Estimados,

acudo por su ayuda. Tengo en mi maquina un virus, pues me sale junto a la hora el mensaje VIRUS ALERT! A continuación pongo el log generado por el Hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:22: VIRUS ALERT!, on 18/07/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal
**Editado**
No colocar logs de HJT fuera de su Foro Oficial. Utilizar versión más nueva.
Leer Políticas:
http://www.forospyware.com/4-post1.html
http://www.forospyware.com/3-post1.html
Leer las Políticas del Foro es la manera más facil y rápida de obtener ayuda.

Agradezco de antemano su ayuda.

Gustavo.

Hola gcornejo,

Primero y principal, esta prohibido colocar los reportes de Hijackthis fuera de su foro correspondiente: Foro oficial de Hijack this en español
, esas son las reglas.

Si tienes problemas de infección con el Virus alert porfavor realiza estos pasos:

Eliminar familia PSGuard, AntiVirGear, VirusProtectPro, AntiVermins, SpyLocked

Suerte y nos comentas si solucionastes..

estimado Anleg_30,

de acuerdo a lo indicado en el link: Eliminar familia PSGuard, AntiVirGear, VirusProtectPro, AntiVermins, SpyLocked, apagué el modo "Restaurar sistema", reinicie en "modo a prueba de fallos", y pasé el HijackThis, pero no encontré ninguna entrada que está listado en el link. Luego ejecuté el DelPSGuard, además del Antispyware y por último el Malwarebytes; este último fue el que detectó el virus y lo eliminó. Sin embargo, me di cuenta que no se había eliminado en otras dos sesiones de windows, por lo que tuve que pasarle de nuevo en esas otras sesiones. A continuación el log:

Malwarebytes' Anti-Malware 1.21
Versión de la Base de Datos: 967
Windows 5.1.2600 Service Pack 3

2:04:35 20/07/2008
mbam-log-7-20-2008 (02-04-35).txt

Tipo de examen : Examen Completo (C:\|)
Objetos examinados: 196839
Tiempo transcurrido: 2 hour(s), 32 minute(s), 41 second(s)

Procesos en Memoria Infectados: 0
Módulos en Memoria Infectados: 0
Claves del Registro Infectadas: 4
Valores del Registro Infectados: 3
Elementos de Datos del Registro Infectados: 5
Carpetas Infectadas: 23
Ficheros Infectados: 30

Procesos en Memoria Infectados:
(No se han detectado elementos maliciosos)

Módulos en Memoria Infectados:
(No se han detectado elementos maliciosos)

Claves del Registro Infectadas:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\rhcv6lj0e15l (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\rhcv6lj0e15l (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VSPlugin (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Valores del Registro Infectados:
HKEY_CURRENT_USER\Control Panel\Desktop\originalwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\convertedwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\scrnsave.exe (Hijack.Wallpaper) -> Quarantined and deleted successfully.

