Trojan Horse de mierd..

mira estos son los 4 archivos k tienen el virus:
Dc81.exe
exe2_2780[1].bin
windrv.dll
windrv.dll1

esos no se pueden borrar ya k kada 1 hace una tarea distinta.. x eso necesito k ne0x me diga k tarea hacen i si no se necesita la deshabilito i lo borro.

http://www.jotapeges.com/im.php?g=10/&n=HijackThis.JPG
kreo k te refieres a eso

StartupList report, 06/10/2004, 19:38:34
StartupList version: 1.52.2
Started from : C:\Documents and Settings\Eric!\Escritorio\HijackThis.EXE
Detected: Windows XP (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 (6.00.2600.0000)

• Using default options
• Including empty and uninteresting sections
  ==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Archivos de programa\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Archivos de programa\Archivos comunes\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Archivos de programa\Netropa\Multimedia Keyboard\MMKeybd.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Archivos de programa\Messenger Plus! 3\MsgPlus.exe
C:\Archivos de programa\Java\j2re1.4.2_05\bin\jusched.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Archivos de programa\Archivos comunes\Symantec Shared\ccApp.exe
C:\Archivos de programa\Logitech\MouseWare\system\em_exec.exe
C:\Archivos de programa\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe
C:\Archivos de programa\Netropa\Multimedia Keyboard\TrayMon.exe
C:\Archivos de programa\Netropa\Onscreen Display\OSD.exe
C:\WINDOWS\System32\tfnxmimj.exe
C:\Archivos de programa\Winamp\winampa.exe
C:\Archivos de programa\The Cleaner\tca.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Archivos de programa\BenQ\Common\Bin\WinCinemaMgr.exe
C:\Archivos de programa\Netropa\Multimedia Keyboard\nhksrv.exe
C:\WINDOWS\System32\alg.exe
C:\Archivos de programa\Norton SystemWorks\Norton Ghost\GhostStartService.exe
C:\Archivos de programa\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Archivos de programa\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\ARCHIV_1\NORTON1\SPEEDD_1\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Archivos de programa\MSN Messenger\msnmsgr.exe
C:\Archivos de programa\Winamp\Winamp.exe
C:\Archivos de programa\Internet Explorer\iexplore.exe
C:\Documents and Settings\Eric!\Escritorio\HijackThis.exe

---

Listing of startup folders:

Shell folders Startup:
[C:\Documents and Settings\Eric!\Menú Inicio\Programas\Inicio]
No files

Shell folders AltStartup:
Folder not found

User shell folders Startup:
Folder not found

User shell folders AltStartup:
Folder not found

Shell folders Common Startup:
[C:\Documents and Settings\All Users\Menú Inicio\Programas\Inicio]
InterVideo WinCinema Manager.lnk = C:\Archivos de programa\BenQ\Common\Bin\WinCinemaMgr.exe

Shell folders Common AltStartup:
Folder not found

User shell folders Common Startup:
Folder not found

User shell folders Alternate Common Startup:
Folder not found

---

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

[HKLM\Software\Microsoft\Windows\CurrentVersion\Winlogon]
Registry key not found

[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
Registry value not found

[HKCU\Software\Microsoft\Windows\CurrentVersion\Winlogon]
Registry key not found

---

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

Logitech Utility = Logi_MwX.Exe
MULTIMEDIA KEYBOARD = C:\Archivos de programa\Netropa\Multimedia Keyboard\MMKeybd.exe
SoundMan = SOUNDMAN.EXE
MessengerPlus3 = "C:\Archivos de programa\Messenger Plus! 3\MsgPlus.exe"
SunJavaUpdateSched = C:\Archivos de programa\Java\j2re1.4.2_05\bin\jusched.exe
NvCplDaemon = RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
nwiz = nwiz.exe /install
NvMediaCenter = RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
ccApp = C:\Archivos de programa\Archivos comunes\Symantec Shared\ccApp.exe
ccRegVfy = C:\Archivos de programa\Archivos comunes\Symantec Shared\ccRegVfy.exe
GhostStartTrayApp = C:\Archivos de programa\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe
NeroCheck = C:\WINDOWS\system32\NeroCheck.exe
CnxDslTaskBar = C:\Archivos de programa\Telefonica Kit ADSL USB\CnxDslTb.exe
ukpifxs = C:\WINDOWS\System32\tfnxmimj.exe
WinampAgent = C:\Archivos de programa\Winamp\winampa.exe
qlajgl = C:\WINDOWS\qlajgl.exe
tcactive = C:\Archivos de programa\The Cleaner\tca.exe
tcmonitor = C:\Archivos de programa\The Cleaner\tcm.exe
MSConfig = C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto

---

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce

AAW = "C:\Archivos de programa\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe" "+b1"

---

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

No values found

---

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

No values found

---

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

Registry key not found

---

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

CTFMON.EXE = C:\WINDOWS\System32\ctfmon.exe
Microsoft Update = mrarys.exe
MessengerPlus3 = "C:\Archivos de programa\Messenger Plus! 3\MsgPlus.exe" /WinStart
Steam = C:\Archivos de programa\Valve\Steam\Steam.exe -silent
Microsoft Update Machine = rhosstt.exe
MSMSGS = "C:\Archivos de programa\Messenger\msmsgs.exe" /background
STYLEXP = C:\Archivos de programa\TGTSoft\StyleXP\StyleXP.exe -Hide
msnmsgr = "C:\Archivos de programa\MSN Messenger\msnmsgr.exe" /background

---

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce

No values found

---

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

Registry key not found

---

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices

No values found

---

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

Registry key not found

---

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run

Registry key not found

---

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run

Registry key not found

---

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
No subkeys found

---

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
No subkeys found

---

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
No subkeys found

---

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
No subkeys found

---

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
Registry key not found

---

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
No subkeys found

---

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
No subkeys found

---

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
Registry key not found

---

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
No subkeys found

---

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
Registry key not found

---

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run
Registry key not found

---

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run
Registry key not found

---

File association entry for .EXE:
HKEY_CLASSES_ROOT\exefile\shell\open\command

(Default) = "%1" %*

---

File association entry for .COM:
HKEY_CLASSES_ROOT\comfile\shell\open\command

(Default) = "%1" %*

---

File association entry for .BAT:
HKEY_CLASSES_ROOT\batfile\shell\open\command

(Default) = "%1" %*

---

File association entry for .PIF:
HKEY_CLASSES_ROOT\piffile\shell\open\command

(Default) = "%1" %*

---

File association entry for .SCR:
HKEY_CLASSES_ROOT\scrfile\shell\open\command

(Default) = "%1" /S

---

File association entry for .HTA:
HKEY_CLASSES_ROOT\htafile\shell\open\command

(Default) = C:\WINDOWS\System32\mshta.exe "%1" %*

---

File association entry for .TXT:
HKEY_CLASSES_ROOT\txtfile\shell\open\command

(Default) = C:\WINDOWS\system32\dllcache\notepad.exe %1

---

Enumerating ICQ Agent Autostart apps:
HKCU\Software\Mirabilis\ICQ\Agent\Apps

Registry key not found

---

Load/Run keys from C:\WINDOWS\WIN.INI:

load=INI section not found
run=INI section not found

Load/Run keys from Registry:

HKLM..\Windows NT\CurrentVersion\WinLogon: load=Registry value not found
HKLM..\Windows NT\CurrentVersion\WinLogon: run=Registry value not found
HKLM..\Windows\CurrentVersion\WinLogon: load=Registry key not found
HKLM..\Windows\CurrentVersion\WinLogon: run=Registry key not found
HKCU..\Windows NT\CurrentVersion\WinLogon: load=Registry value not found
HKCU..\Windows NT\CurrentVersion\WinLogon: run=Registry value not found
HKCU..\Windows\CurrentVersion\WinLogon: load=Registry key not found
HKCU..\Windows\CurrentVersion\WinLogon: run=Registry key not found
HKCU..\Windows NT\CurrentVersion\Windows: load=
HKCU..\Windows NT\CurrentVersion\Windows: run=Registry value not found
HKLM..\Windows NT\CurrentVersion\Windows: load=Registry value not found
HKLM..\Windows NT\CurrentVersion\Windows: run=Registry value not found
HKLM..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=

---

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=INI section not found
SCRNSAVE.EXE=INI section not found
drivers=INI section not found

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\System32\logon.scr
drivers=Registry value not found

Policies Shell key:

HKCU..\Policies: Shell=Registry key not found
HKLM..\Policies: Shell=Registry value not found

---

Enumerating Browser Helper Objects:

(no name) - C:\Archivos de programa\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
(no name) - (no file) - {8BCD8C7A-689B-4102-83BE-1BD8D838313F}
(no name) - (no file) - {9C691A33-7DDA-4C2F-BE4C-C176083F35CF}
NAV Helper - C:\Archivos de programa\Norton SystemWorks\Norton AntiVirus\NavShExt.dll - {BDF3E430-B101-42AD-A544-FADC6B084872}
TGTSoft Explorer Toolbar Changer - C:\Archivos de programa\TGTSoft\StyleXP\TGT_BHO.dll - {C333CF63-767F-4831-94AC-E683D962C63C}

---

Enumerating Task Scheduler jobs:

Norton AntiVirus - Analizar el equipo.job
Norton SystemWorks One Button Checkup.job
Symantec NetDetect.job

---

Enumerating Download Program Files:

[{14A3221B-1678-1982-A355-7263B1281987}]
CODEBASE = ms-its:mhtml:file://C:\foo.mht!http://195.190.118.140/e9xr2.chm::/file.exe

[Symantec AntiVirus scanner]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\avsniff.dll
CODEBASE = http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab

[Symantec RuFSI Utility Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\rufsi.dll
CODEBASE = http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab

[PremiumHTML Class]
InProcServer32 = C:\WINDOWS\DOWNLO_1\IBEROD1.DLL
CODEBASE = http://213.254.243.5/data/dialercab/IberoDialerHTML.cab

[Java Plug-in 1.4.2_05]
InProcServer32 = C:\Archivos de programa\Java\j2re1.4.2_05\bin\npjpi142_05.dll
CODEBASE = http://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab

[xgaLauncher.ctlxgaLauncher]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\xgaLauncher.ocx
CODEBASE = http://62.81.63.147/aa/cabinet/xgaLauncher.CAB

[Java Plug-in 1.4.2_05]
InProcServer32 = C:\Archivos de programa\Java\j2re1.4.2_05\bin\npjpi142_05.dll
CODEBASE = http://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\System32\macromed\flash\Flash.ocx
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

---

Enumerating Winsock LSP files:

NameSpace #1: C:\WINDOWS\System32\mswsock.dll
NameSpace #2: C:\WINDOWS\System32\winrnr.dll
NameSpace #3: C:\WINDOWS\System32\mswsock.dll
Protocol #1: C:\WINDOWS\system32\mswsock.dll
Protocol #2: C:\WINDOWS\system32\mswsock.dll
Protocol #3: C:\WINDOWS\system32\mswsock.dll
Protocol #4: C:\WINDOWS\system32\rsvpsp.dll
Protocol #5: C:\WINDOWS\system32\rsvpsp.dll
Protocol #6: C:\WINDOWS\system32\mswsock.dll
Protocol #7: C:\WINDOWS\system32\mswsock.dll
Protocol #8: C:\WINDOWS\system32\mswsock.dll
Protocol #9: C:\WINDOWS\system32\mswsock.dll
Protocol #10: C:\WINDOWS\system32\mswsock.dll
Protocol #11: C:\WINDOWS\system32\mswsock.dll
Protocol #12: C:\WINDOWS\system32\mswsock.dll
Protocol #13: C:\WINDOWS\system32\mswsock.dll
Protocol #14: C:\WINDOWS\system32\mswsock.dll
Protocol #15: C:\WINDOWS\system32\mswsock.dll

---

Enumerating Windows NT logon/logoff scripts:
No scripts set to run

Windows NT checkdisk command:
BootExecute = autocheck autochk *

Windows NT 'Wininit.ini':
PendingFileRenameOperations: C:\WINDOWS\System32\xplugin.dll => C:\DOCUME_{1\Eric!\CONFIG}1\Temp\temp.fr5168|C:\WINDOWS\mxTarget.dll => C:\DOCUME_{1\Eric!\CONFIG}1\Temp\temp.frB8A6|C:\DOCUME_{1\Eric!\CONFIG}1\Temp\THIA79.tmp\mxTarget.dll => C:\DOCUME_{1\Eric!\CONFIG}1\Temp\temp.fr1653|C:\DOCUME_{1\Eric!\CONFIG}1\Temp\dummy.htm => C:\DOCUME_{1\Eric!\CONFIG}1\Temp\temp.fr5A01|C:\WINDOWS\System32\xplugin.dll => C:\DOCUME_{1\Eric!\CONFIG}1\Temp\temp.fr5808||\

---

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\System32\webcheck.dll
SysTray: C:\WINDOWS\System32\stobject.dll

---

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

Registry key not found

---

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

Registry key not found

---

End of report, 17.993 bytes
Report generated in 0,047 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

pues e notado k el inet me baja 1 pelin mas lento y ke me da varios errores de windows.. antes me daba error del WindowsInstaller i de otra cosa k no recuerdo..pero ya no..

si, me dice k tngo 4 arxivos infectados de Trojan Horse.. esos k dije antes..:S!

#14 Tan clarísimo como que la base de datos de HisjackThis, y google no tienen reconocidos esos archivos como "gusanos".

#14 Tan clarísimo como que la base de datos de HisjackThis, y google no tienen reconocidos esos archivos como "gusanos".

#1 Bájate el The Cleaner, es una utilidad q busca y limina troyanos, ejecútala y vamos hablando.

http://www.moosoft.com/thecleaner/cleaner41.exe