Foro de InfoSpyware - Foro de Hijackthis - Foro de Virus

Hola necesito ayuda, nose en que pagina entre que me infecte de algun bicho el punto es que no me deja ejecutar ningun antivirus que bajo al clickiar me sale que no es una aplicacion win32 valida......tengo windows vista, como hago para poder limpiar Espero toda la ayuda
Gracias

errorrrrrrrrrrr

Hola,

Realiza los siguientes pasos saltea los pasos que no te deje realizar:

Descarga las siguientes herramientas:

• Ccleaner + Manual
  
• MalwareBytes' Anti-Malware
  
• Dr. Web Cure-IT

Usa el Ccleaner para limpiar el sistema,primero utilizá la opción de "Limpiador" para borrar cookies, temporales de Internet y todos los archivos que este te muestre como obsoletos.y luego usa su opción de "Registro" para limpiar todo el registro de Windows (haciendo copia de seguridad).

Ejecuta el MalwareBytes' Anti-Malware y elimina todo lo que te encuentre. (Dejanos el reporte que genere)

Ejecuta Dr. Web Cure-IT y elimina todo lo que éste encuentre. (Dejanos el reporte que genere)

Realiza un escaneo online con:

Kaspersky ---Manual (nos pegas el reporte completo para analizarlo)

Regresa y comentanos los resultados que obtuvistes.

Saludos y mucha suerte!

Hola
Primero que todo gracias por tu ayuda, te cuento que no pude pasar el Ccleaner ni el Dr Web Cure, solo pude pasar el Malwarebytes y me arrojo lo siguiente:
Malwarebytes' Anti-Malware 1.25
Versión de la Base de Datos: 1076
Windows 6.0.6001 Service Pack 1

14:03:09 21-08-2008
mbam-log-08-21-2008 (14-03-09).txt

Tipo de examen : Examen Completo (C:\|D:\|)
Objetos examinados: 140339
Tiempo transcurrido: 1 hour(s), 18 minute(s), 27 second(s)

Procesos en Memoria Infectados: 0
Módulos en Memoria Infectados: 0
Claves del Registro Infectadas: 0
Valores del Registro Infectados: 1
Elementos de Datos del Registro Infectados: 0
Carpetas Infectadas: 2
Ficheros Infectados: 34

Procesos en Memoria Infectados:
(No se han detectado elementos maliciosos)

Módulos en Memoria Infectados:
(No se han detectado elementos maliciosos)

Claves del Registro Infectadas:
(No se han detectado elementos maliciosos)

Valores del Registro Infectados:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run\mule_st_key (Trojan.Agent) -> Delete on reboot.

Elementos de Datos del Registro Infectados:
(No se han detectado elementos maliciosos)

Carpetas Infectadas:
C:\Windows\System32\drivers\downld (Trojan.Agent) -> Delete on reboot.
C:\Users\MARIELA\AppData\Roaming\m (Trojan.Agent) -> Delete on reboot.

