Saludos Señores.

Escribo en este foro para solucionar un problema que al parecer es bastante comun en estos foros, mas sin embargo despues de probar las soluciones propuestas hasta ahora, aun se presenta el problema.

Me refiero al "Virus Protect Pro", mas especificamente al globito de advertencia que se queda en la barra de tareas y que constantemente te esta avisando que tienes 'spyware' ejecutando aun despues de haber desinstalado dicho programa.

Hasta ahora ya segui los pasos de instalar, actualizar y correr "superantispyware", "delPSguard" y "CCleaner", despues de haber desactivado la Restauracion del Sistema, asi como mostrar los archivos ocultos y pasar ha modo a prueba de fallos.

ya tambien ejecute los siguientes programas: "panda antispyaware en linea", "kaspersky", "ewido", "spyswepeer, "Adaware". Spy bot" y "CWShredder".

Todo esto sin ningun exito (el globito sigue ahi).

Aqui les pongo los Logs de los programas que ya ejecute, con la esperanza de que me den alguna pista de que mas hacer.

(INCLUYENDO EL DE HIJACKTHIS AL FINAL)

__________________________________________________ __________________________________________________ ________

DelPSGuard v 4.6.2
by www.ForoSpyware.com
Escaneo a las: 16:04:51.35, 06/08/2007
SO: Microsoft Windows XP [Versi¢n 5.1.2600]


»»»»»»»»»»»» Carpetas y Archivos infectados »»»»»»»»»»»»


»»»»»»»»»»»» Programas Malwares »»»»»»»»»»»»


»»»»»»»»»»»» FIN »»»»»»»»»»»»

__________________________________________________ __________________________________________________ ________



SPYSWEEPER

05:38 p.m.: Traces Found: 1
05:38 p.m.: Full Sweep has completed. Elapsed time 00:15:34
05:38 p.m.: File Sweep Complete, Elapsed Time: 00:14:01
05:30 p.m.: Warning: SweepDirectories: Cannot find directory "d:". This directory was not added to the list of paths to be

scanned.
05:30 p.m.: Warning: Failed to open file "c:\documents and settings\networkservice\datos de programa\webroot\spy

sweeper\temp\ssms39785dc1-6eda-41d6-91c0-e21c1681888a.tmp". La operación se ha completado correctamente
05:30 p.m.: Warning: Failed to open file "c:\documents and settings\networkservice\datos de programa\webroot\spy

sweeper\temp\ssmsbf2b0132-4b00-4b1a-b4da-5c1488cd5f57.tmp". La operación se ha completado correctamente
05:30 p.m.: Warning: Failed to open file "c:\documents and settings\networkservice\datos de programa\webroot\spy

sweeper\temp\ssms095e5efd-4f1b-4b01-9907-4b841ed78740.tmp". La operación se ha completado correctamente
05:30 p.m.: Warning: Failed to open file "c:\documents and settings\networkservice\datos de programa\webroot\spy

sweeper\temp\ssms9af97d0f-801b-48ea-9622-6c65fbcba108.tmp". La operación se ha completado correctamente
05:30 p.m.: Warning: Failed to open file "c:\documents and settings\networkservice\datos de programa\webroot\spy

sweeper\temp\ssmsa24efa55-8627-4f35-8e8a-8481eef41075.tmp". La operación se ha completado correctamente
05:30 p.m.: Warning: Failed to open file "c:\documents and settings\networkservice\datos de programa\webroot\spy

sweeper\temp\ssmsa880dcdb-c6d2-4a1f-917b-4262f4aa689e.tmp". La operación se ha completado correctamente
05:30 p.m.: Warning: Failed to open file "c:\documents and settings\networkservice\datos de programa\webroot\spy

sweeper\temp\ssms27d2a045-897e-43cc-8152-6de33dfca7ff.tmp". La operación se ha completado correctamente
05:30 p.m.: Warning: Failed to open file "c:\documents and settings\networkservice\datos de programa\webroot\spy

sweeper\temp\ssmse6288370-894b-4908-b51b-286b83ec2f84.tmp". La operación se ha completado correctamente
05:30 p.m.: Warning: Failed to open file "c:\documents and settings\networkservice\datos de programa\webroot\spy

sweeper\temp\ssmsebe4dc44-0d0c-4288-b79a-c7ec4f55b058.tmp". La operación se ha completado correctamente
05:30 p.m.: Warning: Failed to open file "c:\documents and settings\networkservice\datos de programa\webroot\spy

