Foro de InfoSpyware - Foro de Hijackthis - Foro de Virus

Hola espero me puedan hayudar con esto, yo ya no se que hacer. Tengo windos vista home premium. El problema que tengo es que no me puedo conectar a internet a menos que entre en safe mode, sino solo me deja en local network. He escaneado la compu con Trend micro, Avast, Kaspersky, Kaspersky online, Dr. Web y nada. con kaspersky online me salieron dos troyanos que ya elimine, pero con los demas virus no he podido terminar el escaneo, siempre se cierran o se congela la laptop y apagan el monitor y dos veces me ha salido la pantalla azul de la muerte espero me puedan recomendar algo para solucionar esto.

Me parece que tenes algun virus dando vuelta por ahi.
Para solucionar lo de internet prueba con LSP-Fix - Winsock 2 , si con esto no funciona es un virus. Probalo y me contas. Saludos.

Hola,

Puedes probar el comando: netsh winsock reset
desde la consola ms-dos a ver si te devuelve la conexión, luego de escribir el comando pulsa enter y reinicia la PC


Nos comentas a ve que tal

hola, muchas gracias por tomarse el tiempo, ya intente con el comando de ms-DOS y con el programa que me pasaron, el programa me dice que no hay problemas y me da miedo borrar algo. Y con el comando no pasa nada. sigo sin poder usar internet en modo normal, solo en safe mode. intente otra vez escanear la computadora con kaspersky y de nuevo dio pantallazo azul.

Hola,

Si te deja realiza mejor el Scan con Panda Online o ESET Online y dejas el reporte




Salu2.........................>

este es el reporte de kaspersky online, el primero que hize corriendo en safe mode, supuestamente ya borre dos troyanos que salen ahi: --------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Sunday, March 1, 2009
Operating System: Microsoft Windows Vista Home Premium Edition, 32-bit (build 6000)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Sunday, March 01, 2009 20:40:03
Records in database: 1860269
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\
F:\

Scan statistics:
Files scanned: 252183
Threat name: 2
Infected objects: 2
Suspicious objects: 0
Duration of the scan: 02:57:08


File name / Threat name / Threats count
C:\Users\owner\Downloads\usedv1\Hacha_-_Hjsplit___Hacha_Pro__ByFal_.rar Infected: Trojan-Dropper.Win32.Agent.aceh 1
C:\Users\owner\Downloads\usedv1\Virtual_Villagers_-_The_Secret_City_by_TheDarkSide\VirtualVillagersTh eSecretCitySetup.exe Infected: Trojan-Downloader.Win32.Agent.asjr 1

The selected area was scanned.


y este es el log que hizo el kaspersky, es el scan mas reciente dice que borro 5 cosas pero no hay cambios en la compu:

Date: Today (events: 1)
Protection (events: 1)
3/1/2009 9:13:31 PM System runs in safe mode Kaspersky Anti-Virus
3/1/2009 7:28:01 PM Cannot be deleted: Trojan-Downloader.Win32.Agent.asjr Kaspersky Anti-Virus c:\users\owner\downloads\usedv1\virtual_villagers_-_the_secret_city_by_thedarkside\virtualvillagersth esecretcitysetup.exe
3/1/2009 7:27:36 PM Detected: Trojan-Downloader.Win32.Agent.asjr Kaspersky Anti-Virus c:\users\owner\downloads\usedv1\virtual_villagers_-_the_secret_city_by_thedarkside\virtualvillagersth esecretcitysetup.exe/data0000/file004
3/1/2009 7:27:29 PM Threats have been detected Kaspersky Anti-Virus
3/1/2009 6:45:20 PM System runs in safe mode Kaspersky Anti-Virus
3/1/2009 6:40:19 PM System runs in safe mode Kaspersky Anti-Virus
3/1/2009 6:11:39 PM System runs in safe mode Kaspersky Anti-Virus
3/1/2009 6:11:39 PM Databases are obsolete Kaspersky Anti-Virus
3/1/2009 5:51:43 PM Databases are obsolete Kaspersky Anti-Virus
Protection (events: 1)
3/1/2009 10:37:03 PM Task started Kaspersky Anti-Virus Files and Memory
3/1/2009 5:51:43 PM Task started Kaspersky Anti-Virus Files and Memory
Protection (events: 1)
3/1/2009 10:37:03 PM Task started Kaspersky Anti-Virus Email and IM
3/1/2009 5:51:43 PM Task started Kaspersky Anti-Virus Email and IM
Protection (events: 1)
3/1/2009 10:37:03 PM Task started Kaspersky Anti-Virus Web Traffic
3/1/2009 5:51:43 PM Task started Kaspersky Anti-Virus Web Traffic
Protection (events: 1)
3/1/2009 10:37:03 PM Task started Kaspersky Anti-Virus Anti-Phishing
3/1/2009 5:51:43 PM Task started Kaspersky Anti-Virus Anti-Phishing
Protection (events: 1)
3/1/2009 10:37:03 PM Task started Kaspersky Anti-Virus Proactive Defense
3/1/2009 6:49:46 PM Task cannot be started Kaspersky Anti-Virus Proactive Defense Task cannot be started in the safe mode
3/1/2009 5:51:43 PM Task started Kaspersky Anti-Virus Proactive Defense
Protection (events: 1)
3/1/2009 6:11:34 PM Application is not activated Kaspersky Anti-Virus
Protection (events: 1)
3/1/2009 10:38:57 PM Task started Kaspersky Anti-Virus Full Scan
3/1/2009 10:38:29 PM Task completed Kaspersky Anti-Virus Quick Scan
3/1/2009 10:37:59 PM Task started Kaspersky Anti-Virus Quick Scan
3/1/2009 7:52:16 PM Task started Kaspersky Anti-Virus Full Scan
3/1/2009 7:37:26 PM Task completed Kaspersky Anti-Virus Full Scan
3/1/2009 7:36:42 PM Task started Kaspersky Anti-Virus Full Scan
3/1/2009 7:28:01 PM Task completed Kaspersky Anti-Virus Full Scan
3/1/2009 7:23:13 PM Task started Kaspersky Anti-Virus Full Scan
3/1/2009 6:46:44 PM Task completed Kaspersky Anti-Virus Quick Scan
3/1/2009 6:45:39 PM Task started Kaspersky Anti-Virus Quick Scan
3/1/2009 6:29:03 PM Task started Kaspersky Anti-Virus Full Scan
3/1/2009 6:26:31 PM Task completed Kaspersky Anti-Virus Quick Scan
3/1/2009 6:25:28 PM Task started Kaspersky Anti-Virus Quick Scan
3/1/2009 6:01:12 PM Task completed Kaspersky Anti-Virus Full Scan
3/1/2009 5:56:56 PM Task started Kaspersky Anti-Virus Full Scan
3/1/2009 5:56:40 PM Task completed Kaspersky Anti-Virus Full Scan
3/1/2009 5:56:39 PM Task started Kaspersky Anti-Virus Full Scan
3/1/2009 5:56:09 PM Task stopped Kaspersky Anti-Virus Full Scan
3/1/2009 5:55:06 PM Task started Kaspersky Anti-Virus Full Scan
3/1/2009 5:53:14 PM Task completed Kaspersky Anti-Virus Quick Scan
3/1/2009 5:51:43 PM Task started Kaspersky Anti-Virus Quick Scan
Protection (events: 1)
3/1/2009 10:33:48 PM Task cannot be started Kaspersky Anti-Virus Update Task cannot be started in the safe mode
3/1/2009 10:13:48 PM Task cannot be started Kaspersky Anti-Virus Update Task cannot be started in the safe mode
3/1/2009 9:53:49 PM Task cannot be started Kaspersky Anti-Virus Update Task cannot be started in the safe mode
3/1/2009 9:33:48 PM Task cannot be started Kaspersky Anti-Virus Update Task cannot be started in the safe mode
3/1/2009 9:13:34 PM Task cannot be started Kaspersky Anti-Virus Update Task cannot be started in the safe mode
3/1/2009 9:07:33 PM Task cannot be started Kaspersky Anti-Virus Update Task cannot be started in the safe mode
3/1/2009 8:47:18 PM Task cannot be started Kaspersky Anti-Virus Update Task cannot be started in the safe mode
3/1/2009 6:40:19 PM It is necessary to restart the computer after update Kaspersky Anti-Virus
3/1/2009 6:27:19 PM Task completed Kaspersky Anti-Virus Update
3/1/2009 6:26:53 PM Task started Kaspersky Anti-Virus Update
3/1/2009 6:25:09 PM Task stopped Kaspersky Anti-Virus Update Operation cancelled by the user
3/1/2009 6:25:05 PM Task started Kaspersky Anti-Virus Update
3/1/2009 6:24:47 PM Task completed Kaspersky Anti-Virus Update
3/1/2009 6:12:06 PM Task started Kaspersky Anti-Virus Update
3/1/2009 6:11:46 PM Task cannot be started Kaspersky Anti-Virus Update Task cannot be started in the safe mode
Date: Today (events: 1)
Protection (events: 1)
3/2/2009 5:13:28 PM System runs in safe mode Kaspersky Anti-Virus
Protection (events: 1)
3/2/2009 2:45:29 PM Task started Kaspersky Anti-Virus Files and Memory
3/2/2009 1:44:17 PM Task started Kaspersky Anti-Virus Files and Memory
Protection (events: 1)
3/2/2009 2:45:29 PM Task started Kaspersky Anti-Virus Email and IM
3/2/2009 1:44:17 PM Task started Kaspersky Anti-Virus Email and IM
Protection (events: 1)
3/2/2009 2:45:29 PM Task started Kaspersky Anti-Virus Web Traffic
3/2/2009 1:44:17 PM Task started Kaspersky Anti-Virus Web Traffic
Protection (events: 1)
3/2/2009 2:45:29 PM Task started Kaspersky Anti-Virus Anti-Phishing
3/2/2009 1:44:17 PM Task started Kaspersky Anti-Virus Anti-Phishing
Protection (events: 1)
3/2/2009 2:45:29 PM Task started Kaspersky Anti-Virus Proactive Defense
3/2/2009 1:44:17 PM Task started Kaspersky Anti-Virus Proactive Defense
Protection (events: 1)
3/2/2009 5:13:27 PM License validity period expires soon Kaspersky Anti-Virus
Protection (events: 1)
3/2/2009 5:13:35 PM Task cannot be started Kaspersky Anti-Virus Update Task cannot be started in the safe mode


no estoy muy seguro si esto es lo que necesitas

Nesecitaria un Scan con cualquiera de los otros 2 ya que esos 2 archivos los eliminastes y quiero descartar que tu poblema sea por infección o por problemas del propio sistema.