Ficheros Infectados:
C:\Windows\System32\drivers\downld\103116.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\108077.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\114551.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\122507.exe (Trojan.Agent) -> Delete on reboot.
C:\Windows\System32\drivers\downld\124894.exe (Trojan.Agent) -> Delete on reboot.
C:\Windows\System32\drivers\downld\130151.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\144706.exe (Trojan.Agent) -> Delete on reboot.
C:\Windows\System32\drivers\downld\150431.exe (Trojan.Agent) -> Delete on reboot.
C:\Windows\System32\drivers\downld\154425.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\175719.exe (Trojan.Agent) -> Delete on reboot.
C:\Windows\System32\drivers\downld\180586.exe (Trojan.Agent) -> Delete on reboot.
C:\Windows\System32\drivers\downld\189151.exe (Trojan.Agent) -> Delete on reboot.
C:\Windows\System32\drivers\downld\198448.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\223315.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\226653.exe (Trojan.Agent) -> Delete on reboot.
C:\Windows\System32\drivers\downld\234407.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\245623.exe (Trojan.Agent) -> Delete on reboot.
C:\Windows\System32\drivers\downld\250802.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\325667.exe (Trojan.Agent) -> Delete on reboot.
C:\Windows\System32\drivers\downld\330971.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\443136.exe (Trojan.Agent) -> Delete on reboot.
C:\Windows\System32\drivers\downld\455226.exe (Trojan.Agent) -> Delete on reboot.
C:\Windows\System32\drivers\downld\75254.exe (Trojan.Agent) -> Delete on reboot.
C:\Windows\System32\drivers\downld\80699.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\85816.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\99606.exe (Trojan.Agent) -> Delete on reboot.
C:\Users\MARIELA\AppData\Roaming\m\data.oct (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\MARIELA\AppData\Roaming\m\list.oct (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\MARIELA\AppData\Roaming\m\srvlist.oct (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\mdelk.exe (Trojan.Spammer) -> Delete on reboot.
C:\Windows\System32\wintems.exe (Trojan.Spammer) -> Delete on reboot.
C:\Users\MARIELA\AppData\Roaming\m\flec006.exe (Trojan.Agent) -> Delete on reboot.
C:\Windows\System32\drivers\hldrrr.exe (Rootkit.Agent) -> Delete on reboot.
C:\Windows\System32\drivers\srosa.sys (Rootkit.Bagle) -> Quarantined and deleted successfully.
eso
gracias

Hola, muy bien

Has podido realizar el punto numero ?

Saludos!

Con respecto al punto 5 es demasiado lento el proceso
No hay otro scan mas rapido, es muy lento, llevo mas de 3 horas y apenas lleva un 5%.
Que problema habra?
gracias

Hola, prueba con el Panda online. Deja su reporte.

Si sigue siendo lento..

Descarga las siguientes herramientas:

• SUPERAntispyware [Manual]
• Ccleaner (Manual)
• MalwareBytes' Anti-Malware
• Ad-aware Manual

Apaga restaurar sistema

Entra en modo seguro o modo a prueba de fallos

Ejecuta el SuperAntispyware y elimina todo lo que te encuentre. Realiza lo mismo con MalwareByte's Anti-Malware y Ad-Aware.

Ejecuta Ccleaner. Usar primero su opción de "Limpiador" para borrar cookies, temporales de Internet y todos los archivos que este te muestre como obsoletos, y luego usar su opción de "Registro" para limpiar todo el registro de Windows (haciendo copia de seguridad).

Recuerda volver y comentarnos como te ha ido, saludos!

Con Panda fue un poco menos lento.
Nuevamente no me dejo pasar el Cclear.
Con el AdWare no me dejo borrar uno que decia algo asi como Beagle.
dejo los reportes.
Malwarebytes' Anti-Malware 1.25
Versión de la Base de Datos: 1076
Windows 6.0.6001 Service Pack 1

16:27:10 22-08-2008
mbam-log-08-22-2008 (16-27-10).txt

Tipo de examen : Examen Completo (C:\|D:\|)
Objetos examinados: 142541
Tiempo transcurrido: 1 hour(s), 14 minute(s), 15 second(s)

Procesos en Memoria Infectados: 0
Módulos en Memoria Infectados: 0
Claves del Registro Infectadas: 0
Valores del Registro Infectados: 1
Elementos de Datos del Registro Infectados: 0
Carpetas Infectadas: 2
Ficheros Infectados: 67

Procesos en Memoria Infectados:
(No se han detectado elementos maliciosos)

Módulos en Memoria Infectados:
(No se han detectado elementos maliciosos)

Claves del Registro Infectadas:
(No se han detectado elementos maliciosos)

Valores del Registro Infectados:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run\mule_st_key (Trojan.Agent) -> Delete on reboot.

Elementos de Datos del Registro Infectados:
(No se han detectado elementos maliciosos)

Carpetas Infectadas:
C:\Windows\System32\drivers\downld (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\MARIELA\AppData\Roaming\m (Trojan.Agent) -> Delete on reboot.

