Foro de InfoSpyware - Foro de Hijackthis - Foro de Virus

Antivirus Lab 2009 Nuevo falso programa Antivirus.

hola que tal espero esten bien, pues le explico que buscando un video en la red me entraron varios virus, fue muy rapido la maquina empezo a ejecutar varios paneles que me decian que tenia muchos virus y que debia comprar su antivirus. estos son muy molestos se ejecutan todo el tiempo y son varios pero todos se refieren a lo mismo. bueno ojala puedan ayudarme a eliminarlos hice un escaneo con kaspersky y este es el reporte
muchas gracias.

martes, 14 de octubre de 2008 22:58:47
Sistema operativo: Microsoft Windows XP Professional, Service Pack 3 (Build 2600)
Kaspersky Online Scanner versión: 5.0.84.1
Ultima actualización: 14/10/2008
Registros en la base antivirus: 1173723

Configuración del análisis
Analizar usando las siguientes bases standard
Analizar archivos verdadero
Analizar bases de correo verdadero

Objetivo a analizar Mi PC
C:\
D:\

Estadísticas
Número de objeros analizados 80264
Virus encontrados 6
Objetos infectados 12 / 0
Objetos sospechosos 0
Duración del análisis 01:22:36

Bombre del objeto infectado Nombre del virus Última acción
C:\Archivos de programa\Alwil Software\Avast4\DATA\aswResp.dat Object is locked saltado

C:\Archivos de programa\Alwil Software\Avast4\DATA\Avast4.db Object is locked saltado

C:\Archivos de programa\Alwil Software\Avast4\DATA\log\AshWebSv.ws Object is locked saltado

C:\Archivos de programa\Alwil Software\Avast4\DATA\log\aswMaiSv.log Object is locked saltado

C:\Archivos de programa\Alwil Software\Avast4\DATA\log\nshield.log Object is locked saltado

C:\Archivos de programa\Alwil Software\Avast4\DATA\log\selfdef.log Object is locked saltado

C:\Archivos de programa\Alwil Software\Avast4\DATA\report\Resident protection.txt Object is locked saltado

C:\Archivos de programa\Applications\iebt.dll Infectados: Trojan-Downloader.Win32.Zlob.aagn saltado

C:\Archivos de programa\Applications\iebu.exe Infectados: Trojan-Downloader.Win32.Zlob.aagl saltado

C:\Archivos de programa\Applications\wcu.exe Infectados: Trojan.Win32.Agent.agpa saltado

C:\Archivos de programa\VirusRL2009\VirusRL2009.exe Infectados: Trojan.Win32.FraudPack.get saltado

C:\Documents and Settings\Administrador\Configuración local\Archivos temporales de Internet\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked saltado

C:\Documents and Settings\Administrador\Configuración local\Archivos temporales de Internet\Content.IE5\index.dat Object is locked saltado

C:\Documents and Settings\Administrador\Configuración local\Archivos temporales de Internet\Content.IE5\Y5LYD9FW\01[1].htm Object is locked saltado

C:\Documents and Settings\Administrador\Configuración local\Datos de programa\Microsoft\Feeds Cache\index.dat Object is locked saltado

C:\Documents and Settings\Administrador\Configuración local\Datos de programa\Microsoft\Messenger\jonhgh@hotmail.com\Sh aringMetadata\Logs\Dfsr00005.log Object is locked saltado

C:\Documents and Settings\Administrador\Configuración local\Datos de programa\Microsoft\Messenger\jonhgh@hotmail.com\Sh aringMetadata\pending.dat Object is locked saltado

C:\Documents and Settings\Administrador\Configuración local\Datos de programa\Microsoft\Messenger\jonhgh@hotmail.com\Sh aringMetadata\Working\database_DC64_81FA_6481_D7A2 \dfsr.db Object is locked saltado

C:\Documents and Settings\Administrador\Configuración local\Datos de programa\Microsoft\Messenger\jonhgh@hotmail.com\Sh aringMetadata\Working\database_DC64_81FA_6481_D7A2 \fsr.log Object is locked saltado

C:\Documents and Settings\Administrador\Configuración local\Datos de programa\Microsoft\Messenger\jonhgh@hotmail.com\Sh aringMetadata\Working\database_DC64_81FA_6481_D7A2 \fsrtmp.log Object is locked saltado

