|
| |||||||
 | Registrarse | Lista de usuarios | AntiSpywares | AntiVirus |
 |
| | Herramientas |
 | 
13/04/08, 13:19:54
|  |
| ||||
| Re: problemas con msn. Virus foto.zip y números .exe Hola! antes te pido disculpas por tardar en responderte... Bueno te cuento que segui los pasos que me indicaste y efectivamente las dns qu estan configuradas en mi sitema me incican que son "Ukraine", el tema es que en los TIPS dice cambiarlas por las provistas por nuestro ISP. y no sé cuales son. ¿cómo puedo saberlo?  La entrada en modo a prueba de fallos no aparece. y cuando reinicio, aparece cada vez que me conecto a internet Te paso el último reporte de Hijackthis. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:18:24, on 13/04/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Archivos de programa\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Archivos de programa\ZyXEL\ADSL USB Modem\CnxDslTb.exe C:\Archivos de programa\QuickTime\qttask.exe C:\WINDOWS\system32\ctfmon.exe C:\Archivos de programa\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Archivos de programa\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe C:\WINDOWS\system32\wscntfy.exe C:\Archivos de programa\Google\Google Talk\googletalk.exe C:\ARCHIV~1\MOZILL~1\FIREFOX.EXE C:\Archivos de programa\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *.local O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe O4 - HKLM\..\Run: [PV92TRAY] PV92Tray.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Archivos de programa\ZyXEL\ADSL USB Modem\CnxDslTb.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Archivos de programa\QuickTime\qttask.exe" -atboottime O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Archivos de programa\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICIO LOCAL') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Servicio de red') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Kodak software updater.lnk = C:\Archivos de programa\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Archivos de programa\Bonjour\ExplorerPlugin.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe (file missing) O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/spanish/kavwebscan_unicode.cab O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1206665915621 O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://fotosdemoi.spaces.live.com/PhotoUpload/MsnPUpld.cab O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game09.zylom.com/activex/zylomgamesplayer.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{42B40EDD-7F63-4C53-A263-4937C53728DA}: NameServer = 85.255.116.102 85.255.112.170 O20 - Winlogon Notify: !SASWinLogon - C:\Archivos de programa\SUPERAntiSpyware\SASWINLO.dll O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Archivos de programa\Bonjour\mDNSResponder.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Archivos de programa\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - C:\WINDOWS\system32\drivers\KodakCCS.exe (file missing) O23 - Service: MySql - Unknown owner - C:/Archivos de programa/xampp/xampp-win32-1.6.2/xampp/mysql/bin/mysqld-nt.exe O23 - Service: NMIndexingService - Unknown owner - C:\Archivos de programa\Archivos comunes\Ahead\Lib\NMIndexingService.exe (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe -- End of file - 5154 bytes Última edición por moirasol fecha: 13/04/08 a las 14:00:46.      |
|
13/04/08, 14:58:10
| |
| ||||
| Re: problemas con msn. Virus foto.zip y números .exe Cita:
__________________ Novedades del Foro | Antivirus Online | Eliminar Malwares | Políticas del Foro | Blog * Ayúdanos haciendo una DONACIÓN para poder seguir Ayudando. * Para evitar Virus y Spywares al navegar por internet, USE FIREFOX !! * No se resuelven dudas por Privados ni por E-mail, ya que para eso esta el foro. |
|