Ficheros Infectados:
C:\Windows\System32\drivers\downld\158341.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\114551.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\115877.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\119761.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\124894.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\130151.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\135112.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\146609.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\14712844.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\14762015.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\14796102.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\14808722.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\14815212.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\14823371.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\14890779.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\14959591.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\14977905.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\150431.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\15262233.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\15291436.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\15303744.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\15307192.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\15318315.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\15325491.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\15329812.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\15373851.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\15426377.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\15440666.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\154425.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\156500.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\172583.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\178855.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\180586.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\183862.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\186062.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\189151.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\196467.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\201272.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\213814.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\221786.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\223315.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\226123.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\226591.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\234407.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\249929.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\261036.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\276074.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\329723.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\342172.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\619745.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\684641.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\717386.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\739787.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\743656.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\78328.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\787399.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\80699.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\80964.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\839113.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\851469.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\85816.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\99606.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\MARIELA\AppData\Roaming\m\data.oct (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\MARIELA\AppData\Roaming\m\list.oct (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\MARIELA\AppData\Roaming\m\srvlist.oct (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\hldrrr.exe (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\srosa.sys (Rootkit.Bagle) -> Quarantined and deleted successfully.

;************************************************* ************************************************** ************************************************** ******************************
ANALYSIS: 2008-08-23 06:07:51
PROTECTIONS: 3
MALWARE: 4
SUSPECTS: 6
;************************************************* ************************************************** ************************************************** ******************************
PROTECTIONS
Description Version Active Updated
;================================================= ================================================== ================================================== ==============================
Windows Defender 1.1.3007.0 No Yes
McAfee Internet Security Suite 2007 8.1 No No
McAfee VirusScan Plus 12.1 No No
;================================================= ================================================== ================================================== ==============================
MALWARE
Id Description Type Active Severity Disinfectable Disinfected Location
;================================================= ================================================== ================================================== ==============================
00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Users\MARIELA\AppData\Roaming\Microsoft\Windows \Cookies\mariela@atdmt[1].txt
00170557 Cookie/Com.com TrackingCookie No 0 Yes No C:\Users\MARIELA\AppData\Roaming\Microsoft\Windows \Cookies\Low\mariela@terra.com[1].txt
02898934 W32/Bagle.RP.worm Virus/Worm No 0 Yes No C:\Users\MARIELA\AppData\Local\Microsoft\Windows\T emporary Internet Files\Content.IE5\NVRYUC0U\b64_3[1].jpg
02898934 W32/Bagle.RP.worm Virus/Worm Yes 1 Yes No C:\Windows\System32\wintems.exe
03009106 W32/Xor-encoded.A Virus No 0 Yes No C:\Users\MARIELA\AppData\Local\VirtualStore\Progra m Files\ESET\infected\OAGCYRCA.NQF
;================================================= ================================================== ================================================== ==============================
SUSPECTS
Sent Location cn'
;================================================= ================================================== ================================================== ==============================
No C:\Windows\System32\drivers\hldrrr.exe cn'
No C:\Program Files\DellTPad\Apoint.exe cn'
No C:\Users\MARIELA\AppData\Local\Microsoft\Windows\T emporary Internet Files\Content.IE5\TIDIGQBA\b64_1[1].jpg
No C:\Users\MARIELA\AppData\Local\Microsoft\Windows\T emporary Internet Files\Content.IE5\WFSEN6LV\b64_1[1].jpg
No C:\Users\MARIELA\AppData\Local\Temp\Rar$EX00.020\A nti-Virus_ESET.NOD32.BR_v.2.70.26_WIN_NT_2K_2K3_XP_VIS TA_32Bit_64Bit_[2007]_by.F!N4LShare.exe
No C:\Users\MARIELA\AppData\Local\Temp\Rar$EX04.476\A nti-Virus_ESET.NOD32.BR_v.2.70.26_WIN_NT_2K_2K3_XP_VIS TA_32Bit_64Bit_[2007]_by.F!N4LShare.exe
;================================================= ================================================== ================================================== ==============================
VULNERABILITIES
Id Severity Description cn'
;================================================= ================================================== ================================================== ==============================
;================================================= ================================================== ================================================== ==============================
Muchas gracias espero mas indicaciones

Descargate OTMoveIt lo guardas en el Escritorio.