C:\Documents and Settings\Administrador\Configuración local\Datos de programa\Microsoft\Messenger\jonhgh@hotmail.com\Sh aringMetadata\Working\database_DC64_81FA_6481_D7A2 \tmp.edb Object is locked saltado

C:\Documents and Settings\Administrador\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat Object is locked saltado

C:\Documents and Settings\Administrador\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat.LOG Object is locked saltado

C:\Documents and Settings\Administrador\Configuración local\Datos de programa\Microsoft\Windows Live Contacts\jonhgh@hotmail.com\real\members.stg Object is locked saltado

C:\Documents and Settings\Administrador\Configuración local\Datos de programa\Microsoft\Windows Live Contacts\jonhgh@hotmail.com\shadow\members.stg Object is locked saltado

C:\Documents and Settings\Administrador\Configuración local\Historial\History.IE5\index.dat Object is locked saltado

C:\Documents and Settings\Administrador\Configuración local\Temp\~DF7F1F.tmp Object is locked saltado

C:\Documents and Settings\Administrador\Configuración local\Temp\~DF7F33.tmp Object is locked saltado

C:\Documents and Settings\Administrador\Configuración local\Temp\~DF807F.tmp Object is locked saltado

C:\Documents and Settings\Administrador\Configuración local\Temp\~DF8961.tmp Object is locked saltado

C:\Documents and Settings\Administrador\Configuración local\Temp\~DF8975.tmp Object is locked saltado

C:\Documents and Settings\Administrador\Configuración local\Temp\~DFDF52.tmp Object is locked saltado

C:\Documents and Settings\Administrador\Cookies\index.dat Object is locked saltado

C:\Documents and Settings\Administrador\Mis documentos\Mi música\iTunes\iTunes Library Extras.itdb Object is locked saltado

C:\Documents and Settings\Administrador\Mis documentos\Mi música\iTunes\iTunes Library Genius.itdb Object is locked saltado

C:\Documents and Settings\Administrador\Mis documentos\Mi música\iTunes\iTunes Library.itl Object is locked saltado

C:\Documents and Settings\Administrador\Mis documentos\Mis historiales de conversación\Octubre 2008\neftalig@msn.com.html Object is locked saltado

C:\Documents and Settings\Administrador\NTUSER.DAT Object is locked saltado

C:\Documents and Settings\Administrador\ntuser.dat.LOG Object is locked saltado

C:\Documents and Settings\LocalService\Configuración local\Archivos temporales de Internet\Content.IE5\index.dat Object is locked saltado

C:\Documents and Settings\LocalService\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat Object is locked saltado

C:\Documents and Settings\LocalService\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat.LOG Object is locked saltado

C:\Documents and Settings\LocalService\Configuración local\Historial\History.IE5\index.dat Object is locked saltado

C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked saltado

C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked saltado

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked saltado

C:\Documents and Settings\NetworkService\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat Object is locked saltado

C:\Documents and Settings\NetworkService\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat.LOG Object is locked saltado

C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked saltado

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked saltado

C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked saltado

C:\System Volume Information\_restore{4A094B7D-CFD6-4B3B-BA7C-61DE910EE438}\RP1\A0000009.dll Infectados: Trojan-Downloader.Win32.Zlob.aagn saltado

C:\System Volume Information\_restore{4A094B7D-CFD6-4B3B-BA7C-61DE910EE438}\RP1\A0000029.dll Infectados: Trojan-Downloader.Win32.Zlob.aagn saltado

C:\System Volume Information\_restore{4A094B7D-CFD6-4B3B-BA7C-61DE910EE438}\RP1\A0000049.dll Infectados: Trojan-Downloader.Win32.Zlob.aagn saltado

C:\System Volume Information\_restore{4A094B7D-CFD6-4B3B-BA7C-61DE910EE438}\RP2\A0000090.dll Infectados: Trojan-Downloader.Win32.Zlob.aagn saltado

C:\System Volume Information\_restore{4A094B7D-CFD6-4B3B-BA7C-61DE910EE438}\RP2\A0000109.dll Infectados: Trojan-Downloader.Win32.Zlob.aagn saltado

C:\System Volume Information\_restore{4A094B7D-CFD6-4B3B-BA7C-61DE910EE438}\RP2\A0000128.dll Infectados: Trojan-Downloader.Win32.Zlob.aagn saltado

