| Ver la Versión Completa : ¡¡¡URGENTE!!!¿¿¿Cómo elimino el virus winlogon??? laura_bakala_16 11/12/06, 18:35:07 :chillando Hola!!! Tengo el virus winlogon y tengo el antivirus kaspersky y cuando me lo detecta le doy a eliminar y se me reinicia el ordenador y no se me elimina el virus, que hago??? porfavor ayudenme que nose que hacer, si es posible agregenme mejor a mi msn xra ayudarme: *editado*@hotmail.com. muchisimas gracias, espero vuestra respuesta lo antes posible. Saludos a todos.::Help:: Hardrive 11/12/06, 18:43:56 Bienvenido al foro :Bien: Analizá con "Ewido Online Scanner" y "Kaspersky Antivirus On-Line" (http://www.forospyware.com/foro-de-virus-y-spywares/aviso-7.html) en ese orden, guardá sus reportes, y pegá ambos aquí. Salu2 laura_bakala_16 11/12/06, 21:10:21 el del kaspersky no lo e podido hacer nose xk xro aki os dejo el del otro, haber si me podeis ayudar. gracias saludos __________________________________________________ ewido anti-spyware online scanner http://www.ewido.net __________________________________________________ Name: TrackingCookie.2o7 Path: E:\Documents and Settings\Usuario\Cookies\usuario@2o7[1].txt Risk: Medium Name: TrackingCookie.Yieldmanager Path: E:\Documents and Settings\Usuario\Cookies\usuario@ad.yieldmanager[1].txt Risk: Medium Name: TrackingCookie.Advertising Path: E:\Documents and Settings\Usuario\Cookies\usuario@advertising[2].txt Risk: Medium Name: TrackingCookie.Falkag Path: E:\Documents and Settings\Usuario\Cookies\usuario@as-eu.falkag[2].txt Risk: Medium Name: TrackingCookie.Atdmt Path: E:\Documents and Settings\Usuario\Cookies\usuario@atdmt[2].txt Risk: Medium Name: TrackingCookie.Atdmt Path: E:\Documents and Settings\Usuario\Cookies\usuario@atdmt[3].txt Risk: Medium Name: TrackingCookie.Clubdicecasino Path: E:\Documents and Settings\Usuario\Cookies\usuario@banner.clubdiceca sino[2].txt Risk: Medium Name: TrackingCookie.Clubdicecasino Path: E:\Documents and Settings\Usuario\Cookies\usuario@clubdicecasino[1].txt Risk: Medium Name: TrackingCookie.Doubleclick Path: E:\Documents and Settings\Usuario\Cookies\usuario@doubleclick[1].txt Risk: Medium Name: TrackingCookie.Mediaplex Path: E:\Documents and Settings\Usuario\Cookies\usuario@mediaplex[1].txt Risk: Medium Name: TrackingCookie.Reliablestats Path: E:\Documents and Settings\Usuario\Cookies\usuario@stats1.reliablest ats[2].txt Risk: Medium Name: TrackingCookie.Belstat Path: E:\Documents and Settings\Usuario\Cookies\usuario@www.belstat[2].txt Risk: Medium Name: TrackingCookie.Casinotropez Path: E:\Documents and Settings\Usuario\Cookies\usuario@www.casinotropez[1].txt Risk: Medium Name: Adware.NewDotNet Path: HKLM\SOFTWARE\Classes\CLSID\{4A2AACF3-ADF6-11D5-98A9-00E018981B9E} Risk: Medium Name: Adware.NewDotNet Path: HKLM\SOFTWARE\Classes\Tldctl2.URLLink Risk: Medium Name: Adware.NewDotNet Path: HKLM\SOFTWARE\Classes\Tldctl2.URLLink\CLSID Risk: Medium Name: Adware.NewDotNet Path: HKLM\SOFTWARE\Classes\Tldctl2.URLLink\CurVer Risk: Medium Name: Adware.NewDotNet Path: HKLM\SOFTWARE\Classes\Tldctl2.URLLink.1 Risk: Medium Name: Adware.SaveNow Path: HKLM\SOFTWARE\Classes\WUSN.1 Risk: Medium Name: Adware.NewDotNet