Foro de InfoSpyware - Foro de Hijackthis - Foro de Virus

hola, bueno es primera vez que pido ayuda en algun foro de este tipo
mi problema es que hace un tiempo que mi pc anda muy lento al punto de por poner un ejemplo: no puedo abrir warcraft 3, que suelo jugar teniendo un reproductor de musica abierto, ya que se entrecorta la musica y el juego anda lento, siendo que esto antes podia hacerlo sin problemas y que los requerimientos de este juego son bajos

en fin e pasado el nod 32,el ashampoo antispiware, ccleaner y nada
desinstale el nod 32 e instale el avast lo pase y sigo con el problema

estas son las caracteristicas de mi pc

AMD Athlon 64 3000+ 2.00 GHz
1,00 GB de RAM
Windows XP

:S no se que mas

de antemano gracias

Por favor, sigue estos pasos:

Para mayor comodidad, IMPRIME ESTA HOJA

( Si no puedes hacer algun paso, saltèalo y trata de seguir con los otros)


Descarga lo siguiente:

º CCLEANER. Lo instalas según Su Manual

º MALWAREBYTE´S. Lo instalas y actualizas según su manual, PERO NO LO EJECUTES AUN

Ejecuta CCLEANER usando primero su opción de "Limpiador" para borrar cookies, temporales de Internet y todos los archivos que este te muestre como obsoletos, y luego usa su opción de "Registro" para limpiar todo el registro de Windows (haciendo copia de seguridad).

Deshabilita RESTAURAR SISTEMA (SYSTEM RESTORE) MIRA AQUI

Inicia EN MODO A PRUEBA DE ERRORES MIRA AQUI


Ejecuta MALWAREBYTE´S

Seleccionas hacer un "escaneo completo". Una vez finalizado, si te detecta algo eliges " quitar lo seleccionado ".
Si te pide reiniciar, lo haces. Después te vas a la pestaña REGISTRO para copiar y pegar el reporte generado en este tema.

Pasas CCLEANER nuevamente.

Inicia en modo normal, habilita restaurar sistema.

Realiza un scan online con KASPERSKY ONLINE SCANER
Si utilizas FIREFOX, debes agregar la extensión IE Tab , que permite Integrar Internet Explorer en pestañas de Mozilla/Firefox.

Elige la opción MY PC para que el escaneo sea completo.

En tu pròxima respuesta, debes pegar el reporte de MALWAREBYTE`S y el de KASPERSKY.


Te dejo saludos y espero tu respuesta.

no puedo realizar el paso 3 resulta que no puedo desactivar la restauracion del sistema me dice que esta deshabilitado por directiva de grupo

Sigue igual con el proceso.....

hola bueno hice todos los pasos aki estan los registros

Malwarebytes' Anti-Malware 1.38
Versión de la Base de Datos: 2297
Windows 5.1.2600 Service Pack 2

01/07/2009 18:52:43
mbam-log-2009-07-01 (18-52-43).txt

Tipo de examen : Examen Completo (C:\|)
Objetos examinados: 150206
Tiempo transcurrido: 56 minute(s), 5 second(s)

Procesos en Memoria Infectados: 0
Módulos en Memoria Infectados: 0
Claves del Registro Infectadas: 6
Valores del Registro Infectados: 3
Elementos de Datos del Registro Infectados: 2
Carpetas Infectadas: 0
Ficheros Infectados: 19

Procesos en Memoria Infectados:
(No se han detectado elementos maliciosos)

Módulos en Memoria Infectados:
(No se han detectado elementos maliciosos)

Claves del Registro Infectadas:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Ext\Stats\{b4bceafd-4cec-4d6d-b164-38242a2cad7c} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

Valores del Registro Infectados:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run\74871232 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Policies\Explorer\ForceClassicControlPan el (Hijack.ControlPanelStyle) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Policies\Explorer\ForceClassicControlPa nel (Hijack.ControlPanelStyle) -> Quarantined and deleted successfully.

Elementos de Datos del Registro Infectados:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Policies\Explorer\NoSMHelp (Hijack.Help) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Carpetas Infectadas:
(No se han detectado elementos maliciosos)

Ficheros Infectados:
c:\WINDOWS\system32\pabawifu.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\ufiwabap.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\atuxlfwr.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\jkkiGWnk.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\jykarklk.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\mLEUkkLd.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\pmnkIxvv.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\ssqoPhEU.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\tmdaexme.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\yayWPJCu.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\mcrh.tmp (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kehitulo.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\gebegimi.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kuvarilo.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\yujukumi.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\getipowi.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kudafane.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ruyebana.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\yapigifa.dll (Trojan.Vundo) -> Quarantined and deleted successfully.