C:\System Volume Information\_restore{4A094B7D-CFD6-4B3B-BA7C-61DE910EE438}\RP3\A0000140.exe Infectados: Trojan-Downloader.Win32.Zlob.aagp saltado

C:\System Volume Information\_restore{4A094B7D-CFD6-4B3B-BA7C-61DE910EE438}\RP3\change.log Object is locked saltado

C:\WINDOWS\CSC\00000001 Object is locked saltado

C:\WINDOWS\Debug\Netlogon.log Object is locked saltado

C:\WINDOWS\Debug\PASSWD.LOG Object is locked saltado

C:\WINDOWS\SchedLgU.Txt Object is locked saltado

C:\WINDOWS\SoftwareDistribution\ReportingEvents.lo g Object is locked saltado

C:\WINDOWS\system32\CatRoot2\edb.log Object is locked saltado

C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked saltado

C:\WINDOWS\system32\config\Antivirus.Evt Object is locked saltado

C:\WINDOWS\system32\config\AppEvent.Evt Object is locked saltado

C:\WINDOWS\system32\config\default Object is locked saltado

C:\WINDOWS\system32\config\default.LOG Object is locked saltado

C:\WINDOWS\system32\config\Internet.evt Object is locked saltado

C:\WINDOWS\system32\config\SAM Object is locked saltado

C:\WINDOWS\system32\config\SAM.LOG Object is locked saltado

C:\WINDOWS\system32\config\SecEvent.Evt Object is locked saltado

C:\WINDOWS\system32\config\SECURITY Object is locked saltado

C:\WINDOWS\system32\config\SECURITY.LOG Object is locked saltado

C:\WINDOWS\system32\config\software Object is locked saltado

C:\WINDOWS\system32\config\software.LOG Object is locked saltado

C:\WINDOWS\system32\config\SysEvent.Evt Object is locked saltado

C:\WINDOWS\system32\config\system Object is locked saltado

C:\WINDOWS\system32\config\system.LOG Object is locked saltado

C:\WINDOWS\system32\h323log.txt Object is locked saltado

C:\WINDOWS\system32\obicx.dll Infectados: Hoax.Win32.Agent.gd saltado

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked saltado

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked saltado

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked saltado

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MA P Object is locked saltado

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MA P Object is locked saltado

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DAT A Object is locked saltado

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked saltado

C:\WINDOWS\Temp\Perflib_Perfdata_6c8.dat Object is locked saltado

C:\WINDOWS\Temp\_avast4_\Webshlock.txt Object is locked saltado

C:\WINDOWS\WindowsUpdate.log Object is locked saltado

Análisis completado.

Hola jonhgh.

Realiza lo siguiente...........

Paso 1.- Descarga, instala y/o actualiza las siguientes herramientas; pero no las ejecutes todavía:

• Ccleaner.
  
• RogueRemover.
  
• Malwarebytes' Anti-Malware.
  Nota: Si después de instalarlo el lenguaje esta en Ingles ve a la pestaña "Settings" y lo cambias a Español.

Paso 2.- Apaga el Restaurar Sistema (solo en Win Me y XP).

Paso 3.- Reinicia en Modo Seguro (a prueba de fallos).

Paso 4.- Ejecuta de a una a la vez:

1. Malwarebytes' Anti-Malware;
   1. Pulsa en "Mas Herramientas" y usa "FileAssassin" para eliminar los archivos señaldos en rojo:
      "C:\Archivos de programa\Applications\iebt.dll"
      "C:\Archivos de programa\Applications\iebu.exe"
      "C:\Archivos de programa\Applications\wcu.exe"
      "C:\Archivos de programa\VirusRL2009\VirusRL2009.exe"
      "C:\WINDOWS\system32\obicx.dll"
      
   2. Despues;
      • Realiza un escaneo completo del PC y elimina las infecciones que este detecte.
      • Esto es fundamental, mandalas a cuarentena y eliminalas desde allí; pegas el reporte generado después de la eliminación.
      • El reporte queda guardado en la pestaña "Logs" o "Registros" en español, abres el reporte y copias el contenido para pegarlo en este tema.
2. RogueRemover; siguiendo las indicaciones de su Manual.
   
3. Ccleaner.
   • Primero utiliza la opción de "Limpiador" para borrar cookies, temporales de Internet y todos los archivos que este te muestre como obsoletos.
   • Luego usa su opción de "Registro" para limpiar todo el registro de Windows.