Path: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Exp lorer\Browser Helper Objects\{4A2AACF3-ADF6-11D5-98A9-00E018981B9E} Risk: Medium Name: Adware.NewDotNet Path: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run \\New.net Startup Risk: Medium Name: Dialer.Generic Path: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uni nstall\Instant Access Risk: High Name: Adware.NewDotNet Path: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uni nstall\New.net Risk: Medium Name: Adware.NewDotNet Path: HKLM\SOFTWARE\New.net Risk: Medium Name: Adware.NewDotNet Path: HKU\.DEFAULT\Software\New.net Risk: Medium Name: Dialer.Generic Path: HKU\S-1-5-21-583907252-261478967-725345543-1003\Software\egdhtml Risk: High Name: Adware.NewDotNet Path: HKU\S-1-5-21-583907252-261478967-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Ext \Stats\{4A2AACF3-ADF6-11D5-98A9-00E018981B9E} Risk: Medium Name: Adware.NewDotNet Path: HKU\S-1-5-21-583907252-261478967-725345543-1003\Software\New.net Risk: Medium Name: Adware.NewDotNet Path: HKU\S-1-5-18\Software\New.net Risk: Medium Name: Adware.RK Path: [1044] E:\WINDOWS\system32\rlls.dll Risk: Medium Name: Adware.RK Path: [1316] E:\WINDOWS\system32\rlls.dll Risk: Medium Name: Adware.RK Path: [1652] E:\windows\system32\rlvknlg.exe Risk: Medium Name: Adware.RK Path: [2756] E:\WINDOWS\system32\rlls.dll Risk: Medium Name: Adware.RK Path: [2768] E:\WINDOWS\system32\rlls.dll Risk: Medium Name: Adware.NewDotNet Path: E:\Archivos de programa\NewDotNet Risk: Medium Name: Adware.NewDotNet Path: E:\Archivos de programa\NewDotNet\newdotnet7_48.dll Risk: Medium Name: Adware.NewDotNet Path: E:\Archivos de programa\NewDotNet\readme.html Risk: Medium Name: Adware.NewDotNet Path: E:\Archivos de programa\NewDotNet\uninstall6_38.exe Risk: Medium Name: Adware.NewDotNet Path: E:\Archivos de programa\NewDotNet\uninstall7_48.exe Risk: Medium Name: TrackingCookie.Casinotropez Path: E:\Documents and Settings\Usuario\Configuración local\Temp\Cookies\usuario@casinotropez[1].txt Risk: Medium Name: TrackingCookie.Doubleclick Path: E:\Documents and Settings\Usuario\Configuración local\Temp\Cookies\usuario@doubleclick[1].txt Risk: Medium Name: TrackingCookie.Casinotropez Path: E:\Documents and Settings\Usuario\Configuración local\Temp\Cookies\usuario@promo.casinotropez[2].txt Risk: Medium Name: TrackingCookie.Tradedoubler Path: E:\Documents and Settings\Usuario\Configuración local\Temp\Cookies\usuario@tradedoubler[2].txt Risk: Medium Name: Adware.Drop Path: E:\Documents and Settings\Usuario\Configuración local\Temp\UDC6Y_0001_D19M0809\installer.exe Risk: Medium Name: TrackingCookie.2o7 Path: :mozilla.14:E:\Documents and Settings\Usuario\Datos de programa\Mozilla\Firefox\Profiles\24rz8gcv.default \cookies.txt Risk: Medium Name: TrackingCookie.2o7 Path: :mozilla.15:E:\Documents and Settings\Usuario\Datos de programa\Mozilla\Firefox\Profiles\24rz8gcv.default \cookies.txt Risk: Medium Name: TrackingCookie.2o7 Path: :mozilla.16:E:\Documents and Settings\Usuario\Datos de programa\Mozilla\Firefox\Profiles\24rz8gcv.default \cookies.txt Risk: Medium Name: TrackingCookie.Tradedoubler Path: :mozilla.28:E:\Documents and Settings\Usuario\Datos de programa\Mozilla\Firefox\Profiles\24rz8gcv.default \cookies.txt Risk: Medium Name: TrackingCookie.Tradedoubler Path: :mozilla.29:E:\Documents and Settings\Usuario\Datos de programa\Mozilla\Firefox\Profiles\24rz8gcv.default \cookies.txt Risk: Medium Name: TrackingCookie.Atdmt Path: :mozilla.53:E:\Documents and Settings\Usuario\Datos de programa\Mozilla\Firefox\Profiles\24rz8gcv.default \cookies.txt Risk: Medium Name: Trojan.Backdoor.CMI Path: E:\Documents and Settings\Usuario\Mis documentos\CARPETAS DE LOS PROGRAMAS\revuelto\52 guiños para MSN7 by Susito21\Guiños.exe Risk: High Name: Trojan.Backdoor.CMI Path: E:\Documents and Settings\Usuario\Mis documentos\CARPETAS DE LOS PROGRAMAS\revuelto\52 guiños para MSN7 by Susito21.rar/52 gui¤os para MSN7 by Susito21\Gui¤os.exe Risk: High Name: Adware.NewDotNet Path: E:\System Volume Information\_restore{63C313E9-1D19-4AC9-9138-BCC88736870E}\RP423\A0666304.dll Risk: Medium Name: Adware.SafeGuard Path: E:\System Volume Information\_restore{63C313E9-1D19-4AC9-9138-BCC88736870E}\RP423\A0666367.dll Risk: Medium Name: Adware.RK Path: E:\System Volume Information\_restore{63C313E9-1D19-4AC9-9138-BCC88736870E}\RP423\A0666399.dll Risk: Medium Name: Adware.RK Path: E:\System Volume Information\_restore{63C313E9-1D19-4AC9-9138-BCC88736870E}\RP424\A0666451.exe Risk: Medium Name: Adware.NewDotNet Path: E:\System Volume Information\_restore{63C313E9-1D19-4AC9-9138-BCC88736870E}\RP424\A0668948.dll Risk: Medium Name: Adware.RK Path: E:\System Volume Information\_restore{63C313E9-1D19-4AC9-9138-BCC88736870E}\RP424\A0668985.dll Risk: Medium Name: Adware.SafeGuard Path: E:\System Volume Information\_restore{63C313E9-1D19-4AC9-9138-BCC88736870E}\RP424\A0669039.dll Risk: Medium Name: Adware.NewDotNet Path: E:\System Volume Information\_restore{63C313E9-1D19-4AC9-9138-BCC88736870E}\RP424\A0670816.dll Risk: Medium Name: Adware.SafeGuard Path: E:\System Volume Information\_restore{63C313E9-1D19-4AC9-9138-BCC88736870E}\RP424\A0670982.dll Risk: Medium Name: Adware.RK Path: E:\System Volume Information\_restore{63C313E9-1D19-4AC9-9138-BCC88736870E}\RP424\A0671005.exe Risk: Medium Name: Adware.RK Path: E:\System Volume Information\_restore{63C313E9-1D19-4AC9-9138-BCC88736870E}\RP424\A0671036.dll Risk: Medium Name: Adware.NewDotNet Path: E:\System Volume Information\_restore{63C313E9-1D19-4AC9-9138-BCC88736870E}\RP426\A0672892.exe Risk: Medium Name: Adware.NewDotNet Path: E:\System Volume Information\_restore{63C313E9-1D19-4AC9-9138-BCC88736870E}\RP426\A0673864.dll Risk: Medium Name: Adware.RK Path: E:\System Volume Information\_restore{63C313E9-1D19-4AC9-9138-BCC88736870E}\RP427\A0674134.dll Risk: Medium Name: Adware.SafeGuard Path: E:\System Volume Information\_restore{63C313E9-1D19-4AC9-9138-BCC88736870E}\RP427\A0674196.dll Risk: Medium Name: Adware.RK Path: E:\System Volume Information\_restore{63C313E9-1D19-4AC9-9138-BCC88736870E}\RP427\A0674529.exe Risk: Medium Name: Adware.SafeGuardProtect Path: E:\System Volume Information\_restore{63C313E9-1D19-4AC9-9138-BCC88736870E}\RP427\A0675913.dll Risk: Medium Name: Adware.NewDotNet Path: E:\System