Thursday, July 2, 2009
Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Program database last update: Thursday, July 02, 2009 00:49:50
Records in database: 2412845

Scan settings
Scan using the following database extended
Scan archives yes
Scan mail databases yes

Scan area My Computer
A:\
C:\
D:\
E:\
F:\
G:\
H:\
I:\
J:\

Scan statistics
Files scanned 73538
Threat name 3
Infected objects 26
Suspicious objects 0
Duration of the scan 03:08:01

File name Threat name Threats count
C:\WINDOWS\system32\bisomasu.dll Infected: Trojan.Win32.Monder.cmwt 1

C:\WINDOWS\system32\hlybyaos.dll Infected: Trojan.Win32.Stuh.pdm 1

C:\WINDOWS\system32\hokeziko.dll Infected: Trojan.Win32.Monder.cmwt 1

C:\WINDOWS\system32\jidaduta.dll Infected: Trojan.Win32.Monder.cmwt 1

C:\WINDOWS\system32\kogujiru.dll Infected: Trojan.Win32.Monder.cmwt 1

C:\WINDOWS\system32\konojodo.dll Infected: Trojan.Win32.Monder.cmwt 1

C:\WINDOWS\system32\letunupo.dll Infected: Trojan.Win32.Monder.cmwt 1

C:\WINDOWS\system32\lgpajcsk.dll Infected: Trojan.Win32.Stuh.pdm 1

C:\WINDOWS\system32\mesafari.dll Infected: Trojan.Win32.Monder.cmwt 1

C:\WINDOWS\system32\munokesu.dll Infected: Trojan.Win32.Monder.cmwt 1

C:\WINDOWS\system32\nezovefo.dll Infected: Trojan.Win32.Monder.cmwt 1

C:\WINDOWS\system32\pmjsbemv.dll Infected: Trojan.Win32.Stuh.pbl 1

C:\WINDOWS\system32\rotatopu.dll Infected: Trojan.Win32.Monder.cmwt 1

C:\WINDOWS\system32\sunapija.dll Infected: Trojan.Win32.Monder.cmwt 1

C:\WINDOWS\system32\teyesiti.dll Infected: Trojan.Win32.Monder.cmwt 1

C:\WINDOWS\system32\tomiluvo.dll Infected: Trojan.Win32.Monder.cmwt 1

C:\WINDOWS\system32\tubatage.dll Infected: Trojan.Win32.Monder.cmwt 1

C:\WINDOWS\system32\tulayeba.dll Infected: Trojan.Win32.Monder.cmwt 1

C:\WINDOWS\system32\vimuvayo.dll Infected: Trojan.Win32.Monder.cmwt 1

C:\WINDOWS\system32\vulafudo.dll Infected: Trojan.Win32.Monder.cmwt 1

C:\WINDOWS\system32\wenigewe.dll Infected: Trojan.Win32.Monder.cmwt 1

C:\WINDOWS\system32\wohobiye.dll Infected: Trojan.Win32.Monder.cmwt 1

C:\WINDOWS\system32\yivivaso.dll Infected: Trojan.Win32.Monder.cmwt 1

C:\WINDOWS\system32\zifubogu.dll Infected: Trojan.Win32.Monder.cmwt 1

C:\WINDOWS\system32\zivahesu.dll Infected: Trojan.Win32.Monder.cmwt 1

C:\WINDOWS\system32\zopejaji.dll Infected: Trojan.Win32.Monder.cmwt 1

The selected area was scanned.

Ufffff que tenias un zoológico en tu pc


º Descarga OTM by OldTimer en el escritorio.

º Hace doble clic sobre OTM.exe para ejecutarlo.

º Asegurate que esté marcado "Unregister Dll's and Ocx's".

º Copia el texto que se encuentra dentro del recuadrado de abajo, y pegalo en el marco izquierdo de OTMoveIt llamado "Paste instruccions for items to be moved ".


º Hace clic en MoveIt para lanzar la supresión. En la parte derecha de la ventana del programa llamada Results podes ver los resultados de la supresión.