Paso 5.- Reinicia en modo normal y realiza un análisis completo con: Panda ActiveScan 2.0.

Nota: Al terminar reactiva el "restaurar sistema".

En tu proxima respuesta:
- Pega los reportes de Malwarebytes' Anti-Malware y del Panda ActiveScan.
- Nos comentas los resultados.

Salu2!.

No estoy muy seguro pero creoq estos son los reportes q arrojo Malwarebytes' Anti-Malware 1.28
Versión de la Base de Datos: 1274
Windows 5.1.2600 Service Pack 3

16/10/2008 01:09:03 a.m.
mbam-log-2008-10-16 (01-08-57).txt

Tipo de examen : Examen Completo (C:\|)
Objetos examinados: 127058
Tiempo transcurrido: 2 hour(s), 38 minute(s), 42 second(s)

Procesos en Memoria Infectados: 0
Módulos en Memoria Infectados: 0
Claves del Registro Infectadas: 17
Valores del Registro Infectados: 6
Elementos de Datos del Registro Infectados: 15
Carpetas Infectadas: 2
Ficheros Infectados: 17

Procesos en Memoria Infectados:
(No se han detectado elementos maliciosos)

Módulos en Memoria Infectados:
(No se han detectado elementos maliciosos)

Claves del Registro Infectadas:
HKEY_CLASSES_ROOT\w123.w123mgr (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\w123.w123mgr.1 (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{f7d09218-46d7-4d3d-9b7f-315204cd0836} (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{95325092-62fc-473b-b32a-ae613278855b} (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{be1a344f-9ff5-4024-949b-52205e6db2d0} (Trojan.Zlob) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Browser Helper Objects\{be1a344f-9ff5-4024-949b-52205e6db2d0} (Trojan.Zlob) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{F5734812-E6A1-8833-ECA9-949B5B8A88BF} (Trojan.Zlob) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{144a6b24-0ebc-4d89-bf09-a06a718e57b5} (Trojan.Zlob) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{e63648f7-3933-440e-b4f6-a8584dd7b7eb} (Trojan.BHO) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{daed9266-8c28-4c1c-8b58-5c66eff1d302} (Search.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{9034a523-d068-4be8-a284-9df278be776e} (Trojan.Zlob) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\virusrl2009 (Rogue.AVLab) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\e405.e405mgr (Trojan.Zlob) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\IEBrowse Tool (Trojan.Zlob) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\IExplorer Bar (Trojan.Zlob) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\Warning Center (Trojan.Zlob) -> No action taken.
HKEY_CLASSES_ROOT\multimediaControls.chl (Trojan.Zlob) -> No action taken.

Valores del Registro Infectados:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run\virusrl2009 (Rogue.AVLab) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Policies\Explorer\Run\start (Trojan.Zlob) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow\*.securewebinfo.com (Trojan.Zlob) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow\*.safetyincludes.com (Trojan.Zlob) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow\*.securemanaging.com (Trojan.Zlob) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run\wblogon (Trojan.Zlob) -> No action taken.

Elementos de Datos del Registro Infectados:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SecurityProviders\SecurityProviders (Broken.SecurityProviders) -> Bad: (msapsspc.dll schannel.dll digest.dll msnsspc.dll) Good: (msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchURL (Hijack.Search) -> Bad: (http://windiwsfsearch.com) Good: (http://www.google.com/) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchURL (Hijack.Search) -> Bad: (http://windiwsfsearch.com) Good: (http://www.google.com/) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Search_URL (Hijack.Search) -> Bad: (http://windiwsfsearch.com) Good: (http://www.google.com/) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Search_URL (Hijack.Search) -> Bad: (http://windiwsfsearch.com) Good: (http://www.google.com/) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page (Hijack.Search) -> Bad: (http://windiwsfsearch.com) Good: (http://www.google.com/) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page (Hijack.Search) -> Bad: (http://windiwsfsearch.com) Good: (http://www.google.com/) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Search Bar (Hijack.Search) -> Bad: (http://windiwsfsearch.com/ie6.html) Good: (http://www.google.com/) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Search Bar (Hijack.Search) -> Bad: (http://windiwsfsearch.com/ie6.html) Good: (http://www.google.com/) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\SearchMigratedDefaultURL (Hijack.Search) -> Bad: (http://windiwsfsearch.com/search?q={searchTerms}) Good: (http://www.google.com/) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\SearchMigratedDefaultURL (Hijack.Search) -> Bad: (http://windiwsfsearch.com/search?q={searchTerms}) Good: (http://www.google.com/) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search\SearchAssistant (Hijack.Search) -> Bad: (http://windiwsfsearch.com) Good: (http://www.google.com/) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Search\SearchAssistant (Hijack.Search) -> Bad: (http://windiwsfsearch.com) Good: (http://www.google.com/) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchUrl\w\ (Hijack.Search) -> Bad: (http://windiwsfsearch.com/search?q=%s) Good: (http://www.google.com/) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchUrl\w\ (Hijack.Search) -> Bad: (http://windiwsfsearch.com/search?q=%s) Good: (http://www.google.com/) -> No action taken.

