What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Can't Remove ads on browsers

2 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hello,

I use Win XP, I have a registered and updated antivirus (Kaspersky). I've tryed almost all different spyware and adware removers, but doesn't seem to work. As a last resourse I would like to try Hijack This. This adware replaces the pictures in the browser(Mozilla or IE) and for some reason doesn't let google or yahoo work. The virus is constantly asking me to go to their webpage and buy a spyware removal. Here is my first log from Hijack This:

Logfile of HijackThis v1.99.1
Scan saved at 21:46:27, on 21/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Archivos de programa\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Archivos de programa\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Archivos de programa\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\ps2.exe
C:\Archivos de programa\PowerISO\PWRISOVM.EXE
C:\Archivos de programa\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Archivos de programa\Archivos comunes\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Archivos de programa\Anyplace Control\apc_host.exe
C:\Archivos de programa\Archivos comunes\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Archivos de programa\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WE_Monitor\wemsrv.exe
C:\Program Files\WE_Monitor\wemon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Propietario\Escritorio\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qes9.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qes9.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.es/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

Thanks four your attention.
Post #2
Reboot and rescan with HiJackThis and post a new log here. Also please describe how your computer behaves at the moment.
Post #3
Hello again, and thanks for answering.

The main problem with my computer is that I both browsers (Mozilla & IE) can't load certain web pages such as What The Tech
or they load the main page but then it gets stuck. The funny thing is that they do load some other pages like newspapers and
you can navigate along those pages without any trouble except for some picture frames (inside the webpage) that are replaced for some
spam ads like porn or online casino. Furthermore, Google, Yahoo and main search engines don't work. Browsers only load
the main page and then keep trying to load the next page with the search results. Sometimes I get some pop up windows too, offering
the same things offered in the ads that are replacing images from the web pages.

This is my latest HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 16:32:15, on 02/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Archivos de programa\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Archivos de programa\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\ps2.exe
C:\Archivos de programa\PowerISO\PWRISOVM.EXE
C:\Archivos de programa\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Archivos de programa\Archivos comunes\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Archivos de programa\Anyplace Control\apc_host.exe
C:\Archivos de programa\Archivos comunes\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Archivos de programa\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WE_Monitor\wemsrv.exe
C:\Program Files\WE_Monitor\wemon.exe
C:\Archivos de programa\Microsoft Office\OFFICE11\POWERPNT.EXE
C:\Archivos de programa\Windows Media Player\wmplayer.exe
C:\Archivos de programa\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Propietario\Escritorio\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.es/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://qes9.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\TSI32\tsircusr.exe
O2 - BHO: DownloadRedirect Class - {00000000-6CB0-410C-8C3D-8FA8D2011D0A} - C:\Archivos de programa\iMesh\iMesh5\iMeshBHO.dll
O2 - BHO: Aplicación auxiliar de vínculos de Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Archivos de programa\Archivos comunes\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: UrlHelper Class - {474597C5-AB09-49d6-A4D5-2E8D7341384E} - C:\Archivos de programa\iMesh Applications\iMesh MediaBar\iMeshIEHelper.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Archivos de programa\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Archivos de programa\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Archivos de programa\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Archivos de programa\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [AVP] "C:\Archivos de programa\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Archivos de programa\Archivos comunes\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Archivos de programa\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [BM1716dd93] Rundll32.exe "C:\WINDOWS\system32\gjdgeetl.dll",s
O4 - HKCU\..\Run: [EPSON Stylus D92 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBZE.EXE "/FU "C:\WINDOWS\TEMP\E_S126.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BM1716dd93] Rundll32.exe "C:\WINDOWS\system32\gjdgeetl.dll",s
O4 - Startup: Adobe Gamma.lnk = C:\Archivos de programa\Archivos comunes\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Archivos de programa\Archivos comunes\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\ARCHIV~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Sothink SWF Catcher - C:\Archivos de programa\Archivos comunes\SourceTec\SWF Catcher\InternetExplorer.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Archivos de programa\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Archivos de programa\Yahoo!\Common/ycdict.htm
O9 - Extra button: Estadísticas del componente Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Archivos de programa\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Archivos de programa\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Archivos de programa\Archivos comunes\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Archivos de programa\Archivos comunes\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Archivos de programa\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://paris.ville.orange.fr/CO/activex/AxisCamControl.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{63837EA1-6042-46B5-AFD2-40C91E26BF16}: NameServer = 80.58.61.250,80.58.61.254
O17 - HKLM\System\CS1\Services\Tcpip\..\{63837EA1-6042-46B5-AFD2-40C91E26BF16}: NameServer = 80.58.61.250,80.58.61.254
O17 - HKLM\System\CS2\Services\Tcpip\..\{63837EA1-6042-46B5-AFD2-40C91E26BF16}: NameServer = 80.58.61.250,80.58.61.254
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARCHIV~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARCHIV~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O20 - Winlogon Notify: LogPack - C:\WINDOWS\SYSTEM32\lp32.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Archivos de programa\Archivos comunes\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: APC-Host - Anyplace Control Software - C:\Archivos de programa\Anyplace Control\apc_host.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Archivos de programa\Archivos comunes\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Unknown owner - C:\Archivos de programa\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" -r (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Archivos de programa\Archivos comunes\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Servicio del iPod (iPod Service) - Apple Inc. - C:\Archivos de programa\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Archivos de programa\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Archivos de programa\Spyware Doctor\pctsSvc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Unknown owner - C:\Archivos de programa\Archivos comunes\Symantec Shared\SNDSrvc.exe (file missing)
O23 - Service: SymWMI Service (SymWSC) - Unknown owner - C:\Archivos de programa\Archivos comunes\Symantec Shared\Security Center\SymWSC.exe (file missing)
O23 - Service: WE_Monitor - Unknown owner - C:\Program Files\WE_Monitor\wemsrv.exe

