Foro de InfoSpyware - Foro de Hijackthis - Foro de Virus

Mira en el Ad ware en detalles de definiciones me aparece este reporte

# de familias 6840
#huellas dactilares 14546
#entradas reg 52761
# total de firmas 573053

esto si te sirve de algo

al poner a correr el ccleaner, buscando problemas me sale :programa de inicio faltante y la direccion del programa que te habia dicho.C:/program Files/AV9/av2009.exe.

y clave de registro sale

HKCU/SOFTWARE/microsoft/windows/current Version/run.

ayyyy, CREO QUE METI LA PATA.

CUENTAME.

CUANADO LE DOY INICIO, Y QUIERO BUSCAR UN ARCHIVO ME SALEN UNA SERIE DE ARICHIVOS, ABRI UNO Y ME SALE UN AVISO ASI:

SPYBOT-SEARCH DESTROY

FILE NAME
SPY BOT-SEARCH DESTROY (MALWARE)
lang-1066.dll.......nothing found

spy bot- sarch destry (heuristic)
lang.1066.dll.........nothing found


AHHHH Y ES QUE ABRI AQUI DE CASUALIDAD POR QUE EL CCLEANER NO QUIERE CORRER, CREI QUE SERIA BUENO REINSTALARLO NO SE QUE ME DIGAS.

Mira!!! por fin pude correr el panda!!!! este es elo reporte...gracias por tu ayuda.

baja (3) Application/My... Aplicación espía Latente Ocultar + Info
1. C:\Program Files\AskSBar\bar\1.bin\A2PLUGIN.DLL

adware/antivir... Adware Latente Ocultar + Info
1. HKEY_CURRENT_USER\Software\Microsoft\Windows\...7C 7B8A-151A-49E6-BAED-CC05FCB50328}

Cookie/Doublec... Cookie espía Latente Ocultar + Info
1. C:\Users\Owner\AppData\Roaming\Microsoft\Wind...oo kies\Low\owner@doubleclick[1].txt

Hola sirena del mar:

Mira, lo primero, desinstala Spybot como cualquier otro programa, desde agregar/quitar programas.
A continuación, sigue los pasos del siguiente link: http://www.forospyware.com/975684-post2.html. Corresponde a mi primer mensaje. Imprímelo si te es más fácil seguirlo desde esa manera; y leelo con tranquilidad. En el mismo, están todos los enlaces y explicaciones, para que puedas realizarlo correctamente.
Y en tu próximo mensaje, me pones: los reportes generados por MalwareByte's Antimalware y por kaspersky online scanner. Necesito ver solo eso, en un principio, para saber de que estamos hablando y poder orientarte mejor.
Un saludo.

Hola Halcon, es un alivio saber que no me haz abandonado, desinstalare el spybot que me esta enloqueciendo y ya te contare como me va...
un saludo.

Estamos aquí para ayudar
No te olvides de realizar el proceso en el orden que te dije, y tampoco te olvides de poner los reportes del MalwareByte's Antimalware y del kaspersky online scanner. Sin los reportes, poco se puede saber y poco se puede ayudar.

Un saludo.

LA TAREA....EL PRIMER SCAN PANDA ME DIO TRES , Y LO REPASE Y SOLO SALIERON DOS, DADO QUE SOLO REPARA COMPRANDO EL PLAN, NO SE QUE PASO CON EL OTRO...MMMM?, ESPERO TU GUIA...UN SALUDO.
;************************************************* ************************************************** ************************************************** ******************************
ANALYSIS: 2009-02-23 18:48:37
PROTECTIONS: 3
MALWARE: 2
SUSPECTS: 0
;************************************************* ************************************************** ************************************************** ******************************
PROTECTIONS
Description Version Active Updated
;================================================= ================================================== ================================================== ==============================
Trend Micro AntiVirus 16.10.1182 Yes Yes
Windows Defender 1.1.1505.0 No Yes
SUPERAntiSpyware 4, 25, 0, 1012 No Yes
;================================================= ================================================== ================================================== ==============================
MALWARE
Id Description Type Active Severity Disinfectable Disinfected Location
;================================================= ================================================== ================================================== ==============================
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Users\Owner\AppData\Roaming\Microsoft\Windows\C ookies\Low\owner@doubleclick[2].txt
03913052 Application/MyWebSearch HackTools No 0 Yes No C:\Program Files\AskSBar\bar\1.bin\A2PLUGIN.DLL
;================================================= ================================================== ================================================== ==============================
SUSPECTS
Sent Location (��>X�^
39

;================================================= ================================================== ================================================== ==============================
;================================================= ================================================== ================================================== ==============================
VULNERABILITIES
Id Severity Description (��>X�^
39

;================================================= ================================================== ================================================== ==============================
;================================================= ================================================== ================================================== ==============================


Malwarebytes' Anti-Malware 1.34
Versión de la Base de Datos: 1795
Windows 6.0.6001 Service Pack 1

2/23/2009 4:52:43 PM
mbam-log-2009-02-23 (16-52-43).txt

Tipo de examen : Examen Completo (C:\|D:\|)
Objetos examinados: 198936
Tiempo transcurrido: 2 hour(s), 9 minute(s), 48 second(s)