Carpetas Infectadas:
C:\Archivos de programa\VirusRL2009 (Rogue.AntiVirusLab) -> No action taken.
C:\WINDOWS\system32\311496 (Trojan.BHO) -> No action taken.

Ficheros Infectados:
C:\Archivos de programa\Applications\iebt.dll (Trojan.Zlob) -> No action taken.
C:\WINDOWS\system32\obicx.dll (Trojan.Zlob) -> No action taken.
C:\Archivos de programa\Applications\iebtm.exe (Trojan.Zlob) -> No action taken.
C:\Archivos de programa\Applications\iebtmm.exe (Trojan.Zlob) -> No action taken.
C:\Archivos de programa\Applications\iebtu.exe (Trojan.Zlob) -> No action taken.
C:\Archivos de programa\Applications\iebu.exe (Trojan.Zlob) -> No action taken.
C:\Archivos de programa\Applications\myd.ico (Trojan.Zlob) -> No action taken.
C:\Archivos de programa\Applications\mym.ico (Trojan.Zlob) -> No action taken.
C:\Archivos de programa\Applications\myp.ico (Trojan.Zlob) -> No action taken.
C:\Archivos de programa\Applications\myv.ico (Trojan.Zlob) -> No action taken.
C:\Archivos de programa\Applications\ot.ico (Trojan.Zlob) -> No action taken.
C:\Archivos de programa\Applications\ts.ico (Trojan.Zlob) -> No action taken.
C:\Archivos de programa\Applications\wcm.exe (Trojan.Zlob) -> No action taken.
C:\Archivos de programa\Applications\wcu.exe (Trojan.Zlob) -> No action taken.
C:\Documents and Settings\Administrador\Favoritos\Antivirus Scan.url (Rogue.Link) -> No action taken.
C:\Documents and Settings\All Users\Menú Inicio\Antivirus Scan.url (Trojan.Zlob) -> No action taken.
C:\Documents and Settings\All Users\Menú Inicio\Online Spyware Test.url (Trojan.Zlob) -> No action taken.

Malwarebytes' Anti-Malware 1.28
Versión de la Base de Datos: 1274
Windows 5.1.2600 Service Pack 3

16/10/2008 01:09:12 a.m.
mbam-log-2008-10-16 (01-09-12).txt

Tipo de examen : Examen Completo (C:\|)
Objetos examinados: 127058
Tiempo transcurrido: 2 hour(s), 38 minute(s), 42 second(s)

Procesos en Memoria Infectados: 0
Módulos en Memoria Infectados: 0
Claves del Registro Infectadas: 17
Valores del Registro Infectados: 6
Elementos de Datos del Registro Infectados: 15
Carpetas Infectadas: 2
Ficheros Infectados: 17

Procesos en Memoria Infectados:
(No se han detectado elementos maliciosos)

Módulos en Memoria Infectados:
(No se han detectado elementos maliciosos)

Claves del Registro Infectadas:
HKEY_CLASSES_ROOT\w123.w123mgr (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\w123.w123mgr.1 (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{f7d09218-46d7-4d3d-9b7f-315204cd0836} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{95325092-62fc-473b-b32a-ae613278855b} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{be1a344f-9ff5-4024-949b-52205e6db2d0} (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Browser Helper Objects\{be1a344f-9ff5-4024-949b-52205e6db2d0} (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{F5734812-E6A1-8833-ECA9-949B5B8A88BF} (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{144a6b24-0ebc-4d89-bf09-a06a718e57b5} (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{e63648f7-3933-440e-b4f6-a8584dd7b7eb} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{daed9266-8c28-4c1c-8b58-5c66eff1d302} (Search.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{9034a523-d068-4be8-a284-9df278be776e} (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\virusrl2009 (Rogue.AVLab) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\e405.e405mgr (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\IEBrowse Tool (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\IExplorer Bar (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\Warning Center (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\multimediaControls.chl (Trojan.Zlob) -> Quarantined and deleted successfully.