º Simultáneamente se abrirá un aviso preguntando si deseas reiniciar el PC. Debes pulsar YES. En caso de no preguntar, deberás reiniciar de todas maneras, para terminar con la eliminación.

º Los resultados aparecen después del reinicio en C: \ _ OTM\MovedFiles\***_***.log (Donde sale "***_***" es la fecha y hora).

Este resultado debes copiar y pegar en tu próxima respuesta.

All processes killed
========== FILES ==========
LoadLibrary failed for C:\WINDOWS\system32\bisomasu.dll
C:\WINDOWS\system32\bisomasu.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\bisomasu.dll scheduled to be moved on reboot.
LoadLibrary failed for C:\WINDOWS\system32\hlybyaos.dll
C:\WINDOWS\system32\hlybyaos.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\hlybyaos.dll scheduled to be moved on reboot.
LoadLibrary failed for C:\WINDOWS\system32\hokeziko.dll
C:\WINDOWS\system32\hokeziko.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\hokeziko.dll scheduled to be moved on reboot.
LoadLibrary failed for C:\WINDOWS\system32\jidaduta.dll
C:\WINDOWS\system32\jidaduta.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\jidaduta.dll scheduled to be moved on reboot.
LoadLibrary failed for C:\WINDOWS\system32\kogujiru.dll
C:\WINDOWS\system32\kogujiru.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\kogujiru.dll scheduled to be moved on reboot.
LoadLibrary failed for C:\WINDOWS\system32\konojodo.dll
C:\WINDOWS\system32\konojodo.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\konojodo.dll scheduled to be moved on reboot.
LoadLibrary failed for C:\WINDOWS\system32\letunupo.dll
C:\WINDOWS\system32\letunupo.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\letunupo.dll scheduled to be moved on reboot.
LoadLibrary failed for C:\WINDOWS\system32\lgpajcsk.dll
C:\WINDOWS\system32\lgpajcsk.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\lgpajcsk.dll scheduled to be moved on reboot.
LoadLibrary failed for C:\WINDOWS\system32\mesafari.dll
C:\WINDOWS\system32\mesafari.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\mesafari.dll scheduled to be moved on reboot.
LoadLibrary failed for C:\WINDOWS\system32\munokesu.dll
C:\WINDOWS\system32\munokesu.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\munokesu.dll scheduled to be moved on reboot.
LoadLibrary failed for C:\WINDOWS\system32\nezovefo.dll
C:\WINDOWS\system32\nezovefo.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\nezovefo.dll scheduled to be moved on reboot.
LoadLibrary failed for C:\WINDOWS\system32\pmjsbemv.dll
C:\WINDOWS\system32\pmjsbemv.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\pmjsbemv.dll scheduled to be moved on reboot.
LoadLibrary failed for C:\WINDOWS\system32\rotatopu.dll
C:\WINDOWS\system32\rotatopu.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\rotatopu.dll scheduled to be moved on reboot.
LoadLibrary failed for C:\WINDOWS\system32\sunapija.dll
C:\WINDOWS\system32\sunapija.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\sunapija.dll scheduled to be moved on reboot.
LoadLibrary failed for C:\WINDOWS\system32\teyesiti.dll
C:\WINDOWS\system32\teyesiti.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\teyesiti.dll scheduled to be moved on reboot.
LoadLibrary failed for C:\WINDOWS\system32\tomiluvo.dll
C:\WINDOWS\system32\tomiluvo.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\tomiluvo.dll scheduled to be moved on reboot.
LoadLibrary failed for C:\WINDOWS\system32\tubatage.dll
C:\WINDOWS\system32\tubatage.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\tubatage.dll scheduled to be moved on reboot.
LoadLibrary failed for C:\WINDOWS\system32\tulayeba.dll
C:\WINDOWS\system32\tulayeba.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\tulayeba.dll scheduled to be moved on reboot.
LoadLibrary failed for C:\WINDOWS\system32\vimuvayo.dll
C:\WINDOWS\system32\vimuvayo.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\vimuvayo.dll scheduled to be moved on reboot.
LoadLibrary failed for C:\WINDOWS\system32\vulafudo.dll
C:\WINDOWS\system32\vulafudo.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\vulafudo.dll scheduled to be moved on reboot.
LoadLibrary failed for C:\WINDOWS\system32\wenigewe.dll
C:\WINDOWS\system32\wenigewe.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\wenigewe.dll scheduled to be moved on reboot.
LoadLibrary failed for C:\WINDOWS\system32\wohobiye.dll
C:\WINDOWS\system32\wohobiye.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\wohobiye.dll scheduled to be moved on reboot.
LoadLibrary failed for C:\WINDOWS\system32\yivivaso.dll
C:\WINDOWS\system32\yivivaso.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\yivivaso.dll scheduled to be moved on reboot.
LoadLibrary failed for C:\WINDOWS\system32\zifubogu.dll
C:\WINDOWS\system32\zifubogu.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\zifubogu.dll scheduled to be moved on reboot.
LoadLibrary failed for C:\WINDOWS\system32\zivahesu.dll
C:\WINDOWS\system32\zivahesu.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\zivahesu.dll scheduled to be moved on reboot.
LoadLibrary failed for C:\WINDOWS\system32\zopejaji.dll
C:\WINDOWS\system32\zopejaji.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\zopejaji.dll scheduled to be moved on reboot.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrador
->Temp folder emptied: 3055167 bytes
->Temporary Internet Files folder emptied: 1606116 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 20823255 bytes
->Opera cache emptied: 104734239 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService
->Temp folder emptied: 65984 bytes
File delete failed. C:\Documents and Settings\LocalService\Configuración local\Archivos temporales de Internet\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 2920270 bytes