Elementos de Datos del Registro Infectados:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductId (Trojan.FakeAlert) -> Bad: (VIRUS ALERT!) Good: (55274-640-9483191-23056) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\International\sTimeFormat (Trojan.FakeAlert) -> Bad: (HH:mm: VIRUS ALERT!) Good: (H:mm:ss) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Policies\Explorer\StartMenuLogOff (Hijack.StartMenu) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Policies\Explorer\NoDrives (Hijack.Drives) -> Bad: (12) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Policies\Explorer\NoToolbarCustomize (Hijack.Explorer) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Carpetas Infectadas:
C:\Archivos de programa\rhcv6lj0e15l (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\mbdrouet\Datos de programa\rhcv6lj0e15l (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\mbdrouet\Datos de programa\rhcv6lj0e15l\Quarantine (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\mbdrouet\Datos de programa\rhcv6lj0e15l\Quarantine\Autorun (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\mbdrouet\Datos de programa\rhcv6lj0e15l\Quarantine\Autorun\HKCU (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\mbdrouet\Datos de programa\rhcv6lj0e15l\Quarantine\Autorun\HKCU\RunO nce (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\mbdrouet\Datos de programa\rhcv6lj0e15l\Quarantine\Autorun\HKLM (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\mbdrouet\Datos de programa\rhcv6lj0e15l\Quarantine\Autorun\HKLM\RunO nce (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\mbdrouet\Datos de programa\rhcv6lj0e15l\Quarantine\Autorun\StartMenu AllUsers (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\mbdrouet\Datos de programa\rhcv6lj0e15l\Quarantine\Autorun\StartMenu CurrentUser (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\mbdrouet\Datos de programa\rhcv6lj0e15l\Quarantine\BrowserObjects (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\mbdrouet\Datos de programa\rhcv6lj0e15l\Quarantine\Packages (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\gcornejo\Datos de programa\rhcv6lj0e15l (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\gcornejo\Datos de programa\rhcv6lj0e15l\Quarantine (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\gcornejo\Datos de programa\rhcv6lj0e15l\Quarantine\Autorun (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\gcornejo\Datos de programa\rhcv6lj0e15l\Quarantine\Autorun\HKCU (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\gcornejo\Datos de programa\rhcv6lj0e15l\Quarantine\Autorun\HKCU\RunO nce (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\gcornejo\Datos de programa\rhcv6lj0e15l\Quarantine\Autorun\HKLM (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\gcornejo\Datos de programa\rhcv6lj0e15l\Quarantine\Autorun\HKLM\RunO nce (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\gcornejo\Datos de programa\rhcv6lj0e15l\Quarantine\Autorun\StartMenu AllUsers (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\gcornejo\Datos de programa\rhcv6lj0e15l\Quarantine\Autorun\StartMenu CurrentUser (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\gcornejo\Datos de programa\rhcv6lj0e15l\Quarantine\BrowserObjects (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\gcornejo\Datos de programa\rhcv6lj0e15l\Quarantine\Packages (Rogue.Multiple) -> Quarantined and deleted successfully.

Ficheros Infectados:
C:\WINDOWS\emxf.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Archivos de programa\rhcv6lj0e15l\database.dat (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Archivos de programa\rhcv6lj0e15l\license.txt (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Archivos de programa\rhcv6lj0e15l\MFC71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Archivos de programa\rhcv6lj0e15l\MFC71ENU.DLL (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Archivos de programa\rhcv6lj0e15l\msvcp71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Archivos de programa\rhcv6lj0e15l\msvcr71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Archivos de programa\rhcv6lj0e15l\rhcv6lj0e15l.exe.local (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Archivos de programa\rhcv6lj0e15l\Uninstall.exe (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\WINDOWS\agpqlrfm.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\mbdrouet\Configuración local\Temp\.tt15.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\mbdrouet\Configuración local\Temp\.tt1.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\mbdrouet\Configuración local\Temp\.tt2.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\mbdrouet\Configuración local\Temp\.tt3.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\mbdrouet\Configuración local\Temp\.tt4.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\mbdrouet\Configuración local\Temp\.tt5.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\mbdrouet\Configuración local\Temp\.tt6.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\mbdrouet\Configuración local\Temp\.tt7.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\mbdrouet\Configuración local\Temp\.tt8.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\mbdrouet\Configuración local\Temp\.tt9.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\mbdrouet\Configuración local\Temp\.ttA.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\mbdrouet\Configuración local\Temp\.ttB.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\mbdrouet\Configuración local\Temp\.ttC.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\mbdrouet\Configuración local\Temp\.ttE.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\mbdrouet\Escritorio\Spyware&Malware Protection.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\mbdrouet\Escritorio\Privacy Protector.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\mbdrouet\Escritorio\Error Cleaner.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\mbdrouet\Favoritos\Error Cleaner.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\mbdrouet\Favoritos\Privacy Protector.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\mbdrouet\Favoritos\Spyware&Malware Protection.url (Rogue.Link) -> Quarantined and deleted successfully.

Luego reinicie la computadora en modo normal, y pasé el CCleaner y por último analicé la máquina con el Ewido Online.

Espero que con esto esté todo eliminado.

Gracias, y saludos,

Gustavo.

Hola gcornejo,

El MalwareBytes ya realizó su trabajo, dime si solventastes definitivamente y si se puede dar por solucionado el tema. ¿? ¿?

Es correcto, está solventado el trabajo, y se puede dar por cerrado el tema. Gracias por la ayuda.

Gustavo.

Muy bien gcornejo, doy tu tema por Solucionado.

Si necesitás continuarlo, das las razones de reapertura por medio de este botón: arriba a la derecha de tu post...

Saludos.