Some of the controls on this property sheet are disabled

"Some of the controls on this property sheet are disabled because one or more other Network property sheets are already open. To use these controls, close all these property sheets and then reopen this one"
Source
Source
Steps to reproduce:

1. Open “network connections” from the control panel.
2. Right click on “Local Area Connection” and click “properties”

Resolution:

1. Download drivers for your current network card.
2. Uninstall all your network cards from (Control panel->System->Device manager)
3. Restart your computer.
4. Let windows attempt to install your network card for you. If windows can not find the correct network card drivers use the one you downloaded in step 1.

If you are still having problems you could try;

• Uninstall all network related applications, eg HP wireless assistant, HP wlan assistant, ect…
• Uninstall all virtual machine applications, eg VMWare, Virtual box, ect…

Source
Are you opening the Local Area Connection so the Status Window is open? or just Right clicking the Local Area Connection? Are you logged in as a limited user or as an Administrator user? Enable the Hidden Administrator account and log out of the user profile your in and log in as Admin and see if it works there. then check your user account for restrictions. 
------

---

Try this: http://www.chicagotech.net/netforums...t=3921&start=

Source
Based on my research, the issue is usually caused by an aborted NIC driver
installation process which leaves a registry value under the following key:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
I suggest you try the following steps to delete the registry value:
1. Click Start, type regedit in the Start Search box and press Enter.
2. Navigate to the following key:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
3. Right click RunOnce and select Export to make a backup.
4. In the right pane, delete the value referenced to rundll32.
5. Quit Registry Editor.
Then, restart the computer to test the issue.
If the issue persists, please reinstall the NIC driver to check the result.
Source
Here's what happened, if you want to know. When I attempted to set the NetBEUI protocol up McAfee Firewall locked me out. I did not know you had setup McAfee to allow different protocols. This is an off the shelf version and all other devices use Enterprise version. ANYWAY, I knew the install was not complete so I searched the registry for "install" and found 3 items 2 were queues in waiting and the other was in HKLM, software, MS, windows, current version, runonce. Deleted that, rebooted and voila! I was back in control.

Can't open Word by clicking on documents

Problem with command-line switches: Can't open Word by clicking on documents

Using Windows 7 64-bit.
When I click a Word document in Explorer or on the Start menu, I get the error "There was a problem sending the command to the program". I'm using Word 2003, but I don't get this problem with Excel 2003.
I know that when I try to open a document this way, the program uses the command switches "/n" -- which means "open a new instance of Word", -- and "/dde" -- which I don't know what it means. I do know that I don't want the /n switch.
1) How can I remove the /n switch? Remember, I'm not clicking on a shortcut, but on a document icon. I know how to assign the "Open With" command, but I don't see any options about changing command-line switches.
2) Is the /dde switch causing my problem? How do I remove it? 

Compatibility mode doesn't seem to make a difference.
This doesn't happen with Excel 2003, or with any version of Office 2007. I'm sure this has something to do with how I associated .doc files to Word 2003: I'm guessing that it added the switches, and they're causing the problem. I wish I knew how to change the switches.

List of open ports in a OS

Source
Linux distributions
As with FreeBSD, the obvious choice of tool to use for listing open ports is netstat. Most Linux distributions use a different version of the utility, however — maintained separately from the Linux distribution, as an independent software development project.One consequence of that fact is that the command line options used to achieve the same results may be different with FreeBSD than with Debian, Ubuntu, or Fedora Core Linux systems. On a typical Linux system, this command will list open network ports and the processes that own them:

  netstat -lnptu

The output should look something like this:

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address   Foreign Address  State   PID/Program name
tcp        0      0 127.0.0.1:631   0.0.0.0:*        LISTEN  2458/cupsd
tcp        0      0 127.0.0.1:5432  0.0.0.0:*        LISTEN  2353/postgres
tcp6       0      0 :::22           :::*             LISTEN  2335/sshd
udp        0      0 0.0.0.0:631     0.0.0.0:*                2458/cupsd

As you can see from this output, the Debian GNU/Linux system on which I ran that command has only four open ports — two for CUPS, so that the computer can communicate with the network printer; one for PostgreSQL so that it can be contacted by applications in development; SSH, so that I can access it remotely, from my laptop.

Microsoft Windows XP Microsoft Windows also offers a netstat command that can be executed from the command line to get a list of open ports. The standard MS Windows version of netstat is slightly more limited than its Unix-like system counterparts, but still suffices to get a listing of listening services:

  netstat -a | find "LISTENING"

The output of this command should look something like this:

TCP    hostname:epmap           hostname:0               LISTENING
TCP    hostname:microsoft-ds    hostname:0               LISTENING
TCP    hostname:10110           hostname:0               LISTENING
TCP    hostname:netbios-ssn     hostname:0               LISTENING

. . . with “hostname” replaced by the system’s hostname, of course.
================
Source

the following command will list all ports in use on the machine:

netstat -a

The output contains the protocol, local address, foreign address and current state
Netstat documentation on microsoft.com
--------------

Designed for testing ports:
Portqry.exe
"Portqry.exe is a command-line utility that you can use to help troubleshoot TCP/IP connectivity issues. Portqry.exe runs on Windows 2000-based computers, on Windows XP-based computers, and on Windows Server 2003-based computers. The utility reports the port status of TCP and UDP ports on a computer that you select. "
Portqry.exe reports the status of a TCP/IP port in one of the following three ways:

• Listening
  
  A process is listening on the port on the computer that you selected. Portqry.exe received a response from the port.
• Not Listening
  
  No process is listening on the target port on the target system. Portqry.exe received an Internet Control Message Protocol (ICMP) "Destination Unreachable - Port Unreachable" message back from the target UDP port. Or if the target port is a TCP port, Portqry received a TCP acknowledgement packet with the Reset flag set.
• Filtered
  
  The port on the computer that you selected is being filtered. Portqry.exe did not receive a response from the port. A process may or may not be listening on the port. By default, TCP ports are queried three times, and UDP ports are queried one time before a report indicates that the port is filtered.