Thanks for your help!
Post #4
Download SDFix and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following :
  • Restart your computer
  • After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
  • Instead of Windows loading as normal, the Advanced Options Menu should appear;
  • Select the first option, to run Windows in Safe Mode, then press Enter.
  • Choose your usual account.
  • Open the extracted SDFix folder and double click RunThis.bat to start the script.
  • Type Y to begin the cleanup process.
  • It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
  • Press any Key and it will restart the PC.
  • When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
  • Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
    (Report.txt will also be copied to Clipboard ready for posting back on the forum).
  • Finally paste the contents of the Report.txt back on the forum with a new HijackThis log
Post #5
This is the log from SDFIX:


SDFix: Version 1.187
Run by [removed] on 02/06/2008 at 20:06

Microsoft Windows XP [Versi¢n 5.1.2600]
Running From: C:\SDFix

Checking Services :


Restoring Windows Registry Values
Restoring Windows Default Hosts File
Restoring Default Desktop Wallpaper

Rebooting


Checking Files :

Trojan Files Found:

C:\WINDOWS\SYSTEM32\LP32.DLL - Deleted
C:\Temp\1cb\syscheck.log - Deleted
C:\Temp\maxsv15\rLCubd.log - Deleted
C:\Archivos de programa\JavaCore\UnInstall.exe - Deleted
C:\Archivos de programa\Spcron\Spcron.dll - Deleted
C:\Archivos de programa\winvi\Uninst.exe - Deleted
C:\Archivos de programa\winvi\version.ini - Deleted
C:\Archivos de programa\winvi\wupda.exe - Deleted
C:\Archivos de programa\winvi\dsktp\AC_RunActiveContent.js - Deleted
C:\Archivos de programa\winvi\dsktp\desktop.html - Deleted
C:\Archivos de programa\winvi\dsktp\internetDetection.swf - Deleted
C:\Archivos de programa\winvi\dsktp\settings.sol - Deleted
C:\WINDOWS\Downloaded Program Files\UWFX5YLP_0001_0816NetInstaller.exe - Deleted
C:\Archivos de programa\.autoreg - Deleted
C:\DOCUME~1\PROPIE~1\CONFIG~1\Temp\rasesnet.exe - Deleted



Folder C:\Archivos de programa\AntiSpywareMaster - Removed
Folder C:\Archivos de programa\InetGet2 - Removed
Folder C:\Archivos de programa\JavaCore - Removed
Folder C:\Archivos de programa\Spcron - Removed
Folder C:\Archivos de programa\Temporary - Removed
Folder C:\Archivos de programa\winvi - Removed
Folder C:\Temp\1cb - Removed
Folder C:\Temp\maxsv15 - Removed
Folder C:\WINDOWS\system32\bkEur01 - Removed


Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-02 20:22:26
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden services & system hive …

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s0"=dword:89e7502a
"s1"=dword:b518d8c9
"s2"=dword:1ed9b6f5

