Hola.

Creo que hay algo mas que se nos escapa , pero que es

• Descarga Sophos Anti-Rootkit, y guárdelo en el escritorio.
• Haga doble clic en sarsfx.exe para extraer los archivos y dejar la configuración por defecto.
• Abra la carpeta C: \ SOPHTEMP y haga doble clic en sargui.exe para iniciar el programa.
• Asegúrese de que se comprueban los siguientes:
  • Ejecución de los procesos
  • Registro de Windows
  • Local de los discos duros
• Haz clic en "Start Scan".
• Haga clic en el botón "OK" después de que reciba la notificación de que ha terminado la búsqueda .
• Ahora ve a inicio / Ejecutar / Escribe o copia lo siguiente : %Temp% , cuando se haya abierto la carpeta Temp , busca el block de Notas con el Nombre de "SARSCAN"
• Copias y pegas aqui el contenido de ese Block de Notas .

salu2!

Sophos Anti-Rootkit Version 1.3RC (data 1.06) (c) 2006 Sophos Plc
Started logging on 20/03/2008 at 18:33:58
Stopped logging on 20/03/2008 at 18:36:41

alooo? ayudaa XD

Hola.

Disculpa la tardanza es que estaba de vaciones !

Tambien...

salu2!

no pude eliminar nada :S no sabia como

Malwarebytes' Anti-Malware 1.09
Versión de la Base de Datos: 532

Tipo de examen : Examen Completo (A:\|C:\|D:\|E:\|F:\|)
Objetos examinados: 80484
Tiempo transcurrido: 26 minute(s), 9 second(s)

Procesos en Memoria Infectados: 0
Módulos en Memoria Infectados: 0
Claves del Registro Infectadas: 7
Valores del Registro Infectados: 0
Elementos de Datos del Registro Infectados: 0
Carpetas Infectadas: 1
Ficheros Infectados: 3

Procesos en Memoria Infectados:
(No se han detectado elementos maliciosos)

Módulos en Memoria Infectados:
(No se han detectado elementos maliciosos)

Claves del Registro Infectadas:
HKEY_CLASSES_ROOT\activationmanager.activationmana ger (Trojan.MultiDefender) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{86a44ef7-78fc-4e18-a564-b18f806f7f56} (Trojan.MultiDefender) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Browser Helper Objects\{86a44ef7-78fc-4e18-a564-b18f806f7f56} (Trojan.MultiDefender) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\{86a44ef7-78fc-4e18-a564-b18f806f7f56} (Trojan.MultiDefender) -> No action taken.
HKEY_CLASSES_ROOT\activationmanager.activationmana ger.1 (Trojan.MultiDefender) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{86a44ef9-78fc-4e18-a564-b18f806f7f56} (Trojan.MultiDefender) -> No action taken.
HKEY_CURRENT_USER\Software\ActivationManager (Trojan.MultiDefender) -> No action taken.

Valores del Registro Infectados:
(No se han detectado elementos maliciosos)

Elementos de Datos del Registro Infectados:
(No se han detectado elementos maliciosos)

Carpetas Infectadas:
C:\Archivos de programa\ActivationManager (Trojan.MultiDefender) -> No action taken.

Ficheros Infectados:
C:\Archivos de programa\ActivationManager\ActivationManager.dll (Trojan.MultiDefender) -> No action taken.
C:\oufddh.exe (Spyware.OnlineGames) -> No action taken.
C:\Archivos de programa\ActivationManager\Uninstall.exe (Trojan.MultiDefender) -> No action taken.

Hola.

Bueno ahora si vemos las infecciones que tienes , ya que en otros scans , no salia nada.

Primero...

1. Busca y desinstala el
   • ActivationManager

Tambien...

• Descarga The Avenger y lo guardas en el escritorio.
• Descomprime Avenger.zip
• Doble click sobre Avenger.exe
• Click en "Aceptar"
• En el Recuadro Blanco que esta debajo de "Input Scrip here"
  • Copias y pegas el siguiente codigo

• Verificar que la Casilla de "Sca for rootkit",este marcada
• Click sobre "Excute" , Click en "Aceptar"
• Tu pc , sera reiniciada , esto es normal.
• Al Reiniar Avenger , Genera un reporte , copiar y pegar aqui el contenido

salu2!
Me cuentas !

bueno te cuento:

//////////////////////////////////////////
Avenger Pre-Processor log
//////////////////////////////////////////

Platform: Windows XP (build 2600, Service Pack 2)
Mon Mar 24 21:01:32 2008

21:01:32: Error: Invalid script. A valid script must begin with a command directive.
Aborting execution!


//////////////////////////////////////////


//////////////////////////////////////////
Avenger Pre-Processor log
//////////////////////////////////////////

Platform: Windows XP (build 2600, Service Pack 2)
Mon Mar 24 21:01:40 2008

21:01:40: Error: Invalid script. A valid script must begin with a command directive.
Aborting execution!


//////////////////////////////////////////


//////////////////////////////////////////
Avenger Pre-Processor log
//////////////////////////////////////////

Platform: Windows XP (build 2600, Service Pack 2)
Mon Mar 24 21:01:45 2008

21:01:45: Error: Invalid script. A valid script must begin with a command directive.
Aborting execution!


//////////////////////////////////////////


Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!