13/04/08, 18:25:41
| |
| ||||
| Re: problemas con msn. Virus foto.zip y números .exe guillermo te paso el log de panda. Muchas gracias! Código: ----------------------------
;***********************************************************************************************************************************************************************************
ANALYSIS: 2008-04-13 21:23:26
PROTECTIONS: 0
MALWARE: 19
SUSPECTS: 0
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description Version Active Updated
;===================================================================================================================================================================================
;===================================================================================================================================================================================
MALWARE
Id Description Type Active Severity Disinfectable Disinfected Location
;===================================================================================================================================================================================
00005468 dialer.bb Dialers No 0 Yes No c:\windows\system32\dktibs.exe
00029036 adware/superspider Adware No 1 Yes No c:\winspec.dat
00029036 adware/superspider Adware No 1 Yes No c:\mssys.com
00029036 adware/superspider Adware No 1 Yes No c:\q250204.exe
00029036 adware/superspider Adware No 1 Yes No c:\windows\system32\services
00029036 adware/superspider Adware No 1 Yes No hkey_current_user\software\microsoft\internet explorer\main\spded
00029036 adware/superspider Adware No 1 Yes No hkey_current_user\software\microsoft\internet explorer\main\hpded
00120012 adware/wincomm Adware No 0 Yes No hkey_local_machine\software\win comm
00122009 Adware/IESearchBar Adware No 0 No No C:\WINDOWS\SYSTEM32\DOWNLOAD.EXE[IESearchToolbar.dll]
00167704 Cookie/Xiti TrackingCookie No 0 Yes No C:\Documents and Settings\Esteban\Datos de programa\Mozilla\Firefox\Profiles\w7jy6iem.default\COOKIES.TXT[.xiti.com/]
00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Esteban\Datos de programa\Mozilla\Firefox\Profiles\w7jy6iem.default\COOKIES.TXT[.statcounter.com/]
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Esteban\Datos de programa\Mozilla\Firefox\Profiles\w7jy6iem.default\COOKIES.TXT[ad.yieldmanager.com/]
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\FOUND.007\FILE0000.CHK
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Esteban\Datos de programa\Mozilla\Firefox\Profiles\w7jy6iem.default\COOKIES.TXT[ad.yieldmanager.com/]
00168113 Cookie/fe.lea.lycos TrackingCookie No 0 Yes No C:\Documents and Settings\Esteban\Datos de programa\Mozilla\Firefox\Profiles\w7jy6iem.default\COOKIES.TXT[fe.lea.lycos.de/]
00168115 Cookie/ads.tripod.lycos.com TrackingCookie No 0 Yes No C:\Documents and Settings\Esteban\Datos de programa\Mozilla\Firefox\Profiles\w7jy6iem.default\COOKIES.TXT[.ads.tripod.lycos.de/]
00241834 Application/MyWebSearch HackTools No 0 Yes No C:\Archivos de programa\Mozilla Firefox\PLUGINS\NPMyWebS.dll
00255579 Adware/IST.ISTBar Adware No 1 Yes No C:\Archivos de programa\StripSaver2\WindowsEx.dll
00255579 Adware/IST.ISTBar Adware No 1 Yes No C:\Archivos de programa\Archivos comunes\Totem Shared\Update\WindowsEx.dll.042
00366244 Application/NirCmd.A HackTools No 0 Yes No C:\System Volume Information\_restore{D4E444B5-83D2-44F2-B24A-9D880437F307}\RP5\A0000612.EXE
00366244 Application/NirCmd.A HackTools No 0 Yes No C:\fixwareout\FindT\NIRCMD.EXE
01048427 Generic Malware Virus/Trojan No 0 No No C:\Archivos de programa\eMule\Incoming\MUSICA DE EMUL\Crack Quark Xpress 6.0.rar[Crack Quark XPress 6.0\Patch1.exe]
01049070 Generic Malware Virus/Trojan No 0 No No C:\Archivos de programa\eMule\Incoming\MUSICA DE EMUL\Crack Quark Xpress 6.0.rar[Crack Quark XPress 6.0\Patch2.exe]
01132474 Generic Trojan Virus/Trojan No 0 Yes No C:\WINDOWS\SHUTDOWN.EXE
01185375 Application/Psexec.A HackTools No 0 Yes No C:\System Volume Information\_restore{D4E444B5-83D2-44F2-B24A-9D880437F307}\RP9\A0000893.EXE
01185375 Application/Psexec.A HackTools No 0 Yes No C:\System Volume Information\_restore{D4E444B5-83D2-44F2-B24A-9D880437F307}\RP9\A0000902.EXE
01185375 Application/Psexec.A HackTools No 0 Yes No C:\WINDOWS\PSEXESVC.EXE
02068642 Adware/SaveNow Adware No 0 Yes No C:\SOFT\CrystalFree.exe
02885963 Rootkit/Booto.C Virus/Worm No 0 Yes No C:\System Volume Information\_restore{D4E444B5-83D2-44F2-B24A-9D880437F307}\RP9\A0000897.SYS
02908593 W32/Oscarbot.TK.worm Virus/Trojan No 1 Yes No C:\System Volume Information\_restore{D4E444B5-83D2-44F2-B24A-9D880437F307}\RP5\A0000653.EXE
;===================================================================================================================================================================================
SUSPECTS
Sent Location (
;===================================================================================================================================================================================
;===================================================================================================================================================================================
VULNERABILITIES
Id Severity Description (
;===================================================================================================================================================================================
184380 MEDIUM MS08-002 (
184379 MEDIUM MS08-001 (
182048 HIGH MS07-069 (
182046 HIGH MS07-067 (
182043 HIGH MS07-064 (
179553 HIGH MS07-061 (
176382 HIGH MS07-057 (
176383 HIGH MS07-058 (
170911 HIGH MS07-050 (
170907 HIGH MS07-046 (
170906 HIGH MS07-045 (
170904 HIGH MS07-043 (
164915 HIGH MS07-035 (
164913 HIGH MS07-033 (
164911 HIGH MS07-031 (
160623 HIGH MS07-027 (
157262 HIGH MS07-022 (
157261 HIGH MS07-021 (
157260 HIGH MS07-020 (
157259 HIGH MS07-019 (
156477 HIGH MS07-017 (
150253 HIGH MS07-016 (
150249 HIGH MS07-013 (
150248 HIGH MS07-012 (
150247 HIGH MS07-011 (
150243 HIGH MS07-008 (
150242 HIGH MS07-007 (
150241 MEDIUM MS07-006 (
141034 HIGH MS06-076 (
141033 MEDIUM MS06-075 (
141030 HIGH MS06-072 (
137571 HIGH MS06-070 (
137568 HIGH MS06-067 (
133387 MEDIUM MS06-065 (
133386 MEDIUM MS06-064 (
133385 MEDIUM MS06-063 (
133379 HIGH MS06-057 (
131654 HIGH MS06-055 (
129977 MEDIUM MS06-053 (
129976 MEDIUM MS06-052 (
126093 HIGH MS06-051 (
126092 MEDIUM MS06-050 (
126087 HIGH MS06-046 (
126086 MEDIUM MS06-045 (
126083 HIGH MS06-042 (
126082 HIGH MS06-041 (
126081 HIGH MS06-040 (
123421 HIGH MS06-036 (
123420 HIGH MS06-035 (
120825 MEDIUM MS06-032 (
120823 MEDIUM MS06-030 (
120818 HIGH MS06-025 (
120815 HIGH MS06-022 (
120814 HIGH MS06-021 (
117384 MEDIUM MS06-018 (
114666 HIGH MS06-015 (
114664 HIGH MS06-013 (
108744 MEDIUM MS06-008 (
108743 MEDIUM MS06-007 (
108742 MEDIUM MS06-006 (
104567 HIGH MS06-002 (
104237 HIGH MS06-001 (
96574 HIGH MS05-053 (
93395 HIGH MS05-051 (
93394 HIGH MS05-050 (
93454 MEDIUM MS05-049 (
;=================================================================================================================================================================================== Última edición por GuillermoTell fecha: 13/04/08 a las 18:42:55. |
|
13/04/08, 18:54:32
| |
| ||||
 Re: problemas con msn. Virus foto.zip y números .exe Hola moirasol te doy la bienvenida al foro de Infospyware.  -Apaga el "Restaurar Sistema" (solo en Win Me y XP) y activa ver archivos ocultos. - Descarga, Instala y/o actualiza y estos programas, (pero no las ejecutes aun). -Reinicia en Modo Seguro (a prueba de fallos)  -Ejecuta estos programas (de a uno).
Realiza un escaneo completo del PC y elimina las infecciones que este encuentre siguiendo las indicaciones de su manual.
Código HTML: c:\windows\system32\dktibs.exe c:\winspec.dat c:\mssys.com c:\q250204.exe c:\windows\system32\services C:\WINDOWS\SYSTEM32\DOWNLOAD.EXE C:\FOUND.007\FILE0000.CHK C:\Archivos de programa\Mozilla Firefox\PLUGINS\NPMyWebS.dll C:\Archivos de programa\StripSaver2 C:\Archivos de programa\Archivos comunes\Totem Shared\Update\WindowsEx.dll.042 C:\Archivos de programa\eMule\Incoming\MUSICA DE EMUL\Crack Quark Xpress 6.0.rar C:\WINDOWS\SHUTDOWN.EXE C:\WINDOWS\PSEXESVC.EXE C:\SOFT\CrystalFree.exe y pegarlo en el marco "Full Path of File to Delete"  - Reinicia en modo normal y elimina la carpeta C:\¡Killbox y usa el CCleaner para limpiar el sistema.Primero utiliza la opción de "Limpiador" para borrar cookies, temporales de Internet y todos los archivos que este te muestre como obsoletos. Luego usa su opción de "Registro" para limpiar todo el registro de Windows (haciendo copia de seguridad).  -Pega un nuevo Log de Hijackthis y un reporte de Panda comentanos como esta trabajando el PC. NOTA: -Para mayor comodidad imprime los pasos. -Al terminar los pasos esconde los archivos ocultos y activa restaurar sistema. -Recuerda volver y contarnos los resultados.
__________________ Novedades del Foro | Antivirus Online | Eliminar Malwares | Políticas del Foro | Blog * Ayúdanos haciendo una DONACIÓN para poder seguir Ayudando. * Para evitar Virus y Spywares al navegar por internet, USE FIREFOX !! * No se resuelven dudas por Privados ni por E-mail, ya que para eso esta el foro. |
|
22/04/08, 21:20:00
| |
| ||||
| Re: problemas con msn. Virus foto.zip y números .exe gustavo, te paso los logs que me pediste...la compu anda bien pero la entrada O17 - HKLM\System\CCS\Services\Tcpip\..\{42B40EDD-7F63-4C53-A263-4937C53728DA}: NameServer = 85.255.116.102 85.255.112.170 sigue apareciendo. Lei los tips sobre el tema pero no sé como modificar las dns.  Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 22:14:07, on 22/04/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Archivos de programa\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Archivos de programa\ZyXEL\ADSL USB Modem\CnxDslTb.exe C:\Archivos de programa\QuickTime\qttask.exe C:\WINDOWS\system32\ctfmon.exe C:\Archivos de programa\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Archivos de programa\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe C:\Archivos de programa\MSN Messenger\msnmsgr.exe C:\Archivos de programa\Google\Google Talk\googletalk.exe C:\ARCHIV~1\MOZILL~1\FIREFOX.EXE C:\Archivos de programa\Outlook Express\msimn.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Archivos de programa\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe O4 - HKLM\..\Run: [PV92TRAY] PV92Tray.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Archivos de programa\ZyXEL\ADSL USB Modem\CnxDslTb.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Archivos de programa\QuickTime\qttask.exe" -atboottime O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Archivos de programa\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICIO LOCAL') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Servicio de red') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Kodak software updater.lnk = C:\Archivos de programa\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Archivos de programa\Bonjour\ExplorerPlugin.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe (file missing) O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/spanish/kavwebscan_unicode.cab O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1206665915621 O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://fotosdemoi.spaces.live.com/PhotoUpload/MsnPUpld.cab O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game09.zylom.com/activex/zylomgamesplayer.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{42B40EDD-7F63-4C53-A263-4937C53728DA}: NameServer = 85.255.116.102 85.255.112.170 O20 - Winlogon Notify: !SASWinLogon - C:\Archivos de programa\SUPERAntiSpyware\SASWINLO.dll O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Archivos de programa\Bonjour\mDNSResponder.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Archivos de programa\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - C:\WINDOWS\system32\drivers\KodakCCS.exe (file missing) O23 - Service: MySql - Unknown owner - C:/Archivos de programa/xampp/xampp-win32-1.6.2/xampp/mysql/bin/mysqld-nt.exe O23 - Service: NMIndexingService - Unknown owner - C:\Archivos de programa\Archivos comunes\Ahead\Lib\NMIndexingService.exe (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe -- End of file - 5194 bytes --------------------------------------------------- ================================================== ================================================== ========================= |
|
22/04/08, 21:20:54
| |
| ||||
| Re: problemas con msn. Virus foto.zip y números .exe a continuación el log de panda. Muchas gracias Código: ;***********************************************************************************************************************************************************************************
ANALYSIS: 2008-04-22 21:12:15
PROTECTIONS: 0
MALWARE: 12
SUSPECTS: 0
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description Version Active Updated
;===================================================================================================================================================================================
;===================================================================================================================================================================================
MALWARE
Id Description Type Active Severity Disinfectable Disinfected Location
;===================================================================================================================================================================================
00029036 adware/superspider Adware No 1 Yes No hkey_current_user\software\microsoft\internet explorer\main\hpded
00029036 adware/superspider Adware No 1 Yes No hkey_current_user\software\microsoft\internet explorer\main\spded
00120012 adware/wincomm Adware No 0 Yes No hkey_local_machine\software\win comm
00122009 Adware/IESearchBar Adware No 0 No No C:\System Volume Information\_restore{D4E444B5-83D2-44F2-B24A-9D880437F307}\RP22\A0001755.EXE[IESearchToolbar.dll]
00122009 Adware/IESearchBar Adware No 0 No No C:\System Volume Information\_restore{D4E444B5-83D2-44F2-B24A-9D880437F307}\RP21\A0001699.EXE[IESearchToolbar.dll]
00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Esteban\Datos de programa\Mozilla\Firefox\Profiles\w7jy6iem.default\COOKIES.TXT[.statcounter.com/]
00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Esteban\Datos de programa\Mozilla\Firefox\Profiles\w7jy6iem.default\COOKIES.TXT[.statcounter.com/]
00241834 Application/MyWebSearch HackTools No 0 Yes No C:\System Volume Information\_restore{D4E444B5-83D2-44F2-B24A-9D880437F307}\RP22\A0001754.DLL
00241834 Application/MyWebSearch HackTools No 0 Yes No C:\System Volume Information\_restore{D4E444B5-83D2-44F2-B24A-9D880437F307}\RP21\A0001700.DLL
00255579 Adware/IST.ISTBar Adware No 1 Yes No C:\Archivos de programa\StripSaver2\WindowsEx.dll
00366244 Application/NirCmd.A HackTools No 0 Yes No C:\fixwareout\FindT\NIRCMD.EXE
00366244 Application/NirCmd.A HackTools No 0 Yes No C:\System Volume Information\_restore{D4E444B5-83D2-44F2-B24A-9D880437F307}\RP5\A0000612.EXE
01132474 Generic Trojan Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{D4E444B5-83D2-44F2-B24A-9D880437F307}\RP22\A0001753.EXE
01132474 Generic Trojan Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{D4E444B5-83D2-44F2-B24A-9D880437F307}\RP21\A0001701.EXE
01185375 Application/Psexec.A HackTools No 0 Yes No C:\System Volume Information\_restore{D4E444B5-83D2-44F2-B24A-9D880437F307}\RP21\A0001702.EXE
01185375 Application/Psexec.A HackTools No 0 Yes No C:\System Volume Information\_restore{D4E444B5-83D2-44F2-B24A-9D880437F307}\RP9\A0000893.EXE
01185375 Application/Psexec.A HackTools No 0 Yes No C:\System Volume Information\_restore{D4E444B5-83D2-44F2-B24A-9D880437F307}\RP22\A0001752.EXE
01185375 Application/Psexec.A HackTools No 0 Yes No C:\System Volume Information\_restore{D4E444B5-83D2-44F2-B24A-9D880437F307}\RP9\A0000902.EXE
02068642 Adware/SaveNow Adware No 0 Yes No C:\System Volume Information\_restore{D4E444B5-83D2-44F2-B24A-9D880437F307}\RP21\A0001703.EXE
02068642 Adware/SaveNow Adware No 0 Yes No C:\System Volume Information\_restore{D4E444B5-83D2-44F2-B24A-9D880437F307}\RP22\A0001751.EXE
02885963 Rootkit/Booto.C Virus/Worm No 0 Yes No C:\System Volume Information\_restore{D4E444B5-83D2-44F2-B24A-9D880437F307}\RP9\A0000897.SYS
02908593 W32/Oscarbot.TK.worm Virus/Trojan No 1 Yes No C:\System Volume Information\_restore{D4E444B5-83D2-44F2-B24A-9D880437F307}\RP5\A0000653.EXE
;===================================================================================================================================================================================
SUSPECTS
Sent Location a
;===================================================================================================================================================================================
;===================================================================================================================================================================================
VULNERABILITIES
Id Severity Description a
;===================================================================================================================================================================================
184380 MEDIUM MS08-002 a
184379 MEDIUM MS08-001 a
182048 HIGH MS07-069 a
182046 HIGH MS07-067 a
182043 HIGH MS07-064 a
179553 HIGH MS07-061 a
176382 HIGH MS07-057 a
176383 HIGH MS07-058 a
170911 HIGH MS07-050 a
170907 HIGH MS07-046 a
170906 HIGH MS07-045 a
170904 HIGH MS07-043 a
164915 HIGH MS07-035 a
164913 HIGH MS07-033 a
164911 HIGH MS07-031 a
160623 HIGH MS07-027 a
157262 HIGH MS07-022 a
157261 HIGH MS07-021 a
157260 HIGH MS07-020 a
157259 HIGH MS07-019 a
156477 HIGH MS07-017 a
150253 HIGH MS07-016 a
150249 HIGH MS07-013 a
150248 HIGH MS07-012 a
150247 HIGH MS07-011 a
150243 HIGH MS07-008 a
150242 HIGH MS07-007 a
150241 MEDIUM MS07-006 a
141034 HIGH MS06-076 a
141033 MEDIUM MS06-075 a
141030 HIGH MS06-072 a
137571 HIGH MS06-070 a
137568 HIGH MS06-067 a
133387 MEDIUM MS06-065 a
133386 MEDIUM MS06-064 a
133385 MEDIUM MS06-063 a
133379 HIGH MS06-057 a
131654 HIGH MS06-055 a
129977 MEDIUM MS06-053 a
129976 MEDIUM MS06-052 a
126093 HIGH MS06-051 a
126092 MEDIUM MS06-050 a
126087 HIGH MS06-046 a
126086 MEDIUM MS06-045 a
126083 HIGH MS06-042 a
126082 HIGH MS06-041 a
126081 HIGH MS06-040 a
123421 HIGH MS06-036 a
123420 HIGH MS06-035 a
120825 MEDIUM MS06-032 a
120823 MEDIUM MS06-030 a
120818 HIGH MS06-025 a
120815 HIGH MS06-022 a
120814 HIGH MS06-021 |
( "Eliminar Archivo"), espera unos momentos y luego acepta el mensaje que aparecerá (Tu sistema será reiniciado)