axel_rose
09/07/06, 08:18:23
Saludos, tengo un problema con este troyano, ya que sigo los pasos mas o menos tipicos para su eliminacion, es decir:
-quito restaurar sistema
-reinicio en modo a prueba de fallos
-lo elimino con hijackthisy killbox y paso el ad-aware
- uso el disk cleaner y luego el regseeker
y una vez hechos estos pasos se me elimina, pero al poco el proceso mssvcc.exe vuelve a aparecer, alguien puede decirme como eliminarlo definitivamente o como protegerme para su eliminacion , muchas gracias
Reitxelle
09/07/06, 12:33:45
Hola, axel_rose.
Ponnos un log de HijackThis (http://www.forospyware.com/t42.html#post44) en este mismo tema, junto con un reporte del ewido online (http://www.ewido.net/en/onlinescan/) y un reporte del kaspersky online (http://www.kaspersky.com/virusscanner/).
Saludos
Reitxelle :adios:
axel_rose
10/07/06, 08:35:56
Aqui dejo el reporte de hijackthis , ewido y kaspersky, he de decir que una vez concluido el analisis con ewido intente eliminar las infecciones detectadas , pero me dio un error el explorer, y lo tuve que cerrar, es esto normal?, aqui van los reportes:
Logfile of HijackThis v1.99.1
Scan saved at 14:28:40, on 10/07/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\ARCHIV~1\CACHEM~1\CachemanXP.exe
C:\WINDOWS\System32\CTSvcCDA.exe
C:\Archivos de programa\Archivos comunes\EPSON\EBAPI\SAgent2.exe
C:\Archivos de programa\Eset\nod32krn.exe
C:\Archivos de programa\Eset\nod32kui.exe
C:\Archivos de programa\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Archivos de programa\Java\jre1.5.0_07\bin\jusched.exe
C:\WINDOWS\System32\mssvcc.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Archivos de programa\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.es/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Archivos de programa\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Archivos de programa\Java\jre1.5.0_07\bin\ssv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Barra Yahoo! con bloqueador de ventanas emergentes - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Archivos de programa\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [nod32kui] "C:\Archivos de programa\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [ATIPTA] C:\Archivos de programa\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Archivos de programa\Java\jre1.5.0_07\bin\jusched.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Archivos de programa\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [msconfig38] mssvcc.exe
O4 - HKLM\..\Run: [spnsvc] rundll32.exe C:\WINDOWS\System32\spnsvc.dll,start
O4 - HKLM\..\RunServices: [msconfig38] mssvcc.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "c:\Archivos de Programa\Messenger\msmsgs.exe /background"
O4 - Global Startup: Inicio rápido de Adobe Reader.lnk = C:\Archivos de programa\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\SYSTEM32\spool\drivers\w32x86\3\E_SRCV0 2.EXE
O8 - Extra context menu item: &MyToolBar Search - res://C:\Archivos de programa\ToolBar888\MyToolBar.dll/MENUSEARCH.HTM
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_07\bin\ssv.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1150890874093
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\ARCHIV~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
O23 - Service: CachemanXP (CachemanXPService) - OuterTechnologies - C:\ARCHIV~1\CACHEM~1\CachemanXP.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTSvcCDA.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Archivos de programa\Archivos comunes\EPSON\EBAPI\SAgent2.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Archivos de programa\Eset\nod32krn.exe
ewido security suite online scanner
http://www.ewido.net
__________________________________________________
Name: Worm.Anker.n
Path: C:\WINDOWS\SYSTEM32\DRIVERS\etc\hosts
Risk: High
Name: Downloader.ConHook.ad
Path: C:\WINDOWS\SYSTEM32\ww32.exe/dotrm.dll
Risk: High
Name: Downloader.Adload.ch
Path: C:\WINDOWS\SYSTEM32\ww32.exe/dotdr.exe
Risk: High
Name: Backdoor.Rbot.aeu
Path: C:\WINDOWS\SYSTEM32\mssvcc.exe
Risk: High
Name: Backdoor.Agent.abc
Path: C:\WINDOWS\SYSTEM32\sck32.exe
Risk: High
Name: Backdoor.Rbot.aeu
Path: C:\WINDOWS\SYSTEM32\winsystems.exe
Risk: High
Name: Downloader.ConHook.ad
Path: C:\WINDOWS\SYSTEM32\dotrm.dll
Risk: High
Name: Adware.Softomate
Path: C:\Archivos de programa\ToolBar888\MyToolBar.dll
Risk: Medium
Name: Adware.Agent
Path: C:\Archivos de programa\CachemanXP\Readme.exe
Risk: Medium
Name: Downloader.IstBar.ai
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Archivos temporales de Internet\Content.IE5\0UARH4VC\popup[2].php
Risk: High
Name: Downloader.IstBar.ai
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Archivos temporales de Internet\Content.IE5\BJVRZJLA\popup[1].php
Risk: High
Name: TrackingCookie.Reliablestats
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Cookies\bobes@stats1.reliablestats[1].txt
Risk: Medium
Name: TrackingCookie.Hitbox
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Cookies\bobes@hitbox[1].txt
Risk: Medium
Name: TrackingCookie.Hitbox
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Cookies\bobes@ehg-sigames.hitbox[2].txt
Risk: Medium
Name: TrackingCookie.Yieldmanager
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Cookies\bobes@ad.yieldmanager[2].txt
Risk: Medium
Name: TrackingCookie.Casalemedia
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Cookies\bobes@casalemedia[1].txt
Risk: Medium
Name: TrackingCookie.Paypopup
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Cookies\bobes@paypopup[2].txt
Risk: Medium
Name: TrackingCookie.Adserver
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Cookies\bobes@z1.adserver[1].txt
Risk: Medium
Name: TrackingCookie.Shopathomeselect
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Cookies\bobes@www.shopathomeselect[2].txt
Risk: Medium
Name: TrackingCookie.Doubleclick
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Cookies\bobes@doubleclick[1].txt
Risk: Medium
Name: TrackingCookie.Paypopup
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Cookies\bobes@popunder.paypopup[2].txt
Risk: Medium
Name: TrackingCookie.Advertising
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Cookies\bobes@advertising[1].txt
Risk: Medium
Name: TrackingCookie.Atdmt
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Cookies\bobes@atdmt[2].txt
Risk: Medium
Name: TrackingCookie.Fastclick
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Cookies\bobes@fastclick[2].txt
Risk: Medium
Name: TrackingCookie.Itrack
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Cookies\bobes@ilead.itrack[1].txt
Risk: Medium
Name: TrackingCookie.Serving-sys
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Cookies\bobes@bs.serving-sys[1].txt
Risk: Medium
Name: TrackingCookie.Serving-sys
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Cookies\bobes@serving-sys[2].txt
Risk: Medium
Name: TrackingCookie.Tribalfusion
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Cookies\bobes@tribalfusion[1].txt
Risk: Medium
Name: TrackingCookie.Mediaplex
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Cookies\bobes@mediaplex[1].txt
Risk: Medium
Name: TrackingCookie.Advertising
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Cookies\bobes@servedby.advertising[2].txt
Risk: Medium
Name: TrackingCookie.Clickhype
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Cookies\bobes@ad1.clickhype[1].txt
Risk: Medium
Name: TrackingCookie.Falkag
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Cookies\bobes@as-eu.falkag[2].txt
Risk: Medium
Name: TrackingCookie.Revenue
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Cookies\bobes@revenue[2].txt
Risk: Medium
Name: TrackingCookie.Targetnet
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Cookies\bobes@targetnet[1].txt
Risk: Medium
Name: TrackingCookie.Tradedoubler
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Cookies\bobes@tradedoubler[2].txt
Risk: Medium
Name: TrackingCookie.Estat
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Cookies\bobes@estat[1].txt
Risk: Medium
Name: TrackingCookie.Falkag
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Cookies\bobes@as1.falkag[2].txt
Risk: Medium
Name: TrackingCookie.Falkag
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Cookies\bobes@as-us.falkag[1].txt
Risk: Medium
Name: TrackingCookie.Weborama
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Cookies\bobes@weborama[2].txt
Risk: Medium
Name: Dropper.VB.cd
Path: C:\Documents and Settings\Bobes\Datos de programa\Pribi\v29.exe
Risk: High
Name: Hijacker.StartPage.ku
Path: C:\Documents and Settings\Bobes\Datos de programa\Setup\Setup.dll
Risk: High
Name: Adware.PowerScan
Path: C:\Documents and Settings\pedro\Menú Inicio\Programas\Power Scan
Risk: Medium
Name: Downloader.Small.bpk
Path: C:\Documents and Settings\LocalService.NT AUTHORITY.002\Configuración local\Archivos temporales de Internet\Content.IE5\H0SBZVNF\is399[1].txt
Risk: High
Name: Downloader.Small.bpk
Path: C:\Documents and Settings\LocalService.NT AUTHORITY.002\Configuración local\Archivos temporales de Internet\Content.IE5\E1G71AYQ\is399[1].txt
Risk: High
Name: Downloader.Small.bpk
Path: C:\Documents and Settings\LocalService.NT AUTHORITY.002\Configuración local\Archivos temporales de Internet\Content.IE5\E1G71AYQ\is399[2].txt
Risk: High
Name: Downloader.ConHook.y
Path: C:\Documents and Settings\Bobes.BOBES-K0JZF7W99\ca32.exe/rm32.dll
Risk: High
Name: Downloader.ConHook.y
Path: C:\Documents and Settings\Bobes.BOBES-K0JZF7W99\cx32.exe/rm32.dll
Risk: High
Name: Downloader.VB.vz
Path: C:\Documents and Settings\Bobes.BOBES-K0JZF7W99\cx32.exe/dr32.exe
Risk: High
Name: Adware.Virtumonde
Path: C:\Documents and Settings\Bobes.BOBES-K0JZF7W99\ch32.exe/rmz.dll
Risk: Medium
Name: Downloader.Adload.ap
Path: C:\Documents and Settings\Bobes.BOBES-K0JZF7W99\ch32.exe/drz.exe
Risk: High
Name: Trojan.Sinowal.aa
Path: C:\Documents and Settings\LocalService.NT AUTHORITY.003\Configuración local\Archivos temporales de Internet\Content.IE5\0M56M504\emvkunkg[1].txt
Risk: High
Name: TrackingCookie.Googleadservices
Path: :mozilla.53:C:\Documents and Settings\Administrador.PEDRO-MWBQFCGMC\Datos de programa\Mozilla\Firefox\Profiles\ip4r3vxt.default \cookies.txt
Risk: Medium
Name: Downloader.ConHook.ad
Path: C:\Documents and Settings\Administrador.PEDRO-MWBQFCGMC\ww32.exe/dotrm.dll
Risk: High
Name: Downloader.Adload.ch
Path: C:\Documents and Settings\Administrador.PEDRO-MWBQFCGMC\ww32.exe/dotdr.exe
Risk: High
Name: Downloader.ConHook.ad
Path: C:\Documents and Settings\Administrador.PEDRO-MWBQFCGMC\dotrm.dll
Risk: High
Name: Adware.MediaMotor
Path: C:\Documents and Settings\Invitado\Configuración local\Archivos temporales de Internet\Content.IE5\OAXAUO6H\util[1].js
Risk: Medium
Name: TrackingCookie.Doubleclick
Path: C:\Documents and Settings\Invitado\Cookies\invitado@doubleclick[1].txt
Risk: Medium
Name: Backdoor.Agobot.agw
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP1\A0000038.exe
Risk: High
Name: Backdoor.Agobot.agw
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP1\A0000055.exe
Risk: High
Name: Backdoor.Agobot.agw
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP1\A0000065.exe
Risk: High
Name: Backdoor.SdBot.asc
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP1\A0000077.exe
Risk: High
Name: Backdoor.Beok
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP1\A0000093.exe
Risk: High
Name: Backdoor.SdBot.asc
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP1\A0000201.exe
Risk: High
Name: Backdoor.Agobot.agw
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP1\A0000207.exe
Risk: High
Name: Backdoor.Agobot.agw
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP1\A0000208.exe
Risk: High
Name: Backdoor.Agobot.agw
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP1\A0000216.exe
Risk: High
Name: Backdoor.Agobot.agw
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP1\A0000284.exe
Risk: High
Name: Backdoor.Agobot.agw
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP1\A0000285.exe
Risk: High
Name: Backdoor.Agobot.agw
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP1\A0000297.exe
Risk: High
Name: Backdoor.Agobot.agw
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP1\A0000360.exe
Risk: High
Name: Backdoor.Agobot.agw
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP2\A0000402.exe
Risk: High
Name: Adware.RXToolbar
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP4\A0000455.dll
Risk: Medium
Name: Backdoor.Agobot.agw
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP4\A0001444.exe
Risk: High
Name: Proxy.Slaper.b
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP4\A0001498.exe
Risk: High
Name: Adware.Virtumonde
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP4\A0001900.exe/rmz.dll
Risk: Medium
Name: Downloader.Adload.ap
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP4\A0001900.exe/drz.exe
Risk: High
Name: Backdoor.Rbot.ayt
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP4\A0001905.exe
Risk: High
Name: Backdoor.Rbot
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP4\A0001906.exe
Risk: High
Name: Backdoor.SdBot.arz
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP4\A0001911.exe
Risk: High
Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP4\A0001912.exe
Risk: High
Name: Adware.Virtumonde
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP4\A0001915.dll
Risk: Medium
Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP4\A0002038.exe
Risk: High
Name: Proxy.Slaper.b
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP4\A0002039.exe
Risk: High
Name: Backdoor.Agobot.agw
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP4\A0002045.exe
Risk: High
Name: Adware.Virtumonde
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP4\A0002054.dll
Risk: Medium
Name: Dropper.Small
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP4\A0002060.exe
Risk: High
Name: Backdoor.Rbot.ats
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP4\A0002116.exe
Risk: High
Name: Backdoor.Rbot.ayt
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP4\A0002121.exe
Risk: High
Name: Adware.404Search
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP4\A0002156.exe
Risk: Medium
Name: Backdoor.Agobot.agw
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP4\A0001797.exe
Risk: High
Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP4\A0001798.exe
Risk: High
Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP10\A0002682.exe
Risk: High
Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP10\A0002683.exe
Risk: High
Name: Backdoor.Rbot
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP10\A0002706.exe
Risk: High
Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP10\A0002710.exe
Risk: High
Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP10\A0002769.exe
Risk: High
Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP11\A0002825.exe
Risk: High
Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP12\A0003879.EXE
Risk: High
Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP13\A0005018.exe
Risk: High
Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP13\A0005090.exe
Risk: High
Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP13\A0005091.exe
Risk: High
Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP13\A0005093.exe
Risk: High
Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP13\A0005094.exe
Risk: High
Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP13\A0006128.exe
Risk: High
Name: Backdoor.Agobot.agw
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP13\A0006130.exe
Risk: High
Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP13\A0006131.exe
Risk: High
Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP14\A0006326.exe
Risk: High
Name: Backdoor.SdBot.aoz
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP14\A0006514.exe
Risk: High
Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP14\A0006541.exe
Risk: High
Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP14\A0006543.exe
Risk: High
Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP17\A0008039.exe
Risk: High
Name: Backdoor.Rbot
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP17\A0008082.exe
Risk: High
Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP17\A0008098.exe
Risk: High
Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP17\A0008099.exe
Risk: High
Name: Adware.IEBar
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP17\A0008237.dll
Risk: Medium
Name: Dropper.VB.mz
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP17\A0008238.exe
Risk: High
Name: Adware.Cydoor
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP17\A0008239.exe/cd_clint.dll
Risk: Medium
Name: Adware.Cydoor
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP17\A0008239.exe/cd_htm.dll
Risk: Medium
Name: Backdoor.Theef.111
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP17\A0008240.exe
Risk: High
Name: Backdoor.Hupigon.aco
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP18\A0008334.exe
Risk: High
Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP19\A0008506.exe
Risk: High
Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP24\A0008779.exe
Risk: High
Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP24\A0008781.exe
Risk: High
Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP24\A0008845.exe
Risk: High
Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP24\A0008847.EXE
Risk: High
Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP24\A0008883.exe
Risk: High
Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP24\A0008885.exe
Risk: High
Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP24\A0008896.exe
Risk: High
Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP24\A0008922.exe
Risk: High
Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP25\A0009059.exe
Risk: High
Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP25\A0009061.exe
Risk: High
Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP26\A0010155.exe
Risk: High
Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP26\A0010172.exe
Risk: High
Name: Downloader.ConHook.ad
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP27\A0010225.exe/dotrm.dll
Risk: High
Name: Adware.Agent
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP27\A0010228.exe
Risk: Medium
Name: Adware.Softomate
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP27\A0010229.dll
Risk: Medium
Name: Downloader.ConHook.ad
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP27\A0010240.exe/dotrm.dll
Risk: High
Name: Downloader.Adload.ch
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP27\A0010240.exe/dotdr.exe
Risk: High
Name: Adware.Agent
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP27\A0010242.exe
Risk: Medium
Name: Adware.Softomate
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP27\A0010249.dll
Risk: Medium
Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP27\A0010267.exe
Risk: High
Name: Downloader.ConHook.ad
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP27\A0010323.exe/dotrm.dll
Risk: High
Name: Downloader.Adload.ch
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP27\A0010323.exe/dotdr.exe
Risk: High
Name: Backdoor.Rbot.aeu
Path: C:\!KillBox\lat.exe
Risk: High
Name: Backdoor.Rbot.aeu
Path: C:\!KillBox\mssvcc.exe
Risk: High
Name: Backdoor.Rbot.aeu
Path: C:\!KillBox\lat.exe( 1)
Risk: High
Name: Backdoor.Rbot.aeu
Path: C:\!KillBox\winsystems.exe
Risk: High
Name: Not-A-Virus.Downloader.Win32.WinFixer.c
Path: C:\FOUND.013\FILE0002.CHK
Risk: Low
Name: Trojan.Sinowal.aa
Path: C:\dpcyac.exe
Risk: High
-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Monday, July 10, 2006 2:14:46 PM
Operating System: Microsoft Windows XP Professional, Service Pack 1 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 10/07/2006
Kaspersky Anti-Virus database records: 193780
-------------------------------------------------------------------------------
Scan Settings:
Scan using the following antivirus database: standard
Scan Archives: true
Scan Mail Bases: true
Scan Target - Folders:
C:\
Scan Statistics:
Total number of scanned objects: 34845
Number of viruses found: 6
Number of infected objects: 10 / 0
Number of suspicious objects: 0
Duration of the scan process: 01:29:19
Infected Object Name / Virus Name / Last Action
C:\WINDOWS\SYSTEM32\config\system.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\config\software.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\config\default.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SECURITY Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SAM Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SYSTEM Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SOFTWARE Object is locked skipped
C:\WINDOWS\SYSTEM32\config\DEFAULT Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\Repository\FS\OBJECTS.DAT A Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\SYSTEM32\i Infected: Trojan-Downloader.BAT.Ftp.ab skipped
C:\WINDOWS\SYSTEM32\spnsvc.dll Infected: Backdoor.Win32.Agent.vc skipped
C:\WINDOWS\SYSTEM32\ww32.exe/data.rar/dotrm.dll Infected: Trojan-Downloader.Win32.ConHook.ad skipped
C:\WINDOWS\SYSTEM32\ww32.exe/data.rar/dotdr.exe Infected: Trojan-Downloader.Win32.Adload.ch skipped
C:\WINDOWS\SYSTEM32\ww32.exe/data.rar Infected: Trojan-Downloader.Win32.Adload.ch skipped
C:\WINDOWS\SYSTEM32\ww32.exe RarSFX: infected - 3 skipped
C:\WINDOWS\SYSTEM32\mssvcc.exe Infected: Backdoor.Win32.Rbot.aeu skipped
C:\WINDOWS\SYSTEM32\sck32.exe Infected: Backdoor.Win32.Agent.abc skipped
C:\WINDOWS\SYSTEM32\winsystems.exe Infected: Backdoor.Win32.Rbot.aeu skipped
C:\WINDOWS\SYSTEM32\dotrm.dll Infected: Trojan-Downloader.Win32.ConHook.ad skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
<¡D3vIL!>
10/07/06, 13:42:22
hola axel_rose
con tu permiso Reitxelle
lo del reporte del EwidoRealiza lo siguiente:
Descarga esta herramientas:
RegSeeker+Manual (http://www.forospyware.com/t713.html)
Ccleaner+Manual (http://www.forospyware.com/t39511.html)
KillBox (http://www.forospyware.com/49-post6.html)
1)Apaga Restaurar Sistema (http://www.forospyware.com/45-post2.html)
2)Ver archivos ocultos (http://www.forospyware.com/46-post3.html)
3)Reinicia a prueba de fallos (http://www.forospyware.com/47-post4.html)
4)Busca y elimina estos archivos y/o carpetas,Para archivos que no se dejen eliminar usa KillBox
C:\WINDOWS\SYSTEM32\ww32.exe/dotrm.dll
C:\WINDOWS\SYSTEM32\ww32.exe/dotdr.exe
C:\WINDOWS\SYSTEM32\mssvcc.exe
C:\WINDOWS\SYSTEM32\sck32.exe
C:\WINDOWS\SYSTEM32\winsystems.exe
C:\WINDOWS\SYSTEM32\dotrm.dll
C:\Archivos de programa\ToolBar888\MyToolBar.dll<--Borra la carpeta
C:\Archivos de programa\CachemanXP\Readme.exe<--Borra la carpeta
C:\Documents and Settings\Bobes\Datos de programa\Pribi\v29.exe<--Borra la capeta
C:\Documents and Settings\Administrador.PEDRO-MWBQFCGMC\dotrm.dll<--Borra la carpeta
C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP1\A0000285.exe
C:\FOUND.013\FILE0002.CHK
C:\dpcyac.exe
5)Sin reiniciar Limpia el registro con RegSeeker,Elimina cookies y temporales con Ccleaner
6)ve a Inicio-->Mi pc-->Disco local-->!KillBox<--Borra todo lo que este en esa carpeta
7)reinicias el pc Normal,Activa restaurar sistema y Nuevamente realizá un Scan Online con Ewidoy comentas como esta tu pc...