Volume Information\_restore{63C313E9-1D19-4AC9-9138-BCC88736870E}\RP427\A0679112.exe Risk: Medium Name: Adware.SafeGuard Path: E:\System Volume Information\_restore{63C313E9-1D19-4AC9-9138-BCC88736870E}\RP427\A0679596.dll Risk: Medium Name: Adware.RK Path: E:\System Volume Information\_restore{63C313E9-1D19-4AC9-9138-BCC88736870E}\RP427\A0679632.dll Risk: Medium Name: Adware.RK Path: E:\System Volume Information\_restore{63C313E9-1D19-4AC9-9138-BCC88736870E}\RP427\A0680117.exe Risk: Medium Name: Adware.NewDotNet Path: E:\System Volume Information\_restore{63C313E9-1D19-4AC9-9138-BCC88736870E}\RP427\A0680403.exe Risk: Medium Name: Dialer.InstantAccess.af Path: E:\System Volume Information\_restore{63C313E9-1D19-4AC9-9138-BCC88736870E}\RP427\A0680557.exe Risk: High Name: Adware.RK Path: E:\System Volume Information\_restore{63C313E9-1D19-4AC9-9138-BCC88736870E}\RP427\A0681075.dll Risk: Medium Name: Dialer.InstantAccess.af Path: E:\System Volume Information\_restore{63C313E9-1D19-4AC9-9138-BCC88736870E}\RP427\A0681419.exe Risk: High Name: Adware.RK Path: E:\System Volume Information\_restore{63C313E9-1D19-4AC9-9138-BCC88736870E}\RP427\A0681427.exe Risk: Medium Name: Adware.RK Path: E:\System Volume Information\_restore{63C313E9-1D19-4AC9-9138-BCC88736870E}\RP427\A0681749.exe Risk: Medium Name: Adware.RK Path: E:\System Volume Information\_restore{63C313E9-1D19-4AC9-9138-BCC88736870E}\RP427\A0681903.dll Risk: Medium Name: Dialer.InstantAccess.af Path: E:\System Volume Information\_restore{63C313E9-1D19-4AC9-9138-BCC88736870E}\RP427\A0681951.exe Risk: High Name: Adware.NewDotNet Path: E:\System Volume Information\_restore{63C313E9-1D19-4AC9-9138-BCC88736870E}\RP427\A0682756.exe Risk: Medium Name: Adware.RK Path: E:\System Volume Information\_restore{63C313E9-1D19-4AC9-9138-BCC88736870E}\RP427\A0682915.dll Risk: Medium Name: Adware.RK Path: E:\System Volume Information\_restore{63C313E9-1D19-4AC9-9138-BCC88736870E}\RP427\A0682923.exe Risk: Medium Name: Adware.SafeGuard Path: E:\System Volume Information\_restore{63C313E9-1D19-4AC9-9138-BCC88736870E}\RP427\A0683010.dll Risk: Medium Name: Adware.RK Path: E:\System Volume Information\_restore{63C313E9-1D19-4AC9-9138-BCC88736870E}\RP427\A0683505.exe Risk: Medium Name: Dialer.InstantAccess.af Path: E:\System Volume Information\_restore{63C313E9-1D19-4AC9-9138-BCC88736870E}\RP427\A0683545.exe Risk: High Name: Adware.SafeGuard Path: E:\System Volume Information\_restore{63C313E9-1D19-4AC9-9138-BCC88736870E}\RP427\A0684817.dll Risk: Medium Name: Adware.SafeGuardProtect Path: E:\System Volume Information\_restore{63C313E9-1D19-4AC9-9138-BCC88736870E}\RP427\A0685255.dll Risk: Medium Name: Dialer.InstantAccess.af Path: E:\System Volume Information\_restore{63C313E9-1D19-4AC9-9138-BCC88736870E}\RP427\A0685258.exe Risk: High Name: Adware.RK Path: E:\System Volume Information\_restore{63C313E9-1D19-4AC9-9138-BCC88736870E}\RP427\A0686184.dll Risk: Medium Name: Adware.RK Path: E:\System Volume Information\_restore{63C313E9-1D19-4AC9-9138-BCC88736870E}\RP427\A0686326.exe Risk: Medium Name: Dialer.InstantAccess.af Path: E:\System Volume