Procesos en Memoria Infectados: 0
Módulos en Memoria Infectados: 0
Claves del Registro Infectadas: 25
Valores del Registro Infectados: 2
Elementos de Datos del Registro Infectados: 1
Carpetas Infectadas: 1
Ficheros Infectados: 9

Procesos en Memoria Infectados:
(No se han detectado elementos maliciosos)

Módulos en Memoria Infectados:
(No se han detectado elementos maliciosos)

Claves del Registro Infectadas:
HKEY_CLASSES_ROOT\gamevance.linker (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{1d22e9e4-f771-4b8d-aa68-ba04e8980e07} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{a851c98a-6136-4b02-9ec7-22aaf33e7b97} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{da4b6a86-82e7-4a9e-abb9-3b225bc214a4} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{7370f91f-6994-4595-9949-601fa2261c8d} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Ext\Stats\{7370f91f-6994-4595-9949-601fa2261c8d} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Browser Helper Objects\{7370f91f-6994-4595-9949-601fa2261c8d} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\gamevance.linker.1 (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Ext\Stats\{d7adf7c1-14fb-4110-b2df-187884cac12a} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Ext\Stats\{b7d3e479-cc68-42b5-a338-938ece35f419} (Adware.SoftMate) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Ext\Stats\{a3ed5288-f558-4f6e-8d5c-740cb6f89029} (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Ext\Stats\{07b18eab-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Ext\Stats\{6fd31ed6-7c94-4bbc-8e95-f927f4d3a949} (Adware.180Solutions) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{f0d4b230-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{f0d4b23a-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{f0d4b23c-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{b15fd82e-85bc-430d-90cb-65db1b030510} (Adware.AskSBAR) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{f0d4b231-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Ext\Stats\{f0d4b231-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Browser Helper Objects\{f0d4b231-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Ext\Stats\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{f0d4b23b-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Ext\PreApproved\{f0d4b23b-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\gamevance (Adware.Gamevance) -> Quarantined and deleted successfully.

Valores del Registro Infectados:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\MenuExt\&Search\ (Adware.Hotbar) -> Quarantined and deleted successfully.

Elementos de Datos del Registro Infectados:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Explorer\Advanced\Start_ShowSearch (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.

Carpetas Infectadas:
C:\Program Files\Gamevance (Adware.Gamevance) -> Quarantined and deleted successfully.

Ficheros Infectados:
C:\Program Files\Gamevance\gvtl.dll (Adware.BHO) -> Quarantined and deleted successfully.
C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL (Adware.AskSBAR) -> Quarantined and deleted successfully.
C:\Program Files\Gamevance\ars.cfg (Adware.Gamevance) -> Quarantined and deleted successfully.
C:\Program Files\Gamevance\gamevancelib32.dll (Adware.Gamevance) -> Quarantined and deleted successfully.
C:\Program Files\Gamevance\gvcfglib.dll (Adware.Gamevance) -> Quarantined and deleted successfully.
C:\Program Files\Gamevance\gvpop.dll (Adware.Gamevance) -> Quarantined and deleted successfully.
C:\Program Files\Gamevance\gvun.exe (Adware.Gamevance) -> Quarantined and deleted successfully.
C:\Program Files\Gamevance\gvwslib.dll (Adware.Gamevance) -> Quarantined and deleted successfully.
C:\Program Files\Gamevance\icon.ico (Adware.Gamevance) -> Quarantined and deleted successfully.




scan panda
Application/My... Aplicación espía Latente Ver + Info
1. C:\Program Files\AskSBar\bar\1.bin\A2PLUGIN.DLL

Cookie/Doublec... Cookie espía Latente Ver + Info

Descarga OTMoveIt3 lo guardas en el Escritorio: Manual de OTMoveit
• Haz un doble clic sobre OTMoveIt.exe para ejecutarlo.
• Asegurate que este marcado "Unregister Dll's and Ocx's".
• Copia el texto que se encuentra en el cuadrado más abajo, y pega el texto en el marco de izquierdo de OTMoveIt nombrado Paste List of Filas / Folders to be moved.
• (archivos que van en cita)

Haz clic en MoveIt! Para lanzar la supresión.
• Cuando el resultado aparece en el marco Results, haz clic en Exit.

Envía el informe (reporte) de OTMoveIt situado sobre C: \ _OTMoveIt\MovedFiles....txt

Saludos

exit, y no reinicio? hay problema si se reinicia? te lo pregunto, por que durante este proceso el pc ha tenido unos pantallazos azules que obligatoriamente me detiene los procesos y toca reiniciar y ...me gustaria saber para estar tranquila.

Gracias por todo tu soporte.

Si te pide reiniciar, hazlo sin problema... después me pones el informe que generó OtMoveIt.
Un saludo.

Necesito un consejo...hice un scaner con mi antivirus trend micro y reporto dos virus, me aconsejas ponerlos en cuarentena? O eliminarlos, y si los encuarenteno...por cuanto tiempo...no se como funciona...gracias.