scanning hidden registry entries …

scanning hidden files …

C:\WINDOWS\SoftwareDistribution\DataStore\Logs\tmp.edb 65536 bytes

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 1


Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Archivos de programa\\Yahoo!\\Messenger\\YPager.exe"="C:\\Archivos de programa\\Yahoo!\\Messenger\\YPager.exe:*:Enabled:Yahoo! Messenger"
"C:\\Archivos de programa\\Yahoo!\\Messenger\\YServer.exe"="C:\\Archivos de programa\\Yahoo!\\Messenger\\YServer.exe:*:Enabled:Yahoo! FT Server"
"C:\\Archivos de programa\\eDonkey2000\\edonkey2000.exe"="C:\\Archivos de programa\\eDonkey2000\\edonkey2000.exe:*:Enabled:eDonkey2000 Application"
"C:\\Archivos de programa\\Macromedia\\Dreamweaver 8\\Dreamweaver.exe"="C:\\Archivos de programa\\Macromedia\\Dreamweaver 8\\Dreamweaver.exe:*:Enabled:Dreamweaver 8"
"C:\\Archivos de programa\\TurboNote\\tbnote.exe"="C:\\Archivos de programa\\TurboNote\\tbnote.exe:*:Enabled:TurboNote+ v5.4"
"C:\\Archivos de programa\\Work Examiner Server\\weserver.exe"="C:\\Archivos de programa\\Work Examiner Server\\weserver.exe:*:Enabled:Work Examiner Server"
"C:\\Archivos de programa\\Work Examiner Monitor\\wemon.exe"="C:\\Archivos de programa\\Work Examiner Monitor\\wemon.exe:*:Enabled:Work Examiner Monitor"
"C:\\Archivos de programa\\Inspyder Software Inc\\Inspyder FilterWeb\\FilterWeb.exe"="C:\\Archivos de programa\\Inspyder Software Inc\\Inspyder FilterWeb\\FilterWeb.exe:*:Enabled: "
"C:\\Archivos de programa\\Anyplace Control\\apc_host.exe"="C:\\Archivos de programa\\Anyplace Control\\apc_host.exe:*:Enabled:Anyplace Control: www.anyplace-control.com"
"C:\\Archivos de programa\\Work Examiner Server\\wesheduler.exe"="C:\\Archivos de programa\\Work Examiner Server\\wesheduler.exe:*:Enabled:Work Examiner Sheduler"
"C:\\WINDOWS\\system32\\ftp.exe"="C:\\WINDOWS\\system32\\ftp.exe:*:Enabled:Programa de transferencia de archivos"
"C:\\Archivos de programa\\BitLord\\BitLord.exe"="C:\\Archivos de programa\\BitLord\\BitLord.exe:*:Disabled:BitLord"
"\\\\192.168.1.3\\presario ©\\Archivos de programa\\BitLord\\BitLord.exe"="\\\\192.168.1.3\\presario ©\\Archivos de programa\\BitLord\\BitLord.exe:*:Disabled:BitLord"
"C:\\Archivos de programa\\iMesh Applications\\iMesh6\\iMesh6.exe"="C:\\Archivos de programa\\iMesh Applications\\iMesh6\\iMesh6.exe:*:Disabled:iMesh 6"
"C:\\Archivos de programa\\Internet Explorer\\iexplore.exe"="C:\\Archivos de programa\\Internet Explorer\\iexplore.exe:*:Disabled:Internet Explorer"
"C:\\Archivos de programa\\MSN Messenger\\msnmsgr.exe"="C:\\Archivos de programa\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Archivos de programa\\MSN Messenger\\livecall.exe"="C:\\Archivos de programa\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Archivos de programa\\iTunes\\iTunes.exe"="C:\\Archivos de programa\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\WE_Monitor\\wemon.exe"="C:\\Program Files\\WE_Monitor\\wemon.exe:*:Enabled:Work Examiner Monitor"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Archivos de programa\\MSN Messenger\\msnmsgr.exe"="C:\\Archivos de programa\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Archivos de programa\\MSN Messenger\\livecall.exe"="C:\\Archivos de programa\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

Remaining Files :


File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes :

Thu 16 Dec 2004 196 A.SHR — "C:\BOOT.BAK"
Tue 13 May 2008 1,506,200 ..SH. — "C:\WINDOWS\system32\doqpvnyt.tmp"
Thu 27 Jul 2006 13 A..H. — "C:\Documents and Settings\All Users\Datos de programa\íÇŽ3113>.sys"
Thu 3 Feb 2005 4,348 ..SH. — "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Mon 8 Oct 2007 75,776 …H. — "C:\Documents and Settings\Propietario\Mis documentos\~WRL1766.tmp"
Mon 4 Feb 2008 80,896 …H. — "C:\Documents and Settings\Propietario\Mis documentos\~WRL2490.tmp"
Mon 21 Feb 2000 358,912 A..H. — "C:\Documents and Settings\Propietario\Mis documentos\BACKUP\~WRL0003.tmp"
Sat 19 Feb 2000 355,840 A..H. — "C:\Documents and Settings\Propietario\Mis documentos\BACKUP\~WRL0004.tmp"
Fri 7 Apr 2000 1,522,176 A..H. — "C:\Documents and Settings\Propietario\Mis documentos\BACKUP\~WRL0005.tmp"
Tue 30 Sep 2003 52,224 A..H. — "C:\Documents and Settings\Propietario\Mis documentos\BACKUP\~WRL0434.tmp"
Thu 18 May 2000 323,584 A..H. — "C:\Documents and Settings\Propietario\Mis documentos\BACKUP\~WRL0788.tmp"
Thu 27 Apr 2000 1,399,808 A..H. — "C:\Documents and Settings\Propietario\Mis documentos\BACKUP\~WRL0904.tmp"
Tue 30 Sep 2003 68,608 A..H. — "C:\Documents and Settings\Propietario\Mis documentos\BACKUP\~WRL0934.tmp"
Fri 7 Apr 2000 1,714,176 A..H. — "C:\Documents and Settings\Propietario\Mis documentos\BACKUP\~WRL0963.tmp"
Mon 29 May 2000 363,008 A..H. — "C:\Documents and Settings\Propietario\Mis documentos\BACKUP\~WRL1298.tmp"
Fri 18 Feb 2000 295,936 A..H. — "C:\Documents and Settings\Propietario\Mis documentos\BACKUP\~WRL2031.tmp"
Wed 6 Nov 2002 399,872 A..H. — "C:\Documents and Settings\Propietario\Mis documentos\BACKUP\~WRL2437.tmp"
Mon 28 Feb 2000 27,136 A..H. — "C:\Documents and Settings\Propietario\Mis documentos\BACKUP\~WRL2802.tmp"
Thu 27 Apr 2000 440,320 A..H. — "C:\Documents and Settings\Propietario\Mis documentos\BACKUP\~WRL2870.tmp"
Thu 27 Apr 2000 935,424 A..H. — "C:\Documents and Settings\Propietario\Mis documentos\BACKUP\~WRL2940.tmp"
Tue 23 May 2000 320,512 A..H. — "C:\Documents and Settings\Propietario\Mis documentos\BACKUP\~WRL3089.tmp"
Thu 27 Apr 2000 733,696 A..H. — "C:\Documents and Settings\Propietario\Mis documentos\BACKUP\~WRL3119.tmp"
Thu 27 Apr 2000 1,185,792 A..H. — "C:\Documents and Settings\Propietario\Mis documentos\BACKUP\~WRL3154.tmp"
Tue 30 Sep 2003 65,024 A..H. — "C:\Documents and Settings\Propietario\Mis documentos\BACKUP\~WRL3259.tmp"
Thu 27 Apr 2000 1,185,792 A..H. — "C:\Documents and Settings\Propietario\Mis documentos\BACKUP\~WRL3593.tmp"
Tue 30 May 2000 533,504 A..H. — "C:\Documents and Settings\Propietario\Mis documentos\BACKUP\~WRL3721.tmp"
Fri 27 Dec 2002 302,592 A..H. — "C:\Documents and Settings\Propietario\Mis documentos\BACKUP\~WRL4038.tmp"
Tue 27 Jun 2006 31,744 A..H. — "C:\Documents and Settings\Propietario\Mis documentos\DOCUMENTOS CENTRO\~WRL2411.tmp"
Thu 8 May 2008 0 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\a0599e95d7e3ff7d693d5b86358352ee\BIT2.tmp"
Tue 19 Feb 2008 333,312 …H. — "C:\Documents and Settings\Propietario\Mis documentos\ALUMNOS\FACTURAS ALUMNOS\~WRL0121.tmp"
Fri 8 Feb 2008 333,824 …H. — "C:\Documents and Settings\Propietario\Mis documentos\ALUMNOS\FACTURAS ALUMNOS\~WRL1787.tmp"
Fri 8 Feb 2008 331,776 …H. — "C:\Documents and Settings\Propietario\Mis documentos\ALUMNOS\FACTURAS ALUMNOS\~WRL2598.tmp"
Mon 21 Apr 2008 332,288 …H. — "C:\Documents and Settings\Propietario\Mis documentos\ALUMNOS\FACTURAS ALUMNOS\~WRL2809.tmp"
Fri 8 Feb 2008 330,752 …H. — "C:\Documents and Settings\Propietario\Mis documentos\ALUMNOS\FACTURAS ALUMNOS\~WRL3036.tmp"
Tue 12 Feb 2008 332,800 …H. — "C:\Documents and Settings\Propietario\Mis documentos\ALUMNOS\FACTURAS ALUMNOS\~WRL3235.tmp"
Thu 27 Mar 2008 332,288 …H. — "C:\Documents and Settings\Propietario\Mis documentos\EMPRESAS\Thales Group\~WRL0708.tmp"
Fri 29 Feb 2008 332,288 …H. — "C:\Documents and Settings\Propietario\Mis documentos\EMPRESAS\Thales Group\~WRL1502.tmp"
Fri 29 Feb 2008 332,800 …H. — "C:\Documents and Settings\Propietario\Mis documentos\EMPRESAS\Thales Group\~WRL2078.tmp"
Wed 7 May 2008 330,752 …H. — "C:\Documents and Settings\Propietario\Mis documentos\EMPRESAS\UNION PACIFIC\~WRL1711.tmp"
Tue 12 Feb 2008 323,584 …H. — "C:\Documents and Settings\Propietario\Mis documentos\ALUMNOS\CERTIFICADOS\Espa¤ol\~WRL0001.tmp"
Fri 18 Apr 2008 324,096 …H. — "C:\Documents and Settings\Propietario\Mis documentos\ALUMNOS\CERTIFICADOS\Espa¤ol\~WRL0002.tmp"
Thu 22 May 2008 323,584 …H. — "C:\Documents and Settings\Propietario\Mis documentos\ALUMNOS\CERTIFICADOS\Espa¤ol\~WRL0003.tmp"
Thu 27 Mar 2008 325,632 …H. — "C:\Documents and Settings\Propietario\Mis documentos\ALUMNOS\CERTIFICADOS\Espa¤ol\~WRL0747.tmp"
Wed 6 Feb 2008 325,120 …H. — "C:\Documents and Settings\Propietario\Mis documentos\ALUMNOS\CERTIFICADOS\Espa¤ol\~WRL2304.tmp"
Mon 14 Apr 2008 324,096 …H. — "C:\Documents and Settings\Propietario\Mis documentos\ALUMNOS\CERTIFICADOS\Espa¤ol\~WRL2977.tmp"
Mon 5 May 2008 325,632 …H. — "C:\Documents and Settings\Propietario\Mis documentos\ALUMNOS\CERTIFICADOS\Espa¤ol\~WRL3809.tmp"
Mon 28 Apr 2008 324,608 …H. — "C:\Documents and Settings\Propietario\Mis documentos\ALUMNOS\CERTIFICADOS\Fran‡ais\~WRL0173.tmp"