User: NetworkService
->Temp folder emptied: 349824 bytes
->Temporary Internet Files folder emptied: 37458 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 2909 bytes
File delete failed. C:\WINDOWS\temp\_av_proI.tm~a02516\setup.lok scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\_avast4_\Webshlock.txt scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_51c.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\~DF7C2E.tmp scheduled to be deleted on reboot.
Windows Temp folder emptied: 112711340 bytes

RecycleBin emptied: 0 bytes

Total Files Cleaned = 234,90 mb


OTM by OldTimer - Version 3.0.0.2 log created on 07022009_162728

Files moved on Reboot...
File C:\WINDOWS\system32\bisomasu.dll not found!
File C:\WINDOWS\system32\hlybyaos.dll not found!
File C:\WINDOWS\system32\hokeziko.dll not found!
File C:\WINDOWS\system32\jidaduta.dll not found!
File C:\WINDOWS\system32\kogujiru.dll not found!
File C:\WINDOWS\system32\konojodo.dll not found!
File C:\WINDOWS\system32\letunupo.dll not found!
File C:\WINDOWS\system32\lgpajcsk.dll not found!
File C:\WINDOWS\system32\mesafari.dll not found!
File C:\WINDOWS\system32\munokesu.dll not found!
File C:\WINDOWS\system32\nezovefo.dll not found!
File C:\WINDOWS\system32\pmjsbemv.dll not found!
File C:\WINDOWS\system32\rotatopu.dll not found!
File C:\WINDOWS\system32\sunapija.dll not found!
File C:\WINDOWS\system32\teyesiti.dll not found!
File C:\WINDOWS\system32\tomiluvo.dll not found!
File C:\WINDOWS\system32\tubatage.dll not found!
File C:\WINDOWS\system32\tulayeba.dll not found!
File C:\WINDOWS\system32\vimuvayo.dll not found!
File C:\WINDOWS\system32\vulafudo.dll not found!
File C:\WINDOWS\system32\wenigewe.dll not found!
File C:\WINDOWS\system32\wohobiye.dll not found!
File C:\WINDOWS\system32\yivivaso.dll not found!
File C:\WINDOWS\system32\zifubogu.dll not found!
File C:\WINDOWS\system32\zivahesu.dll not found!
File C:\WINDOWS\system32\zopejaji.dll not found!

Registry entries deleted on Reboot...

º Descarga OTC.exe en el escritorio.

º Lo ejecutas y presionas Cleanup.

Eso eliminará a OTM, su cuarentena y a OTC.exe y reiniciará tu pc.

Me comentas como sigue todo ahora....

Salu2

ia lo hice uta kedo filete muxo mas rapido de como estaba :) gracias
ahora me podrias decir que causaba que estubiera tan lento asi pa saber

gracias

Esto

Y esto


Bueno, me alegro que soluciones tu problema . Por cualquier otro problema, no dudes en volver a postear.

Te dejo saludos y MUCHA SUERTE

TEMA SOLUCIONADO


PD: si deseas REABRIR ESTE TEMA, presiona y un MODERADOR atenderà la consulta...