Por cirto a raiz de que te quedastes sin conexión, que fue lo último que hicistes ¿?

aqui esta el reporte que me dio panda
SUSPECTS: 1
;************************************************* ************************************************** ************************************************** ******************************
PROTECTIONS
Description Version Active Updated
;================================================= ================================================== ================================================== ==============================
Kaspersky Anti-Virus 8.0.0.506 Yes Yes
Windows Defender 1.1.1505.0 No Yes
Kaspersky Anti-Virus 8.0.0.506 No Yes
Spy Sweeper 5.5.7.103 No Yes
;================================================= ================================================== ================================================== ==============================
MALWARE
Id Description Type Active Severity Disinfectable Disinfected Location
;================================================= ================================================== ================================================== ==============================
00034347 dialer.su Dialers No 0 Yes No hkey_local_machine\software\microsoft\windows\curr entversion\uninstall\switch
00103694 PHP/Ripog.A Virus/Trojan No 0 Yes No C:\Users\owner\AppData\Local\Microsoft\Messenger\m oconamodoquy@hotmail.com\ObjectStore\UserTile\iyei Tb8RdKka4rwZ0LL0GGkb8Uw=.id2
00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Users\owner\AppData\Roaming\Microsoft\Windows\C ookies\Low\owner@atdmt[1].txt
03587590 Adware/Yassist Adware No 0 No No C:\Users\owner\Programas\DivXWebPlayerInstaller.ex e[²ÇÇ\y_toolbar.exe][²èÇ]
;================================================= ================================================== ================================================== ==============================
SUSPECTS
Sent Location 0 �~p��39

;================================================= ================================================== ================================================== ==============================
No C:\Windows\System32\drivers\senekauwwvkimv.sys 0 �~p��39

;================================================= ================================================== ================================================== ==============================
VULNERABILITIES
Id Severity Description 0 �~p��39

;================================================= ================================================== ================================================== ==============================
184379 MEDIUM MS08-001 0 �~p��39

182048 HIGH MS07-069 0 �~p��39

176382 HIGH MS07-057 0 �~p��39

;================================================= ================================================== ================================================== ==============================


y cuando empezo el problema acababa de bajar un juego

.-Descarga y descomprime The Avenger + Manual

1. Abre the Avenger
2. Debajo de "Input script here" pegas el siguiente script (Código):
   
   
   Código HTML:

   Drivers to disable:
   senekauwwvkimv.sys
   
   Drivers to delete:
   senekauwwvkimv.sys
   
   Files to delete:
   C:\Windows\System32\drivers\senekauwwvkimv.sys
   C:\Users\owner\AppData\Local\Microsoft\Messenger\moconamodoquy@hotmail.com\ObjectStore\UserTile\iyeiTb8RdKka4rwZ0LL0GGkb8Uw=.id2
   
   Registry keys to delete:
   hkey_local_machine\software\microsoft\windows\currentversion\uninstall\switch
   

3. Para comenzar la supresión pulsa sobre "Execute"
4. Te pedirá confirmacion para la eliminación, dices que si
5. Luego confirma para reiniciar tu PC

Luego del reinicio dejame el reporte que se guradará en C:\Avenger.txt

aqui esta el reporte, ya puedo usar otra vez el internet sin entrar en safe mode, pero me aparece un mensaje que no se puede iniciar el security center, y cuando le pongo en iniciar me dice que no se puede.

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows Vista

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.

Hidden driver "seneka" found!
ImagePath: \systemroot\system32\drivers\senekauwwvkimv.sys
Start Type: 1 (System)

Rootkit scan completed.


Error: could not open driver "senekauwwvkimv.sys"
Disablement of driver "senekauwwvkimv.sys" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "\Registry\Machine\System\CurrentControlSet\Servic es\senekauwwvkimv.sys" not found!
Deletion of driver "senekauwwvkimv.sys" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist

File "C:\Windows\System32\drivers\senekauwwvkimv.sy s" deleted successfully.

Error: file "C:\Users\owner\AppData\Local\Microsoft\Messenger\ moconamodoquy@hotmail.com\ObjectStore\UserTile\iye iTb8RdKka4rwZ0LL0GGkb8Uw=.id2" not found!
Deletion of file "C:\Users\owner\AppData\Local\Microsoft\Messenger\ moconamodoquy@hotmail.com\ObjectStore\UserTile\iye iTb8RdKka4rwZ0LL0GGkb8Uw=.id2" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist

Registry key "hkey_local_machine\software\microsoft\windows\cur rentversion\uninstall\switch" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.