Foro de InfoSpyware - Foro de Hijackthis - Foro de Virus

hola mi problema es el siguiente :

al tratar de acceder a los archivos en el disco c: mi ps me pide que elija el programa con el que deseo abrir esta aplicacion.... y cuando hago un escaneo con el avast 4.8 me sale la siguiente informacion.....

19/05/2008 23:06:38 SYSTEM 1304 Sign of "Win32:Agent-YBW [Trj]" has been found in "C:\WINDOWS\system32\wnms.exe" file.
19/05/2008 23:07:15 SYSTEM 1304 Sign of "Win32:Vanti-BK [Rtk]" has been found in "C:\WINDOWS\system32\drivers\vga.sys" file.
19/05/2008 23:07:16 SYSTEM 1304 Sign of "Win32:Vanti-BK [Rtk]" has been found in "C:\WINDOWS\system32\drivers\vga.sys" file.
19/05/2008 23:14:58 SYSTEM 1304 Sign of "Win32:AuCrypt [Cryp]" has been found in "C:\WINDOWS\SYSTEM32\KAVO1.DLL" file.
20/05/2008 8:51:23 familia 1408 Sign of "Win32:Agent-XMW [Trj]" has been found in "C:\DOCUME~1\familia\CONFIG~1\Temp\mss8.tmp" file.
20/05/2008 9:21:24 familia 1408 Sign of "Win32:Agent-XMW [Trj]" has been found in "C:\DOCUME~1\familia\CONFIG~1\Temp\mssA.tmp" file.
20/05/2008 15:38:03 SYSTEM 1204 Sign of "Win32:Agent-XMW [Trj]" has been found in "C:\WINDOWS\system32\wnms.exe" file.
20/05/2008 15:48:39 SYSTEM 1196 Sign of "Win32:Agent-XMW [Trj]" has been found in "C:\WINDOWS\system32\wnms.exe" file.
21/05/2008 11:03:20 SYSTEM 1268 Sign of "Win32:Agent-XMW [Trj]" has been found in "C:\WINDOWS\system32\wnms.exe" file.
21/05/2008 11:33:31 SYSTEM 1268 Sign of "Win32:Agent-XMW [Trj]" has been found in "C:\DOCUME~1\familia\CONFIG~1\Temp\mss8.tmp" file.
21/05/2008 12:03:44 SYSTEM 1268 Sign of "Win32:Agent-XMW [Trj]" has been found in "C:\DOCUME~1\familia\CONFIG~1\Temp\mssA.tmp" file.
21/05/2008 14:47:13 familia 1224 Sign of "Win32:Agent-XMW [Trj]" has been found in "C:\DOCUME~1\familia\CONFIG~1\Temp\mss11.tmp" file.
21/05/2008 17:33:37 SYSTEM 1260 Sign of "Win32:Agent-XMW [Trj]" has been found in "C:\WINDOWS\system32\wnms.exe" file.
21/05/2008 17:50:52 SYSTEM 1260 AAVM - scanning warning: x_AavmCheckFileDirectEx [UNI]: C:\DOCUMENTS AND SETTINGS\CRISTIAN\DATOS DE PROGRAMA\MICROSOFT\PLANTILLAS\NORMAL.DOT (C:\DOCUMENTS AND SETTINGS\CRISTIAN\DATOS DE PROGRAMA\MICROSOFT\PLANTILLAS\NORMAL.DOT) returning error, 00000005.
21/05/2008 19:20:08 SYSTEM 1260 Sign of "Win32:Agent-XMW [Trj]" has been found in "C:\WINDOWS\system32\wnms.exe" file.
21/05/2008 22:03:51 SYSTEM 1196 Sign of "Win32:Agent-XMW [Trj]" has been found in "C:\WINDOWS\system32\wnms.exe" file.
21/05/2008 22:04:27 SYSTEM 1196 Sign of "Win32:Vanti-BK [Rtk]" has been found in "C:\WINDOWS\system32\drivers\vga.sys" file.
21/05/2008 22:04:28 SYSTEM 1196 Sign of "Win32:Vanti-BK [Rtk]" has been found in "C:\WINDOWS\system32\drivers\vga.sys" file.
22/05/2008 7:50:08 SYSTEM 1276 Sign of "Win32:Agent-XMW [Trj]" has been found in "C:\WINDOWS\system32\wnms.exe" file.
22/05/2008 12:52:00 SYSTEM 1200 Sign of "Win32:Agent-XMW [Trj]" has been found in "C:\WINDOWS\system32\wnms.exe" file.
22/05/2008 15:44:24 familia 1280 Sign of "Win32:Agent-XMW [Trj]" has been found in "C:\DOCUME~1\familia\CONFIG~1\Temp\mss8.tmp" file.
22/05/2008 16:14:58 familia 1280 Sign of "Win32:Agent-XMW [Trj]" has been found in "C:\DOCUME~1\familia\CONFIG~1\Temp\mss11.tmp" file.
22/05/2008 16:45:37 familia 1280 Sign of "Win32:Agent-XMW [Trj]" has been found in "C:\DOCUME~1\familia\CONFIG~1\Temp\mss18.tmp" file.
22/05/2008 17:15:46 familia 1280 Sign of "Win32:Agent-XMW [Trj]" has been found in "C:\DOCUME~1\familia\CONFIG~1\Temp\mss1B.tmp" file.
22/05/2008 20:14:59 SYSTEM 1244 Sign of "Win32:Agent-XMW [Trj]" has been found in "C:\WINDOWS\system32\wnms.exe" file.
22/05/2008 20:55:46 SYSTEM 1244 Sign of "Win32:Vanti-BK [Rtk]" has been found in "C:\WINDOWS\system32\drivers\vga.sys" file.
22/05/2008 20:57:14 SYSTEM 1244 Sign of "Win32:Vanti-BK [Rtk]" has been found in "C:\WINDOWS\system32\drivers\vga.sys" file.
23/05/2008 8:45:48 SYSTEM 1272 Sign of "Win32:Agent-XMW [Trj]" has been found in "C:\WINDOWS\system32\wnms.exe" file.
23/05/2008 9:59:30 SYSTEM 1268 Sign of "Win32:Agent-XMW [Trj]" has been found in "C:\WINDOWS\system32\wnms.exe" file.
23/05/2008 13:22:58 SYSTEM 1280 Sign of "Win32:Agent-XMW [Trj]" has been found in "C:\WINDOWS\system32\wnms.exe" file.
23/05/2008 15:40:57 SYSTEM 1200 Sign of "Win32:Agent-XMW [Trj]" has been found in "C:\WINDOWS\system32\wnms.exe" file.
23/05/2008 15:50:54 SYSTEM 1200 AAVM - scanning warning: x_AavmCheckFileDirectEx [UNI]: C:\DOCUMENTS AND SETTINGS\CRISTIAN\DATOS DE PROGRAMA\MICROSOFT\PLANTILLAS\NORMAL.DOT (C:\DOCUMENTS AND SETTINGS\CRISTIAN\DATOS DE PROGRAMA\MICROSOFT\PLANTILLAS\NORMAL.DOT) returning error, 00000005.
23/05/2008 17:32:55 SYSTEM 1240 Sign of "Win32:Agent-XMW [Trj]" has been found in "C:\WINDOWS\system32\wnms.exe" file.
23/05/2008 17:33:35 SYSTEM 1240 Sign of "Win32:Vanti-BK [Rtk]" has been found in "C:\WINDOWS\system32\drivers\vga.sys" file.
23/05/2008 17:33:35 SYSTEM 1240 Sign of "Win32:Vanti-BK [Rtk]" has been found in "C:\WINDOWS\system32\drivers\vga.sys" file.
23/05/2008 19:37:17 SYSTEM 1240 AAVM - scanning warning: x_AavmCheckFileDirectEx [UNI]: E:\autorun.inf (E:\autorun.inf) returning error, 00000005.
24/05/2008 15:52:51 SYSTEM 1196 Sign of "Win32:Agent-XMW [Trj]" has been found in "C:\WINDOWS\system32\wnms.exe" file.
24/05/2008 18:35:05 SYSTEM 1204 Sign of "Win32:Agent-XMW [Trj]" has been found in "C:\WINDOWS\system32\wnms.exe" file.
24/05/2008 18:35:45 SYSTEM 1204 Sign of "Win32:Vanti-BK [Rtk]" has been found in "C:\WINDOWS\system32\drivers\vga.sys" file.
25/05/2008 0:15:50 SYSTEM 1204 AAVM - scanning warning: x_AavmCheckFileDirectEx [UNI]: E:\autorun.inf (E:\autorun.inf) returning error, 00000005.
25/05/2008 9:44:14 SYSTEM 1268 Sign of "Win32:Agent-XMW [Trj]" has been found in "C:\WINDOWS\system32\wnms.exe" file.
25/05/2008 9:44:46 SYSTEM 1268 Sign of "Win32:Vanti-BK [Rtk]" has been found in "C:\WINDOWS\system32\drivers\vga.sys" file.
25/05/2008 9:44:46 SYSTEM 1268 Sign of "Win32:Vanti-BK [Rtk]" has been found in "C:\WINDOWS\system32\drivers\vga.sys" file.
25/05/2008 9:45:48 SYSTEM 1268 Sign of "Win32:Vanti-BK [Rtk]" has been found in "C:\WINDOWS\system32\drivers\vga.sys" file.
25/05/2008 12:13:54 SYSTEM 1236 Sign of "Win32:Agent-XMW [Trj]" has been found in "C:\WINDOWS\system32\wnms.exe" file.
25/05/2008 12:43:56 SYSTEM 1236 Sign of "Win32:Agent-XMW [Trj]" has been found in "C:\DOCUME~1\familia\CONFIG~1\Temp\mss11.tmp" file.
25/05/2008 13:13:57 SYSTEM 1236 Sign of "Win32:Agent-XMW [Trj]" has been found in "C:\DOCUME~1\familia\CONFIG~1\Temp\mss1B.tmp" file.
25/05/2008 13:44:26 SYSTEM 1236 Sign of "Win32:Agent-XMW [Trj]" has been found in "C:\DOCUME~1\familia\CONFIG~1\Temp\mss29.tmp" file.
26/05/2008 15:43:50 SYSTEM 1388 Sign of "Win32:Agent-XMW [Trj]" has been found in "C:\DOCUME~1\familia\CONFIG~1\Temp\mssE.tmp" file.
26/05/2008 16:14:23 SYSTEM 1388 Sign of "Win32:Agent-XMW [Trj]" has been found in "C:\DOCUME~1\familia\CONFIG~1\Temp\mss18.tmp" file.
26/05/2008 16:44:40 SYSTEM 1388 Sign of "Win32:Agent-XMW [Trj]" has been found in "C:\DOCUME~1\familia\CONFIG~1\Temp\mss24.tmp" file.
26/05/2008 17:14:30 SYSTEM 1388 Sign of "Win32:Agent-XMW [Trj]" has been found in "C:\DOCUME~1\familia\CONFIG~1\Temp\mss2B.tmp" file.
26/05/2008 17:44:41 SYSTEM 1388 Sign of "Win32:Agent-XMW [Trj]" has been found in "C:\DOCUME~1\familia\CONFIG~1\Temp\mss2D.tmp" file.
26/05/2008 18:14:47 SYSTEM 1388 Sign of "Win32:Agent-XMW [Trj]" has been found in "C:\DOCUME~1\familia\CONFIG~1\Temp\mss31.tmp" file.
26/05/2008 18:44:36 SYSTEM 1388 Sign of "Win32:Agent-XMW [Trj]" has been found in "C:\DOCUME~1\familia\CONFIG~1\Temp\mss36.tmp" file.
26/05/2008 23:21:54 SYSTEM 1260 Sign of "Win32:Agent-XMW [Trj]" has been found in "C:\WINDOWS\system32\wnms.exe" file.
26/05/2008 23:22:26 SYSTEM 1260 Sign of "Win32:Vanti-BK [Rtk]" has been found in "C:\WINDOWS\system32\drivers\vga.sys" file.
26/05/2008 23:22:27 SYSTEM 1260 Sign of "Win32:Vanti-BK [Rtk]" has been found in "C:\WINDOWS\system32\drivers\vga.sys" file.
26/05/2008 23:23:48 SYSTEM 1260 Sign of "Win32:Vanti-BK [Rtk]" has been found in "C:\WINDOWS\system32\drivers\vga.sys" file.
27/05/2008 10:09:46 SYSTEM 1268 Sign of "Win32:Agent-XMW [Trj]" has been found in "C:\WINDOWS\system32\wnms.exe" file.
27/05/2008 1022 SYSTEM 1268 Sign of "Win32:Vanti-BK [Rtk]" has been found in "C:\WINDOWS\system32\drivers\vga.sys" file.
27/05/2008 11:38:21 SYSTEM 1196 Sign of "Win32:Agent-XMW [Trj]" has been found in "C:\WINDOWS\system32\wnms.exe" file.
27/05/2008 12:26:58 SYSTEM 1200 Sign of "Win32:Agent-XMW [Trj]" has been found in "C:\WINDOWS\system32\wnms.exe" file.
27/05/2008 13:09:22 SYSTEM 1200 Sign of "Win32:OnLineGames-DZE [Trj]" has been found in "C:\RECYCLER\S-1-5-21-1708537768-1659004503-725345543-1005\Dc15.cmd" file.
27/05/2008 15:23:47 familia 1264 Sign of "Win32:Agent-XMW [Trj]" has been found in "C:\DOCUME~1\familia\CONFIG~1\Temp\mssF.tmp" file.
27/05/2008 17:17:47 SYSTEM 1268 Sign of "Win32:Agent-XMW [Trj]" has been found in "C:\WINDOWS\system32\wnms.exe" file.
28/05/2008 10:44:35 SYSTEM 1336 Sign of "Win32:Agent-XMW [Trj]" has been found in "C:\DOCUME~1\familia\CONFIG~1\Temp\mssAD.tmp" file.
28/05/2008 15:33:02 SYSTEM 1196 Sign of "Win32:Agent-XMW [Trj]" has been found in "C:\WINDOWS\system32\wnms.exe" file.
28/05/2008 16:16:56 SYSTEM 1200 Sign of "Win32:Agent-XMW [Trj]" has been found in "C:\WINDOWS\system32\wnms.exe" file.
28/05/2008 17:40:25 SYSTEM 1284 Sign of "Win32:Agent-XMW [Trj]" has been found in "C:\WINDOWS\system32\wnms.exe" file.
28/05/2008 17:41:45 SYSTEM 1284 Sign of "Win32:Vanti-BK [Rtk]" has been found in "C:\WINDOWS\system32\drivers\vga.sys" file.
28/05/2008 21:53:11 SYSTEM 1284 AAVM - scanning warning: x_AavmCheckFileDirectEx [UNI]: E:\autorun.inf (E:\autorun.inf) returning error, 00000005.
29/05/2008 0:01:52 SYSTEM 1284 Sign of "Win32:Vanti-BK [Rtk]" has been found in "C:\WINDOWS\system32\drivers\vga.sys" file.
29/05/2008 11:05:25 SYSTEM 1276 Sign of "Win32:Agent-XMW [Trj]" has been found in "C:\WINDOWS\system32\wnms.exe" file.
29/05/2008 17:37:01 SYSTEM 1216 Sign of "Win32:Agent-XMW [Trj]" has been found in "C:\WINDOWS\system32\wnms.exe" file.
29/05/2008 19:23:53 SYSTEM 1216 Sign of "Win32:Agent-XMW [Trj]" has been found in "C:\WINDOWS\system32\wnms.exe" file.
29/05/2008 19:24:50 SYSTEM 1216 Sign of "Win32:AuCrypt [Cryp]" has been found in "C:\WINDOWS\system32\kavo.exe" file.
29/05/2008 19:33:56 SYSTEM 1216 Sign of "Win32:AuCrypt [Cryp]" has been found in "C:\WINDOWS\SYSTEM32\KAVO0.DLL" file.
30/05/2008 12:31:56 SYSTEM 1196 Sign of "Win32:Agent-XMW [Trj]" has been found in "C:\WINDOWS\system32\wnms.exe" file.
30/05/2008 16:45:56 SYSTEM 1268 Sign of "Win32:Agent-XMW [Trj]" has been found in "C:\WINDOWS\system32\wnms.exe" file.
30/05/2008 19:23:11 cristian 3804 Sign of "Win32:AuCrypt [Cryp]" has been found in "E:\9mf.exe" file.
30/05/2008 21:27:07 cristian 1984 Sign of "Win32:Agent-XMW [Trj]" has been found in "c:\windows\system32\wnms.exe" file.
31/05/2008 16:33:03 SYSTEM 1268 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\wans.exe" file.
31/05/2008 16:33:47 SYSTEM 1268 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\spoolsv.exe" file.
31/05/2008 17:20:49 SYSTEM 1268 AAVM - scanning warning: x_AavmCheckFileDirectEx [UNI]: C:\DOCUMENTS AND SETTINGS\CRISTIAN\DATOS DE PROGRAMA\MICROSOFT\PLANTILLAS\NORMAL.DOT (C:\DOCUMENTS AND SETTINGS\CRISTIAN\DATOS DE PROGRAMA\MICROSOFT\PLANTILLAS\NORMAL.DOT) returning error, 00000005.
01/06/2008 12:40:40 SYSTEM 1272 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\wans.exe" file.
01/06/2008 18:26:28 SYSTEM 1388 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\wans.exe" file.
01/06/2008 22:21:54 SYSTEM 1388 AAVM - scanning warning: x_AavmCheckFileDirectEx [UNI]: C:\DOCUMENTS AND SETTINGS\CRISTIAN\DATOS DE PROGRAMA\MICROSOFT\PLANTILLAS\NORMAL.DOT (C:\DOCUMENTS AND SETTINGS\CRISTIAN\DATOS DE PROGRAMA\MICROSOFT\PLANTILLAS\NORMAL.DOT) returning error, 00000005.
01/06/2008 23:45:39 SYSTEM 1268 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\wans.exe" file.
02/06/2008 10:02:17 SYSTEM 1264 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\wans.exe" file.
02/06/2008 11:53:42 SYSTEM 1284 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\wans.exe" file.
02/06/2008 13:35:23 SYSTEM 1300 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\wans.exe" file.
02/06/2008 13:35:39 SYSTEM 1300 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "C:\WINDOWS\system32\wans.exe" file.
03/06/2008 10:48:49 SYSTEM 1272 Sign of "Win32:Rootkit-gen [Rtk]" has been found in "E:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\spoolsv.exe" file.
11/06/2008 9:09:18 SYSTEM 1392 Function setifaceUpdateFiles() has failed. Return code is 0xC0000142, dwRes is C0000142.
11/06/2008 9:09:19 SYSTEM 1392 An error has occured while attempting to update. Please check the logs.
11/06/2008 23:21:11 SYSTEM 1216 Sign of "VBS:Agent-BD [Trj]" has been found in "E:\.vbs" file.
12/06/2008 1432 familia 1280 AAVM - scanning warning: x_AavmCheckFileDirectEx [UNI]: C:\Documents and Settings\cristian\Escritorio\Dolby AC3 (2000)\AC3Filter\ac3filter.ax (C:\Documents and Settings\cristian\Escritorio\Dolby AC3 (2000)\AC3Filter\ac3filter.ax) returning error, 00000005.
13/06/2008 18:27:36 familia 1292 AAVM - scanning warning: x_AavmCheckFileDirectEx [UNI]: C:\Documents and Settings\cristian\Escritorio\Dolby AC3 (2000)\AC3Filter\ac3filter.ax (C:\Documents and Settings\cristian\Escritorio\Dolby AC3 (2000)\AC3Filter\ac3filter.ax) returning error, 00000005.
18/06/2008 0:09:56 familia 1276 AAVM - scanning warning: x_AavmCheckFileDirectEx [UNI]: C:\Documents and Settings\cristian\Escritorio\Dolby AC3 (2000)\AC3Filter\ac3filter.ax (C:\Documents and Settings\cristian\Escritorio\Dolby AC3 (2000)\AC3Filter\ac3filter.ax) returning error, 00000005.
29/06/2008 13:31:56 SYSTEM 1264 Function setifaceUpdatePackages() has failed. Return code is 0x20000004, dwRes is 20000004.
29/06/2008 13:31:58 SYSTEM 1264 An error has occured while attempting to update. Please check the logs.
29/06/2008 17:47:39 SYSTEM 1264 AAVM - scanning warning: x_AavmCheckFileDirectEx [UNI]: C:\Documents and Settings\cristian\Escritorio\Dolby AC3 (2000)\AC3Filter\ac3filter.ax (C:\Documents and Settings\cristian\Escritorio\Dolby AC3 (2000)\AC3Filter\ac3filter.ax) returning error, 00000005.
05/07/2008 17:55:42 SYSTEM 1280 Sign of "SWF:CVE-2007-0071 [Expl]" has been found in "http://www.miniclip.com/swfcontent/animations/caveman.swf?url=/games/caveman/es/&loop=true" file.
09/07/2008 21:56:34 SYSTEM 1200 Function setifaceUpdatePackages() has failed. Return code is 0x20000004, dwRes is 20000004.
16/07/2008 15:37:28 familia 1224 AAVM - scanning warning: x_AavmCheckFileDirectEx [UNI]: C:\Documents and Settings\cristian\Escritorio\Dolby AC3 (2000)\AC3Filter\ac3filter.ax (C:\Documents and Settings\cristian\Escritorio\Dolby AC3 (2000)\AC3Filter\ac3filter.ax) returning error, 00000005.
18/07/2008 15:41:21 familia 1312 AAVM - scanning warning: x_AavmCheckFileDirectEx [UNI]: C:\Documents and Settings\cristian\Escritorio\Dolby AC3 (2000)\AC3Filter\ac3filter.ax (C:\Documents and Settings\cristian\Escritorio\Dolby AC3 (2000)\AC3Filter\ac3filter.ax) returning error, 00000005.

me preocupa el hecho de que sean virus muy peligrosos.... asi que necesito un buen consejo....para eliminarlos....ya que segun lo anterior mi compu tiene un rootkit y algo asi como win32aucrypt



les agradezco la colaboracion................

Paso 1- Descarga estas herramientas pero no las ejecutes aun:

• DelPsguard
• MalwareByte's Antimalware

Paso 2- Reinicia he inicia en "Modo a prueba de fallos" (modo seguro con funciones a red)

Paso 3- Ejecuta estas herramientas, de a una:

• Ejecuta DelPsguard como lo indica su manual.
• Ejecuta MalwareByte's Antimalware y analiza el equipo completamente, eliminando todo lo que encuentre.

Paso 4- Descarga CCleaner y ejecútalo usando primero su opción de "Limpiador" para borrar cookies, temporales de Internet y todos los archivos que este te muestre como obsoletos, y luego usa su opción de "Registro" para limpiar todo el registro de Windows (haciendo copia de seguridad).


Paso 5- Realiza un analisis online con kaspersky online scanner como lo indica su manual y nos dejas su reporte.

Si usas Firefox como navegador recuerda usar la extencion IE Tab para poder realizar algun scanner online.

Reinicia y nos contas los resultados junto a los reportes generados por, MalwareByte's Antimalware, DelPsguard y Kaspersky online scanner.