De nuevo aquí...
Tengo un nuevo problema. En el escritorio me sale en un recuadro: Warning! antivirus or spyware. He intentado borrarlo pero sale de nuevo. Han desaparecido el Adware y el CCleaner. No puedo abrir el correo ni el firefox. El Panda me lo reconoce como un troyano de publicidad pero no me lo borra........
Me podéis dar alguna solución?
Gracias!

Que tal IEM,

A.-Descarga y actualiza Super antispyware <Leer_manual>

B.- Desacarga DelpSGuard esta al final de la pagina<Leer Manual>

C.-.-Descarga y actualiza Malwarebytes' Anti-Malware<Leer_manual>

1.-Desactiva restaurar sistema
2.-Entra en modo seguro

• Ejecuta super antispyware

• Ejecuta DelpSGuard de acuerdo a su manual:
  1. Elige la opccion 1 y pulsa enter para comenzar
  2. Vuelve a presionar enter para continuar
  3. Luego que termine reinicia en modo normal y ubica el reporte
     que se creará en C:\Reportar_a_ForoSpyware.txt

• Ejecuta Malwarebytes' Anti-Malware de la siguiente manera:
  • Realiza un examen completo
  • Elimina lo que consiga con la opcion de quitar todo lo seleccionado,
  • Reinicia el sistema (este paso es importante para eliminar lo que consiga)
  • Abre el programa y ubica el reporte en la pestaña "Registros" ("Logs" en ingles) abrelo y pegalo aqui

D.-En modo Normal Realiza un Scan Online con el Panda ActiveScan+Manual y pega el reporte que genere envolviendolo con la etiqueta CODE #

Regresa con los reportes del Panda, DelpSguard, MalwareBytes y dime como esta la PC

Gracias por responder.
Me pongo manos a la obra y cuando tenga todo lo mando y te digo algo.

DelPSGuard v 4.9.8
by www.ForoSpyware.com
Reporte Creado: 18:33:41,10, 07/08/2008
SO: Microsoft Windows XP [Versi¢n 5.1.2600]
Modo de Inicio: Seguro
_________________________________________


»»»»»»»»»»»» Carpetas y Archivos infectados »»»»»»»»»»»»

C:\WINDOWS\system32 \ntimage.gif Eliminado Malware.Bagle

»»»»»»»»»»»»»»»»»»» Programas Malwares »»»»»»»»»»»»»»»»»



»»»»»»»»»»»»»»»»»»» FIN »»»»»»»»»»»»»»»»»»»

Malwarebytes' Anti-Malware 1.24
Versión de la Base de Datos: 1030
Windows 5.1.2600 Service Pack 2

20:32:12 07/08/2008
mbam-log-8-7-2008 (20-32-12).txt

Tipo de examen : Examen Completo (C:\|D:\|E:\|F:\|)
Objetos examinados: 129407
Tiempo transcurrido: 1 hour(s), 53 minute(s), 2 second(s)

Procesos en Memoria Infectados: 0
Módulos en Memoria Infectados: 0
Claves del Registro Infectadas: 12
Valores del Registro Infectados: 3
Elementos de Datos del Registro Infectados: 6
Carpetas Infectadas: 25
Ficheros Infectados: 21

Procesos en Memoria Infectados:
(No se han detectado elementos maliciosos)

Módulos en Memoria Infectados:
(No se han detectado elementos maliciosos)

Claves del Registro Infectadas:
HKEY_CLASSES_ROOT\CLSID\{1cd4e2dc-2da0-4154-8723-38cb04fb6a58} (Adware.EGDAccess) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{31ddc1fd-cea3-4837-a6dc-87e67015adc9} (Adware.EGDAccess) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{321f38b6-7e5f-470e-b58c-927523b7af92} (Adware.EGDAccess) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{5fd9726a-4977-449d-8352-25fdd8a510b5} (Adware.EGDAccess) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{5fd9726a-4977-449d-8352-25fdd8a510b5} (Adware.EGDAccess) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{87c1805d-c5ae-4455-ab39-e245bb516136} (Adware.EGDAccess) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{af7410c1-fba3-415e-800a-4110ced40536} (Adware.EGDAccess) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{cb5d474e-a510-40a4-b5a4-838933bcba64} (Adware.EGDAccess) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{fa1d6d8f-c6ed-4752-8512-a33283240130} (Adware.EGDAccess) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{fbf65a16-c9ab-465e-aece-d2d9d5ab5e60} (Adware.EGDAccess) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\rhce4bj0e1b3 (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.

Valores del Registro Infectados:
HKEY_CURRENT_USER\Control Panel\Desktop\originalwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\convertedwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\scrnsave.exe (Hijack.Wallpaper) -> Quarantined and deleted successfully.