sweeper\temp\ssms7bfba6ad-e8c1-4c86-8edc-4d9092c099f3.tmp". La operación se ha completado correctamente
05:30 p.m.: Warning: Failed to open file "c:\documents and settings\networkservice\datos de programa\webroot\spy

sweeper\temp\ssmse32ea058-245d-4f8f-8cf7-182a1ec0fb46.tmp". La operación se ha completado correctamente
05:30 p.m.: Warning: Failed to open file "c:\documents and settings\networkservice\datos de programa\webroot\spy

sweeper\temp\ssmsb865ab77-9f07-492b-a2ec-4833bec014e0.tmp". La operación se ha completado correctamente
05:24 p.m.: Starting File Sweep
05:24 p.m.: Warning: SweepDirectories: Cannot find directory "a:". This directory was not added to the list of paths to be

scanned.
05:24 p.m.: Cookie Sweep Complete, Elapsed Time: 00:00:00
05:24 p.m.: Starting Cookie Sweep
05:24 p.m.: Registry Sweep Complete, Elapsed Time:00:01:20
05:24 p.m.: HKU\S-1-5-21-1644491937-1078081533-725345543-500\software\security tools\ (ID = 2221338)
05:24 p.m.: Found Trojan Horse: trojan-downloader-zlob
05:24 p.m.: Memory Sweep Complete, Elapsed Time: 00:00:00
05:24 p.m.: Starting Registry Sweep
05:22 p.m.: Starting Memory Sweep
05:22 p.m.: Sweep initiated using definitions version 962
05:22 p.m.: Spy Sweeper 5.5.7.48 started
05:22 p.m.: | Start of Session, Lunes, 06 de Agosto de 2007 |
***************
05:21 p.m.: Program Version 5.5.7.48 Using Spyware Definitions 962
05:21 p.m.: Spy Sweeper 5.5.7.48 started
05:21 p.m.: | Start of Session, Lunes, 06 de Agosto de 2007 |
***************
Keylogger: Off
05:16 p.m.: Informational: ShieldEmail: Start monitoring port 25 for mail activities
05:16 p.m.: Informational: ShieldEmail: Start monitoring port 110 for mail activities
E-mail Attachment: On
BHO Shield: On
IE Security Shield: On
Alternate Data Stream (ADS) Execution Shield: On
Startup Shield: On
Common Ad Sites: Off
Hosts File Shield: On
Internet Communication Shield: On
ActiveX Shield: On
Windows Messenger Service Shield: On
IE Favorites Shield: On
File System Shield: On
Execution Shield: On
System Services Shield: On
IE Hijack Shield: On
IE Tracking Cookies Shield: Off
05:16 p.m.: Shield States
05:16 p.m.: License Check Status (0): Success
05:16 p.m.: Spyware Definitions: 962
05:16 p.m.: Spy Sweeper 5.5.7.48 started
05:16 p.m.: Spy Sweeper 5.5.7.48 started
05:16 p.m.: | Start of Session, Lunes, 06 de Agosto de 2007 |
***************

__________________________________________________ __________________________________________________ ________

PANDA EN LINEA

Incidencia Estado Elemento





Spyware:Cookie/YieldManager No desinfectado C:\Documents

and Settings\Administrador\Cookies\administrador@ad.yi eldmanager[1].txt



__________________________________________________ __________________________________________________ ________

__________________________________________________
ewido anti-spyware online scanner
http://www.ewido.net
__________________________________________________


Name: TrackingCookie.Netflame
Path: C:\Documents and Settings\Administrador\Cookies\administrador@ssl-hints.netflame[2].txt
Risk: Medium

__________________________________________________ __________________________________________________ ________

KASPERSKY ONLINE SCANNER REPORT

Monday, August 06, 2007 3:57:12 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 6/08/2007
Kaspersky Anti-Virus database records: 376185
Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true
Scan Target My Computer
A:\
C:\
D:\
Scan Statistics
Total number of scanned objects 18526
Number of viruses found 0
Number of infected objects 0 / 0
Number of suspicious objects 0
Duration of the scan process 00:25:41

Infected Object Name Virus Name Last Action
C:\$Persi0.sys Object is locked skipped
C:\Documents and Settings\Administrador\Configuración local\Archivos temporales de Internet\Content.IE5\index.dat