Information\_restore{63C313E9-1D19-4AC9-9138-BCC88736870E}\RP427\A0686386.exe Risk: High Name: Adware.SafeGuard Path: E:\System Volume Information\_restore{63C313E9-1D19-4AC9-9138-BCC88736870E}\RP427\A0686424.dll Risk: Medium Name: Adware.NewDotNet Path: E:\System Volume Information\_restore{63C313E9-1D19-4AC9-9138-BCC88736870E}\RP427\A0689882.exe Risk: Medium Name: Adware.NewDotNet Path: E:\System Volume Information\_restore{63C313E9-1D19-4AC9-9138-BCC88736870E}\RP427\A0689883.exe Risk: Medium Name: Adware.NewDotNet Path: E:\System Volume Information\_restore{63C313E9-1D19-4AC9-9138-BCC88736870E}\RP428\A0690830.exe Risk: Medium Name: Adware.NewDotNet Path: E:\System Volume Information\_restore{63C313E9-1D19-4AC9-9138-BCC88736870E}\RP428\A0690831.exe Risk: Medium Name: Adware.NewDotNet Path: E:\System Volume Information\_restore{63C313E9-1D19-4AC9-9138-BCC88736870E}\RP428\A0690832.exe Risk: Medium Name: Adware.SafeGuardProtect Path: E:\System Volume Information\_restore{63C313E9-1D19-4AC9-9138-BCC88736870E}\RP428\A0696312.dll Risk: Medium Name: Adware.RK Path: E:\System Volume Information\_restore{63C313E9-1D19-4AC9-9138-BCC88736870E}\RP428\A0698368.dll Risk: Medium Name: Adware.RK Path: E:\System Volume Information\_restore{63C313E9-1D19-4AC9-9138-BCC88736870E}\RP428\A0699531.exe Risk: Medium Name: Adware.SafeGuard Path: E:\System Volume Information\_restore{63C313E9-1D19-4AC9-9138-BCC88736870E}\RP428\A0699949.dll Risk: Medium Name: Dialer.InstantAccess.af Path: E:\System Volume Information\_restore{63C313E9-1D19-4AC9-9138-BCC88736870E}\RP428\A0700088.exe Risk: High Name: Adware.RK Path: E:\System Volume Information\_restore{63C313E9-1D19-4AC9-9138-BCC88736870E}\RP428\A0701174.dll Risk: Medium Name: Adware.RK Path: E:\System Volume Information\_restore{63C313E9-1D19-4AC9-9138-BCC88736870E}\RP428\A0701585.exe Risk: Medium Name: Adware.SafeGuardProtect Path: E:\System Volume Information\_restore{63C313E9-1D19-4AC9-9138-BCC88736870E}\RP428\A0702031.dll Risk: Medium Name: Adware.NewDotNet Path: E:\WINDOWS\NDNuninstall6_38.exe Risk: Medium Name: Adware.NewDotNet Path: E:\WINDOWS\NDNuninstall7_22.exe Risk: Medium Name: Adware.NewDotNet Path: E:\WINDOWS\NDNuninstall7_48.exe Risk: Medium Name: Dialer.InstantAccess.af Path: E:\WINDOWS\system32\mwsrvacc.exe Risk: High Name: Adware.RK Path: E:\WINDOWS\system32\rk.bin Risk: Medium Name: Adware.RK Path: E:\WINDOWS\system32\rlls.dll Risk: Medium Name: Adware.RK Path: E:\WINDOWS\system32\rlvknlg.exe Risk: Medium Name: Adware.SafeGuardProtect Path: E:\WINDOWS\system32\sfg.dll Risk: Medium Name: Adware.SafeGuard Path: E:\WINDOWS\system32\sfg_02c9.dll Risk: Medium Name: Trojan.Small Path: E:\WINDOWS\system32\wnsinttr.exe Risk: High Hardrive 11/12/06, 21:31:22 Pues tu PC está infectada ::ups:: De igual manera, primero pegá el reporte del Kaspersky Online antes de que continuemos. Salu2 laura_bakala_16 12/12/06, 01:16:45 Pero sk no me sale nada del reporte del kaspersky, yo tengo el antivirus kaspersky en mi ordenador si puede ser pego el informe de ese, y sino pos nose como hacerlo, esta muy infectada verdad?? ::ups:: que puedo hacer??? ::stress:: es que encima es nuevo de julio y no quiero k que me