Portqry.exe can query a single port, an ordered list of ports, or a sequential range of ports.
Examples 

The following command tries to resolve "reskit.com" to an IP address and then queries TCP port 25 on the corresponding host:

portqry -n reskit.com -p tcp -e 25

The following command tries to resolve "169.254.0.11" to a host name and then queries TCP ports 143,110, and 25 (in that order) on the host that you selected. This command also creates a log file (Portqry.log) that contains a log of the command that you ran and its output.

portqry -n 169.254.0.11 -p tcp -o 143,110,25 -l portqry.log

The following command tries to resolve my_server to an IP address and then queries the specified range of UDP ports (135-139) in sequential order on the corresponding host. This command also creates a log file (my_server.txt) that contains a log of the command that you ran and its output.

portqry -n my_server -p udp -r 135:139 -l my_server.txt

Portqry.exe is available for download from the Microsoft Download Center. To download Portqry.exe, visit the following Microsoft Web site: 

http://www.microsoft.com/downloads/details.aspx?familyid=89811747-C74B-4638-A2D5-AC828BDC6983&displaylang=en

---------------

telnet [ipaddress] [portnumber]
Fill in the address/port. If you connect, you know the port is open, assuming it's a TCP service. Doesn't work for UDP
You could also use nmap to see all of the open ports on a given machine.

Desktop Earth

Source
Desktop Earth is a wallpaper generator for Windows. It runs whenever you're logged on and updates your wallpaper with an accurate representation of the Earth as it would be seen from space at that precise moment.
Day and night is accurately represented depending on the Sun's overhead position (which depends on both the time of day and the day of the year) and both the snow cover and the foliage changes with the seasons.
Images are created from high-resolution textures (2560x1280) so it's perfect for that QSXGA display.
An image is generated every month to accurately depict snow and foliage changes, and the night view is simply stunning.
If you just want to stick with one view of the earth, there is a huge stash of wallpapers in the install directory that can be used permanently without being connected to the internet or having Desktop Earth installed.

Best Free Security List

Source
This huge list of free computer security products and services has been compiled over several years and is continuously updated.
The purpose of the list is to provide a comprehensive documentation of the security products available rather than specific recommendations.  If you are seeking recommendations then check out our comparative reviews of security products (links to them are shown in the list with ) or view the personal suggestions of the list authors at the end of the list. We also offer free personalized security advice via our Security Wizard.
The products on this list are almost exclusively free with a few exceptions. These include useful products without a free alternative that offer lifetime licenses or products of outstanding merit.
If you are looking for a particular type of product use the index table below to go to the appropriate page. If you simply want to browse the list then click the link at the top of the index to view the list as a single huge page.
Note that in some cases the links in the list point to executables. In such cases replace [dot] with . and the link will work.
We encourage you to use the comments section below to let us know about dead or incorrect links, suggest products that could be added or simply to tell us about your experience with particular products. We really value these suggestions and look carefully at each one. Sometimes this takes a little time but rest assured your comments will be noted.
Disclaimer:  We have tried to make sure that all links are legitimate. So in case of  a "detection" by your antivirus the most likely explanation is it being a false positive. However, as cybercriminals compromise multitude of web sites daily, we would like to be informed for any potentially malicious links. Some of these programs may also harm your PC if they are misused. You use any of the applications at your own risk.
Alias: http://tinyurl.com/free-security   http://bit.ly/DQNn0   http://goo.gl/nw5c

Probably the Best Free Security List in the World - Page Index (or click here to view as one huge page)
1. Introduction / Keys / What's New 2. Realtime Protection 3. Scanners 4. Malware Removal Tools 5. Online Scanners 6. Firewalls 7. HIPS 8. System Hardening-HIPS 9. System Hardening	10. Sandboxing / Virtualization 11. Vulnerability Scanning 12. Browser Security 13. IP-Blocking/Hardening 14. Privacy 15. System Monitoring 16. Network Traffic Monitoring 17. System Cleaning	18. Data Rescue 19. Encrypting 20. Backup 21. System Rescue 22. Miscellaneous 23. Tests & Analysis Tools 24. Vista/Windows 7 Security 25. My Choices and More

Security Tool

Como-eliminar-un-virus-troyano
es.kioskea.net/forum/affich-273897-como-desinstalo-security-tool
Security Tool es un rogue que muestra falsas alertas de seguridad con el fin de hacernos descargar un falso antivirus. Si lo descargamos, nos hará creer que está escaneando el sistema y nos mostrará falsos informes indicandonos que todos nuestros programas están infectados. Este rogue no permite ejecutar ningún programa incluyendo las herramientas de desinfección.
¿Cómo se contrae esta infección?
Al descargar falsos codecs para reproducir videos pornográficos, a través de cracks y mediante exploits en las páginas web.
En un informe de Hijackthis, podemos reconocer a Security Tool por estas líneas:
O4 - HKLM\..\Run: [61385932] C:\DOCUME~1\ALLUSE~1\APPLIC~1\61385932\61385932.exe
O4 - HKCU\..\Run: [79512125] C:\ProgramData\79512125\79512125.exe
O4 - HKLM\..\Run: [54264728] C:\ProgramData\54264728\54264728.exe
O4 - HKCU\..\Run: [Minisoft] C:\Users\Boudard\AppData\Local\Temp\50549.exe

Redireccionamiento de sitios web

Fuente

Fuente 
Eliminar Malware
 

Si algún paso no pudieses realizar, sáltalo
.- Descarga, Instala y/o actualiza estos programas: (pero no los ejecutes aun).

• Malwarebytes' Anti-Malware
• CCleaner

.- Desconectar de internet
Reiniciar e iniciar en "Modo a prueba de fallos" (modo seguro)
.- Malwarebytes' Antimalware (Ver Manual)

• Actualizalo desde su pestaña Actualizar.
• En su opción de Análisis Completo.
• Al terminar presionas Mostrar Resultados.
• Despues, verificas que todo este seleccionado y pulsas "Eliminar Seleccionados"
• Cuando te indique aceptas el reinicio del sistema.
• El reporte esta en la Pestaña Registros

.- Ccleaner (Ver Manual)

• En su opcion "Limpiador" pulsas Ejecutar el Limpiador.
• Luego usa su opción "Registro" pulsas Buscar Problemas, Despues Reparar Seleccionados y

Por ultimo Reparar todas las seleccionadas (haciendo copia de seguridad).
.- Reinicia en Modo Normal y comprueba cómo funciona el sistema.
.-Realice un escaneo con Panda Active Scan 2.0 siguiendo su Manual de Panda ActiveScan 2.0 (NO interferirá con tu antivirus)==================
1.- Descarga y ejecuta OTM by OldTimer:

• Haz doble clic sobre el archivo OTM.exe para ejecutarlo
• Pega el siguiente codigo bajo el area "Paste Instructions for items to be Moved"
  
  Código:

  :Files
  c:\users\user\downloads\opensebj-0-11i (1).exe
  c:\users\user\downloads\opensebj-0-11i.exe
  c:\users\user\downloads\dsc93673 (1).zip
  c:\users\user\downloads\dsc93673.zip
  
  :Commands
  [RESETHOSTS]
  [EMPTYFLASH]
  [EMPTYTEMP]
  [REBOOT]

• Presiona el boton rojo MoveIt!
• Espera hasta cuando el resultado aparezca en el marco Results.
• Permite que se Reinicie el equipo, esto es importante.

2.- Descarga TDSSKiller y ejecútalo como indica su Manual.

• Antes desconecta el ordenador de Internet o apaga el Modem.

3.- Pegas los reportes de OTM y TDSSKiller en la siguiente respuesta.
====================
1.- Descargando y ejecuta iniRem by InfoSpyware, lo descomprimes al escritorio.

• Doble Clic en el archivo IniRem 3.0.exe
• Ingresar la pagina de inicio que desee tener y marque las casillas de Internet Explorer y/o Firefox.
• Presionar en el texto botón del programa “Desbloquear”
• Haces clic en el botón Restaurar archivo hosts.

b)
1.- Muy importante: en primer lugar desconecte el ordenador de Internet.
2.- En la parte trasera del Modem vera un pequeña ranura al lado del botón de apagado; Dicho botón se utiliza para retesar al mismo introduciendo un objeto puntiagudo. Procede a resetearl
3.- Restablecer los parametros de navegacion/ configuración de DNS de la conexión a Internet:

• Vaya a Inicio -> Panel de control -> Haga doble clic en redes e internet -> Redes y recursos compartidos-> Cambiar configuración del adaptador
• Haga clic derecho sobre la conexión por defecto (en Conexión de área local o general, la conexión de red inalámbrica) y seleccione Propiedades.
• Haga doble clic en Protocolo Internet (TCP / IPv4).
• En la pestaña General:
• Seleccione "Obtener una dirección IP automáticamente".
• Seleccione "Obtener la dirección del servidor DNS automáticamente".
• Haga clic en Aceptar dos veces para guardar la configuración.
• Reinicie si tiene que cambiar cualquier configuración

4.- Renovar el caché de DNS:

• Haga clic en de Inicio -> haga clic en Ejecutar
• En la ventana de comandos de copia / pega el siguiente texto:
  
  Código:

  ipconfig /flushdns

• A continuación, pulsa enter. Salga de la ventana de comandos.

5.- Vuelva a conectar: Una vez que haya seguido todos los pasos anteriores puede volver a conectar su ordenador a Internet. ====================
====================
el pc está limpio de infección
Realiza lo siguiente:

Descargar DDS.pif desde aquí y guardarla en su escritorio de Windows.

• Si usas Firefox dale clic derecho y selecciona Guardar Como
• Si falla lo anterior --> descarga DDS.scr

Deshabilite cualquier bloqueador de script y a continuación, haga doble clic en dds.pif para ejecutar la herramienta y espere pacientemente el reporte.

• Cuando haya terminado, DDS, se abrirá dos (2) los reportes:

1. DDS.txt
2. Attach.txt

En la próxima respuesta:
Pega los reportes llamados DDS.txt y Attach.txt
==================
Lop S & D (manual):

1. Haz doble clic en LopSD.exe
2. Elige el idioma escribiendo la letra correspondiente y pulsa en Enter
   
3. Haz clic en "Aceptar (Ok)" en la ventana informativa
4. Haz clic en 2 para elegir la opción "2 (Fix + Hosts)" y a continuación pulsa en Enter
5. Espera hasta el final de la exploración
6. Se generará un informe, pega el contenido del mismo en tu próxima respuesta.
7. (La copia del informe se puede encontrar en esta ubicación: %SystemDrive%\lopR.txt, en la mayoría de los casos en C:\lopR.txt).

Ejecutas Ccleaner --> Herramientas --> Inicio y dar a:

a)Desactivar a las siguientes entradas:

Código:

Si HKCU:Run msnmsgr "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background

Si HKCU:Run ares "C:\Program Files (x86)\Ares\Ares.exe" -h

Si HKLM:Run IAStorIcon C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe

Si HKLM:Run Adobe Reader Speed Launcher "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"

Si HKLM:Run BackupManagerTray "C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" -h -k

Si HKLM:Run LManager C:\Program Files (x86)\Launch Manager\LManager.exe

Si HKLM:Run Adobe ARM "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

Si HKLM:Run SynTPEnh %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe

Si HKLM:Run PLFSetI C:\Windows\PLFSetI.exe

Si HKLM:Run IgfxTray C:\Windows\system32\igfxtray.exe

Si HKLM:Run HotKeysCmds C:\Windows\system32\hkcmd.exe

Si HKLM:Run Persistence C:\Windows\system32\igfxpers.exe

Cita:

Cualquiera de estas entradas puedes reactivarlas yendo a Ccleaner -> Herramientas -> Inicio, seleccionándola y dando a -> Activar

b) No olvides reiniciar para que los cambios surtan efecto

Con Revo Uninstaller y siguiendo su manual; busca si están y desinstala las siguientes aplicaciones:

Cita:

Avira AntiVir Personal - Free Antivirus --> recomendaría sustituirlo por avast! Bing Bar eBay Worldwide --> si no haces uso de él McAfee Internet Security Suite MyWinLocker MyWinLocker Suite --> si no haces uso de ambos Norton Online Backup --> si no haces uso de él

Haz uso de las siguientes herramientas específicas de desinstalación de antivirus:

Cita:

>> Si decides cambiar Avira por avast!:



Avira no dispone de una herramienta específica para desinstalar el programa, pero si tenemos problemas a la hora de querer instalar otro antivirus si que disponemos de Avira AntiVir RegistryCleaner, es una utilidad que una vez hayamos desinstalado este antivirus nos servirá para eliminar todos las claves del registro que Avira haya dejado en el PC.

• Descarga de Avira AntiVir RegistryCleaner

• Descarga de MCPR

>> Haz uso de AppRemover para eliminar restos de otros antivirus salvo Malwarebytes' o Avira (si no deseas cambiarlo)



Una buena alternativa gratuita para desinstalar correctamente todo tipo de programas de seguridad tales como antivirus, antispywares, antimalwares y demás se trata de AppRemover
AppRemover. Desinstala prog

Recycler virus

Eliminar y evitar reinfecciones de virus Recycler

1. Abrir una consola de comandos (cmd.exe)
2. Finalizar el proceso del explorador (explorer.exe):
   taskkill /f /im explorer.exe
3. Tipear:
   cd \Recycler
4. Quitar los atributos de la carpeta \S-1-5-21-1482476501-1644491937-682003330-1013\ con el comando:
   attrib -h -r -s S-1-5-21-1482476501-1644491937-682003330-1013
5. Renombrar la carpeta, una forma bien simple de arruinarle los planes a este virus:
   ren S-1-5-21-1482476501-1644491937-682003330-1013 aaaaaa
6. Abrir el explorador de windows tipeando en la consola:
   explorer.exe.
7. Ir a la carpeta Recycler y veremos nuestra carpeta llamada aaaaaa . Accedemos a la carpeta y veremos el contenido: ise.exe, isee.exe y desktop.ini. Procedemos a eliminar esos archivos y limpiamos la ruta del registro HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{08B0E5C0-4FCB-11CF-AAX5-90401C608512}.

Más información en: Análisis del Virus RECYCLER

Ping request could not find host comodo.com

Ping request could not find host comodo.com. Please check the name and try again
Test if all the security software and antivirus sites are accesible.. If not, you have a worm infection or something else.
Look for a dorkbot or conficker infection
computerhope.com/forum/index.php?topic=127768.15
Malwarebytes Anti-Malware from here.
Download DDS from HERE or HERE and save it to your desktop
Boot in Safe Mode with NetWorking, download and install MBAM. Run the scan. Re-boot in Normal mode and try to run the scan again.
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.
Download OTL to your desktop.
* Open OTL
* Copy and Paste the following text in the codebox into the Custom Scans/Fixes window.
Code: [Select]
:OTL
BHO: {00A6FAF1-072E-44cf-8957-5838F569A31D} - No File
BHO: Searchqu Toolbar: {99079a25-328f-4bd4-be04-00955acaa0a7} - c:\progra~1\wi371a~1\datamngr\toolbar\searchqudtx.dll
TB: Searchqu Toolbar: {99079a25-328f-4bd4-be04-00955acaa0a7} - c:\progra~1\wi371a~1\datamngr\toolbar\searchqudtx.dll
BHO: DataMngr: {9d717f81-9148-4f12-8568-69135f087db0} - c:\progra~1\wi371a~1\datamngr\BROWSE~1.DLL
AppInit_DLLs: c:\progra~1\wi371a~1\datamngr\datamngr.dll c:\progra~1\wi371a~1\datamngr\IEBHO.dll

:Files
c:\documents and settings\all users\application data\igukaaa.tmp
c:\documents and settings\all users\application data\ggukaaa.tmp
c:\documents and settings\all users\application data\usskaaa.tmp
c:\documents and settings\all users\application data\vsskaaa.tmp
c:\documents and settings\all users\application data\ysskaaa.tmp
c:\documents and settings\all users\application data\xsskaaa.tmp
c:\documents and settings\all users\application data\ofrkaaa.tmp
c:\documents and settings\all users\application data\nfrkaaa.tmp
c:\documents and settings\all users\application data\mfrkaaa.tmp
c:\documents and settings\all users\application data\kfrkaaa.tmp
c:\documents and settings\all users\application data\lfrkaaa.tmp
c:\documents and settings\all users\application data\rtvkaaa.tmp
c:\documents and settings\all users\application data\ptvkaaa.tmp
c:\documents and settings\all users\application data\otvkaaa.tmp
c:\documents and settings\all users\application data\stvkaaa.tmp
c:\documents and settings\all users\application data\qtvkaaa.tmp
c:\documents and settings\all users\application data\ahxkaaa.tmp
c:\documents and settings\all users\application data\zgxkaaa.tmp
c:\documents and settings\all users\application data\ygxkaaa.tmp
c:\documents and settings\all users\application data\chxkaaa.tmp
c:\documents and settings\all users\application data\bhxkaaa.tmp

:services
MLJCHGIH

:COMMANDS
[resethosts]
[purity]
[start explorer]
* Click Run Fix
* OTLI2 may ask to reboot the machine. Please do so if asked.
* Click OK
* A report will open. Copy and Paste that report in your next reply.
************************************************************
Download Combofix from any of the links below, and save it to your desktop. 
Link 1
Link 2
Link 3
To prevent your anti-virus application interfering with  ComboFix we need to disable it. See here for a tutorial regarding how to do so if you are unsure.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to  have this pre-installed on your machine before doing any malware  removal. This will not occur in Windows Vista and 7
It will allow you to boot up into a special recovery/repair  mode that will allow us to more easily help you should your computer  have a problem after an attempted removal of malware.
If you did not have it installed, you will see the prompt below. Choose YES.

Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.
+++++++++....................
Please download this file from Microsoft and save it on your desktop.
WindowsXP-KB310994-SP2-Home-BootDisk-ENU
Next, please drop/drop it onto Combofix, and Combofix will install the recovery console.


Once that is done, Combofix will ask if you want to continue to scan. Select no, and then let me know once you have gotten this far.
 --------------------------------
Let's see what's up with your internet connection.
Please download MiniToolBox to Desktop and run it.

Checkmark the following boxes:

• Flush DNS
• Report IE Proxy Settings
• Reset IE Proxy Settings
• List content of Hosts
• List IP Configuration
• Lst Last 10 Event Viewer Errors
• List Users, Partitions and Memory Size

-----------------
Start - Run and type cmd
in the window that pops up type ipconfig /flushdns
---------
download Farbar Service Scanner and run it on the computer with the issue.

• Press "Scan".
• It will create a log (FSS.txt) in the same directory the tool is run.
• Please copy and paste the log to your reply

------------------
download SystemLook from one of the links below and save it to your desktop.
Link # 1
Link # 2
Temporarily disable your antivirus and any antispyware real time protection before performing a scan. Click this link to see a list of security programs that should be disabled and how to disable them.
Double-click SystemLook.exe to run 
Copy the contents of the following codebox into the main textfield.

Code: [Select]

:filefind
svchost.exe
Click the Look button to start the scan.
Note: The scan may take some time so please just let it do its work and be patient (or do something else unrelated to the computer).
When finished, a notepad window will open with the results of the scan. Please post the log. The log can also be found on your desktop entitled SystemLook.txt------------------------------ 
You will need to download ComboFix to your desktop, install the Recovery Console and post the full log. There are things there that we need to fix before we can go any further.
Please download SystemLook from one of the links below and save it to your desktop.
Link # 1
Link # 2
Temporarily disable your antivirus and any antispyware real time protection before performing a scan. Click this link to see a list of security programs that should be disabled and how to disable them.
Double-click SystemLook.exe to run it.
Copy the contents of the following codebox into the main textfield.

Code: [Select]

:filefind
explorer.exe
winlogon.exe
i8042prt.sys 
Click the Look button to start the scan.
Note: The scan may take some time so please just let it do its work and be patient (or do something else unrelated to the computer).
When finished, a notepad window will open with the results of the scan. Please post the log. The log can also be found on your desktop entitled SystemLook.txt
---------------------------
Please click here to download AVP Tool by Kaspersky.

• Save it to your desktop.
• Reboot your computer into SafeMode. You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight SafeMode then hit enter.
• Double click the setup file to run it.
• Click Next to continue.
• Accept the License agreement and click on next.
• It will, by default, install it to your desktop folder. Click Next.
• It will then open a box There will be a tab that says Automatic scan.
• Under Automatic scan make sure these are checked.
• Hidden Startup Objects
• System Memory
• Disk Boot Sectors.
• My Computer.
• Also any other drives (Removable that you may have)

Leave the rest of the settings as they appear as default.
•Then click on Scan at the to right hand Corner.
•It will automatically Neutralize any objects found.
•If some objects are left un-neutralized then click the button that says Neutralize all
•If it says it cannot be neutralized then choose the delete option when prompted.
•After that is done click on the reports button at the bottom and save it to file name it Kas.
•Save it somewhere convenient like your desktop and just post only the detected Virus\malware in the report it will be at the very top under Detected post those results in your next reply.
Note: This tool will self uninstall when you close it so please save the log before closing it.
------------------------------
using a Windows Recovery Environment to help disinfect the system so it may boot again.
Download the OTLPE Standard REATOGO Windows Recovery Environment.

• Place a blank CD-R disc in to your CD burning drive.
• Download OTLPEStd.exe and double-click on it to burn to a CD using an ISO Burner. One can be found here.
• Reboot your system using the boot CD you just created.
• Note : If you do not know how to set your computer to boot from CD follow the steps here
• Your system should now display a REATOGO-X-PE desktop.
• Double-click on the OTLPE icon.
• When asked "Do you wish to load the remote registry", select Yes
• When asked "Do you wish to load remote user profile(s) for scanning", select Yes
• Ensure the box "Automatically Load All Remaining Users" is checked and press OK
• OTL should now start. Change the following settings
• Change Drivers to Non-Microsoft
• Press Run Scan to start the scan.
• When finished, the file will be saved  in drive C:\_OTL\MovedFiles
• Copy this file to your USB drive if you do not have internet connection on this system
• Please post the contents of the OTL.txt file in your reply.

You should boot your computer with OTLPE disk and take the opportunity to save your important data just in case everything gets worse.
* Open OTL
* Copy and Paste the following text in the codebox into the Custom Scans/Fixes window.
Code: [Select]
:OTL
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O3 - HKU\Kaitlyn_Cochrane_ON_C\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\Kaitlyn_Cochrane_ON_C\..\Toolbar\WebBrowser: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O3 - HKU\Kaitlyn_Cochrane_ON_C\..\Toolbar\WebBrowser: (no name) - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - No CLSID value found.
O3 - HKU\Keith__Cochrane_ON_C\..\Toolbar\WebBrowser: (no name) - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - No CLSID value found.
O3 - HKU\Lori_Cochrane_ON_C\..\Toolbar\WebBrowser: (no name) - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - No CLSID value found.
O3 - HKU\Lori_Cochrane_ON_C\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\Lori_Cochrane_ON_C\..\Toolbar\WebBrowser: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O4 - HKU\Kaitlyn_Cochrane_ON_C..\Run: [swg]  File not found
O4 - HKU\Lori_Cochrane_ON_C..\Run: [swg]  File not found

:COMMANDS
[resethosts]
[purity]
[start explorer]
* Click Run Fix
* OTLI2 may ask to reboot the machine. Please do so if asked.
* Click OK
* A report will open. Copy and Paste that report in your next reply.
---------------------------------
Let's try to uninstall/reinstall TCP/IP stack.
1. Download winsock.zip
Unzip it.
Right click on Winsock.reg, click "Merge".
Allow registry merge.
2. Restart computer.
3. Go to Start ==> Control Panel.  Double-click Network Connections. Right-click Local Area Connection, and select Properties.

• On the General tab, click Install a popup window opens.
• Select Protocol from the list and then click Add.
• A new window opens, click Have Disk....
• In the browse... box type c:\windows\inf
• Click OK.
• Select Internet Protocol (TCP/IP), and then click OK.
• Restart and check the connection.

************************************************
Please download RenewMyDNS by DragonMaster Jay.
•Save it to your Desktop.
•Right-click on the file and select Extract All...
•Choose a location to save extracted files and keep pressing Next until Finished.
•Double-click RenewMyDNS folder, then double-click RenewMyDNS.bat to start the program.
•Follow the prompts, and when finished it will launch a log.
•Post that log in your next reply.
•After posting the log, delete the folder RenewMyDNS.

Conficker worm removal

ESET OnlineScan

GMER
Detect and remove rootkits on your PC.
Descargar

TDL Rootkit Detector
Detect presence of the TDL rootkit in your system
Descargar

RKill
Kill running malware processes that stop the use of normal antivirus
Descargar

SuperAntiSpyware Fr...
Detect and remove spyware, malware, rootkits, trojans, hijacker...
Descargar

Kaspersky TDSSKille...
Detect and remove rootkit malware on your PC.
Descargar

==================== 
blog.eset.com/2009/03/28/conficker-removal
download.cnet.com/Conficker-Removal-Tool
dw.com.com/redirected
symantec.com/security_response/writeup.jsp?

Discovered:

December 30, 2008

Updated:

March 24, 2009 12:05:35 PM

Also Known As:

Worm:W32/Downadup.AL [F-Secure], Win32/Conficker.B [Computer Associates], W32/Confick-D [Sophos], WORM_DOWNAD.AD [Trend], Net-Worm.Win32.Kido.ih [Kaspersky], Conficker.D [Panda Software]

Type:

Worm

Systems Affected:

Windows 98, Windows 95, Windows XP, Windows Me, Windows Vista, Windows NT, Windows Server 2003, Windows 2000

CVE References:

CVE-2008-4250

W32.Downadup.B is a worm that spreads by exploiting the Microsoft Windows Server Service RPC Handling Remote Code Execution Vulnerability (BID 31874). It also attempts to spread to network shares protected by weak passwords and block access to security-related Web sites.
Microsoft Windows Server 2003 Datacenter Edition SP1,Microsoft Windows Server 2003 SP1/SP2

• Microsoft Security Update for Windows Server 2003 (KB958644)
  http://www.microsoft.com/downloads/details.aspx?familyid=F26D395D-2459 -4E40-8C92-3DE1C52C390D&displaylang=en

Note: For more information, please see the following resource:
W32.Downadup
======

This tool is designed to remove the infections of:

• W32.Downadup
• W32.Downadup.B
• W32.Downadup.C

Important:

• If you are on a network or have a full-time connection to the Internet, such as a DSL or cable modem, disconnect the computer from the network and Internet. Disable or password-protect file sharing, or set the shared files to Read Only, before reconnecting the computers to the network or to the Internet. Because this worm spreads by using shared folders on networked computers, to ensure that the worm does not reinfect the computer after it has been removed, Symantec suggests sharing with Read Only access or by using password protection.
  
  For instructions on how to do this, refer to your Windows documentation, or the document: How to configure shared Windows folders for maximum network protection.
  