Elementos de Datos del Registro Infectados:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\System (Rootkit.DNSChanger) -> Data: kdxjv.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.115.27 85.255.112.217 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\T cpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.115.27 85.255.112.217 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\T cpip\Parameters\Interfaces\{88da32ec-9395-4c44-8f73-a35114c516f5}\NameServer (Trojan.DNSChanger) -> Data: 85.255.115.27 85.255.112.217 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\T cpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.115.27 85.255.112.217 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\T cpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.115.27 85.255.112.217 -> Quarantined and deleted successfully.

Carpetas Infectadas:
C:\WINDOWS\msskinner (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Archivos de programa\rhce4bj0e1b3 (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Propietario\Datos de programa\ultra (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\maite\Datos de programa\rhce4bj0e1b3 (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\maite\Datos de programa\rhce4bj0e1b3\Quarantine (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\maite\Datos de programa\rhce4bj0e1b3\Quarantine\Autorun (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\maite\Datos de programa\rhce4bj0e1b3\Quarantine\Autorun\HKCU (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\maite\Datos de programa\rhce4bj0e1b3\Quarantine\Autorun\HKCU\RunO nce (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\maite\Datos de programa\rhce4bj0e1b3\Quarantine\Autorun\HKLM (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\maite\Datos de programa\rhce4bj0e1b3\Quarantine\Autorun\HKLM\RunO nce (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\maite\Datos de programa\rhce4bj0e1b3\Quarantine\Autorun\StartMenu AllUsers (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\maite\Datos de programa\rhce4bj0e1b3\Quarantine\Autorun\StartMenu CurrentUser (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\maite\Datos de programa\rhce4bj0e1b3\Quarantine\BrowserObjects (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\maite\Datos de programa\rhce4bj0e1b3\Quarantine\Packages (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Propietario\Datos de programa\rhce4bj0e1b3 (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Propietario\Datos de programa\rhce4bj0e1b3\Quarantine (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Propietario\Datos de programa\rhce4bj0e1b3\Quarantine\Autorun (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Propietario\Datos de programa\rhce4bj0e1b3\Quarantine\Autorun\HKCU (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Propietario\Datos de programa\rhce4bj0e1b3\Quarantine\Autorun\HKCU\RunO nce (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Propietario\Datos de programa\rhce4bj0e1b3\Quarantine\Autorun\HKLM (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Propietario\Datos de programa\rhce4bj0e1b3\Quarantine\Autorun\HKLM\RunO nce (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Propietario\Datos de programa\rhce4bj0e1b3\Quarantine\Autorun\StartMenu AllUsers (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Propietario\Datos de programa\rhce4bj0e1b3\Quarantine\Autorun\StartMenu CurrentUser (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Propietario\Datos de programa\rhce4bj0e1b3\Quarantine\BrowserObjects (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Propietario\Datos de programa\rhce4bj0e1b3\Quarantine\Packages (Rogue.Multiple) -> Quarantined and deleted successfully.

Ficheros Infectados:
C:\WINDOWS\msskinner\msbackup.dat (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Archivos de programa\rhce4bj0e1b3\database.dat (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Archivos de programa\rhce4bj0e1b3\license.txt (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Archivos de programa\rhce4bj0e1b3\MFC71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Archivos de programa\rhce4bj0e1b3\MFC71ENU.DLL (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Archivos de programa\rhce4bj0e1b3\msvcp71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Archivos de programa\rhce4bj0e1b3\msvcr71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Archivos de programa\rhce4bj0e1b3\rhce4bj0e1b3.exe.local (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Propietario\Datos de programa\ultra\uninstall.bat (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\WINDOWS\inf\ultra.inf (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\inf\ultra.PNF (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\pphca4bj0e1b3.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Escritorio\Instant Access.lnk (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Escritorio\NoCreditCard.lnk (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Escritorio\Join The Orgy.lnk (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\WINDOWS\tmlpcert2007 (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Propietario\Menú Inicio\NoCreditCard.lnk (Dialer) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Propietario\Datos de programa\Microsoft\Internet Explorer\Quick Launch\Antivirus XP 2008.lnk (Rogue.Antivirus2008) -> Quarantined and deleted successfully.
C:\Documents and Settings\maite\Configuración local\Temp\.tt2.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\maite\Configuración local\Temp\.tt5.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Propietario\Configuración local\Temp\s1265.php (Trojan.FakeAlert) -> Quarantined and deleted successfully.



Esto es lo que me sale.

Ha desaparecido

Hola IEM,

Las Herramientas ya cumplieron su trabajo,

Porfavor dime si se solucionó el problema o aun sigues con los inconvenientes..¿ ?

Hola!
No me sale nada en el escritorio, el recuadro de alerta del troyano a desaparecido.

Una pregunta, cuando el Super antispyware dice que lo manda a la cuarentena, lo ha eliminado todo lo que ha encontrado? o los guarda? que ocurre pasada la cuarentena?

Mil Gracias.

Hola,

Si el Super AntiSpyware tiene algo en cuarentena entonces elimina lo que aparece ally, en la cuarentena las infecciones ya no pueden hacer daño, pero es preferible eliminarlas por completo.


Si no ha mas dudas entonces damos por solucionado el tema, salud2....................>