• Haz un doble clic sobre OTMoveIt.exe para ejecutarlo.
• Asegurate que este marcado "Unregister Dll's and Ocx's".
• Copia el texto que se encuentra en el cuadrado más abajo, y pega el texto en el marco de izquierdo de OTMoveIt nombrado Paste List of Filas / Folders to be moved.

• Haz clic en MoveIt! Para lanzar la supresión.
• Cuando el resultado aparece en el marco Results, haz clic enExit.
• Reinicia el PC (Este paso es muy importante)

Envía el informe (reporte) de OTMoveIt situado sobre C: \ _ OTMoveIt\MovedFiles.

Hola Aqui esta el informe de Otmolvet
Gracias



C:\Program Files\DellTPad\Apoint.exe moved successfully.
< C:\Users\MARIELA\AppData\Local\Microsoft\Windows\T emporary Internet Files\Content.IE5\NVRYUC0U\b64_3[1].jpg >
File/Folder C:\Users\MARIELA\AppData\Local\Microsoft\Windows\T emporary Internet Files\Content.IE5\NVRYUC0U\b64_3[1].jpg not found.
< C:\Users\MARIELA\AppData\Local\Microsoft\Windows\T emporary Internet Files\Content.IE5\TIDIGQBA\b64_1[1].jpg >
File/Folder C:\Users\MARIELA\AppData\Local\Microsoft\Windows\T emporary Internet Files\Content.IE5\TIDIGQBA\b64_1[1].jpg not found.
< C:\Users\MARIELA\AppData\Local\Microsoft\Windows\T emporary Internet Files\Content.IE5\WFSEN6LV\b64_1[1].jpg >
File/Folder C:\Users\MARIELA\AppData\Local\Microsoft\Windows\T emporary Internet Files\Content.IE5\WFSEN6LV\b64_1[1].jpg not found.
< C:\Users\MARIELA\AppData\Local\Temp\Rar$EX00.020\A nti-Virus_ESET.NOD32.BR_v.2.70.26_WIN_NT_2K_2K3_XP_VIS TA_32Bit_64Bit_[2007]_by.F!N4LShare.exe >
File/Folder C:\Users\MARIELA\AppData\Local\Temp\Rar$EX00.020\A nti-Virus_ESET.NOD32.BR_v.2.70.26_WIN_NT_2K_2K3_XP_VIS TA_32Bit_64Bit_[2007]_by.F!N4LShare.exe not found.
< C:\Users\MARIELA\AppData\Local\Temp\Rar$EX04.476\A nti-Virus_ESET.NOD32.BR_v.2.70.26_WIN_NT_2K_2K3_XP_VIS TA_32Bit_64Bit_[2007]_by.F!N4LShare.exe >
File/Folder C:\Users\MARIELA\AppData\Local\Temp\Rar$EX04.476\A nti-Virus_ESET.NOD32.BR_v.2.70.26_WIN_NT_2K_2K3_XP_VIS TA_32Bit_64Bit_[2007]_by.F!N4LShare.exe not found.
File/Folder C:\Users\MARIELA\AppData\Local\VirtualStore\Progra m Files\ESET\infected\OAGCYRCA.NQF not found.
File move failed. C:\Windows\System32\drivers\hldrrr.exe scheduled to be moved on reboot.
File move failed. C:\Windows\System32\wintems.exe scheduled to be moved on reboot.

OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 08232008_180244

Files moved on Reboot...
File move failed. C:\Windows\System32\drivers\hldrrr.exe scheduled to be moved on reboot.
File move failed. C:\Windows\System32\wintems.exe scheduled to be moved on reboot.