  For further information on the vulnerability and patches to resolve it please refer to the following document:
  Microsoft Windows Server Service RPC Handling Remote Code Execution Vulnerability
• If you are removing an infection from a network, first make sure that all the shares are disabled or set to Read Only.
• This tool is not designed to run on Novell NetWare servers. To remove this threat from a NetWare server, first make sure that you have the current virus definitions, and then run a full system scan with the Symantec antivirus product.

How to download and run the tool

Backdoor-IRCBot-Dorkbot

Reiniciar el sistema operativo en modo seguro (presionando F8 mientras reinicia el SOperativo) 

Dorkbot.D Eliminar y recuperar archivos ocultos

Eliminando Dorkbot.d (ESET - nod32)

Sin tener que formatear el disco, cosa que en algunos casos tampoco lo es solución, ya que el Dorkbot se aloja en el MBR del disco.

[Descargar rkill para poder instalar un antivirus]

Descargar el tool ElistarA
Hacer clic aquí para descargar directamente (clave para descomprimir: zonavirus)

Si usan Vista o windows 7 hay que hacer un click con el botón derecho sobre el archivo elistara y  ejecutar como administrador, seleccionan primero el disco C y le dan explorar, una vez que finalicen seleccionan las otras particiones y lo mismo con las unidades de USB o tarjetas de memoria.

Con esto el DorkBot está en cierto modo eliminado, pero nos quedan dos detalles, uno es el residuo del virus y otro es recuperar los atributos de las carpetas que el virus nos ocultó, para ello vamos a abrir el winrar y vamos a explorar cada una de las unidades la carpeta raiz y vamos a eliminar una carpeta con el nombre RECYCLER.BIN

Luego ejecutar

cmd

una vez abierta la consola de comandos, ir al directorio raiz del USB flash memory (X:)

X:

attrib -s -r -h *.* /s /d

================
Fuente
USBFix by Chiquitine29 // Manual de Uso

1. Conecte todos sus dispositivos extraibles, Pendrive, etc.
2. Abre USBFix
3. Seguido tipea la opción 3 - Supresión
4. Aparecerá una advertencia para que conecte sus dispositivos USB, dale Aceptar
5. Durante el análisis el escritorio puede desaparecer, es normal, si USBFix le pide reiniciar el sistema dale Aceptar y reinicia la PC.
6. Busca el reporte que se creará en esta ruta: C:\USBFix.txt

Cita:

UsbFix creará una carpeta oculta llamada "$RECYCLE.BIN" "autorun.inf" en cada partición y cada unidad USB que se encuentre conectado al momento de ejecutar este. No elimine esta carpeta ... eso le ayudará a proteger sus dispositivos USB de futuras infecciones

GMER
Detect and remove rootkits on your PC.
Descargar

TDL Rootkit Detector
Detect presence of the TDL rootkit in your system
Descargar

RKill
Kill running malware processes that stop the use of normal antivirus
Descargar

SuperAntiSpyware Fr...
Detect and remove spyware, malware, rootkits, trojans, hijacker...
Descargar

Kaspersky TDSSKille...
Detect and remove rootkit malware on your PC.
Descargar
=========http://www.forospyware.com/t381169.html
www.bitdefender.com/VIRUS-1000651-en-Backdoor-IRCBot-Dorkbot-A.html Backdoor.IRCBot.Dorkbot.A

Spreading:	medium
Damage:	medium
Size:	~ 118Kb
Discovered:	2011 May 15

SYMPTOMS:

• Extra http traffic
• Presence of a hidden file in folder. The name of the file is random.
• Presence of  “HKEY_CURRENT_USER\Software\\Microsoft\\Windows\\CurrentVersion\\Run\file name”  value.

TECHNICAL DESCRIPTION:

        1. Spreading methods:

The malware has two ways of spreading: either via Instant Messaging (using MSN, Pidgin, Xchat) or USB devices.

        2. General  information:

Once the malware is executed, it copies itself in the folder. The copy is hidden and has a random name. 

       3. Implementation details:

The malicious file has multiple layers of encrypted data. It decrypts some string structures. One such structure contains the encrypted string, the length of the string and a hash computed on the decrypted string (crc32).

 ==============

http://www.fortiguard.com/latest/av/3925334 

W32/Dorkbot.BS!tr is classified as a Trojan.

Trojan has the capabilities to remote access connection handling, perform Denial of Service (DoS) or Distributed DoS (DDoS), capture keyboard inputs, delete file or object, or terminate process. ==============

Analizar el contenido de la innecesaria carpeta Recycler en USB flash memory

tecnicambalandia.blogspot.com/ recycler-virus

Analizar las infecciones detectadas

===============

Malware regional sigue propagándose por botnets

por plorenzana

En días pasados, un administrador nos envió una muestra proveniente de una aula de cómputo para su análisis. Ésta se había estado propagando a través de dispositivos USB y hasta esa fecha no había sido detectada por los antivirus instalados.

Nos proporcionó la muestra tal y como la encontró en los dispositivos de almacenamiento removibles, por lo regular, este tipo de malware se aloja en una carpeta llamada RECYCLER (generalmente funge como papelera de reciclaje del dispositivo, se encuentra oculta y con permisos especiales) la estructura del directorio creada era la siguiente:

El nombre del malware en el dispositivo era 13a0ea84.exe, sin embargo, este tipo de denominaciones hacen pensar que se trata de algún algoritmo para generar nombres aleatoriamente. 

La muestra no se encuentra empaquetada por alguna herramienta, y por las cadenas encontradas es posible ver que fue programada con VisualBasic. Algunas de las cadenas que encontramos en texto claro, fueron APAAGADO, seguido de un número.

 [...]

posible Solución

Decidí formatear la memoria USB, pero el sistema bloquea el intento normal para darle formato desde la interfaz gráfica de windows... tuve que hacerlo desde la consola de MS-DOS, y aún así me decía que había procesos asociados, forcé el cierre de los mismos y sólo así me aseguré de que estuviese 100% limpia... sin embargo al volver a conectarla automáticamente me creaba las carpetas RECYCLER... dentro de las cuáles viene oculto este malware... por lo que entendí que al haber fallado el proceso del antivirus... ya estaba copiado en mi disco duro.

Otro síntoma de que ya estaba infectada mi computadora fué que al tratar de buscar información acerca del virus original reportado por el antivirus no podía acceder a las páginas de Symantec, McAfee, Kaspersky, etc. con ninguno de los navegadores instalados. Pensé que era una extraña coincidencia y verifiqué al mismo tiempo en otras dos computadoras que aún no habían sido infectadas.

Tal como describe este documento... el archivo se copia al folder

C:\Documents and Settings\[Usuario]\Datos de programa\[Nombre de archivo aleatorio].exe -- Para sistemas operativos en español

C:\Documents and Settings\[Usuario]\Application Data\[Nombre de archivo aleatorio].exe -- Sistemas operativos en inglés

Agregó la llave de registro HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\[Nombre de archivo aleatorio]... intenté varias veces eliminar la llave de registro, pero solo era eliminada por unos minutos antes de restaurarse debido a que el archivo malicioso no era removido aún.

Seguir las indicaciones bajo el siguiente link

http://www.forospyware.com/t391413.html

Ejecutar MalwareBytes y CCleaner

www.malwarebytes.org

Scan type: Full scan (C:\|)

Files Infected: 1

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) - Bad: (1) Good: (0) - Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) - Bad: (1) Good: (0) - Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) - Bad: (1) Good: (0) - Quarantined and deleted successfully.

Files Infected:
c:\documents and settings\administrator\application data\Amlklk.exe (Backdoor.Bot.WPM) -Quarantined and deleted successfully.

---------------------

Luego

Reparar errores de registro con CCleaner

Reiniciar el equipo inmediatamente

ESET OnlineScan

places.sqlite -Marcadores e historial no operativo

Source

(Redirigido desde The bookmarks and history system will not be functional)

¿Ves este error cuando inicias Firefox?

El sistema de marcadores e historial no funcionará debido a que uno de los archivos de Firefox está en uso por otra aplicación. Algunos programas de seguridad puedes causar este problema.

Esto ocurre cuando el archivo (llamado places.sqlite) que guarda los marcadores e historial no puede ser accedido por Firefox. Este artículo cubre dos posibles soluciones.
Si no ves el error de más arriba, puedes probar uno de estos artículos:

• Marcadores y botones de las barras de herramientas no funcionan después de actualizar
• Marcadores desaparecidos
• No se guardan los marcadores
• Los botones Atrás y Adelante u otros han desaparecido de la barra de herramientas

Índice de contenidos

• Solución 1: Reiniciar el equipo
• Solución 2: Crear una nueva base de datos places
  • Parte 1 - Abre la carpeta del perfil
  • Parte 2 – Crear la base de datos
• ¡Ayuda! Esto no arregla el problema

Solución 1: Reiniciar el equipo

Las causas más comunes de este error son debidas a que hay otro programa usando el archivo o hubo un problema con el archivo cuando el equipo se cerró de forma inesperada (como un corte de electricidad). Las buenas noticias es que simplemente puedes recuperar el archivo reiniciando para arreglar ambos problemas.

Solución 2: Crear una nueva base de datos places

Si reiniciar el el equipo no ayuda, puedes intentar que Firefox cree una nueva versión del archivo por ti. Tranquilo, no es tan difícil

Parte 1 - Abre la carpeta del perfil

1. En la parte superior de la ventana de Firefox, haz clic en el botón Firefox y, posteriormente, haz clic en el menú Ayuda (en Windows XP, haz clic en el menú Ayuda) y selecciona Información para solucionar problemas. La ventana de Información para solucionar problemas aparecerá.
2. Bajo Configuración básica de la aplicación, haz clic en el botón Abrir carpeta que lo contiene. La ventana con los archivos de tu perfil se abrirá.
   Nota: si te resulta imposible abrir o utilizar Fire​fox, sigue las instrucciones que se muestran en Buscar tu perfil sin necesidad de abrir Firefox.

Mantén la ventana abierta y ve a la parte 2.

Parte 2 – Crear la base de datos

1. En la parte superior de la ventana de Firefox, haz clic en el botón Firefox (menú Archivo en Windows XP) y haz clic en Salir. Espera hasta que Firefox se cierre.
2. En la carpeta del perfil de Firefox, busca y renombra los archivos places.sqlite y places.sqlite-journal (si existe).
   • Para renombrar un archivo, haz clic con el botón derecho del ratón en él y da a Renombrar en el menú. Añade la terminación .old al final.
3. Finalmente, reinicia Firefox.
   • Cuando Firefox se reabra, creará una nueva base de datos. Tu historial de navegación se perderá, pero Firefox cargará una copia de seguridad de tus marcadores desde el archivo de copia más reciente.
   • Si tus marcadores no han sido restaurados después de crear esta nueva base de datos, sigue los pasos en el artículo Marcadores desaparecidos.

¡Ayuda! Esto no arregla el problema

Este problema tiene síntomas que son muy parecidos a otros problemas. Quizás alguno de estos artículos describe mejor tu problema

• Marcadores y botones de las barras de herramientas no funcionan después de actualizar
• Marcadores desaparecidos
• No se guardan los marcadores
• Los botones Atrás y Adelante u otros han desaparecido de la barra de herramientas

Compartir este artículo: puedes utilizar el enlace http://mzl.la/LLcerE