Hola! Muchas gracias por contestar. He pasado el Spy Sweeper y me ha detectado 6 problemas que he elimando tal y como ponia en el post. Mi ratón sigue haciendo lo mismo. Aqui está el log del SPy Sweeper y luego el del HijackThis:
********
15:36: | Start of Session, domingo, 04 de diciembre de 2005 |
15:36: Spy Sweeper started
15:36: Sweep initiated using definitions version 556
15:36: Starting Memory Sweep
15:44: Memory Sweep Complete, Elapsed Time: 00:07:30
15:44: Starting Registry Sweep
15:44: Found Adware: altnet
15:44: HKCR\clsid\{3f4d4f88-0198-4921-b630-957f3eb814e0}\ (1 subtraces) (ID = 103460)
15:44: HKCR\clsid\{3646c2bd-3554-49ca-8125-44deefb881de}\ (1 subtraces) (ID = 103462)
15:44: HKLM\software\classes\clsid\{b7156514-a76c-4545-9d5b-a4e1d02c7aec}\ (23 subtraces) (ID = 103494)
15:44: Found Adware: topsearch
15:44: HKCR\clsid\{b7156514-a76c-4545-9d5b-a4e1d02c7aec}\ (23 subtraces) (ID = 143925)
15:44: HKLM\software\classes\topsearch.tslink\ (5 subtraces) (ID = 143926)
15:44: HKLM\software\classes\topsearch.tslink.1\ (3 subtraces) (ID = 143927)
15:44: HKLM\software\classes\typelib\{edd3b3e9-3ffd-4836-a6de-d4a9c473a971}\ (9 subtraces) (ID = 143928)
15:44: HKCR\topsearch.tslink\ (5 subtraces) (ID = 143929)
15:44: HKCR\typelib\{edd3b3e9-3ffd-4836-a6de-d4a9c473a971}\ (9 subtraces) (ID = 143930)
15:44: Found Adware: rx toolbar
15:44: HKCR\rxresult.rxresultfilter\ (3 subtraces) (ID = 729537)
15:44: HKCR\rxresult.rxresultfilter\clsid\ (1 subtraces) (ID = 729539)
15:44: HKCR\rxresult.rxresultfilter.1\ (3 subtraces) (ID = 729541)
15:44: HKCR\rxresult.rxresultfilter.1\clsid\ (1 subtraces) (ID = 729543)
15:44: HKCR\rxresult.rxresulttracker\ (3 subtraces) (ID = 729545)
15:44: HKCR\rxresult.rxresulttracker\clsid\ (1 subtraces) (ID = 729547)
15:44: HKCR\rxresult.rxresulttracker.1\ (3 subtraces) (ID = 729549)
15:44: HKCR\rxresult.rxresulttracker.1\clsid\ (1 subtraces) (ID = 729551)
15:44: HKCR\clsid\{2ab289ae-4b90-4281-b2ae-1f4bb034b647}\ (10 subtraces) (ID = 729553)
15:44: HKCR\typelib\{05563f82-69a7-40a6-8670-153b635a7ef6}\ (9 subtraces) (ID = 729573)
15:44: HKLM\software\rxresults\ (5 subtraces) (ID = 729611)
15:44: HKLM\software\classes\rxresult.rxresultfilter\ (3 subtraces) (ID = 729616)
15:44: HKLM\software\classes\rxresult.rxresultfilter\clsid\ (1 subtraces) (ID = 729618)
15:44: HKLM\software\classes\rxresult.rxresultfilter.1\ (3 subtraces) (ID = 729620)
15:44: HKLM\software\classes\rxresult.rxresultfilter.1\clsid\ (1 subtraces) (ID = 729622)
15:44: HKLM\software\classes\rxresult.rxresulttracker\ (3 subtraces) (ID = 729624)
15:44: HKLM\software\classes\rxresult.rxresulttracker\clsid\ (1 subtraces) (ID = 729626)
15:44: HKLM\software\classes\rxresult.rxresulttracker.1\ (3 subtraces) (ID = 729628)
15:44: HKLM\software\classes\rxresult.rxresulttracker.1\clsid\ (1 subtraces) (ID = 729630)
15:44: HKLM\software\classes\clsid\{2ab289ae-4b90-4281-b2ae-1f4bb034b647}\ (10 subtraces) (ID = 729632)
15:44: HKLM\software\classes\typelib\{05563f82-69a7-40a6-8670-153b635a7ef6}\ (9 subtraces) (ID = 729652)
15:44: Found Adware: 180search assistant/zango
15:44: HKU\WRSS_Profile_S-1-5-21-746137067-2111687655-1060284298-501\software\saap\ (19 subtraces) (ID = 135784)
15:45: Registry Sweep Complete, Elapsed Time:00:00:58
15:45: Starting Cookie Sweep
15:45: Found Spy Cookie: outster cookie
15:45: mi pc@outster[1].txt (ID = 3103)
15:45: Cookie Sweep Complete, Elapsed Time: 00:00:00
15:45: Starting File Sweep
15:45: c:\archivos de programa\rxtoolbar (1 subtraces) (ID = -2147476417)
15:45: admdloader.dll (ID = 49786)
15:45: admfdi.dll (ID = 49789)
15:46: asmend.exe (ID = 49803)
15:46: admdata.dll (ID = 49784)
15:46: altnetuninstall.exe (ID = 49794)
15:46: admprog.dll (ID = 49790)
15:48: dminfo3.cab (ID = 49823)
15:48: jsinstall.cab (ID = 49835)
15:48: help.xml (ID = 49830)
15:48: setup.cab (ID = 49872)
15:49: topsearch.dll (ID = 79735)
15:49: skin.xml (ID = 49876)
15:49: altnet.css (ID = 49792)
15:49: points manager.exe.manifest (ID = 49859)
15:49: local_firstuse.html (ID = 49844)
15:49: local_points.html (ID = 49846)
15:50: local_redeem.html (ID = 49846)
15:50: dminstall7.cab (ID = 49829)
15:50: local_start.html (ID = 49844)
15:50: sysdetect.dll (ID = 49877)
15:51: local_wallet.html (ID = 49846)
15:51: message.xml (ID = 49847)
15:52: selectdir.txt (ID = 49864)
15:52: selectdir1st.txt (ID = 49865)
15:52: Found Adware: java byteverify
15:52: jar.jar-66a18b46-7811c4ff.zip (ID = 64824)
15:52: Warning: Unhandled Archive Type
15:58: File Sweep Complete, Elapsed Time: 00:13:20
15:58: Full Sweep has completed. Elapsed time 00:21:58
15:58: Traces Found: 232
15:59: Removal process initiated
16:00: Quarantining All Traces: 180search assistant/zango
16:00: Quarantining All Traces: altnet
16:00: Quarantining All Traces: java byteverify
16:00: Quarantining All Traces: rx toolbar
16:00: Quarantining All Traces: topsearch
16:00: Quarantining All Traces: outster cookie
16:00: Removal process completed. Elapsed time 00:00:44
********
15:31: | Start of Session, domingo, 04 de diciembre de 2005 |
15:31: Spy Sweeper started
15:33: There is a problem reaching the server. The cause may be in your connection, or on the server. Please try again later.
15:36: | End of Session, domingo, 04 de diciembre de 2005 |
Y el del Hijack THIS:
Logfile of HijackThis v1.99.1
Scan saved at 16:01:51, on 04/12/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Archivos de programa\SinEspias\no-spy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Archivos de programa\Messenger\msmsgs.exe
C:\Archivos de programa\Microsoft Encarta\Biblioteca de Consulta Encarta 2005\EDICT.EXE
C:\Archivos de programa\Internet Explorer\iexplore.exe
C:\Archivos de programa\Webroot\Spy Sweeper\SpySweeper.exe
C:\Archivos de programa\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Documents and Settings\MI PC\Escritorio\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.es
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.google.es/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.es
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.google.es/R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Archivos de programa\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O4 - HKLM\..\Run: [Zone Labs Client] C:\Archivos de programa\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [Sin Espias] C:\Archivos de programa\SinEspias\No-Spy.exe /autorun
O4 - HKLM\..\Run: [stnospy] C:\Archivos de programa\SinEspias\no-spy.exe /autorun
O4 - HKLM\..\Run: [SpySweeper] "C:\Archivos de programa\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Archivos de programa\Messenger\msmsgs.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Archivos de programa\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Investigador - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\Encarta Researcher\EROPROJ.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) -
http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cabO16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) -
http://messenger.zone.msn.com/binary/MineS...er.cab31267.cabO16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) -
http://by14fd.bay14.hotmail.msn.com/resources/MsnPUpld.cabO16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) -
http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cabO16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) -
http://www.pandasoftware.com/activescan/as5free/asinst.cabO16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) -
http://messenger.msn.com/download/MsnMesse...pDownloader.cabO18 - Filter hijack: Class Install Handler - (no CLSID) - (no file)
O18 - Filter hijack: deflate - (no CLSID) - (no file)
O18 - Filter hijack: gzip - (no CLSID) - (no file)
O18 - Filter hijack: lzdhtml - (no CLSID) - (no file)
O18 - Filter hijack: text/webviewhtml - (no CLSID) - (no file)
O20 - Winlogon Notify: reset5 - reset5.dll (file missing)
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Reset 5 - Unknown owner - C:\WINDOWS\system32\srvany.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Archivos de programa\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Ahi están, veis algo raro? A lo mejor lo que causa mi problema de aparición de ventanas y eso no es un Spyware sino un Troyano o otra cosa no? No tengo ni idea de lo que puede ser :( Bueno muchas gracias