Valores del Registro Infectados:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run\virusrl2009 (Rogue.AVLab) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Policies\Explorer\Run\start (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow\*.securewebinfo.com (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow\*.safetyincludes.com (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow\*.securemanaging.com (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run\wblogon (Trojan.Zlob) -> Quarantined and deleted successfully.

Elementos de Datos del Registro Infectados:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SecurityProviders\SecurityProviders (Broken.SecurityProviders) -> Bad: (msapsspc.dll schannel.dll digest.dll msnsspc.dll) Good: (msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchURL (Hijack.Search) -> Bad: (http://windiwsfsearch.com) Good: (http://www.google.com/) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchURL (Hijack.Search) -> Bad: (http://windiwsfsearch.com) Good: (http://www.google.com/) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Search_URL (Hijack.Search) -> Bad: (http://windiwsfsearch.com) Good: (http://www.google.com/) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Search_URL (Hijack.Search) -> Bad: (http://windiwsfsearch.com) Good: (http://www.google.com/) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page (Hijack.Search) -> Bad: (http://windiwsfsearch.com) Good: (http://www.google.com/) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page (Hijack.Search) -> Bad: (http://windiwsfsearch.com) Good: (http://www.google.com/) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Search Bar (Hijack.Search) -> Bad: (http://windiwsfsearch.com/ie6.html) Good: (http://www.google.com/) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Search Bar (Hijack.Search) -> Bad: (http://windiwsfsearch.com/ie6.html) Good: (http://www.google.com/) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\SearchMigratedDefaultURL (Hijack.Search) -> Bad: (http://windiwsfsearch.com/search?q={searchTerms}) Good: (http://www.google.com/) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\SearchMigratedDefaultURL (Hijack.Search) -> Bad: (http://windiwsfsearch.com/search?q={searchTerms}) Good: (http://www.google.com/) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search\SearchAssistant (Hijack.Search) -> Bad: (http://windiwsfsearch.com) Good: (http://www.google.com/) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Search\SearchAssistant (Hijack.Search) -> Bad: (http://windiwsfsearch.com) Good: (http://www.google.com/) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchUrl\w\ (Hijack.Search) -> Bad: (http://windiwsfsearch.com/search?q=%s) Good: (http://www.google.com/) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchUrl\w\ (Hijack.Search) -> Bad: (http://windiwsfsearch.com/search?q=%s) Good: (http://www.google.com/) -> Quarantined and deleted successfully.

Carpetas Infectadas:
C:\Archivos de programa\VirusRL2009 (Rogue.AntiVirusLab) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\311496 (Trojan.BHO) -> Quarantined and deleted successfully.

Ficheros Infectados:
C:\Archivos de programa\Applications\iebt.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\obicx.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Archivos de programa\Applications\iebtm.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Archivos de programa\Applications\iebtmm.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Archivos de programa\Applications\iebtu.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Archivos de programa\Applications\iebu.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Archivos de programa\Applications\myd.ico (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Archivos de programa\Applications\mym.ico (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Archivos de programa\Applications\myp.ico (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Archivos de programa\Applications\myv.ico (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Archivos de programa\Applications\ot.ico (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Archivos de programa\Applications\ts.ico (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Archivos de programa\Applications\wcm.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Archivos de programa\Applications\wcu.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrador\Favoritos\Antivirus Scan.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Menú Inicio\Antivirus Scan.url (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Menú Inicio\Online Spyware Test.url (Trojan.Zlob) -> Quarantined and deleted successfully.