estropee, gracias por todo, saludos. Lalets 12/12/06, 01:48:30 hola, bueno con permiso de mi compa Hardrive, aca te van lso pasos a seguir: :1: realiza estos pasos (al pie de la letra): Eliminar Spyware New.net (http://www.forospyware.com/t3804.html) :2: descarga el AVG antispyware 7.5 y spybot (http://www.infospyware.com/Anti-Spywares.htm) y reinicia en modo normal, luego procede a escanear con ellos :3: busca y elimina si es que estan, los siguientes archivos: E:\WINDOWS\system32\wnsinttr.exe E:\WINDOWS\system32\sfg.dll E:\WINDOWS\system32\mwsrvacc.exe E:\WINDOWS\NDNuninstall6_38.exe E:\WINDOWS\NDNuninstall7_22.exe E:\WINDOWS\NDNuninstall7_48.exe E:\WINDOWS\system32\mwsrvacc.exe E:\WINDOWS\system32\rk.bin E:\WINDOWS\system32\rlls.dll E:\WINDOWS\system32\sfg_02c9.dll E:\windows\system32\rlvknlg.exe si no se dejan, utiliza el killbox (http://www.forospyware.com/t42.html) :4: pasa el disk cleaner (http://www.forospyware.com/t42.html) para limpiar galletas y temporales, y el regseeker (http://www.forospyware.com/t713.html) para limpiar el registro :5: reinicia en modo normal y escanea nuevamente con el ewido y tambien con el panda online (http://www.forospyware.com/foro-de-virus-y-spywares/aviso-7.html), si te detectan algo, peganos ambos reportes salu2 :Bien: Hardrive 12/12/06, 01:56:11 EDITADO Lalets respondió primero ;) Sólo agregar una cosita, también ejecutá FixNew.net (http://securityresponse.symantec.com/avcenter/FxNdotN.exe), herramienta la cual elimina el spyware New.net Salu2 taladro92 12/12/06, 12:07:35 Quiero decir un par de cosas , el archivo que se encuentra en C:\Windows\System32\winlogon.exe no es un virus sino que es un archivo legitimo de Microsoft Windows que sirve para el logeo y deslogeo de tu ordenador. Lo que te pasa a ti es que un virus daño ese archivo , un "metodo" para recuperar el winlogon.exe original es instalar el service pack 2 de Windows XP , puedes instalarlo si no lo tienes haciendo click aqui (http://download.microsoft.com/download/6/e/a/6ea24385-85cd-47ac-b7f9-7bd9080063ec/WindowsXP-KB835935-SP2-ESN.exe) Lalets 12/12/06, 12:11:36 Quiero decir un par de cosas , el archivo que se encuentra en C:\Windows\System32\winlogon.exe no es un virus sino que es un archivo legitimo de Microsoft Windows que sirve para el logeo y deslogeo de tu ordenador. Lo que te pasa a ti es que un virus daño ese archivo , un "metodo" para recuperar el winlogon.exe original es instalar el service pack 2 de Windows XP , puedes instalarlo si no lo tienes haciendo click aqui (http://download.microsoft.com/download/6/e/a/6ea24385-85cd-47ac-b7f9-7bd9080063ec/WindowsXP-KB835935-SP2-ESN.exe) nunca dijo la ruta, quiza este en :\Windows\system o :\Windows ;) en el reporte no aparece, quiza manipula e interfiere con ese proceso, asi qeu mientras realiza los pasos que te dejamos Hard y yo ;) salu2 :Bien: taladro92 12/12/06, 12:18:28 nunca dijo la ruta, quiza este en :\Windows\system o :\Windows ;) en el reporte no aparece, quiza manipula e interfiere con ese proceso, asi qeu mientras realiza los pasos que te dejamos Hard y yo ;) salu2 :Bien: Tienes razon , mejor me quedo callado y aprendo ... ;) saludos .. |