[carofm]

Hi everyone

First of all, I would like to say that my mother tongue is not Engish, so I'll try to be as clear as possible about my problem.

For some days, when I wrote e-mails, there was a considerable delay between the time when I keyed the letters and the time when they appeared on the screen.

For some reason - too long to explain here and now - I thought my e-mails were being "read" or tracked or redirected. I then remembered an email I received some days ago and deleted it. I tried my webmail after doing so and now the text appears in real time (no delay).

1. Is it possible that someone had tried to access my webmail?
2. Could there be any connection between the delay, the email I deleted and my "feeling" that, in fact, my e-mails were being redirected, or was it just pure coincidence that, when I deleted that email, my webmail started working well again?

I'm certain it was not a problem with the webmail (gmail) as I have two gmail accounts and this happened in only one of them. The other has been working perfectly well.

Thanks for your help,
Caro

[MFDnNC]

Not sure - English is perfect

Post a hijack log to be safe


Click here to download HJTInstall.exe

• Save HJTInstall.exe to your desktop.
• Doubleclick on the HJTInstall.exe icon on your desktop.
• By default it will install to C:\Program Files\Trend Micro\HijackThis .
• Click on Install.
• It will create a HijackThis icon on the desktop.
• Once installed, it will launch Hijackthis.
• Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
• Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
• Come back here to this thread and Paste the log in your next reply.
• DO NOT have Hijackthis fix anything yet. Most of what it finds will be harmless or even required.

[carofm]

Thanks for your help and for your comment about my Engish!

I have a question for you, though. In the instructions, it says: "Copy and paste the log here". Which log?
It's not just my Eglish, it's also mu IT knowledge...

TKS for all,
Caro

[MFDnNC]

Hijack will, when you use scan and create a log, create a log in notepad - that is what you post here

[carofm]

Hi! This is what I got:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:41:05 p.m., on 03/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Archivos de programa\Archivos comunes\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Archivos de programa\Eset\nod32krn.exe
C:\Archivos de programa\Eset\nod32kui.exe
C:\Archivos de programa\Google\Gmail Notifier\gnotify.exe
C:\Archivos de programa\iTunes\iTunesHelper.exe
C:\Archivos de programa\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Archivos de programa\Huawei Technologies\Huawei SmartAX MT810\dslmon.exe
C:\Archivos de programa\iPod\bin\iPodService.exe
C:\Archivos de programa\Google\Gmail Notifier\gnotify.exe
C:\Archivos de programa\Internet Explorer\IEXPLORE.EXE
C:\Archivos de programa\Archivos comunes\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Archivos de programa\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer proporcionado por Windows uE
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Archivos de programa\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Archivos de programa\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: del.icio.us Toolbar Helper - {7AA07AE6-01EF-44EC-93CA-9D7CD41CCDB6} - C:\Archivos de programa\del.icio.us\Internet Explorer Buttons\dlcsIE.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: del.icio.us - {981FE6A8-260C-4930-960F-C3BC82746CB0} - C:\Archivos de programa\del.icio.us\Internet Explorer Buttons\dlcsIE.dll
O4 - HKLM\..\Run: [nod32kui] "C:\Archivos de programa\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Archivos de programa\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Archivos de programa\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Archivos de programa\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Archivos de programa\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICIO LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICIO LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide1] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICIO LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Servicio de red')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Servicio de red')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Global Startup: DSLMON.lnk = ?
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Referencia - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARCHIV~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.windowsue.com
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/...x/qtplugin.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1B3FD3BE-F7B9-4BF3-8D3F-1390D7164837}: NameServer = 200.45.191.35 200.45.191.40
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Archivos de programa\Archivos comunes\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Servicio del iPod (iPod Service) - Apple Inc. - C:\Archivos de programa\iPod\bin\iPodService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Archivos de programa\Eset\nod32krn.exe

--
End of file - 6020 bytes


I cannot answer your other email I cannot post PMS.

Thanks again,
Caro

[MFDnNC]

I see nothing - do this

Download Superantispyware (SAS) free home version

http://www.superantispyware.com/supe...freevspro.html

Install it and double-click the icon on your desktop to run it.
· It will ask if you want to update the program definitions, click Yes.
· Under Configuration and Preferences, click the Preferences button.
· Click the Scanning Control tab.
· Under Scanner Options make sure the following are checked:
o Close browsers before scanning
o Scan for tracking cookies
o Terminate memory threats before quarantining.
o Please leave the others as they were.
o Click the Close button to leave the control center screen.
· On the main screen, under Scan for Harmful Software click Scan your computer.
· On the left check C:\Fixed Drive.
· On the right, under Complete Scan, choose Perform Complete Scan.
· Click Next to start the scan. Please be patient while it scans your computer.
· After the scan is complete a summary box will appear. Click OK.
· Make sure everything in the white box has a check next to it, then click Next.
· It will quarantine what it found and if it asks if you want to reboot, click Yes.
· To retrieve the removal information for me please do the following:
o After reboot, double-click the SUPERAntispyware icon on your desktop.
o Click Preferences. Click the Statistics/Logs tab.
o Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
o It will open in your default text editor (such as Notepad/Wordpad).
o Please highlight everything in the notepad, then right-click and choose copy.
· Click close and close again to exit the program.
Please paste that information here for me regardless of what it finds with a new HijackThis log.

This will take some time!!!!!!!!

[carofm]

Hi MFDnNC.
Here it goes.
SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 10/04/2007 at 10:38 PM

Application Version : 3.9.1008

Core Rules Database Version : 3318
Trace Rules Database Version: 1319

Scan type : Complete Scan
Total Scan Time : 01:35:56

Memory items scanned : 365
Memory threats detected : 0
Registry items scanned : 4247
Registry threats detected : 0
File items scanned : 14522
File threats detected : 25

Adware.Tracking Cookie
C:\Documents and Settings\Administrador\Cookies\administrador@vhost.oddcast[2].txt
C:\Documents and Settings\Administrador\Cookies\administrador@imrworldwide[2].txt
C:\Documents and Settings\Administrador\Cookies\administrador@tribalfusion[2].txt
C:\Documents and Settings\Administrador\Cookies\administrador@2o7[2].txt
C:\Documents and Settings\Administrador\Cookies\administrador@fastclick[1].txt
C:\Documents and Settings\Administrador\Cookies\administrador@ads.e-planning[1].txt
C:\Documents and Settings\Administrador\Cookies\administrador@tripod[1].txt
C:\Documents and Settings\Administrador\Cookies\administrador@stpetersburgtimes.122.2o7[1].txt
C:\Documents and Settings\Administrador\Cookies\administrador@atdmt[1].txt
C:\Documents and Settings\Administrador\Cookies\administrador@mediaplex[1].txt
C:\Documents and Settings\Administrador\Cookies\administrador@revsci[2].txt
C:\Documents and Settings\Administrador\Cookies\administrador@advertising[1].txt
C:\Documents and Settings\Administrador\Cookies\administrador@msnportal.112.2o7[1].txt
C:\Documents and Settings\Administrador\Cookies\administrador@ads.pointroll[1].txt
C:\Documents and Settings\Administrador\Cookies\administrador@bs.serving-sys[2].txt
C:\Documents and Settings\Administrador\Cookies\administrador@tacoda[2].txt
C:\Documents and Settings\Administrador\Cookies\administrador@statcounter[1].txt
C:\Documents and Settings\Administrador\Cookies\administrador@zedo[1].txt
C:\Documents and Settings\Administrador\Cookies\administrador@questionmarket[1].txt
C:\Documents and Settings\Administrador\Cookies\administrador@ads.techguy[1].txt
C:\Documents and Settings\Administrador\Cookies\administrador@ds.clickexperts[1].txt
C:\Documents and Settings\Administrador\Cookies\administrador@superstats[1].txt
C:\Documents and Settings\Administrador\Cookies\administrador@ads.us.e-planning[1].txt
C:\Documents and Settings\Administrador\Cookies\administrador@casalemedia[1].txt
C:\Documents and Settings\Administrador\Cookies\administrador@serving-sys[1].txt

Thanks,
Caro

[MFDnNC]

All looks fine

[carofm]

Thanks a lot!
Caro