIMON MFC Application c: \ archivos de programa \ telefonica \ kit adsl usb \ dslmon.exe -
Ares p2p for windows c: \ archivos de programa \ ares \ ares.exe - Ares Development Group
003 Autorun registry entries Current User
SpeedStartup c: \ archivos de programa \ speed startup \ speedstartup.exe -
005 Current user startup startmenu
ADIMON MFC Application c: \ archiv~1 \ telefo~1 \ kitads~1 \ dslmon.exe -
010 Installed services
Ares Chatroom server c: \ archivos de programa \ ares \ chatserver.exe - Ares Development Group
CPUCooLServer Service c: \ archivos de programa \ cpucool \ coolsrv.exe -
Windows Live Setup Service c: \ archivos de programa \ windows live \ installer \ wlsetupsvc.exe -
011 Installed drivers
Creative AC3 Software Decoder C: \ WINDOWS \ system32 \ drivers \ ctac32k.sys - Creative Technology Ltd
Creative Proxy Driver C: \ WINDOWS \ system32 \ drivers \ ctprxy2k.sys - Creative Technology Ltd
Creative SoundFont Management Device Driver C: \ WINDOWS \ system32 \ drivers \ ctsfm2k.sys - Creative Technology Ltd
Dev_UNIDRV c: \ windows \ system32 \ drivers \ unidrv.sys - TwinSSoft Co.
E-mu Plug-in Architecture Driver C: \ WINDOWS \ system32 \ drivers \ emupia2k.sys - Creative Technology Ltd
Creative P16V HAL Driver C: \ WINDOWS \ system32 \ drivers \ hap16v2k.sys - Creative Technology Ltd
ntiopnp c: \ windows \ system32 \ drivers \ ntiopnp.sys -
036 Internet Explorer Components
Mi página de inicio actual About:Home
041 Internet Explorer Toolbars
Knight Online Toolbar {E7D38ED4-2933-43B8-B0B9-52D11CE9CA10} c: \ archivos de programa \ knight online toolbar \ v3.2.0.0 \ knight_… -
045 Internet Explorer\Toolbar\WebBrowser
Knight Online Toolbar {E7D38ED4-2933-43B8-B0B9-52D11CE9CA10} c: \ archivos de programa \ knight online toolbar \ v3.2.0.0 \ knight_… -
048 ESC Trusted zones
Zone: *.update.microsoft.com http://*.update.microsoft.com
Zone: *.update.microsoft.com https://*.update.microsoft.com
050 Explorer ShellExecuteHooks
MSCAT ShellHook Module {5A834547-7166-4A89-88B0-B92CC015F6DC… c: \ windows \ system32 \ kbddus.dll -
052 Explorer Browser Helper Objects (BHO)
{3F272861-97F6-45AA-90F0-5ECB6C852A85} GUID / CLSID not found
{7E853D72-626A-48EC-A868-BA8D5E23E045} GUID / CLSID not found
Knight Online Toolbar {9D006D63-579B-4D77-9C12-15623661ADDA} c: \ archivos de programa \ knight online toolbar \ v3.2.0.0 \ knight_… -
061 Shell Approved Extensions
MSCAT ShellHook Module {5A834547-7166-4A89-88B0-B92CC015F6DC… c: \ windows \ system32 \ kbddus.dll -
063 BootExecute
autocheck autochk * autocheck autochk *
100 Internet Explorer settings
Start Page HKCU http://www.hotmail.com/
Start Page HKLM http://go.microsoft.com/fwlink/?LinkId=69157
Search Page HKCU http://www.microsoft.com/isapi/redir.dll?p…amp;ar=iesearch
Search Page HKLM http://go.microsoft.com/fwlink/?LinkId=54896
Default_Page_URL HKLM http://go.microsoft.com/fwlink/?LinkId=69157
Default_Search_URL HKLM http://go.microsoft.com/fwlink/?LinkId=54896
SearchAssistant HKLM http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
CustomizeSearch HKLM http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
ShellNext HKCU iexplore
102 Explorer Bars
{32683183-48a0-441b-a342-7c2a440a9478} GUID / CLSID not found
104 ActiveX controls (Distribution Units)
{33564D57-0000-0010-8000-00AA00389B71} GUID / CLSID not found
105 IE Menu extensions
E&xportar a Microsoft Excel res://C:\ARCHIV~1\MICROS~2\Office10\EXCEL.EXE/3000
106 URL hijacking
Default http://
ftp ftp://
gopher gopher://
home http://
mosaic http://
www http://
120 Domain/Dns Hijacking
NameServer {93277E8F-888D-4C18-913F-460D7EFC9B9B} 80.58.61.250 80.58.61.254
136 Local Machine Runonce (+subkeys)
SpeedStartup c: \ archivos de programa \ speed startup \ speedstartup.exe -
160 HKCU System Policies
DisableRegistryTools 0
161 HKLM System Policies
dontdisplaylastusername 0
shutdownwithoutlogon 1
undockwithoutlogon 1
170 Explorer MountPoints
{a5bc4a56-7bc6-11dc-a680-4d6564696130} F:\LaunchU3.exe -a
173 ContextMenuHandlers
{548773BA-874E-4C02-9DC7-B7A096772C7D} {548773BA-874E-4C02-9… c: \ archivos de programa \ mp3 player utilities 3.57 \ amvtools \ src… -
174 Winlogon\VmApplet
rundll32 shell32,Control_RunDLL "sysdm.cpl" rundll32 shell32,Control_RunDLL "sysdm.cpl"
180 FileType Hijacking
HKEY_CLASSES_ROOT batfile "%1" %*
HKEY_CLASSES_ROOT cmdfile "%1" %*
HKEY_CLASSES_ROOT comfile "%1" %*
HKEY_CLASSES_ROOT exefile "%1" %*
HKEY_CLASSES_ROOT htafile C:\WINDOWS\system32\mshta.exe "%1" %*
HKEY_CLASSES_ROOT piffile "%1" %*
HKEY_CLASSES_ROOT scrfile "%1" /S