
Muchas gracias por vuestra respuesta, el HijackThis es una maravilla. Creo que he encontrado los molestosos.
El proceso roProcComms.exe pertenece al programa Visual Time de Robotics (comunicacion del servidor con los terminales de fichaje). Ya me puese en contacto con ellos y me han enviado una actualizacion.
El Log.exe parece un programa del UPS para guardar el historial de actividades a un archivo log. Ese archivo tenia, no se porque 105MB. Lo elimine y he cree uno nuevo. Del momento parece que va bien.
He pasado varios Antivirus y no han encontrado nada.
Egualmente te adjunto los logs del HijackThis, pero espero que ya todo esta bien.
Logfile of HijackThis v1.98.2
Scan saved at 10:05:32, on 01/09/2004
Platform: Windows 2000 SP2 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\termsrv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\llssrv.exe
C:\WINNT\system32\MGE\RunSC.exe
C:\WINNT\system32\MGE\PCtl.exe
C:\Archivos de programa\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\MGE\BIL.EXE
C:\WINNT\system32\MGE\CILRS232.EXE
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\Dfssvc.exe
C:\WINNT\System32\inetsrv\inetinfo.exe
E:\Robotics\VISUAL~1\Procs\roProcComms.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\Smtray.exe
C:\WINNT\System32\internat.exe
C:\Archivos de programa\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\LOGWIN32\EXES\LOGWIN32.EXE
C:\WINNT\system32\ntvdm.exe
E:\Robotics\VISUAL~1\System\VTConsole.exe
C:\HT\HijackThis.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://localhost/iisHelp/iis/misc/default.aspR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [PMXInit] C:\WINNT\System32\pmxinit.exe -SetupRunOnce
O4 - HKLM\..\Run: [Smapp] Smtray.exe
O4 - HKLM\..\RunOnce: [PMXInit] C:\WINNT\System32\pmxinit.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - Startup: Panel de Control Logic Win.LNK = C:\LOGWIN32\EXES\LOGWIN32.EXE
O4 - Startup: Protección Red.LNK = C:\LOGWIN32\EXES\logred95.exe
O4 - Global Startup: Opciones de inicio de VisualTime.lnk = E:\Robotics\VisualTime\System\VTLauncher.exe
O4 - Global Startup: Service Manager.lnk = C:\Archivos de programa\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O16 - DPF: {8AE2688B-025F-4F98-B164-4FA711A631C2} (lcAplisLWNet.lcAplisNet) -
https://soporte.logiccontrol.es/web/lcLWNet.CABO16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) -
http://www.pandasoftware.com/activescan/as5/asinst.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{1EC0A99D-AAB5-40A4-B148-5E0D64E1939B}: NameServer = 80.58.0.33,80.58.32.97
**************************************************************
StartupList report, 01/09/2004, 10:06:01
StartupList version: 1.52.2
Started from : C:\HT\HijackThis.EXE
Detected: Windows 2000 SP2 (WinNT 5.00.2195)
Detected: Internet Explorer v6.00 (6.00.2600.0000)
* Using default options
* Including empty and uninteresting sections
==================================================
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\termsrv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\llssrv.exe
C:\WINNT\system32\MGE\RunSC.exe
C:\WINNT\system32\MGE\PCtl.exe
C:\Archivos de programa\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\MGE\BIL.EXE
C:\WINNT\system32\MGE\CILRS232.EXE
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\Dfssvc.exe
C:\WINNT\System32\inetsrv\inetinfo.exe
E:\Robotics\VISUAL~1\Procs\roProcComms.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\Smtray.exe
C:\WINNT\System32\internat.exe
C:\Archivos de programa\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\LOGWIN32\EXES\LOGWIN32.EXE
C:\WINNT\system32\ntvdm.exe
E:\Robotics\VISUAL~1\System\VTConsole.exe
C:\HT\HijackThis.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
C:\WINNT\system32\MGE\Log.exe
--------------------------------------------------
Listing of startup folders:
Shell folders Startup:
[C:\Documents and Settings\paco\Menú Inicio\Programas\Inicio]
Panel de Control Logic Win.LNK = C:\LOGWIN32\EXES\LOGWIN32.EXE
Protección Red.LNK = C:\LOGWIN32\EXES\logred95.exe
Shell folders AltStartup:
*Folder not found*
User shell folders Startup:
*Folder not found*
User shell folders AltStartup:
*Folder not found*
Shell folders Common Startup:
[C:\Documents and Settings\All Users\Menú Inicio\Programas\Inicio]
Opciones de inicio de VisualTime.lnk = E:\Robotics\VisualTime\System\VTLauncher.exe
Service Manager.lnk = C:\Archivos de programa\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
Shell folders Common AltStartup:
*Folder not found*
User shell folders Common Startup:
*Folder not found*
User shell folders Alternate Common Startup:
*Folder not found*
--------------------------------------------------
Checking Windows NT UserInit:
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINNT\system32\userinit.exe,
[HKLM\Software\Microsoft\Windows\CurrentVersion\Winlogon]
*Registry key not found*
[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
*Registry value not found*
[HKCU\Software\Microsoft\Windows\CurrentVersion\Winlogon]
*Registry key not found*
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
PMXInit = C:\WINNT\System32\pmxinit.exe -SetupRunOnce
Smapp = Smtray.exe
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
PMXInit = C:\WINNT\System32\pmxinit.exe
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*No values found*
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
*Registry key not found*
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*Registry key not found*
--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
internat.exe = internat.exe
--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