Error: could not open file "C:\Archivos de programa\ActivationManager\ActivationManager.dll"
Deletion of file "C:\Archivos de programa\ActivationManager\ActivationManager.dll" failed!
Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)
--> bad path / the parent directory does not exist

File "C:\oufddh.exe" deleted successfully.

Error: could not open file "C:\Archivos de programa\ActivationManager\Uninstall.exe"
Deletion of file "C:\Archivos de programa\ActivationManager\Uninstall.exe" failed!
Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)
--> bad path / the parent directory does not exist


Error: folder "C:\Archivos de programa\ActivationManager" not found!
Deletion of folder "C:\Archivos de programa\ActivationManager" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: folder "Registry to delete:" not found!
Deletion of folder "Registry to delete:" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: could not open folder "HKEY_CLASSES_ROOT\activationmanager.activationman a ger"
Deletion of folder "HKEY_CLASSES_ROOT\activationmanager.activationman a ger" failed!
Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)
--> bad path / the parent directory does not exist


Error: could not open folder "HKEY_CLASSES_ROOT\CLSID\{86a44ef7-78fc-4e18-a564-b18f806f7f56}"
Deletion of folder "HKEY_CLASSES_ROOT\CLSID\{86a44ef7-78fc-4e18-a564-b18f806f7f56}" failed!
Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)
--> bad path / the parent directory does not exist


Error: could not open folder "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Cur r entVersion\Explorer\Browser Helper Objects\{86a44ef7-78fc-4e18-a564-b18f806f7f56}"
Deletion of folder "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Cur r entVersion\Explorer\Browser Helper Objects\{86a44ef7-78fc-4e18-a564-b18f806f7f56}" failed!
Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)
--> bad path / the parent directory does not exist


Error: could not open folder "HKEY_CLASSES_ROOT\activationmanager.activationman a ger.1"
Deletion of folder "HKEY_CLASSES_ROOT\activationmanager.activationman a ger.1" failed!
Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)
--> bad path / the parent directory does not exist


Error: could not open folder "HKEY_CLASSES_ROOT\Typelib\{86a44ef9-78fc-4e18-a564-b18f806f7f56}"
Deletion of folder "HKEY_CLASSES_ROOT\Typelib\{86a44ef9-78fc-4e18-a564-b18f806f7f56}" failed!
Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)
--> bad path / the parent directory does not exist


Error: could not open folder "HKEY_CURRENT_USER\Software\ActivationManager"
Deletion of folder "HKEY_CURRENT_USER\Software\ActivationManager" failed!
Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)
--> bad path / the parent directory does not exist


Completed script processing.

*******************

Finished! Terminate.

Hola.

prueba con este codigo :

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!


Error: could not open file "C:\Archivos de programa\ActivationManager\ActivationManager.dll"
Deletion of file "C:\Archivos de programa\ActivationManager\ActivationManager.dll" failed!
Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)
--> bad path / the parent directory does not exist


Error: file "C:\oufddh.exe" not found!
Deletion of file "C:\oufddh.exe" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: could not open file "C:\Archivos de programa\ActivationManager\Uninstall.exe"
Deletion of file "C:\Archivos de programa\ActivationManager\Uninstall.exe" failed!
Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)
--> bad path / the parent directory does not exist


Error: folder "C:\Archivos de programa\ActivationManager" not found!
Deletion of folder "C:\Archivos de programa\ActivationManager" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: folder "Registry to delete:" not found!
Deletion of folder "Registry to delete:" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: could not open folder "HKEY_CLASSES_ROOT\activationmanager.activationman a ger"
Deletion of folder "HKEY_CLASSES_ROOT\activationmanager.activationman a ger" failed!
Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)
--> bad path / the parent directory does not exist


Error: could not open folder "HKEY_CLASSES_ROOT\CLSID\{86a44ef7-78fc-4e18-a564-b18f806f7f56}"
Deletion of folder "HKEY_CLASSES_ROOT\CLSID\{86a44ef7-78fc-4e18-a564-b18f806f7f56}" failed!
Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)
--> bad path / the parent directory does not exist


Error: could not open folder "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Cur r entVersion\Explorer\Browser Helper Objects\{86a44ef7-78fc-4e18-a564-b18f806f7f56}"
Deletion of folder "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Cur r entVersion\Explorer\Browser Helper Objects\{86a44ef7-78fc-4e18-a564-b18f806f7f56}" failed!
Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)
--> bad path / the parent directory does not exist


Error: could not open folder "HKEY_CLASSES_ROOT\activationmanager.activationman a ger.1"
Deletion of folder "HKEY_CLASSES_ROOT\activationmanager.activationman a ger.1" failed!
Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)
--> bad path / the parent directory does not exist


Error: could not open folder "HKEY_CLASSES_ROOT\Typelib\{86a44ef9-78fc-4e18-a564-b18f806f7f56}"
Deletion of folder "HKEY_CLASSES_ROOT\Typelib\{86a44ef9-78fc-4e18-a564-b18f806f7f56}" failed!
Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)
--> bad path / the parent directory does not exist


Error: could not open folder "HKEY_CURRENT_USER\Software\ActivationManager"
Deletion of folder "HKEY_CURRENT_USER\Software\ActivationManager" failed!
Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)
--> bad path / the parent directory does not exist


Completed script processing.

*******************

Finished! Terminate.

Hola.

Ahora si acepto de bueno forma el scrip,pero no elimino nada , parece que las entrdas del registro asi como los archivos ya no estan.

Por favor vuelve a pasar el Malwaresbytes antimalware.

salu2!