espera que Reitxelle revise el log de HijackThis
salu2:Bien:
Reitxelle
10/07/06, 18:56:19
Hola.
A parte de lo que te a comentado **Devil May cry, te pongo ahora lo del log y una corrección a uno de los archivos que te dijeron.
C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP1\A0000285.exe
Este archivo no hace falta que lo elimines manual. Aparte es un poco engorroso de hacer. Cuando deshabilites el 'Restaurar sistema' esa carpeta se vacía.
Realiza estos pasos para limpiar el log:
Actualiza tu sistema operativo en WindowsUpdate (http://www.windowsupdate.com). Esto es muy importante para que tu sistema no tenga ninguna vulnerabilidad que ya haya sido corregida.
1.- Deshabilita el Restaurar Sistema (http://www.forospyware.com/45-post2.html)
2.- Activa la opción Ver Archivos Ocultos (http://www.forospyware.com/46-post3.html)
3.- Reinicia en Modo a Prueba de Fallos (http://www.forospyware.com/showpost.php?p=47&postcount=4)
4.- Desinstala estos programas desde 'Agregar/Quitar programas':
ToolBar888
5.- Cierra todos los programas, ejecuta HijackThis y dale "Fix Cheked" a estas entradas:
O4 - HKLM\..\Run: [msconfig38] mssvcc.exe
O4 - HKLM\..\RunServices: [msconfig38] mssvcc.exe
O8 - Extra context menu item: &MyToolBar Search - res://C:\Archivos de programa\ToolBar888\MyToolBar.dll/MENUSEARCH.HTM
6.- Sin reiniciar, busca y elimina estos archivos, si no se dejan eliminar descarga el programa "Killbox" (http://www.forospyware.com/49-post6.html) y sigue las indicaciones del mensaje, copia y pega los archivos para que los elimine al reiniciar.
C:\WINDOWS\System32\mssvcc.exe
C:\WINDOWS\System32\spnsvc.dll
C:\Archivos de programa\ToolBar888\MyToolBar.dll/MENUSEARCH.HTM ---> borra esta carpeta con todo su contenido
7.- Pasa estas herramientas:
- Ad-Aware 1.06 SE Personal (http://www.infospyware.com/Anti-Spywares.htm)
- Disk Cleaner (http://www.infospyware.com/Herramientas.htm) para limpiar cookies y temporales
- RegSeeker (http://www.infospyware.com/) para limpiar el registro de Windows y su manual (http://www.forospyware.com/t713.html) pasalo varias veces hasta que ya no te salga nada para eliminar.
8.- Reinicia el pc
- Instálate el SpywareBlaster 3.4 (http://www.infospyware.com/Anti-Spywares.htm) manual (http://www.forospyware.com/showpost.php?p=26690)
9.- Pasa dos de estos antivirus online (http://www.forospyware.com/foro-de-virus-y-spywares/aviso-7.html) (ewido y kaspersky preferentemente) y nos comentas si te detectaron algo o no. Si hay algo que te detecten nos pegas el reporte que te generen.
10.- Comprueba los resultados y nos pegas un nuevo log para comprobar que quedó limpio.
De preferencia, imprime las indicaciones para que se te haga más fácil seguirlas.
Saludos
Reitxelle :adios: