Foro de InfoSpyware - Foro de Hijackthis - Foro de Virus

Poseso q se ma ha metido un trojano destos y no soy capaz de quitarlo... a ver si me podeis echar una mano.

*EDITADO*


asias por la ayuda

Hola n4d Bienvenido al Foro

Edita tu log de hjt que has puesto ya que lo has colocado en un sector errado

NO poner Logs de HijackThis y/o ComboFIX en este sector del foro o seran eliminados.


Descarga, instala y actualiza las siguientes herramientas pero no las ejecutes aun

• DelPSGuard [Última version]
  
• Malwarebytes' Anti-Malware
  
• SuperAntiSpyware>>> Manual y elimina todo lo que encuentres

Apaga Restaurar Sistema (Solo en Windows Me y XP)

Inicia en Modo a Prueba de Fallos

Ejecuta las herramientas del paso actualizadas y en su mismo orden y de a una

Inicia en modo normal

Descarga Ccleaner + Manual y usalo primero en modo Limpiador para limpiar cookies y temporales de internet y luego en modo Registro (haciendo copia de seguridad como lo indica el manual)

Has un scanner con Panda ActiveScan Online y pegas el reporte aqui junto con los reportes de MalwareByte y Delpsguard .


Salu2 Recuerda Volver

pego los logs:

DelPSGuard v 4.9.7
by www.ForoSpyware.com
Reporte Creado: 18:05:20,87, 09/05/2008
SO: Microsoft Windows XP [Versi¢n 5.1.2600]
Modo de Inicio: Seguro
_________________________________________


»»»»»»»»»»»» Carpetas y Archivos infectados »»»»»»»»»»»»

E:\WINDOWS\system32 \ntimage.gif Eliminado Malware.Bagle
E:\WINDOWS\default.htm ...: ! Eliminado ! :...

»»»»»»»»»»»»»»»»»»» Programas Malwares »»»»»»»»»»»»»»»»»



»»»»»»»»»»»»»»»»»»» FIN »»»»»»»»»»»»»»»»»»»








Malwarebytes' Anti-Malware 1.12
Database version: 722

Scan type: Full Scan (E:\|)
Objects scanned: 71195
Time elapsed: 33 minute(s), 14 second(s)

Memory Processes Infected: 1
Memory Modules Infected: 2
Registry Keys Infected: 23
Registry Values Infected: 1
Registry Data Items Infected: 3
Folders Infected: 2
Files Infected: 60

Memory Processes Infected:
E:\WINDOWS\system32\wmsdkns.exe (Trojan.Agent) -> Unloaded process successfully.

Memory Modules Infected:
E:\WINDOWS\system32\mlJCVpQI.dll (Trojan.Vundo) -> Unloaded module successfully.
E:\WINDOWS\system32\opnkHBTl.dll (Trojan.Vundo) -> Unloaded module successfully.

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Browser Helper Objects\{27f9204b-a179-4a03-a8b9-73f709a73273} (Trojan.Vundo) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{27f9204b-a179-4a03-a8b9-73f709a73273} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Browser Helper Objects\{15651c7c-e812-44a2-a9ac-b467a2233e7d} (Adware.123Mania) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Browser Helper Objects\{622cc208-b014-4fe0-801b-874a5e5e403a} (Adware.123Mania) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Browser Helper Objects\{9c5b2f29-1f46-4639-a6b4-828942301d3e} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Browser Helper Objects\{ffff0001-0002-101a-a3c9-08002b2f49fb} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Browser Helper Objects\{00000250-0320-4dd4-be4f-7566d2314352} (Fake.Dropped.Malware.Renos) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Browser Helper Objects\{13197ace-6851-45c3-a7ff-c281324d5489} (Fake.Dropped.Malware.Renos) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Browser Helper Objects\{4e1075f4-eec4-4a86-add7-cd5f52858c31} (Fake.Dropped.Malware.Renos) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Browser Helper Objects\{4e7bd74f-2b8d-469e-92c6-ce7eb590a94d} (Fake.Dropped.Malware.Renos) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Browser Helper Objects\{5929cd6e-2062-44a4-b2c5-2c7e78fbab38} (Fake.Dropped.Malware.Renos) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Browser Helper Objects\{5dafd089-24b1-4c5e-bd42-8ca72550717b} (Fake.Dropped.Malware.Renos) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Browser Helper Objects\{5fa6752a-c4a0-4222-88c2-928ae5ab4966} (Fake.Dropped.Malware.Renos) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Browser Helper Objects\{8674aea0-9d3d-11d9-99dc-00600f9a01f1} (Fake.Dropped.Malware.Renos) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Browser Helper Objects\{965a592f-8efa-4250-8630-7960230792f1} (Fake.Dropped.Malware.Renos) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Browser Helper Objects\{cf021f40-3e14-23a5-cba2-717765728274} (Fake.Dropped.Malware.Renos) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Browser Helper Objects\{fc3a74e5-f281-4f10-ae1e-733078684f3c} (Fake.Dropped.Malware.Renos) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\MsSecurity1.209.4 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{dd4a65c7-61d7-445f-bcf1-5065f765eaf9} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Browser Helper Objects\{dd4a65c7-61d7-445f-bcf1-5065f765eaf9} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\opnkhbtl (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\ShellExecuteHooks\{dd4a65c7-61d7-445f-bcf1-5065f765eaf9} (Trojan.Vundo) -> Delete on reboot.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\LSA\Authentication Packages (Trojan.Vundo) -> Data: e:\windows\system32\mljcvpqi -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: e:\windows\system32\wmsdkns.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\Lsa\Authentication Packages (Trojan.Vundo) -> Data: e:\windows\system32\mljcvpqi -> Delete on reboot.

Folders Infected:
E:\Archivos de programa\webHancer (Adware.Webhancer) -> Quarantined and deleted successfully.
E:\Archivos de programa\webHancer\Programs (Adware.Webhancer) -> Quarantined and deleted successfully.

Files Infected:
E:\WINDOWS\system32\mlJCVpQI.dll (Trojan.Vundo) -> Delete on reboot.
E:\WINDOWS\system32\IQpVCJlm.ini (Trojan.Vundo) -> Delete on reboot.
E:\WINDOWS\system32\IQpVCJlm.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully.
E:\Archivos de programa\webHancer\Programs\whinstaller.exe (Adware.WebHancer) -> Quarantined and deleted successfully.
E:\Documents and Settings\n4d\Configuración local\Temp\syswcc32.exe (Adware.Webhancer) -> Quarantined and deleted successfully.
E:\System Volume Information\_restore{4316FFAA-1F75-4971-A198-C42C37FED8C8}\RP69\A0013907.exe (Adware.WebHancer) -> Quarantined and deleted successfully.
E:\System Volume Information\_restore{4316FFAA-1F75-4971-A198-C42C37FED8C8}\RP69\A0013908.dll (Adware.WebHancer) -> Quarantined and deleted successfully.
E:\System Volume Information\_restore{4316FFAA-1F75-4971-A198-C42C37FED8C8}\RP69\A0013913.dll (Adware.WebHancer) -> Quarantined and deleted successfully.
E:\WINDOWS\system32\iifcywxW.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
E:\WINDOWS\system32\mlJCUoPI.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
E:\WINDOWS\system32\urqOHYQH.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
E:\Archivos de programa\webHancer\Programs\license.txt (Adware.Webhancer) -> Quarantined and deleted successfully.
E:\Archivos de programa\webHancer\Programs\readme.txt (Adware.Webhancer) -> Quarantined and deleted successfully.
E:\Archivos de programa\webHancer\Programs\sporder.dll (Adware.Webhancer) -> Quarantined and deleted successfully.
E:\Archivos de programa\webHancer\Programs\whagent.ini (Adware.Webhancer) -> Quarantined and deleted successfully.
E:\WINDOWS\system32\wmsdkns.exe (Trojan.Agent) -> Quarantined and deleted successfully.
E:\WINDOWS\lfn.exe (Trojan.Agent) -> Quarantined and deleted successfully.
E:\WINDOWS\winself.exe (Trojan.Agent) -> Quarantined and deleted successfully.
E:\WINDOWS\avifile32.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
E:\WINDOWS\avisynthex32.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
E:\WINDOWS\aviwrap32.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
E:\WINDOWS\bjam.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
E:\WINDOWS\bokja.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
E:\WINDOWS\browserad.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
E:\WINDOWS\cdsm32.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
E:\WINDOWS\changeurl_30.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
E:\WINDOWS\didduid.ini (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
E:\WINDOWS\msa64chk.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
E:\WINDOWS\msapasrc.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
E:\WINDOWS\mspphe.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
E:\WINDOWS\123messenger.per (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
E:\WINDOWS\mssvr.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
E:\WINDOWS\ntnut.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
E:\WINDOWS\saiemod.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
E:\WINDOWS\shdocpe.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
E:\WINDOWS\shdocpl.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
E:\WINDOWS\stcloader.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
E:\WINDOWS\swin32.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
E:\WINDOWS\voiceip.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
E:\WINDOWS\winsb.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
E:\WINDOWS\2020search.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
E:\WINDOWS\2020search2.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
E:\WINDOWS\apphelp32.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
E:\WINDOWS\asferror32.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
E:\WINDOWS\asycfilt32.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
E:\WINDOWS\athprxy32.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
E:\WINDOWS\ati2dvaa32.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
E:\WINDOWS\ati2dvag32.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
E:\WINDOWS\audiosrv32.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
E:\WINDOWS\autodisc32.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
E:\WINDOWS\licencia.txt (Malware.Trace) -> Quarantined and deleted successfully.
E:\WINDOWS\telefonos.txt (Malware.Trace) -> Quarantined and deleted successfully.
E:\WINDOWS\textos.txt (Malware.Trace) -> Quarantined and deleted successfully.
E:\WINDOWS\system32\geBqOeEt.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
E:\WINDOWS\system32\opnkHBTl.dll (Trojan.Vundo) -> Delete on reboot.
E:\WINDOWS\system32\ddcCroLC.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
E:\WINDOWS\system32\yayxuTKA.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
E:\WINDOWS\system32\ljJaXNEw.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
E:\WINDOWS\system32\wvUopqRj.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
E:\Documents and Settings\n4d\Configuración local\Temp\ie.exe (Trojan.Agent) -> Quarantined and deleted successfully.





he conseguido quitar el troyano, pero ahora no se porq... no me deja usar el GOOGLE y ciertas webs no me abren. =(

alguna sugerencia?

Hola n4d


Malwarebytes ha hecho su trabajo pero ahora pégate el reporte del panda online y uno nuevo de
Malwarebytes acá para ver que nos muestra este

Salu2