Malwarebytes' Anti-Malware 1.25
Versión de la Base de Datos: 1101
Windows 5.1.2600 Service Pack 3

09:55:35 a.m. 31/08/2008
mbam-log-08-31-2008 (09-55-35).txt

Tipo de examen : Examen Completo (C:\|)
Objetos examinados: 143492
Tiempo transcurrido: 1 hour(s), 34 minute(s), 7 second(s)

Procesos en Memoria Infectados: 1
Módulos en Memoria Infectados: 0
Claves del Registro Infectadas: 6
Valores del Registro Infectados: 2
Elementos de Datos del Registro Infectados: 0
Carpetas Infectadas: 3
Ficheros Infectados: 11

Procesos en Memoria Infectados:
C:\WINDOWS\system32\cftmon.exe (Trojan.Agent) -> Unloaded process successfully.

Módulos en Memoria Infectados:
(No se han detectado elementos maliciosos)

Claves del Registro Infectadas:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{28abc5c0-4fcb-11cf-aax5-81cx1c635612} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\MediaHoldings (Adware.PlayMP3Z) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Mirar (Adware.Mirar) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\PlayMP3 (Adware.PlayMP3Z) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\FBrowsingAdvisor (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\fbrowsingadvisor_is1 (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.

Valores del Registro Infectados:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run\cftmon (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run\Windows UDP Control Center (Backdoor.Bot) -> Quarantined and deleted successfully.

Elementos de Datos del Registro Infectados:
(No se han detectado elementos maliciosos)

Carpetas Infectadas:
C:\Archivos de programa\FBrowsingAdvisor (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\Archivos de programa\FBrowserAdvisor (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013 (Trojan.Agent) -> Quarantined and deleted successfully.

Ficheros Infectados:
C:\regxpcom.exe (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrador\Mis documentos\Mi música\winrar 3.51 + crack\CORE10k.EXE (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Archivos de programa\FBrowsingAdvisor\XPCOMEvents.dll (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\Archivos de programa\FBrowsingAdvisor\IXPCOMEvents.xpt (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\Archivos de programa\FBrowsingAdvisor\Logo.png (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\Archivos de programa\FBrowsingAdvisor\main.db (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\Archivos de programa\FBrowsingAdvisor\unins000.dat (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\Archivos de programa\FBrowsingAdvisor\unins000.exe (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\Desktop.ini (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\hosts (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\cftmon.exe (Trojan.Agent) -> Quarantined and deleted successfully.

Malwarebytes' Anti-Malware 1.28
Versión de la Base de Datos: 1274
Windows 5.1.2600 Service Pack 3

16/10/2008 01:09:12 a.m.
mbam-log-2008-10-16 (01-09-12).txt

Tipo de examen : Examen Completo (C:\|)
Objetos examinados: 127058
Tiempo transcurrido: 2 hour(s), 38 minute(s), 42 second(s)

Procesos en Memoria Infectados: 0
Módulos en Memoria Infectados: 0
Claves del Registro Infectadas: 17
Valores del Registro Infectados: 6
Elementos de Datos del Registro Infectados: 15
Carpetas Infectadas: 2
Ficheros Infectados: 17

Procesos en Memoria Infectados:
(No se han detectado elementos maliciosos)

Módulos en Memoria Infectados:
(No se han detectado elementos maliciosos)

Claves del Registro Infectadas:
HKEY_CLASSES_ROOT\w123.w123mgr (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\w123.w123mgr.1 (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{f7d09218-46d7-4d3d-9b7f-315204cd0836} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{95325092-62fc-473b-b32a-ae613278855b} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{be1a344f-9ff5-4024-949b-52205e6db2d0} (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Browser Helper Objects\{be1a344f-9ff5-4024-949b-52205e6db2d0} (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{F5734812-E6A1-8833-ECA9-949B5B8A88BF} (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{144a6b24-0ebc-4d89-bf09-a06a718e57b5} (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{e63648f7-3933-440e-b4f6-a8584dd7b7eb} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{daed9266-8c28-4c1c-8b58-5c66eff1d302} (Search.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{9034a523-d068-4be8-a284-9df278be776e} (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\virusrl2009 (Rogue.AVLab) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\e405.e405mgr (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\IEBrowse Tool (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\IExplorer Bar (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\Warning Center (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\multimediaControls.chl (Trojan.Zlob) -> Quarantined and deleted successfully.

Valores del Registro Infectados:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run\virusrl2009 (Rogue.AVLab) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Policies\Explorer\Run\start (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow\*.securewebinfo.com (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow\*.safetyincludes.com (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow\*.securemanaging.com (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run\wblogon (Trojan.Zlob) -> Quarantined and deleted successfully.