Object is locked skipped
C:\Documents and Settings\Administrador\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat Object is

locked skipped
C:\Documents and Settings\Administrador\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat.LOG

Object is locked skipped
C:\Documents and Settings\Administrador\Configuración local\Historial\History.IE5\index.dat Object is locked

skipped
C:\Documents and Settings\Administrador\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Administrador\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Administrador\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\All Users\Datos de programa\Microsoft\Network\Downloader\qmgr0.dat Object is locked

skipped
C:\Documents and Settings\All Users\Datos de programa\Microsoft\Network\Downloader\qmgr1.dat Object is locked

skipped
C:\Documents and Settings\LocalService\Configuración local\Archivos temporales de Internet\Content.IE5\index.dat

Object is locked skipped
C:\Documents and Settings\LocalService\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat Object is

locked skipped
C:\Documents and Settings\LocalService\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat.LOG

Object is locked skipped
C:\Documents and Settings\LocalService\Configuración local\Historial\History.IE5\index.dat Object is locked

skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat Object is

locked skipped
C:\Documents and Settings\NetworkService\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat.LOG

Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{2889A636-DA59-4662-B5B6-07ACB7FD9FC5}\RP2\change.log Object is locked

skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.lo g Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MA P Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MA P Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DAT A Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
Scan process completed.

__________________________________________________ __________________________________________________ ________

y FINALMENTE EL LOG DE HIJACKTHIS

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 06:12:06 p.m., on 06/08/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Safe mode

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Archivos de programa\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\explorer.exe
C:\Archivos de programa\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
C:\Documents and Settings\Administrador\Mis documentos\Nueva carpeta\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Archivos de programa\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {34E6F97C-34E0-4CE5-B92B-F83634BEDC01} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARCHIV~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [AVG7_CC] "C:\ARCHIV~1\Grisoft\AVG7\avgcc.exe" /STARTUP
O4 - HKLM\..\Run: [SpySweeper] C:\Archivos de programa\Webroot\Spy Sweeper\SpySweeperUI.exe /startintray
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Archivos de programa\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Archivos de programa\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Servicio de red')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\ARCHIV~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Servicio de red')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Archivos de programa\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Wireless Configuration Utility HW.51.lnk = ?
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Referencia - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARCHIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{5BAF1D44-6EE1-43E0-B3B8-A744EFAB42DB}: NameServer = 200.33.148.201,200.33.148.193
O17 - HKLM\System\CS1\Services\Tcpip\..\{5BAF1D44-6EE1-43E0-B3B8-A744EFAB42DB}: NameServer = 200.33.148.201,200.33.148.193
O17 - HKLM\System\CS2\Services\Tcpip\..\{5BAF1D44-6EE1-43E0-B3B8-A744EFAB42DB}: NameServer = 200.33.148.201,200.33.148.193
O20 - Winlogon Notify: !SASWinLogon - C:\Archivos de programa\SUPERAntiSpyware\SASWINLO.DLL
O20 - Winlogon Notify: DfLogon - C:\WINDOWS\SYSTEM32\LogonDll.dll
O22 - SharedTaskScheduler: Precargador Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Demonio de caché de las categorías de componente - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: exultet - {4f5f16ef-af9d-4fe6-8410-f0670b58979d} - C:\WINDOWS\system32\gusur.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\ARCHIV~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\ARCHIV~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\ARCHIV~1\Grisoft\AVG7\avgemc.exe
O23 - Service: DF5Serv - Faronics Corporation - C:\Archivos de programa\Faronics\Deep Freeze\Install C-0\DF5Serv.exe
O23 - Service: Servicio del administrador de discos lógicos (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Cargador del Terminal (escSrv) - Unknown owner - C:\WINDOWS\system32\escsrv.exe
O23 - Service: Registro de sucesos (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Servicio COM de grabación de CD de IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe
O23 - Service: Escritorio remoto compartido de NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe
O23 - Service: Plug and Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Administrador de sesión de Ayuda de escritorio remoto (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Tarjeta inteligente (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Registros y alertas de rendimiento (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Instantáneas de volumen (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Motor de Spy Sweeper de Webroot (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Archivos de programa\Webroot\Spy Sweeper\SpySweeper.exe
O23 - Service: Adaptador de rendimiento de WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe

--
End of file - 6102 bytes
__________________________________________________ __________________________________________________ ________


De antemano gracias.

Hola y Bienvenid@ a forospyware

Políticas del Foro de InfoSpyware

Continuamos en este Tema