*Registry key not found*
--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*Registry key not found*
--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
*Registry key not found*
--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*Registry key not found*
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*
--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
[OptionalComponents]
*No values found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
*No subkeys found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*No subkeys found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
*Registry key not found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*Registry key not found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
*No subkeys found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
*Registry key not found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*Registry key not found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
*Registry key not found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*Registry key not found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*
--------------------------------------------------
File association entry for .EXE:
HKEY_CLASSES_ROOT\exefile\shell\open\command
(Default) = "%1" %*
--------------------------------------------------
File association entry for .COM:
HKEY_CLASSES_ROOT\comfile\shell\open\command
(Default) = "%1" %*
--------------------------------------------------
File association entry for .BAT:
HKEY_CLASSES_ROOT\batfile\shell\open\command
(Default) = "%1" %*
--------------------------------------------------
File association entry for .PIF:
HKEY_CLASSES_ROOT\piffile\shell\open\command
(Default) = "%1" %*
--------------------------------------------------
File association entry for .SCR:
HKEY_CLASSES_ROOT\scrfile\shell\open\command
(Default) = "%1" /S
--------------------------------------------------
File association entry for .HTA:
HKEY_CLASSES_ROOT\htafile\shell\open\command
(Default) = C:\WINNT\System32\mshta.exe "%1" %*
--------------------------------------------------
File association entry for .TXT:
HKEY_CLASSES_ROOT\txtfile\shell\open\command
(Default) = %SystemRoot%\system32\NOTEPAD.EXE %1
--------------------------------------------------
Enumerating ICQ Agent Autostart apps:
HKCU\Software\Mirabilis\ICQ\Agent\Apps
*Registry key not found*
--------------------------------------------------
Load/Run keys from C:\WINNT\WIN.INI:
load=*INI section not found*
run=*INI section not found*
Load/Run keys from Registry:
HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\Windows: load=
HKCU\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=
--------------------------------------------------
Shell & screensaver key from C:\WINNT\SYSTEM.INI:
Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*
Shell & screensaver key from Registry:
Shell=Explorer.exe
SCRNSAVE.EXE=*Registry value not found*
drivers=*Registry value not found*
Policies Shell key:
HKCU\..\Policies: Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not found*
--------------------------------------------------
Enumerating Browser Helper Objects:
*No BHO's found*
--------------------------------------------------
Enumerating Task Scheduler jobs:
Cofinox Initial.job
CofinoxBackUp.job
daily backup.job
--------------------------------------------------
Enumerating Download Program Files:
[DirectAnimation Java Classes]
CODEBASE = file://C:\WINNT\Java\classes\dajava.cab
OSD = C:\WINNT\Downloaded Program Files\DirectAnimation Java Classes.osd
[Microsoft XML Parser for Java]
CODEBASE = file://C:\WINNT\Java\classes\xmldso.cab
OSD = C:\WINNT\Downloaded Program Files\Microsoft XML Parser for Java.osd
[lcAplisLWNet.lcAplisNet]
InProcServer32 = C:\WINNT\Downloaded Program Files\lcLWNet.ocx
CODEBASE =
https://soporte.logiccontrol.es/web/lcLWNet.CAB[ActiveScan Installer Class]
InProcServer32 = C:\WINNT\Downloaded Program Files\asinst.dll
CODEBASE =
http://www.pandasoftware.com/activescan/as5/asinst.cab[Shockwave Flash Object]
InProcServer32 = C:\WINNT\System32\macromed\flash\Flash.ocx
CODEBASE =
http://download.macromedia.com/pub/shockwa...ash/swflash.cab--------------------------------------------------
Enumerating Winsock LSP files:
NameSpace #1: C:\WINNT\System32\rnr20.dll
NameSpace #2: C:\WINNT\System32\winrnr.dll
Protocol #1: C:\WINNT\system32\msafd.dll
Protocol #2: C:\WINNT\system32\msafd.dll
Protocol #3: C:\WINNT\system32\msafd.dll
Protocol #4: C:\WINNT\system32\rsvpsp.dll
Protocol #5: C:\WINNT\system32\rsvpsp.dll
Protocol #6: C:\WINNT\system32\msafd.dll
Protocol #7: C:\WINNT\system32\msafd.dll
Protocol #8: C:\WINNT\system32\msafd.dll
Protocol #9: C:\WINNT\system32\msafd.dll
Protocol #10: C:\WINNT\system32\msafd.dll
Protocol #11: C:\WINNT\system32\msafd.dll
--------------------------------------------------
Enumerating Windows NT logon/logoff scripts:
*No scripts set to run*
Windows NT checkdisk command:
BootExecute = autocheck autochk *
Windows NT 'Wininit.ini':
PendingFileRenameOperations: *Registry value not found*
--------------------------------------------------
Enumerating ShellServiceObjectDelayLoad items:
Network.ConnectionTray: C:\WINNT\system32\NETSHELL.dll
WebCheck: C:\WINNT\System32\webcheck.dll
SysTray: stobject.dll
--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
*Registry key not found*
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
*Registry key not found*
--------------------------------------------------
End of report, 15.410 bytes
Report generated in 2,093 seconds
Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only
Muchas gracias y un saludo
mmkoala