Hola, desde hace una semana que estoy luchando en contra del winantiviruspro, amaena y otros malwares/spywares/adware que están ingresando en mi pc.

He leido algunos temas relacionados y le he pasado el ewido, el trend micro y ambos detectaron cosas que he eliminado. Luego pasé el regseeker hasta que no quedó nada (una línea sigue apareciendo en c:\windows\??crosoft\nslookup.exe, no sé si es algo malo o no).

Por último, pasé el kaspersky online y arrojó el siguiente resultado:


Tuesday, August 29, 2006 7:58:15 AM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 29/08/2006
Kaspersky Anti-Virus database records: 206084


Scan Settings
Scan using the following antivirus database standard
Scan Archives true
Scan Mail Bases true

Scan Target My Computer
C:\
D:\

Scan Statistics
Total number of scanned objects 50220
Number of viruses found 2
Number of infected objects 2 / 0
Number of suspicious objects 0
Duration of the scan process 00:57:39

Infected Object Name Virus Name Last Action
C:\Documents and Settings\All Users\Application Data\avg7\Log\emc.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Support\WDLog-06262006-230419.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped

C:\Documents and Settings\char\.housecall\Quarantine\__delete_on_re boot__l_s_a_s_s_._e_x_e_.bac_a02812 Infected: Trojan-Downloader.Win32.PurityScan.da skipped

C:\Documents and Settings\char\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\om fge.class-2ce291f0-3e0a676a.class Infected: Trojan-Downloader.Java.OpenStream.y skipped

C:\Documents and Settings\char\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\char\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\char\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\char\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{DF26E349-CA4F-44C6-BD3E-52A946DA043D} Object is locked skipped

C:\Documents and Settings\char\Local Settings\History\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\char\Local Settings\History\History.IE5\MSHist012006082920060 830\index.dat Object is locked skipped

C:\Documents and Settings\char\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\char\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\char\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

C:\Program Files\Norton AntiVirus\AVApp.log Object is locked skipped

C:\Program Files\Norton AntiVirus\AVError.log Object is locked skipped

C:\Program Files\Norton AntiVirus\AVVirus.log Object is locked skipped

C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\SchedLgU.Txt Object is locked skipped

C:\WINDOWS\SoftwareDistribution\EventCache\{0B57BF F4-6033-442D-B588-F36C0F39F24D}.bin Object is locked skipped

C:\WINDOWS\SoftwareDistribution\ReportingEvents.lo g Object is locked skipped

C:\WINDOWS\Sti_Trace.log Object is locked skipped

C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped

C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped

C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\default Object is locked skipped

C:\WINDOWS\system32\config\default.LOG Object is locked skipped

C:\WINDOWS\system32\config\SAM Object is locked skipped

C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SECURITY Object is locked skipped

C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

C:\WINDOWS\system32\config\software Object is locked skipped

C:\WINDOWS\system32\config\software.LOG Object is locked skipped

C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\system Object is locked skipped

C:\WINDOWS\system32\config\system.LOG Object is locked skipped

C:\WINDOWS\system32\config\systemprofile\Cookies\i ndex.dat Object is locked skipped

C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat Object is locked skipped

C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\WINDOWS\system32\h323log.txt Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MA P Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MA P Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DAT A Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped

C:\WINDOWS\wiadebug.log Object is locked skipped

C:\WINDOWS\wiaservc.log Object is locked skipped

C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.



AUN ASI EL WINANTIVIRUSPRO APARECIÓ APENAS ABRÍ EL EXPLORER.
ME PUEDEN DECIR QUE HACER? LA PC ESTÁ CADA VEZ MAS LENTA.

Por otra parte, me podrían recomendar algo que impida que estas cosas entren? Mi pc la utilizamos varias personas.

Muchas gracias!

Hola charlyparker,

Comenzá eliminando las dos infecciones que tenés, para ellos seguí estos pasos:

:1: Buscá y eliminá estos archivos/carpetas (Si no lo/los encontrás activá ''Ver archivos ocultos del sistema'' (http://www.forospyware.com/t13.html)), si no se dejan eliminar descargá el programa "Killbox" (http://www.forospyware.com/showpost.php?p=49&postcount=6) y seguí las indicaciones del mensaje, copiá y pegá los archivos para que los elimine al reiniciar.

C:\Documents and Settings\char\.housecall\Quarantine <-- Eliminá todo el contenido de esta carpeta

Seguí estos pasos para vaciar la caché de Java:

1.En el menú Inicio, seleccioná Configuración > Panel de control.
2. En el Panel de control, abrí el Panel de control de Java.
3. Seleccioná General -> Borrar archivos -> Marcá las tres opciones que aparecen y clickeás en aceptar.

:2: Ejecutá Disk Cleaner (http://www.forospyware.com/t42.html#post48) y Regseeker (http://www.forospyware.com/t713.html)

Comentános como te fué.

Suerte:Bien:

Hola, gracias por la respuesta tan rápida.
Te cuento:
el primer archivo lo pude borrar.

En el tema de Java, abro Java Plug in Control Panel, dentro del panel de control pero no me aparece ninguna pestaña "General" ni encontré la opción de borrar archivos. Busqué el archivo infectado que sale en el log de kaspesky y no lo encuentro aunque puse ver archivos ocultos.

Me decís que puedo hacer para continuar?
Gracias de nuevo!

Hola otra vez,

como te dije antes, en el mensaje de arriba, lo de java no lo pude solucionar.

Corri el disk cleaner y el regseeker hasta que quedó solo uno que no lo pude sacar, que es:
C:|windows|??crosofot|nslookup.exe

Por otro lado, corri otra vez el trend micro online, y arrojo solo un resultado, mostrando una vulnerabilidad en el sistema, que es:

ASP.NET PATH VALIDATION VULNERABILITY

Por último, corri el kaspersky y arrojó lo siguiente:

Tuesday, August 29, 2006 10:00:46 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 29/08/2006
Kaspersky Anti-Virus database records: 206343


Scan Settings
Scan using the following antivirus database standard
Scan Archives true
Scan Mail Bases true

Scan Target My Computer
C:\
D:\

Scan Statistics
Total number of scanned objects 47545
Number of viruses found 1
Number of infected objects 1 / 0
Number of suspicious objects 0
Duration of the scan process 00:34:30

Infected Object Name Virus Name Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Support\WDLog-06262006-230419.log Object is locked skipped

C:\Documents and Settings\char\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\om fge.class-2ce291f0-3e0a676a.class Infected: Trojan-Downloader.Java.OpenStream.y skipped

C:\Documents and Settings\char\Application Data\Sun\Java\Deployment\log\plugin142_05.trace Object is locked skipped

C:\Documents and Settings\char\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\char\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\char\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\char\Local Settings\History\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\char\Local Settings\Temp\hsperfdata_char\2032 Object is locked skipped

C:\Documents and Settings\char\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\char\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\char\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\default Object is locked skipped

C:\WINDOWS\system32\config\default.LOG Object is locked skipped

C:\WINDOWS\system32\config\SAM Object is locked skipped

C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SECURITY Object is locked skipped

C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

C:\WINDOWS\system32\config\software Object is locked skipped

C:\WINDOWS\system32\config\software.LOG Object is locked skipped

C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\system Object is locked skipped

C:\WINDOWS\system32\config\system.LOG Object is locked skipped

C:\WINDOWS\system32\config\systemprofile\Cookies\i ndex.dat Object is locked skipped

C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat Object is locked skipped

C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MA P Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MA P Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DAT A Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped

Scan process completed.


Como verás, muestra solo un virus y es el de java que no pude sacar.

Hasta ahora no volvió a aparecer la ventada de winantiviruspro.
Me decís que hago para terminar?

Muchas gracias de nuevo!!

Holas. El archivo virus que esta en la cache de Java lo podes borrar manualmente, es este:
C:\Documents and Settings\char\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\om fge.class-2ce291f0-3e0a676a.class
Aunque, si bien recuerdo, el programa CCleaner (http://download.ccleaner.com/ccsetup131.exe) (manual (http://www.forospyware.com/t39511.html)) tambien vacia la cache de Java.

¿Sigues con problemas?

Salu2

Hola hardrive

después de todo lo que hice sigue apareciendo el maldito winantiviruspro 2006.
Qué hago? te paso un log de hijackthis?

Saludos!