Finished!


And this is the one from HJT:

Logfile of HijackThis v1.99.1
Scan saved at 20:37:32, on 02/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Archivos de programa\Anyplace Control\apc_host.exe
C:\Archivos de programa\Archivos comunes\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Archivos de programa\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WE_Monitor\wemsrv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\WE_Monitor\wemon.exe
C:\Archivos de programa\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Archivos de programa\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\ps2.exe
C:\Archivos de programa\PowerISO\PWRISOVM.EXE
C:\Archivos de programa\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Archivos de programa\Archivos comunes\Real\Update_OB\realsched.exe
C:\Archivos de programa\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Documents and Settings\Propietario\Escritorio\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.es/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://qes9.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\TSI32\tsircusr.exe
O2 - BHO: DownloadRedirect Class - {00000000-6CB0-410C-8C3D-8FA8D2011D0A} - C:\Archivos de programa\iMesh\iMesh5\iMeshBHO.dll
O2 - BHO: Aplicación auxiliar de vínculos de Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Archivos de programa\Archivos comunes\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: UrlHelper Class - {474597C5-AB09-49d6-A4D5-2E8D7341384E} - C:\Archivos de programa\iMesh Applications\iMesh MediaBar\iMeshIEHelper.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Archivos de programa\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Archivos de programa\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Archivos de programa\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Archivos de programa\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [AVP] "C:\Archivos de programa\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Archivos de programa\Archivos comunes\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Archivos de programa\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [BM1716dd93] Rundll32.exe "C:\WINDOWS\system32\gjdgeetl.dll",s
O4 - HKCU\..\Run: [EPSON Stylus D92 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBZE.EXE "/FU "C:\WINDOWS\TEMP\E_S126.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BM1716dd93] Rundll32.exe "C:\WINDOWS\system32\gjdgeetl.dll",s
O4 - Startup: Adobe Gamma.lnk = C:\Archivos de programa\Archivos comunes\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Archivos de programa\Archivos comunes\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\ARCHIV~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Sothink SWF Catcher - C:\Archivos de programa\Archivos comunes\SourceTec\SWF Catcher\InternetExplorer.htm
O8 - Extra context menu item: Yahoo! &Dictionary; - file:///C:\Archivos de programa\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps; - file:///C:\Archivos de programa\Yahoo!\Common/ycdict.htm
O9 - Extra button: Estadísticas del componente Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Archivos de programa\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Archivos de programa\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Archivos de programa\Archivos comunes\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Archivos de programa\Archivos comunes\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Archivos de programa\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://paris.ville.orange.fr/CO/activex/AxisCamControl.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{63837EA1-6042-46B5-AFD2-40C91E26BF16}: NameServer = 80.58.61.250,80.58.61.254
O17 - HKLM\System\CS1\Services\Tcpip\..\{63837EA1-6042-46B5-AFD2-40C91E26BF16}: NameServer = 80.58.61.250,80.58.61.254
O17 - HKLM\System\CS2\Services\Tcpip\..\{63837EA1-6042-46B5-AFD2-40C91E26BF16}: NameServer = 80.58.61.250,80.58.61.254
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARCHIV~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARCHIV~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O20 - Winlogon Notify: LogPack - lp32.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Archivos de programa\Archivos comunes\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: APC-Host - Anyplace Control Software - C:\Archivos de programa\Anyplace Control\apc_host.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Archivos de programa\Archivos comunes\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Unknown owner - C:\Archivos de programa\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" -r (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Archivos de programa\Archivos comunes\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Servicio del iPod (iPod Service) - Apple Inc. - C:\Archivos de programa\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Archivos de programa\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Archivos de programa\Spyware Doctor\pctsSvc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Unknown owner - C:\Archivos de programa\Archivos comunes\Symantec Shared\SNDSrvc.exe (file missing)
O23 - Service: SymWMI Service (SymWSC) - Unknown owner - C:\Archivos de programa\Archivos comunes\Symantec Shared\Security Center\SymWSC.exe (file missing)
O23 - Service: WE_Monitor - Unknown owner - C:\Program Files\WE_Monitor\wemsrv.exe

Thanks you very much again!
Post #6
Run - ATF Cleaner instructions here.

—————-


Then download Malwarebytes' Anti-Malware to your desktop.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* Be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform FULL SCAN, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad. Please save it to a convenient location. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt
Post #7
Hi,

I followed your ionstructions and I think everything works fine now.

Still I'm posting the log from Malware & HJT. Please tell me if you see anything wrong.

Thanks!

Malwarebytes' Anti-Malware 1.14
Versión de la Base de Datos: 817

18:27:13 03/06/2008
mbam-log-6-3-2008 (18-27-13).txt

Tipo de examen : Examen Completo (C:\|D:\|)
Objetos examinados: 193677
Tiempo transcurrido: 1 hour(s), 7 minute(s), 56 second(s)

Procesos en Memoria Infectados: 0
Módulos en Memoria Infectados: 0
Claves del Registro Infectadas: 24
Valores del Registro Infectados: 3
Elementos de Datos del Registro Infectados: 0
Carpetas Infectadas: 9
Ficheros Infectados: 59

Procesos en Memoria Infectados:
(No se han detectado elementos maliciosos)

Módulos en Memoria Infectados:
(No se han detectado elementos maliciosos)

Claves del Registro Infectadas:
HKEY_CLASSES_ROOT\Interface\{1e404d48-670a-4085-a6a0-d195793ddd33} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{9f593aac-ca4c-4a41-a7ff-a00812192d61} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{749ec66f-a838-4b38-b8e5-e65d905fff74} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{ff46f4ab-a85f-487e-b399-3f191ac0fe23} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{2e4a04a1-a24d-45ae-aca4-949778400813} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{63334394-3da3-4b29-a041-03535909d361} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\testcpv6.bho (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\testcpv6.bho.1 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\imeshmediabar.stockbar (Adware.Softomate) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\imeshmediabar.stockbar.1 (Adware.Softomate) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{f9df827a-8fa7-48a3-b268-ca4db563ea40} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{f9df827a-8fa7-48a3-b268-ca4db563ea40} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mysidesearchsearchassistant (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\testCPV6.DLL (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Spcron (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Svconr (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\MySearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\winvi (Adware.SoftMate) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\winvi (Adware.SoftMate) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

Valores del Registro Infectados:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{f9df827a-8fa7-48a3-b268-ca4db563ea40} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BM1716dd93 (Trojan.Agent) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BM1716dd93 (Trojan.Agent) -> Quarantined and deleted successfully.

Elementos de Datos del Registro Infectados:
(No se han detectado elementos maliciosos)

Carpetas Infectadas:
C:\Archivos de programa\Outerinfo (Adware.Outerinfo) -> Quarantined and deleted successfully.
C:\Archivos de programa\Outerinfo\FF (Adware.Outerinfo) -> Quarantined and deleted successfully.
C:\Archivos de programa\Outerinfo\FF\components (Adware.Outerinfo) -> Quarantined and deleted successfully.
C:\Archivos de programa\SideFind (Adware.ISTBar) -> Quarantined and deleted successfully.
C:\Archivos de programa\MySearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Archivos de programa\MySearch\bar (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Archivos de programa\MySearch\bar\History (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Archivos de programa\MySearch\bar\Settings (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Archivos de programa\Svconr (Trojan.Agent) -> Quarantined and deleted successfully.

Ficheros Infectados:
C:\System Volume Information\_restore{E2935319-C2B6-4ED4-8A48-11DE4175FEAC}\RP692\A0128863.exe (Adware.Vapsup) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E2935319-C2B6-4ED4-8A48-11DE4175FEAC}\RP692\A0128864.dll (Adware.Vapsup) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E2935319-C2B6-4ED4-8A48-11DE4175FEAC}\RP693\A0129891.per (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E2935319-C2B6-4ED4-8A48-11DE4175FEAC}\RP696\A0132142.exe (Rogue.AntiSpyMaster) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E2935319-C2B6-4ED4-8A48-11DE4175FEAC}\RP696\A0134150.exe (Adware.ClickSpring) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E2935319-C2B6-4ED4-8A48-11DE4175FEAC}\RP696\A0134151.exe (Trojan.Insider) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E2935319-C2B6-4ED4-8A48-11DE4175FEAC}\RP696\A0134152.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E2935319-C2B6-4ED4-8A48-11DE4175FEAC}\RP696\A0134153.exe (Adware.SurfAccuracy) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E2935319-C2B6-4ED4-8A48-11DE4175FEAC}\RP696\A0134167.exe (Adware.SurfAccuracy) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E2935319-C2B6-4ED4-8A48-11DE4175FEAC}\RP696\A0134168.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E2935319-C2B6-4ED4-8A48-11DE4175FEAC}\RP696\A0134170.dll (Adware.SurfAccuracy) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E2935319-C2B6-4ED4-8A48-11DE4175FEAC}\RP696\A0135171.exe (Adware.PurityScan) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E2935319-C2B6-4ED4-8A48-11DE4175FEAC}\RP696\A0135172.exe (Adware.PurityScan) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E2935319-C2B6-4ED4-8A48-11DE4175FEAC}\RP696\A0135174.dll (Adware.ZenoSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E2935319-C2B6-4ED4-8A48-11DE4175FEAC}\RP696\A0135175.exe (Trojan.StartPage) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E2935319-C2B6-4ED4-8A48-11DE4175FEAC}\RP696\A0136150.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E2935319-C2B6-4ED4-8A48-11DE4175FEAC}\RP696\A0136219.exe (Adware.PurityScan) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E2935319-C2B6-4ED4-8A48-11DE4175FEAC}\RP696\A0136221.exe (Trojan.StartPage) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E2935319-C2B6-4ED4-8A48-11DE4175FEAC}\RP696\A0136222.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E2935319-C2B6-4ED4-8A48-11DE4175FEAC}\RP696\A0136223.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E2935319-C2B6-4ED4-8A48-11DE4175FEAC}\RP696\A0136224.exe (Trojan.Insider) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E2935319-C2B6-4ED4-8A48-11DE4175FEAC}\RP696\A0136225.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E2935319-C2B6-4ED4-8A48-11DE4175FEAC}\RP696\A0136226.exe (Adware.Insider) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E2935319-C2B6-4ED4-8A48-11DE4175FEAC}\RP696\A0136227.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E2935319-C2B6-4ED4-8A48-11DE4175FEAC}\RP696\A0136228.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E2935319-C2B6-4ED4-8A48-11DE4175FEAC}\RP696\A0136229.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E2935319-C2B6-4ED4-8A48-11DE4175FEAC}\RP696\A0136233.exe (Adware.ZeroSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E2935319-C2B6-4ED4-8A48-11DE4175FEAC}\RP696\A0136253.exe (Adware.ZeroSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E2935319-C2B6-4ED4-8A48-11DE4175FEAC}\RP696\A0136255.exe (Trojan.StartPage) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E2935319-C2B6-4ED4-8A48-11DE4175FEAC}\RP696\A0136256.exe (Adware.PurityScan) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E2935319-C2B6-4ED4-8A48-11DE4175FEAC}\RP696\A0136277.exe (Adware.ZeroSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E2935319-C2B6-4ED4-8A48-11DE4175FEAC}\RP696\A0136279.exe (Trojan.StartPage) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E2935319-C2B6-4ED4-8A48-11DE4175FEAC}\RP696\A0136280.exe (Adware.PurityScan) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E2935319-C2B6-4ED4-8A48-11DE4175FEAC}\RP698\A0136372.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E2935319-C2B6-4ED4-8A48-11DE4175FEAC}\RP698\A0136390.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E2935319-C2B6-4ED4-8A48-11DE4175FEAC}\RP706\A0138138.exe (Adware.Insider) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E2935319-C2B6-4ED4-8A48-11DE4175FEAC}\RP706\A0138139.dll (Adware.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E2935319-C2B6-4ED4-8A48-11DE4175FEAC}\RP706\A0138142.exe (Adware.SoftMate) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E2935319-C2B6-4ED4-8A48-11DE4175FEAC}\RP706\A0138148.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E2935319-C2B6-4ED4-8A48-11DE4175FEAC}\RP706\A0138149.dll (Adware.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E2935319-C2B6-4ED4-8A48-11DE4175FEAC}\RP706\A0138151.exe (Adware.Insider) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E2935319-C2B6-4ED4-8A48-11DE4175FEAC}\RP706\A0138154.exe (Adware.SoftMate) -> Quarantined and deleted successfully.


Logfile of HijackThis v1.99.1
Scan saved at 17:32:54, on 04/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Archivos de programa\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Archivos de programa\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\ps2.exe
C:\Archivos de programa\PowerISO\PWRISOVM.EXE
C:\Archivos de programa\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Archivos de programa\Archivos comunes\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Archivos de programa\Anyplace Control\apc_host.exe
C:\Archivos de programa\Archivos comunes\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Archivos de programa\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WE_Monitor\wemsrv.exe
C:\Program Files\WE_Monitor\wemon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Archivos de programa\Microsoft Office\OFFICE11\POWERPNT.EXE
C:\Archivos de programa\Windows Media Player\wmplayer.exe
C:\Archivos de programa\MSN Messenger\usnsvc.exe
C:\Archivos de programa\MSN Messenger\msnmsgr.exe
C:\Archivos de programa\Outlook Express\msimn.exe
C:\Archivos de programa\Microsoft Office\OFFICE11\EXCEL.EXE
C:\Archivos de programa\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Archivos de programa\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Propietario\Escritorio\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.es/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://qes9.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\TSI32\tsircusr.exe,
O2 - BHO: DownloadRedirect Class - {00000000-6CB0-410C-8C3D-8FA8D2011D0A} - C:\Archivos de programa\iMesh\iMesh5\iMeshBHO.dll
O2 - BHO: Aplicación auxiliar de vínculos de Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Archivos de programa\Archivos comunes\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: UrlHelper Class - {474597C5-AB09-49d6-A4D5-2E8D7341384E} - C:\Archivos de programa\iMesh Applications\iMesh MediaBar\iMeshIEHelper.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Archivos de programa\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Archivos de programa\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Archivos de programa\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Archivos de programa\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [AVP] "C:\Archivos de programa\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Archivos de programa\Archivos comunes\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Archivos de programa\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [EPSON Stylus D92 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBZE.EXE "/FU "C:\WINDOWS\TEMP\E_S126.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Adobe Gamma.lnk = C:\Archivos de programa\Archivos comunes\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Archivos de programa\Archivos comunes\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\ARCHIV~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Sothink SWF Catcher - C:\Archivos de programa\Archivos comunes\SourceTec\SWF Catcher\InternetExplorer.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Archivos de programa\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Archivos de programa\Yahoo!\Common/ycdict.htm
O9 - Extra button: Estadísticas del componente Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Archivos de programa\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Archivos de programa\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Archivos de programa\Archivos comunes\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Archivos de programa\Archivos comunes\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Archivos de programa\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://paris.ville.orange.fr/CO/activex/AxisCamControl.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{63837EA1-6042-46B5-AFD2-40C91E26BF16}: NameServer = 80.58.61.250,80.58.61.254
O17 - HKLM\System\CS1\Services\Tcpip\..\{63837EA1-6042-46B5-AFD2-40C91E26BF16}: NameServer = 80.58.61.250,80.58.61.254
O17 - HKLM\System\CS2\Services\Tcpip\..\{63837EA1-6042-46B5-AFD2-40C91E26BF16}: NameServer = 80.58.61.250,80.58.61.254
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARCHIV~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARCHIV~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O20 - Winlogon Notify: LogPack - lp32.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Archivos de programa\Archivos comunes\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: APC-Host - Anyplace Control Software - C:\Archivos de programa\Anyplace Control\apc_host.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Archivos de programa\Archivos comunes\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Unknown owner - C:\Archivos de programa\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" -r (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Archivos de programa\Archivos comunes\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Servicio del iPod (iPod Service) - Apple Inc. - C:\Archivos de programa\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Archivos de programa\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Archivos de programa\Spyware Doctor\pctsSvc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Unknown owner - C:\Archivos de programa\Archivos comunes\Symantec Shared\SNDSrvc.exe (file missing)
O23 - Service: SymWMI Service (SymWSC) - Unknown owner - C:\Archivos de programa\Archivos comunes\Symantec Shared\Security Center\SymWSC.exe (file missing)
O23 - Service: WE_Monitor - Unknown owner - C:\Program Files\WE_Monitor\wemsrv.exe

Thank you very much!
Post #8
Close all programs leaving only HijackThis running. Place a check against each of the following,

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O20 - Winlogon Notify: LogPack - lp32.dll (file missing)


Click on Fix Checked when finished and exit HijackThis.

That should do it let me know how it's running after that.
Post #9
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI