![]() |
| |||||||
| Foro Oficial de HijackThis en español Analizamos tu log de HijackThis para eliminar Hijackers, Spyware, Adware, ToolBars, Virus, Troyanos y Malwares en gral. Antes lea las Políticas del Foro de HijackThis. |
![]() |
| | Herramientas |
![]() | ![]() |
| |||
| Fondo Rojo Con Mensaje De Alerta Y Mensaje Virus Alert Hola, tengo un problema que ya he visto han solucionado en varias ocasiones de Spyware, fondo rojo con mesaje de virus, continuos pop-ups y mensajes de virus y un mensaje VIRUS ALERT! junto al reloj Este es el log Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:07: VIRUS ALERT!, on 27/05/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Network Associates\Common Framework\FrameworkService.exe C:\Program Files\Network Associates\VirusScan\Mcshield.exe C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\svchost.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe C:\WINDOWS\system32\igfxpers.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\USBMonit.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\WgaTray.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\explorer.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.forospyware.com/ O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe" O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [Gene USB Monitor] C:\WINDOWS\system32\USBMonit.exe O4 - HKLM\..\Run: [Client Access Service] "C:\Program Files\IBM\Client Access\cwbsvstr.exe" O4 - HKLM\..\Run: [Client Access PC5250 Sound] "C:\Program Files\IBM\Client Access\Emulator\pcssnd.exe" O4 - HKLM\..\Run: [Client Access Help Update] "C:\Program Files\IBM\Client Access\cwbinhlp.exe" O4 - HKLM\..\Run: [Client Access Express Welcome] "C:\Program Files\IBM\Client Access\cwbwlwiz.exe" O4 - HKLM\..\Run: [Client Access Check Version] "C:\Program Files\IBM\Client Access\cwbckver.exe" LOGIN O4 - HKLM\..\Run: [64cbe8dc] rundll32.exe "C:\WINDOWS\system32\npngbkbt.dll",b O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICIO LOCAL') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Servicio de red') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Pol icies\System, DisableRegedit=1 O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/spanish/kavwebscan_unicode.cab O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1140098272890 O17 - HKLM\System\CCS\Services\Tcpip\..\{496F0DE7-A464-45CA-B866-CE353B3B78FA}: NameServer = 192.168.0.90,192.168.0.91 O21 - SSODL: vltdfabw - {658ED220-B9E1-4381-97C2-EC10FBB84D4E} - C:\WINDOWS\vltdfabw.dll O21 - SSODL: vregfwlx - {7093C4A2-059E-4605-974D-7A55EE140932} - C:\WINDOWS\vregfwlx.dll O21 - SSODL: RamCD - {03859cf3-a8b2-41b6-a823-a06e4a412384} - C:\WINDOWS\Resources\RamCD.dll O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Servicio de registro de McAfee (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe -- End of file - 5133 bytes |
![]() | ![]() |
| ||||
| Re: Fondo Rojo Con Mensaje De Alerta Y Mensaje Virus Alert Hola Mardigan, te doy la bienvenida al Foro de InfoSpyware. Paso 1- Descarga, Instala y/o actualiza estas herramientas: (pero no los ejecutes aun) Paso 2- Con todos los programas cerrados, ejecuta HijackThis y dale a las siguientes entradas:O4 - HKLM\..\Run: [64cbe8dc] rundll32.exe "C:\WINDOWS\system32\npngbkbt.dll",b O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Pol icies\System, DisableRegedit=1 O21 - SSODL: vltdfabw - {658ED220-B9E1-4381-97C2-EC10FBB84D4E} - C:\WINDOWS\vltdfabw.dll O21 - SSODL: vregfwlx - {7093C4A2-059E-4605-974D-7A55EE140932} - C:\WINDOWS\vregfwlx.dll Paso 3- Ejecuta estas herramientas, de a una:
Cita:
Paso 4- Descarga CCleaner y ejecútalo usando primero su opción de "Limpiador" para borrar cookies, temporales de Internet y todos los archivos que este te muestre como obsoletos, y luego usa su opción de "Registro" para limpiar todo el registro de Windows (haciendo copia de seguridad). Reinicia y nos contas los resultados. junto con el reporte de Paso 5- Reinicia en modo normal y nos dejas los reportes de:
**Nota** - Para mayor comodidad imprime los pasos. - Recuerda regresar y contarnos los resultados. Salu2 Hablándole al mundo en "Twitter"" Novedades del Foro | Antivirus Online | Eliminar Malwares | Políticas del Foro | Blog * Ayúdanos haciendo una DONACIÓN para poder seguir Ayudando. * Para evitar Virus y Spywares al navegar por internet, USE FIREFOX !! * No se resuelven dudas por Privados ni por E-mail, ya que para eso esta el foro. |
![]() | ![]() |
| |||
| Re: Fondo Rojo Con Mensaje De Alerta Y Mensaje Virus Alert Muchísimas gracias no me lo podía creer, todo perfecto, salvo una cosilla, no puedo apagar el equipo de la forma ortodoxa, cuando pulso apagar equipo se queda una aplicación colgada llamada Sysfader (si me decís como solucionar esto ya sería la bomba), por lo demás todo perfecto... Os dejo aquí los informes solicitados Malwarebytes' Anti-Malware 1.12 Versión de la Base de Datos: 722 Tipo de examen : Examen Rápido Objetos examinados: 38626 Tiempo transcurrido: 7 minute(s), 33 second(s) Procesos en Memoria Infectados: 0 Módulos en Memoria Infectados: 0 Claves del Registro Infectadas: 6 Valores del Registro Infectados: 1 Elementos de Datos del Registro Infectados: 0 Carpetas Infectadas: 2 Ficheros Infectados: 19 Procesos en Memoria Infectados: (No se han detectado elementos maliciosos) Módulos en Memoria Infectados: (No se han detectado elementos maliciosos) Claves del Registro Infectadas: HKEY_CLASSES_ROOT\CLSID\{03859cf3-a8b2-41b6-a823-a06e4a412384} (Trojan.Clicker) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Malware.Trace) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\Software\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully. Valores del Registro Infectados: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\ShellServiceObjectDelayLoad\RamCD (Trojan.Clicker) -> Quarantined and deleted successfully. Elementos de Datos del Registro Infectados: (No se han detectado elementos maliciosos) Carpetas Infectadas: C:\WINDOWS\privacy_danger (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINDOWS\privacy_danger\images (Trojan.FakeAlert) -> Quarantined and deleted successfully. Ficheros Infectados: C:\WINDOWS\system32\fofwpksc.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\cskpwfof.ini (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\privacy_danger\index.htm (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINDOWS\privacy_danger\images\capt.gif (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINDOWS\privacy_danger\images\danger.jpg (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINDOWS\privacy_danger\images\down.gif (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINDOWS\privacy_danger\images\spacer.gif (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINDOWS\Resources\RamCD.dll (Trojan.Clicker) -> Quarantined and deleted successfully. C:\Program Files\tmp105000.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Program Files\tmp105015.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\Administrator\Favorites\Error Cleaner.url (Rogue.Link) -> Quarantined and deleted successfully. C:\Documents and Settings\Administrator\Favorites\Privacy Protector.url (Rogue.Link) -> Quarantined and deleted successfully. C:\Documents and Settings\Administrator\Favorites\Spyware&Malware Protection.url (Rogue.Link) -> Quarantined and deleted successfully. C:\Documents and Settings\JMART\Desktop\Spyware&Malware Protection.url (Rogue.Link) -> Quarantined and deleted successfully. C:\Documents and Settings\JMART\Desktop\Privacy Protector.url (Rogue.Link) -> Quarantined and deleted successfully. C:\Documents and Settings\JMART\Desktop\Error Cleaner.url (Rogue.Link) -> Quarantined and deleted successfully. C:\Documents and Settings\JMART\Favorites\Error Cleaner.url (Rogue.Link) -> Quarantined and deleted successfully. C:\Documents and Settings\JMART\Favorites\Privacy Protector.url (Rogue.Link) -> Quarantined and deleted successfully. C:\Documents and Settings\JMART\Favorites\Spyware&Malware Protection.url (Rogue.Link) -> Quarantined and deleted successfully. ComboFix 08-05-27.4 - Administrator 2008-05-28 9:38:49.1 - NTFSx86 MINIMAL Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.806 [GMT 2:00] Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Start Menu\Programs\BulletProofSoft.com C:\Documents and Settings\All Users\Start Menu\Programs\BulletProofSoft.com\BPS Spyware Remover\BPS Spyware-Adware Remover.lnk C:\Documents and Settings\All Users\Start Menu\Programs\BulletProofSoft.com\BPS Spyware Remover\Help.lnk C:\Documents and Settings\All Users\Start Menu\Programs\BulletProofSoft.com\BPS Spyware Remover\Uninstall.lnk C:\Documents and Settings\JMART\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus-2008pro.lnk C:\Program Files\BulletProofSoft.com C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\Box.bps C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\Core.dll C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\DataBase.ini C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\DB.bps C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\DB1.bps C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\DB2.bps C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\DB3.bps C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\DB4.bps C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\DB5.bps C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\English.inf C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\English.jpg C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\Errors.txt C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\Espanol.inf C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\Espanol.jpg C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\Francais.inf C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\Francais.jpg C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\guard.bps C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\Help.chm C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\home.bps C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\hosts C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\Italiano.inf C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\Italiano.jpg C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\Mask.skn C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\Purchase.bps C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\Scan Session.txt C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\Splash.spl C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\SpyRem.exe C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\unins000.dat C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\unins000.exe C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\update.cli C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\update.exe C:\WINDOWS\atfxqogp.dll C:\WINDOWS\boqnrwdmkrs.dll C:\WINDOWS\system32\818646 C:\WINDOWS\system32\818646\818646.dll C:\WINDOWS\system32\bjdjpumk.ini C:\WINDOWS\system32\mcrh.tmp C:\WINDOWS\system32\regsvr.exe C:\WINDOWS\system32\tbkbgnpn.ini C:\WINDOWS\system32\UDcIOXbc.ini C:\WINDOWS\system32\UDcIOXbc.ini2 C:\WINDOWS\vltdfabw.dll C:\WINDOWS\vregfwlx.dll C:\WINDOWS\xmpstean.exe . ((((((((((((((((((((((((( Files Created from 2008-04-28 to 2008-05-28 ))))))))))))))))))))))))))))))) . 2008-05-27 15:18 . 2008-05-27 15:20 <DIR> d-------- C:\Escritorio 2008-05-27 13:41 . 2008-05-27 15:11 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-05-27 13:15 . 2008-04-27 17:33 <DIR> d-------- C:\Program Files\DelPSGuard 2008-05-27 12:59 . 2008-05-27 12:59 <DIR> d-------- C:\Program Files\Trend Micro 2008-05-27 12:28 . 2008-04-28 08:15 <DIR> d-------- C:\cuarentena 2008-05-27 09:38 . 2008-05-27 09:47 7,680 --ahs---- C:\WINDOWS\Thumbs.db 2008-05-26 20:18 . 2008-04-28 08:14 <DIR> d-------- C:\Documents and Settings\JMART\Application Data\TmpRecentIcons 2008-05-26 18:23 . 2008-05-26 15:23 94,208 --a------ C:\WINDOWS\edma.exe 2008-05-14 10:32 . 2008-05-14 10:32 <DIR> d-------- C:\Program Files\HachaPro 2008-05-06 16:53 . 2008-05-27 11:27 256 --a------ C:\WINDOWS\RENT2007.INI 2008-04-28 09:26 . 2008-04-28 09:26 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-04-28 09:26 . 2008-04-28 09:26 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-04-28 09:26 . 2008-04-28 09:26 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Malwarebytes 2008-04-28 09:26 . 2008-05-05 20:46 27,048 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys 2008-04-28 09:26 . 2008-05-05 20:46 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-04-28 08:45 . 2008-04-28 08:45 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\TmpRecentIcons . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) )) . 2008-05-27 11:32 --------- d-----w C:\Program Files\Winamp 2008-05-27 10:56 --------- d-----w C:\Program Files\GNU 2008-05-27 09:29 --------- d-----w C:\Program Files\URUSoft 2008-05-27 09:28 --------- d-----w C:\Program Files\AviSynth 2.5 2008-05-27 07:40 --------- d-----w C:\Program Files\NCH Swift Sound 2008-05-27 07:39 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-05-27 07:39 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-05-27 04:00 --------- d-----w C:\Program Files\Soulseek 2008-05-13 10:28 --------- d-----w C:\Program Files\Microsoft Silverlight 2008-04-28 06:29 --------- d-----w C:\Program Files\ESET 2008-04-27 15:47 512,096 ----a-w C:\WINDOWS\system32\drivers\amon.sys 2008-04-27 15:47 15,424 ----a-w C:\WINDOWS\system32\drivers\nod32drv.sys 2008-04-27 15:36 --------- d-----w C:\Program Files\Yahoo! 2008-04-27 15:36 --------- d-----w C:\Program Files\Google 2008-04-27 15:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-04-27 15:08 --------- d-----w C:\Program Files\Lavasoft . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{29625431-52CE-45BF-9882-9008B56CE76B}] C:\WINDOWS\system32\cbXOIcDU.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BCBEB0EB-744A-4F05-99A5-636B721C318E}] C:\WINDOWS\system32\efcCssQg.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 08:00 15360] "BPS Spyware Remover"="C:\Program Files\BulletProofSoft.com\BPS Spyware Remover\SpyRem.exe" [ ] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run] "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 15:42 1404928] "igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-09-20 11:35 94208] "igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-09-20 11:36 114688] "igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-09-20 11:32 77824] "Gene USB Monitor"="C:\WINDOWS\system32\USBMonit.exe" [2006-05-06 13:18 36864] "Client Access Service"="C:\Program Files\IBM\Client Access\cwbsvstr.exe" [2005-03-04 06:30 20530] "Client Access PC5250 Sound"="C:\Program Files\IBM\Client Access\Emulator\pcssnd.exe" [2005-03-04 06:30 40960] "Client Access Help Update"="C:\Program Files\IBM\Client Access\cwbinhlp.exe" [2005-03-04 06:30 24626] "Client Access Express Welcome"="C:\Program Files\IBM\Client Access\cwbwlwiz.exe" [2005-03-04 06:30 20480] "Client Access Check Version"="C:\Program Files\IBM\Client Access\cwbckver.exe" [2005-03-04 06:30 45056] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2008-04-27 17:47 949376] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 08:00 15360] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-11-08 11:55:33 110592] [HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\policies\system] "dontdisplaylockeduserid"= 1 (0x1) [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0] Source= file:///C:\WINDOWS\privacy_danger\index.htm FriendlyName= Privacy Protection [hkey_local_machine\software\microsoft\windows\curr entversion\explorer\shellexecutehooks] "{BCBEB0EB-744A-4F05-99A5-636B721C318E}"= C:\WINDOWS\system32\efcCssQg.dll [ ] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\efcCssQg] efcCssQg.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.divxa32"= msaud32_divx.acm "VIDC.YV12"= yv12vfw.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\group policy\state\S-1-5-21-172240133-2049398255-165283079-10954\Scripts\Logon\0\0] "Script"=screenid.bat [HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\group policy\state\S-1-5-21-172240133-2049398255-165283079-10954\Scripts\Logon\1\0] "Script"=eblogin.bat [HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\group policy\state\S-1-5-21-172240133-2049398255-165283079-22466\Scripts\Logon\0\0] "Script"=screenid.bat [HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\group policy\state\S-1-5-21-172240133-2049398255-165283079-22466\Scripts\Logon\1\0] "Script"=eblogin.bat [HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\group policy\state\S-1-5-21-172240133-2049398255-165283079-22466\Scripts\Logon\2\0] "Script"=eblogin.bat [HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\group policy\state\S-1-5-21-172240133-2049398255-165283079-72851\Scripts\Logon\0\0] "Script"=screenid.bat [HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\group policy\state\S-1-5-21-172240133-2049398255-165283079-72851\Scripts\Logon\1\0] "Script"=eblogin.bat [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\64cbe8dc] C:\WINDOWS\system32\fofwpksc.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Network Associates Error Reporting Service] --a------ 2003-10-07 10:48 147514 C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ShStatEXE] --a------ 2004-09-22 21:00 94208 C:\Program Files\Network Associates\VirusScan\SHSTAT.exe [HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= S3 ASPI;Advanced SCSI Programming Interface Driver;C:\WINDOWS\System32\DRIVERS\ASPI32.sys [2002-07-17 10:05] S3 MBAMCatchMe;MBAMCatchMe;C:\WINDOWS\system32\driver s\mbamcatchme.sys [2008-05-05 20:46] [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{8aaa71bd-e8c6-11db-8901-0014225291a7}] \Shell\AutoRun\command - E:\LaunchU3.exe *Newly Created Service* - ENTDRV51 . ************************************************** ************************ catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-28 09:43:29 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************** ************************ . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\lsass.exe -> C:\Program Files\Eset\pr_imon.dll . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Network Associates\Common Framework\FrameworkService.exe C:\Program Files\Network Associates\VirusScan\Mcshield.exe C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\ESET\nod32krn.exe C:\WINDOWS\system32\WgaTray.exe . ************************************************** ************************ . Completion time: 2008-05-28 9:47:28 - machine was rebooted [JMART] ComboFix-quarantined-files.txt 2008-05-28 07:47:20 Pre-Run: 2,739,310,592 bytes free Post-Run: 2,660,069,376 bytes free 195 --- E O F --- 2008-05-21 01:01:41 1996-03-22 13:58 7216 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\REGSVR.EXE .vir 2002-11-20 23:01 700416 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\update.exe.vir 2004-12-02 13:57 222720 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\Splash.spl.vir 2005-09-24 15:23 663 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\English.jpg.vir 2006-02-16 11:06 38048 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\update.cli.vir 2006-03-06 17:51 576730 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\Help.chm.vir 2006-03-09 05:23 13093 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\Espanol.jpg.vir 2006-03-09 05:25 13151 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\Francais.jpg.vir 2006-03-15 04:28 45392 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\Box.bps.vir 2006-03-15 05:23 61208 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\Purchase.bps.vir 2006-03-19 02:42 768 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\Italiano.jpg.vir 2006-04-04 08:53 95329 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\guard.bps.vir 2006-04-09 14:48 1661106 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\Mask.skn.vir 2006-06-05 06:38 512731 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\home.bps.vir 2006-08-17 15:27 47214 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\Espanol.inf.vir 2006-08-17 15:28 48314 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\Francais.inf.vir 2006-08-17 15:29 50088 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\Italiano.inf.vir 2006-08-17 16:09 774144 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\Core.dll.vir 2006-08-17 16:11 21652 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\English.inf.vir 2006-08-17 16:32 6880 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\DB.bps.vir 2006-09-18 15:19 606208 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\SpyRem.exe.vir 2008-04-27 18:01 635401 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\unins000.exe.vir 2008-04-27 18:02 829 --a------ C:\Qoobox\Quarantine\C\Documents and Settings\All Users\Start Menu\Programs\BulletProofSoft.com\BPS Spyware Remover\Help.lnk.vir 2008-04-27 18:02 841 --a------ C:\Qoobox\Quarantine\C\Documents and Settings\All Users\Start Menu\Programs\BulletProofSoft.com\BPS Spyware Remover\BPS Spyware-Adware Remover.lnk.vir 2008-04-27 18:02 8510 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\unins000.dat.vir 2008-04-27 18:02 853 --a------ C:\Qoobox\Quarantine\C\Documents and Settings\All Users\Start Menu\Programs\BulletProofSoft.com\BPS Spyware Remover\Uninstall.lnk.vir 2008-04-28 08:18 179587 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\UDcIOXbc.i ni2.vir 2008-04-28 08:19 179689 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\UDcIOXbc.i ni.vir 2008-04-28 08:53 145 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\Scan Session.txt.vir 2008-04-28 08:53 151 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\DataBase.ini.vir 2008-04-28 08:53 4018 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\Errors.txt.vir 2008-04-28 08:53 686 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\hosts.vir 2008-05-25 11:39 706512 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\DB1.bps.vir 2008-05-25 11:56 751152 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\DB2.bps.vir 2008-05-25 12:05 759040 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\DB3.bps.vir 2008-05-25 12:41 651264 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\DB4.bps.vir 2008-05-25 12:46 341840 --a------ C:\Qoobox\Quarantine\C\Program Files\BulletProofSoft.com\BPS Spyware Remover\DB5.bps.vir 2008-05-26 15:22 180224 --a------ C:\Qoobox\Quarantine\C\WINDOWS\vregfwlx.dll.vir 2008-05-26 15:22 229376 --a------ C:\Qoobox\Quarantine\C\WINDOWS\vltdfabw.dll.vir 2008-05-26 15:23 155648 --a------ C:\Qoobox\Quarantine\C\WINDOWS\atfxqogp.dll.vir 2008-05-26 15:23 221184 --a------ C:\Qoobox\Quarantine\C\WINDOWS\boqnrwdmkrs.dll.vir 2008-05-26 15:23 81920 --a------ C:\Qoobox\Quarantine\C\WINDOWS\xmpstean.exe.vir 2008-05-26 18:31 1163016 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\bjdjpumk.i ni.vir 2008-05-27 00:24 13824 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\818646\818 646.dll.vir 2008-05-27 09:27 781 --a------ C:\Qoobox\Quarantine\C\Documents and Settings\JMART\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus-2008pro.lnk.vir 2008-05-27 14:55 143 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\mcrh.tmp.v ir 2008-05-27 15:38 1164036 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\tbkbgnpn.i ni.vir 2008-05-28 09:40 54 --a------ C:\Qoobox\Quarantine\catchme.log De nuevo muchas gracias, por todo... |
![]() | ![]() |
| ||||
| Re: Fondo Rojo Con Mensaje De Alerta Y Mensaje Virus Alert Hola, ComboFix detecto y elimino ya algunos Malwares, pero todavía le quedaron algunas cosas para sacar siguiendo estos pasos: A) - Abrir el Notepad (Bloc de Notas)
B) - Ahora copia y pega estos archivos dentro del Notepad Código: KillAll::
File::
C:\WINDOWS\edma.exe
C:\WINDOWS\system32\cbXOIcDU.dll
C:\WINDOWS\system32\efcCssQg.dll
Folder::
C:\Documents and Settings\JMART\Application Data\TmpRecentIcons
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{29625431-52CE-45BF-9882-9008B56CE76B}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BCBEB0EB-744A-4F05-99A5-636B721C318E}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BPS Spyware Remover"=-
D) - Arrastrar y soltar el archivo CFScript.txt dentro del archivo ComboFix.exe como lo muestra la animación de abajo. Esto activara ComboFix nuevamente.
Salu2 Hablándole al mundo en "Twitter"" Novedades del Foro | Antivirus Online | Eliminar Malwares | Políticas del Foro | Blog * Ayúdanos haciendo una DONACIÓN para poder seguir Ayudando. * Para evitar Virus y Spywares al navegar por internet, USE FIREFOX !! * No se resuelven dudas por Privados ni por E-mail, ya que para eso esta el foro. |
![]() | ![]() |
| ||||
| Re: Fondo Rojo Con Mensaje De Alerta Y Mensaje Virus Alert Hola, no siempre en modo normal a menos que se marque lo contrario. Salu2 Hablándole al mundo en "Twitter"" Novedades del Foro | Antivirus Online | Eliminar Malwares | Políticas del Foro | Blog * Ayúdanos haciendo una DONACIÓN para poder seguir Ayudando. * Para evitar Virus y Spywares al navegar por internet, USE FIREFOX !! * No se resuelven dudas por Privados ni por E-mail, ya que para eso esta el foro. |
![]() |
| Herramientas | |
|
|
![]() |
Temas Similares | ![]() |
| Tema | Autor | Foro | Respuestas | Último mensaje |
| mi maquina esta lenta (Terminado) | gianpierre89 | Temas Solucionados | 16 | 05/06/07 01:03:26 |
| problemas con el mensaje de VIrus Alert | kameknight | Foro Oficial de HijackThis en español | 7 | 12/06/06 18:47:37 |
| Creo que estoy enviando correos a lo bestia....(Solucionado) | dutch | Temas Solucionados | 27 | 18/05/06 14:03:27 |
| problema con virus y fondo de escritorio | osote | Foro de Virus y Spywares | 2 | 05/12/05 07:46:18 |
| Ayuda con "Home Search Assistent", "Search Extendr" y "Shopping (solucionado)" | sertrual | Temas Solucionados | 18 | 13/10/05 10:08:18 |