Elementos de Datos del Registro Infectados:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SecurityProviders\SecurityProviders (Broken.SecurityProviders) -> Bad: (msapsspc.dll schannel.dll digest.dll msnsspc.dll) Good: (msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchURL (Hijack.Search) -> Bad: (http://windiwsfsearch.com) Good: (http://www.google.com/) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchURL (Hijack.Search) -> Bad: (http://windiwsfsearch.com) Good: (http://www.google.com/) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Search_URL (Hijack.Search) -> Bad: (http://windiwsfsearch.com) Good: (http://www.google.com/) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Search_URL (Hijack.Search) -> Bad: (http://windiwsfsearch.com) Good: (http://www.google.com/) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page (Hijack.Search) -> Bad: (http://windiwsfsearch.com) Good: (http://www.google.com/) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page (Hijack.Search) -> Bad: (http://windiwsfsearch.com) Good: (http://www.google.com/) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Search Bar (Hijack.Search) -> Bad: (http://windiwsfsearch.com/ie6.html) Good: (http://www.google.com/) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Search Bar (Hijack.Search) -> Bad: (http://windiwsfsearch.com/ie6.html) Good: (http://www.google.com/) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\SearchMigratedDefaultURL (Hijack.Search) -> Bad: (http://windiwsfsearch.com/search?q={searchTerms}) Good: (http://www.google.com/) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\SearchMigratedDefaultURL (Hijack.Search) -> Bad: (http://windiwsfsearch.com/search?q={searchTerms}) Good: (http://www.google.com/) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search\SearchAssistant (Hijack.Search) -> Bad: (http://windiwsfsearch.com) Good: (http://www.google.com/) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Search\SearchAssistant (Hijack.Search) -> Bad: (http://windiwsfsearch.com) Good: (http://www.google.com/) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchUrl\w\ (Hijack.Search) -> Bad: (http://windiwsfsearch.com/search?q=%s) Good: (http://www.google.com/) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchUrl\w\ (Hijack.Search) -> Bad: (http://windiwsfsearch.com/search?q=%s) Good: (http://www.google.com/) -> Quarantined and deleted successfully.

Carpetas Infectadas:
C:\Archivos de programa\VirusRL2009 (Rogue.AntiVirusLab) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\311496 (Trojan.BHO) -> Quarantined and deleted successfully.

Ficheros Infectados:
C:\Archivos de programa\Applications\iebt.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\obicx.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Archivos de programa\Applications\iebtm.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Archivos de programa\Applications\iebtmm.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Archivos de programa\Applications\iebtu.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Archivos de programa\Applications\iebu.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Archivos de programa\Applications\myd.ico (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Archivos de programa\Applications\mym.ico (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Archivos de programa\Applications\myp.ico (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Archivos de programa\Applications\myv.ico (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Archivos de programa\Applications\ot.ico (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Archivos de programa\Applications\ts.ico (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Archivos de programa\Applications\wcm.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Archivos de programa\Applications\wcu.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrador\Favoritos\Antivirus Scan.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Menú Inicio\Antivirus Scan.url (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Menú Inicio\Online Spyware Test.url (Trojan.Zlob) -> Quarantined and deleted successfully.



Amenazas con desinfección gratuita (2)
Peligrosidad baja (2)
Trj/Rebooter.J Virus
Latente
Ver + Info
No desinfectable
1. C:\WINDOWS\Temp\FinePoint\data1.cab[ctrbt.exe]
Trj/CI.A Virus
Latente
Ver + Info
1. C:\WINDOWS\system32\host32.exe
Sólo disponible para usuarios registrados.
Registrarme gratis - Estoy registrado
Amenazas con desinfección de pago (0)
Sólo disponible en versión de pago.
Comprar - Soy cliente
Archivos sospechosos (3)
C:\Documents and Settings\All Users\Datos de ...pport.msi[unk_0051][EventFixer.exe] Enviando
C:\Archivos de programa\Powerbullet\PbConverter.exe Enviando
C:\Archivos de programa\Archivos comunes\Appl...e Device Support\bin\EventFixer.exe Enviando

Hola.

¿Se soluciono el problema?.

El reporte de panda no sirve de mucho; lee el manual de uso para que sepas como generar y pegar el reporte.

Nos comentas.

Salu2!.