Hola estimados, forospyware, debo decirles que gracias a dios los encontré,:aplausos: puesto que soy el ser humano mas ignorante de la tierra en cuanto a informatica, a pesar que me gusta mucho y me considero un tipo inteligente. ::Help::

En fin, mi tema es que hace poco me contagié con el virus Bush, y a pesar de que estuve leyendo e investigando sobre como eliminar este bicho, lo que encontré me orientó un poco pero al final no supe que hacer.

por otro lado, tengo la sospecha de que mi PC puede tener alguno otro virus.

Por favor, ls pido que meorienten sobre que hacer, y como hacerlo, paso por paso, y se ganaran un amigo inestimable dispuesto a ayudarlos en lo que yo pueda.

Salu2 y muxas grax.

Hola ! Como estas ?

Hacé un escaneo con estos 2 antivirus:

- Ewido (una vez q termina de escanear y si encontró algún bicho, clickea en Remove Infections). [Manual] (http://www.forospyware.com/t42048.html)
- Kaspersky (una vez q termina de escanear, péganos el reporte q te dé aquí, para su posterior análisis). [Manual] (http://www.forospyware.com/t55793.html)

Abrazo y esperamos los reportes...

Acá está el informe que me arrojó Kapersky...
:enfermo:
-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Sunday, July 22, 2007 12:20:33 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.93.0
Kaspersky Anti-Virus database last update: 22/07/2007
Kaspersky Anti-Virus database records: 366577
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\

Scan Statistics:
Total number of scanned objects: 77579
Number of viruses found: 6
Number of infected objects: 15
Number of suspicious objects: 0
Duration of the scan process: 00:59:52

Infected Object Name / Virus Name / Last Action
C:\Archivos de programa\ESET\cache\CACHE.NDB Object is locked skipped
C:\Archivos de programa\ESET\infected\TNLHI2AA.NQF/stream/data0001 Infected: not-a-virus:AdWare.Win32.NewDotNet skipped
C:\Archivos de programa\ESET\infected\TNLHI2AA.NQF/stream/data0002/data.rar/whAgent.exe Infected: not-a-virus:AdWare.Win32.WebHancer.351 skipped
C:\Archivos de programa\ESET\infected\TNLHI2AA.NQF/stream/data0002/data.rar/whInstaller.exe Infected: not-a-virus:AdWare.Win32.WebHancer skipped
C:\Archivos de programa\ESET\infected\TNLHI2AA.NQF/stream/data0002/data.rar/whSurvey.exe Infected: not-a-virus:AdWare.Win32.WebHancer skipped
C:\Archivos de programa\ESET\infected\TNLHI2AA.NQF/stream/data0002/data.rar/webhdll.dll Infected: not-a-virus:AdWare.Win32.WebHancer skipped
C:\Archivos de programa\ESET\infected\TNLHI2AA.NQF/stream/data0002/data.rar/whiehlpr.dll Infected: not-a-virus:AdWare.Win32.WebHancer skipped
C:\Archivos de programa\ESET\infected\TNLHI2AA.NQF/stream/data0002/data.rar Infected: not-a-virus:AdWare.Win32.WebHancer skipped
C:\Archivos de programa\ESET\infected\TNLHI2AA.NQF/stream/data0002 Infected: not-a-virus:AdWare.Win32.WebHancer skipped
C:\Archivos de programa\ESET\infected\TNLHI2AA.NQF/stream/data0003 Infected: not-a-virus:AdTool.Win32.WinAD.bv skipped
C:\Archivos de programa\ESET\infected\TNLHI2AA.NQF/stream Infected: not-a-virus:AdTool.Win32.WinAD.bv skipped
C:\Archivos de programa\ESET\infected\TNLHI2AA.NQF NSIS: infected - 10 skipped
C:\Archivos de programa\ESET\infected\TNLHI2AA.NQF PE-Crypt.XorPE: infected - 10 skipped
C:\Archivos de programa\ESET\infected\XOKLGUBA.NQF Infected: IM-Worm.Win32.VB.au skipped
C:\Archivos de programa\ESET\logs\virlog.dat Object is locked skipped
C:\Archivos de programa\ESET\logs\warnlog.dat Object is locked skipped
C:\Documents and Settings\LocalService\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\XP\Configuración local\Archivos temporales de Internet\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\XP\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\XP\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\XP\Configuración local\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \Cache\_CACHE_001_ Object is locked skipped
C:\Documents and Settings\XP\Configuración local\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \Cache\_CACHE_002_ Object is locked skipped
C:\Documents and Settings\XP\Configuración local\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \Cache\_CACHE_003_ Object is locked skipped
C:\Documents and Settings\XP\Configuración local\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \Cache\_CACHE_MAP_ Object is locked skipped
C:\Documents and Settings\XP\Configuración local\Historial\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\XP\Configuración local\Historial\History.IE5\MSHist0120070722200707 23\index.dat Object is locked skipped
C:\Documents and Settings\XP\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\XP\Datos de programa\Microsoft\MSNLiveFav\LiveFavorites.xml Object is locked skipped
C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cert8.db Object is locked skipped
C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \history.dat Object is locked skipped
C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \key3.db Object is locked skipped
C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \parent.lock Object is locked skipped
C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \search.sqlite Object is locked skipped
C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \urlclassifier2.sqlite Object is locked skipped
C:\Documents and Settings\XP\Mis documentos\Rodrigo\Archive.rar/autorun.inf Infected: Trojan.Win32.Agent.amp skipped
C:\Documents and Settings\XP\Mis documentos\Rodrigo\Archive.rar RAR: infected - 1 skipped
C:\Documents and Settings\XP\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\XP\ntuser.dat.LOG Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{07E510E5-34C4-46B6-BEAB-A9566317BF82}\RP156\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.lo g Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\MsDtc\MSDTC.LOG Object is locked skipped
C:\WINDOWS\system32\MsDtc\Trace\dtctrace.log Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MA P Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MA P Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DAT A Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.


:scandrive
y en Ewido, luego de terminar el proceso, no aparecian los botones de start new scan, o save report... solo aparecia el de remove infections, por lo mismo, solo active este ultimo, ante lo cual, se supone que se removieron las infecciones. eso lo se por que ariba de la ventana del Ewido salia en rojo i16 o algo asi... y luego quedo en i0. Finalmente en la ubicacion donde deberia haber estado el boton de save report, clike con el mouse, y el explorador se puso super lento, y no me daba ninguna señal de estar funcioando, por lo cual no pude guardar el reporte... Voy a hacer los dos scaneos de nuevo y copio los respectivos nuevos informes...

Hola ! Como estas ? Todo bien ?

No hagas de nuevo los 2 escaneos, no es necesario

Bueno, ahora sugiero q hagas esto:

1) Reinicia tu pc en modo a prueba de fallos (http://www.forospyware.com/t68195.html) busca y elimina manualmente este archivo:

C:\Documents and Settings\XP\Mis documentos\Rodrigo\Archive.rar RAR

Si no se deja eliminar utiliza para hacerlo al FileASSASSIN (http://www.infospyware.com/Herramientas.htm) y si no se deja eliminar con el FileASSASSIN, eliminalo con el KillBox (http://www.forospyware.com/t68195.html).

2) Reinicia en modo normal.

3) Vacía la cuarentena de tu antivirus.

4) Pasale a tu pc de nuevo el antivirus online Kaspersky y una vez q termina de escanear, péganos el reporte q te de aquí, para su posterior análisis y asegurarnos de q la infecciónes hayan desaparecido por completo.

Abrazo y espero el reporte del Kaspersky...

Hola, realicé el escaneo Ewido de nuevo. aca esta el informe...

__________________________________________________
ewido anti-spyware online scanner
http://www.ewido.net
__________________________________________________


Name: TrackingCookie.Netflame
Path: C:\Documents and Settings\XP\Cookies\xp@ssl-hints.netflame[2].txt
Risk: Medium

Name: TrackingCookie.Netflame
Path: :mozilla.27:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Netflame
Path: :mozilla.28:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Netflame
Path: :mozilla.29:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.2o7
Path: :mozilla.52:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.2o7
Path: :mozilla.53:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.2o7
Path: :mozilla.54:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.2o7
Path: :mozilla.55:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.2o7
Path: :mozilla.56:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.2o7
Path: :mozilla.57:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.2o7
Path: :mozilla.58:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.2o7
Path: :mozilla.59:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.2o7
Path: :mozilla.60:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.2o7
Path: :mozilla.61:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.2o7
Path: :mozilla.62:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.2o7
Path: :mozilla.63:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.2o7
Path: :mozilla.64:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.2o7
Path: :mozilla.65:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Doubleclick
Path: :mozilla.66:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Real
Path: :mozilla.67:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Real
Path: :mozilla.68:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Real
Path: :mozilla.69:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Real
Path: :mozilla.70:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Clickbank
Path: :mozilla.94:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Googleadservices
Path: :mozilla.96:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Googleadservices
Path: :mozilla.97:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Googleadservices
Path: :mozilla.98:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Yieldmanager
Path: :mozilla.154:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Yieldmanager
Path: :mozilla.155:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Yieldmanager
Path: :mozilla.156:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Yieldmanager
Path: :mozilla.157:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Yieldmanager
Path: :mozilla.162:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Yieldmanager
Path: :mozilla.166:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Yieldmanager
Path: :mozilla.167:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Paypal
Path: :mozilla.168:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Mediaplex
Path: :mozilla.181:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Fastclick
Path: :mozilla.183:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.2o7
Path: :mozilla.205:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Zedo
Path: :mozilla.217:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Zedo
Path: :mozilla.219:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Zedo
Path: :mozilla.220:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.2o7
Path: :mozilla.221:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Adbrite
Path: :mozilla.226:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Adbrite
Path: :mozilla.227:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Imrworldwide
Path: :mozilla.239:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Imrworldwide
Path: :mozilla.240:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Atdmt
Path: :mozilla.241:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Statcounter
Path: :mozilla.296:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Adtech
Path: :mozilla.318:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Adtech
Path: :mozilla.319:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Sexlist
Path: :mozilla.326:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Advertising
Path: :mozilla.328:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Sexcounter
Path: :mozilla.329:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Sexcounter
Path: :mozilla.330:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Sexcounter
Path: :mozilla.331:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Sexcounter
Path: :mozilla.332:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Sexcounter
Path: :mozilla.333:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Sexcounter
Path: :mozilla.334:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Weborama
Path: :mozilla.358:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Weborama
Path: :mozilla.359:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Specificclick
Path: :mozilla.377:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Specificclick
Path: :mozilla.378:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Specificclick
Path: :mozilla.379:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Specificclick
Path: :mozilla.380:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.2o7
Path: :mozilla.452:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Cqcounter
Path: :mozilla.458:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.247realmedia
Path: :mozilla.507:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.247realmedia
Path: :mozilla.508:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.247realmedia
Path: :mozilla.509:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Adbrite
Path: :mozilla.518:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Adbrite
Path: :mozilla.519:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Adrevolver
Path: :mozilla.521:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Adrevolver
Path: :mozilla.522:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Burstnet
Path: :mozilla.577:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Com
Path: :mozilla.586:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Dealtime
Path: :mozilla.610:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Ru4
Path: :mozilla.625:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Fortunecity
Path: :mozilla.665:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Hotlog
Path: :mozilla.696:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Ivwbox
Path: :mozilla.718:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Webtrends
Path: :mozilla.737:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.2o7
Path: :mozilla.753:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.2o7
Path: :mozilla.754:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Overture
Path: :mozilla.801:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Overture
Path: :mozilla.810:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Questionmarket
Path: :mozilla.823:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Questionmarket
Path: :mozilla.824:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Realmedia
Path: :mozilla.826:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Realmedia
Path: :mozilla.827:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Revsci
Path: :mozilla.829:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Revsci
Path: :mozilla.830:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Revsci
Path: :mozilla.831:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Revsci
Path: :mozilla.832:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Spylog
Path: :mozilla.889:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Adbrite
Path: :mozilla.890:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Tacoda
Path: :mozilla.896:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Tacoda
Path: :mozilla.897:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Tradedoubler
Path: :mozilla.916:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Tribalfusion
Path: :mozilla.929:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium

Name: TrackingCookie.2o7
Path: :mozilla.935:C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cookies.txt
Risk: Medium


Por otro lado, voy a reiniciar mi pc en modo aprueba de fallos. elimino el malware, y si no puedo hacerlo manualmente, ocupo el FileASSASSIN y si no puedo eliminarlo con el FileASSASSIN, uso el KillBox.

luego reinicio ne modo normal, y vacio la cuarentena del antivirus (supongo que de mi antivirus que es el nod 32, o no?). y finalmente reescaneo con kapersky.

Espero que ande todo bien...
gracias

Exacto hacé todo eso y espero el nuevo reporte del Kaspersky.

dos consultas:
1- al iniciar en modo a prueba de fallos, busque el archivo y no aparece en la carpeta supuesta.
2- siempre que inicio mi pc, aparece una ventana que me avisa que no se pudo hallar el archivo: c:/windows/system32/wincfgs.exe

finalmente, voy a aplicar el FileASSASSIN y/o el KillBox.

Gracias
::stress::

fileassasin, no ubica el archivo...
::stress::

aplque el killbox. y nuevamente no aparece el archivo. por otra lado imrpimi la pantalla que me apareció por si quieres que te la envíe.

Gracias
:enfermo:

Activa ver archivos ocultos (http://www.forospyware.com/t68195.html) y fijate si así aparece y hacé todo lo q te dije anteriomente....

Si no te aparece el archivo aún hacé exactamente todo lo q dice AQUÍ (http://www.forospyware.com/t92153.html#post398656), y luego hacé el escaneo con el Kaspersky y pégame aquí el nuevo reporte q te dé.

Hola, aca esta el ultimo reporte de Kapersky, luego de aplicar: msnclean, y ccleaner...::pensar::

Espero tu pronta respuesta.:biggrin:

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Sunday, July 22, 2007 5:19:16 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.93.0
Kaspersky Anti-Virus database last update: 22/07/2007
Kaspersky Anti-Virus database records: 366631
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\

Scan Statistics:
Total number of scanned objects: 64236
Number of viruses found: 5
Number of infected objects: 13
Number of suspicious objects: 0
Duration of the scan process: 00:55:15

Infected Object Name / Virus Name / Last Action
C:\Archivos de programa\ESET\cache\CACHE.NDB Object is locked skipped
C:\Archivos de programa\ESET\infected\TNLHI2AA.NQF/stream/data0001 Infected: not-a-virus:AdWare.Win32.NewDotNet skipped
C:\Archivos de programa\ESET\infected\TNLHI2AA.NQF/stream/data0002/data.rar/whAgent.exe Infected: not-a-virus:AdWare.Win32.WebHancer.351 skipped
C:\Archivos de programa\ESET\infected\TNLHI2AA.NQF/stream/data0002/data.rar/whInstaller.exe Infected: not-a-virus:AdWare.Win32.WebHancer skipped
C:\Archivos de programa\ESET\infected\TNLHI2AA.NQF/stream/data0002/data.rar/whSurvey.exe Infected: not-a-virus:AdWare.Win32.WebHancer skipped
C:\Archivos de programa\ESET\infected\TNLHI2AA.NQF/stream/data0002/data.rar/webhdll.dll Infected: not-a-virus:AdWare.Win32.WebHancer skipped
C:\Archivos de programa\ESET\infected\TNLHI2AA.NQF/stream/data0002/data.rar/whiehlpr.dll Infected: not-a-virus:AdWare.Win32.WebHancer skipped
C:\Archivos de programa\ESET\infected\TNLHI2AA.NQF/stream/data0002/data.rar Infected: not-a-virus:AdWare.Win32.WebHancer skipped
C:\Archivos de programa\ESET\infected\TNLHI2AA.NQF/stream/data0002 Infected: not-a-virus:AdWare.Win32.WebHancer skipped
C:\Archivos de programa\ESET\infected\TNLHI2AA.NQF/stream/data0003 Infected: not-a-virus:AdTool.Win32.WinAD.bv skipped
C:\Archivos de programa\ESET\infected\TNLHI2AA.NQF/stream Infected: not-a-virus:AdTool.Win32.WinAD.bv skipped
C:\Archivos de programa\ESET\infected\TNLHI2AA.NQF NSIS: infected - 10 skipped
C:\Archivos de programa\ESET\infected\TNLHI2AA.NQF PE-Crypt.XorPE: infected - 10 skipped
C:\Archivos de programa\ESET\infected\XOKLGUBA.NQF Infected: IM-Worm.Win32.VB.au skipped
C:\Archivos de programa\ESET\logs\virlog.dat Object is locked skipped
C:\Archivos de programa\ESET\logs\warnlog.dat Object is locked skipped
C:\Documents and Settings\LocalService\Configuración local\Archivos temporales de Internet\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Configuración local\Historial\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\XP\Configuración local\Archivos temporales de Internet\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\XP\Configuración local\Archivos temporales de Internet\PhishingFilter\45E13EC5-3DB7-4B3D-9F80-073A58AB5E82.dat Object is locked skipped
C:\Documents and Settings\XP\Configuración local\Datos de programa\Ares\My Shared Folder\___ARESTRA___03-james_morrison-wonderful_world.mp3 Object is locked skipped
C:\Documents and Settings\XP\Configuración local\Datos de programa\Ares\My Shared Folder\___ARESTRA___05 - one last chance.mp3 Object is locked skipped
C:\Documents and Settings\XP\Configuración local\Datos de programa\Ares\My Shared Folder\___ARESTRA___06 undiscovered(3).mp3 Object is locked skipped
C:\Documents and Settings\XP\Configuración local\Datos de programa\Ares\My Shared Folder\___ARESTRA___08 caravan.mp3 Object is locked skipped
C:\Documents and Settings\XP\Configuración local\Datos de programa\Ares\My Shared Folder\___ARESTRA___11-james_morrison-how_come.mp3 Object is locked skipped
C:\Documents and Settings\XP\Configuración local\Datos de programa\Ares\My Shared Folder\___ARESTRA___james morrison - the pieces dont fit anymore.mp3 Object is locked skipped
C:\Documents and Settings\XP\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\XP\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\XP\Configuración local\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \Cache\_CACHE_001_ Object is locked skipped
C:\Documents and Settings\XP\Configuración local\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \Cache\_CACHE_002_ Object is locked skipped
C:\Documents and Settings\XP\Configuración local\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \Cache\_CACHE_003_ Object is locked skipped
C:\Documents and Settings\XP\Configuración local\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \Cache\_CACHE_MAP_ Object is locked skipped
C:\Documents and Settings\XP\Configuración local\Historial\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\XP\Configuración local\Temp\Metacafe\Cache\[From www.metacafe.com] 699609.4328893.1.jpeg Object is locked skipped
C:\Documents and Settings\XP\Configuración local\Temp\Perflib_Perfdata_9bc.dat Object is locked skipped
C:\Documents and Settings\XP\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\XP\Datos de programa\Microsoft\MSNLiveFav\LiveFavorites.xml Object is locked skipped
C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \cert8.db Object is locked skipped
C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \history.dat Object is locked skipped
C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \key3.db Object is locked skipped
C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \parent.lock Object is locked skipped
C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \search.sqlite Object is locked skipped
C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\3vgah5ec.default \urlclassifier2.sqlite Object is locked skipped
C:\Documents and Settings\XP\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\XP\ntuser.dat.LOG Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{07E510E5-34C4-46B6-BEAB-A9566317BF82}\RP156\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\DataStore\DataStor e.edb Object is locked skipped
C:\WINDOWS\SoftwareDistribution\DataStore\Logs\edb .log Object is locked skipped
C:\WINDOWS\SoftwareDistribution\DataStore\Logs\tmp .edb Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.lo g Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\MsDtc\MSDTC.LOG Object is locked skipped
C:\WINDOWS\system32\MsDtc\Trace\dtctrace.log Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MA P Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MA P Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DAT A Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.

ahi si...

Hola ...Rodrigo...

El reporte está limpio ¿Sigues con problemas?

Salu2

Tengo una duda, por una parte, en el reporte de Kapersky me aparece:

Number of viruses found: 5
Number of infected objects: 13

:scandrive

y tu me dices:

El reporte está limpio
::stress::


pero se supone que Kapersky encontro 5 virus, y 13 objetos infectados, o no?
::pensar::


por otro lado,aun tengo el problema de que al iniciar mi PC, me aparece una ventana que me dice que falta un archivo:
c:/windows/system32/wincfgs.exe

QUE HAGO?::Help::

No, a lo q se refiere el amigo Hardrive, es q los archivos infectados son los q están en la cuarentena de tu antivirus y q no pueden hacer mas daño a tu pc. Tan sólo vaciando la cuarentena de tu antivirus desaparecerán.

Hacé esto:

1) Descarga el CCleaner (http://www.infospyware.com/Herramientas.htm) [Manual] (http://www.forospyware.com/t39511.html#post159877)

2) Reinicia tu pc en modo a prueba de fallos (http://www.forospyware.com/t68195.html).

3) Ejecuta el CCleaner y usa su opción "Limpiador" para eliminar cookies y temporales. Luego usa la opción "Registro", para limpiar toda basura q haya en el registro de Windows (antes, realiza una copia de seguridad).

4) Reinicia en modo normal.

5) Vacia la cuarentena de tu antivirus.

6) Escaneá de nuevo a tu pc con el Kaspersky online y pégame aquí el nuevo reporte q te dé.

Abrazo...

tres consultas:
1 ¿que pasa si no elimino los archivos de la cuarentena de mi antivirus?
2 ¿como hago una copi de seguridad?
3 ¿para que sirve el archivo: c:/windows/system32/wincfgs.exe y si no lo tengo, debo conseguirlo?

gracias!

¿que pasa si no elimino los archivos de la cuarentena de mi antivirus?

Los archivos q están en tu cuarentena están encriptados y no pueden hacer daño alguno a tu pc, asi q no te preocupes.

¿como hago una copia de seguridad?

Fijate en el manual q te dejé, q allí esta perfectamente explicado. Y lo vas a entender mejor.


Abrazo, hacé todos los pasos y espero el nuevo reporte...