Foro de InfoSpyware - Foro de Hijackthis - Foro de Virus

buenos dias .

Necesito reparar un rookit que segun nod32 tengo en la memoria operativa,pero..... el no lo quita,
Lei todo lo que decias para la limpieza pero nad de nada. porque tengo otro problema o es el mismo no lo se, no me deja abrir los programas que descargo para su limpieza como dr web , malwarwbytes y demas, cuando miro como arreglar est me dice que descarge programas para limpiar , pero como? si no me deja utilizarlos( no puedo utilizar lo definido en la definicion) osea que sigo igual
por favor decidme algo .
os dejo el reprote de hijtac por si sirve de algo

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:44:54, on 03/07/2009
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16851)
Boot mode: Normal

Descarga, instala y ejecuta AVIRA ANTIROOTKIT

Pones el reporte generado



Por favor, sigue estos pasos:

Para mayor comodidad, IMPRIME ESTA HOJA

( Si no puedes hacer algun paso, saltèalo y trata de seguir con los otros)


Descarga lo siguiente:

º CCLEANER. Lo instalas según Su Manual

º MALWAREBYTE´S. Lo instalas y actualizas según su manual, PERO NO LO EJECUTES AUN

Ejecuta CCLEANER usando primero su opción de "Limpiador" para borrar cookies, temporales de Internet y todos los archivos que este te muestre como obsoletos, y luego usa su opción de "Registro" para limpiar todo el registro de Windows (haciendo copia de seguridad).

Deshabilita RESTAURAR SISTEMA (SYSTEM RESTORE) MIRA AQUI

Inicia EN MODO A PRUEBA DE ERRORES MIRA AQUI


Ejecuta MALWAREBYTE´S

Seleccionas hacer un "escaneo completo". Una vez finalizado, si te detecta algo eliges " quitar lo seleccionado ".
Si te pide reiniciar, lo haces. Después te vas a la pestaña REGISTRO para copiar y pegar el reporte generado en este tema.

Pasas CCLEANER nuevamente.

Inicia en modo normal, habilita restaurar sistema.

Realiza un scan online con KASPERSKY ONLINE SCANER
Si utilizas FIREFOX, debes agregar la extensión IE Tab , que permite Integrar Internet Explorer en pestañas de Mozilla/Firefox.

Elige la opción MY PC para que el escaneo sea completo.

En tu pròxima respuesta, debes pegar el reporte de MALWAREBYTE`S y el de KASPERSKY.


Te dejo saludos y espero tu respuesta.



PD: Si no te deja ejecutar malwarebyte´s, le cambias el nombre al ejecutable...

Gracias ante todo.

He hecho lo que dijiste pero no puedo ejecutar el avira antirookit
el malwarebite si si lo cambio d nombre.

despues de hacer todo sigue igual te mando los reporte de malware y del karpsky
para que me digas alg . muchas gracias

Malwarebytes' Anti-Malware 1.38
Versión de la Base de Datos: 2297
Windows 6.0.6000

04/07/2009 12:12:12
mbam-log-2009-07-04 (12-12-12).txt

Tipo de examen : Examen Completo (C:\|D:\|)
Objetos examinados: 220874
Tiempo transcurrido: 35 minute(s), 59 second(s)

Procesos en Memoria Infectados: 0
Módulos en Memoria Infectados: 1
Claves del Registro Infectadas: 14
Valores del Registro Infectados: 0
Elementos de Datos del Registro Infectados: 0
Carpetas Infectadas: 1
Ficheros Infectados: 7

Procesos en Memoria Infectados:
(No se han detectado elementos maliciosos)

Módulos en Memoria Infectados:
\\?\globalroot\systemroot\System32\UACanuogjtpasjn mupgu.dll (Trojan.TDSS) -> Delete on reboot.

Claves del Registro Infectadas:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Ext\Stats\{3aa42713-5c1e-48e2-b432-d8bf420dd31d} (Rogue.AntiVirus2008) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Ext\Stats\{b7d3e479-cc68-42b5-a338-938ece35f419} (Adware.SoftMate) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Ext\Stats\{a3ed5288-f558-4f6e-8d5c-740cb6f89029} (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Ext\Stats\{e596df5f-4239-4d40-8367-ebadf0165917} (Rogue.Installer) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Ext\Stats\{100eb1fd-d03e-47fd-81f3-ee91287f9465} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Ext\Stats\{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Ext\Stats\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Ext\Stats\{6fd31ed6-7c94-4bbc-8e95-f927f4d3a949} (Adware.180Solutions) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\821f2b76-2db1-4556-76c5-070e7a43661e (Adware.TheSuperAds) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\UAC (Rootkit.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\{557385cc-c707-62bd-1283-61707c2d4cf9} (Adware.AdRotator) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\VB and VBA Program Settings\tm (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Browser Helper Objects\{d6d9a05a-2a2f-7e65-52fe-43c77766afcc} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{d6d9a05a-2a2f-7e65-52fe-43c77766afcc} (Adware.BHO) -> Quarantined and deleted successfully.

Valores del Registro Infectados:
(No se han detectado elementos maliciosos)

Elementos de Datos del Registro Infectados:
(No se han detectado elementos maliciosos)

Carpetas Infectadas:
c:\Users\casa\AppData\Roaming\Microsoft\Windows\St art Menu\Programs\System Security (Rogue.SystemSecurity) -> Quarantined and deleted successfully.

Ficheros Infectados:
\\?\globalroot\systemroot\System32\UACanuogjtpasjn mupgu.dll (Trojan.TDSS) -> Quarantined and deleted successfully.
c:\program files\motorola phone tools\MPT_TEST_Info.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Windows\System32\821f2b76-2db1-4556-76c5-070e7a43661e.exe (Adware.TheSuperAds) -> Quarantined and deleted successfully.
c:\Users\casa\AppData\Roaming\microsoft\Windows\st art menu\Programs\system security\System Security (Rogue.SystemSecurity) -> Quarantined and deleted successfully.
C:\Windows\System32\SKYNETlog.dat (Trojan.Agent) -> Delete on reboot.
C:\Windows\system32\uacinit.dll (Trojan.Agent) -> Delete on reboot.
c:\Windows\System32\izvdzhzdixavjq.dll-uninst.exe (Adware.AdRotator) -> Quarantined and deleted successfully.



karpeskyy.......................
--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0 REPORT
Saturday, July 4, 2009
Operating System: Microsoft Windows Vista Home Basic Edition, 32-bit (build 6000)
Kaspersky Online Scanner version: 7.0.26.13
Program database last update: Saturday, July 04, 2009 11:36:29
Records in database: 2425951
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\
F:\
G:\
H:\
I:\

Scan statistics:
Files scanned: 138376
Threat name: 3
Infected objects: 2
Suspicious objects: 4
Duration of the scan: 02:26:40


File name / Threat name / Threats count
C:\Program Files\ESET\nodlogin.exe Infected: Trojan.Win32.Autoit.ac 1
C:\Program Files\PDF2Any\PDF2Any.exe Infected: not-a-virus:AdWare.Win32.AdBar.at 1
C:\Users\casa\AppData\Roaming\Thunderbird\Profiles \exyihr5t.default\Mail\Local Folders\Inbox Suspicious: Trojan-Spy.HTML.Fraud.gen 4

The selected area was scanned.

Utiliza GMER ANTIROOTKIT siguiendo atentamente el manual que escribió GUILLERMO TELL.

Luego pones su reporte en tu próxima respuesta....

Te dejo saludos....

antes que nada agradeceros el esfuerzo que estais demostrand en ayudarme
a ver si cinseguimos algo, gracias
dejo el reporte del gmmer
GMER 1.0.15.14972 - http://www.gmer.net
Rootkit scan 2009-07-06 14:48:18
Windows 6.0.6000


---- System - GMER 1.0.15 ----

SSDT 865B8A60 ZwOpenProcess
SSDT 865B8E80 ZwOpenThread
SSDT 865B9460 ZwSuspendProcess
SSDT 865B9280 ZwSuspendThread
SSDT 865B8C90 ZwTerminateProcess
SSDT 865B90B0 ZwTerminateThread

Code 86100A86 ZwEnumerateKey
Code 860FFA86 ZwFlushInstructionCache
Code 86461275 IofCallDriver
Code 85E76A75 IofCompleteRequest

---- Kernel code sections - GMER 1.0.15 ----

.text ntkrnlpa.exe!IofCallDriver 82427F37 5 Bytes JMP 8646127A
.text ntkrnlpa.exe!IofCompleteRequest 82427FA4 5 Bytes JMP 85E76A7A
PAGE ntkrnlpa.exe!ZwEnumerateKey 82537F06 5 Bytes JMP 86100A8A
PAGE ntkrnlpa.exe!ZwFlushInstructionCache 825E849F 5 Bytes JMP 860FFA8A

---- User code sections - GMER 1.0.15 ----

.text C:\Program Files\Internet Explorer\Iexplore.exe[276] ntdll.dll!LdrUnloadDll 7777BF0A 5 Bytes JMP 00D9000C
.text C:\Program Files\Internet Explorer\Iexplore.exe[276] USER32.dll!DialogBoxIndirectParamW 767614EA 5 Bytes JMP 7184178F C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[276] USER32.dll!MessageBoxExA 7677570D 5 Bytes JMP 718416D6 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[276] USER32.dll!DialogBoxParamA 767765BF 5 Bytes JMP 71841754 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[276] USER32.dll!MessageBoxIndirectW 7677F1B3 5 Bytes JMP 716D16B6 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[276] USER32.dll!DialogBoxParamW 7678129F 5 Bytes JMP 716AF341 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[276] USER32.dll!DialogBoxIndirectParamA 767A29C9 5 Bytes JMP 718417CA C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[276] USER32.dll!MessageBoxIndirectA 767AFACF 5 Bytes JMP 71841710 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[276] USER32.dll!MessageBoxExW 767AFBC9 5 Bytes JMP 7184169C C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\Iexplore.exe[276] WININET.dll!HttpAddRequestHeadersA 7742FB4D 5 Bytes JMP 00F6000A
.text C:\Program Files\Internet Explorer\Iexplore.exe[276] WININET.dll!HttpAddRequestHeadersW 7749D14D 5 Bytes JMP 014A000A
.text C:\Windows\System32\spoolsv.exe[444] ntdll.dll!LdrUnloadDll 7777BF0A 5 Bytes JMP 00FA000C
.text C:\Windows\system32\taskeng.exe[468] ntdll.dll!LdrLoadDll 7776EB00 5 Bytes JMP 0182000A
.text C:\Windows\system32\taskeng.exe[468] ntdll.dll!LdrUnloadDll 7777BF0A 5 Bytes JMP 0183000C
.text C:\Program Files\Internet Explorer\IEUser.exe[488] ntdll.dll!LdrUnloadDll 7777BF0A 5 Bytes JMP 00DE000C
.text C:\Windows\system32\wininit.exe[544] ntdll.dll!LdrUnloadDll 7777BF0A 5 Bytes JMP 0086000C
.text C:\Windows\system32\services.exe[600] ntdll.dll!LdrUnloadDll 7777BF0A 5 Bytes JMP 0184000C
.text C:\Windows\system32\lsass.exe[612] ntdll.dll!LdrUnloadDll 7777BF0A 5 Bytes JMP 0146000C
.text C:\Windows\system32\lsm.exe[620] ntdll.dll!LdrLoadDll 7776EB00 5 Bytes JMP 0142000A
.text C:\Windows\system32\lsm.exe[620] ntdll.dll!LdrUnloadDll 7777BF0A 5 Bytes JMP 0143000C
.text C:\Windows\system32\winlogon.exe[656] ntdll.dll!LdrLoadDll 7776EB00 5 Bytes JMP 0049000A
.text C:\Windows\system32\winlogon.exe[656] ntdll.dll!LdrUnloadDll 7777BF0A 5 Bytes JMP 004A000C
.text C:\Program Files\ESET\ESET Smart Security\egui.exe[872] ntdll.dll!LdrLoadDll 7776EB00 5 Bytes JMP 00AD000A
.text C:\Program Files\ESET\ESET Smart Security\egui.exe[872] ntdll.dll!LdrUnloadDll 7777BF0A 5 Bytes JMP 00AE000C
.text C:\Windows\system32\taskeng.exe[904] ntdll.dll!LdrLoadDll 7776EB00 5 Bytes JMP 00CA000A
.text C:\Windows\system32\taskeng.exe[904] ntdll.dll!LdrUnloadDll 7777BF0A 5 Bytes JMP 00CB000C
.text C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe[1000] ntdll.dll!LdrLoadDll 7776EB00 5 Bytes JMP 00E6000A
.text C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe[1000] ntdll.dll!LdrUnloadDll 7777BF0A 5 Bytes JMP 00E7000C
.text C:\Windows\System32\svchost.exe[1176] ntdll.dll!LdrLoadDll 7776EB00 5 Bytes JMP 001A000A
.text C:\Windows\system32\svchost.exe[1472] ntdll.dll!LdrLoadDll 7776EB00 5 Bytes JMP 000D000A
.text C:\Windows\system32\SLsvc.exe[1532] ntdll.dll!LdrLoadDll 7776EB00 5 Bytes JMP 00F1000A
.text C:\Windows\system32\SLsvc.exe[1532] ntdll.dll!LdrUnloadDll 7777BF0A 5 Bytes JMP 00F4000C
.text c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe[1840] ntdll.dll!LdrLoadDll 7776EB00 5 Bytes JMP 00E1000A
.text c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe[1840] ntdll.dll!LdrUnloadDll 7777BF0A 5 Bytes JMP 00E2000C
.text c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe[1872] ntdll.dll!LdrLoadDll 7776EB00 5 Bytes JMP 015C000A
.text c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe[1872] ntdll.dll!LdrUnloadDll 7777BF0A 5 Bytes JMP 015D000C
.text C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe[1968] ntdll.dll!LdrLoadDll 7776EB00 5 Bytes JMP 00C5000A
.text C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe[1968] ntdll.dll!LdrUnloadDll 7777BF0A 5 Bytes JMP 00C6000C
.text C:\Windows\system32\Dwm.exe[1996] ntdll.dll!LdrLoadDll 7776EB00 5 Bytes JMP 00CA000A
.text C:\Windows\system32\Dwm.exe[1996] ntdll.dll!LdrUnloadDll 7777BF0A 5 Bytes JMP 00CB000C
.text C:\Windows\Explorer.EXE[2044] ntdll.dll!LdrLoadDll 7776EB00 5 Bytes JMP 008E000A
.text C:\Windows\Explorer.EXE[2044] ntdll.dll!LdrUnloadDll 7777BF0A 5 Bytes JMP 008F000C
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[2456] ntdll.dll!LdrLoadDll 7776EB00 5 Bytes JMP 00DD000A
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[2456] ntdll.dll!LdrUnloadDll 7777BF0A 5 Bytes JMP 00DE000C
.text C:\Windows\system32\svchost.exe[2476] ntdll.dll!LdrLoadDll 7776EB00 5 Bytes JMP 002D000A
.text C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe[2524] ntdll.dll!LdrUnloadDll 7777BF0A 5 Bytes JMP 0220000C
.text C:\Program Files\ESET\ESET Smart Security\ekrn.exe[2560] ntdll.dll!LdrUnloadDll 7777BF0A 5 Bytes JMP 00DA000C
.text C:\Program Files\ESET\ESET Smart Security\ekrn.exe[2560] kernel32.dll!SetUnhandledExceptionFilter 760CD177 4 Bytes [C2, 04, 00, 00]
.text C:\Program Files\Mozilla Thunderbird\thunderbird.exe[2724] ntdll.dll!LdrUnloadDll 7777BF0A 5 Bytes JMP 010F000C
.text C:\Windows\system32\wuauclt.exe[2776] ntdll.dll!LdrLoadDll 7776EB00 5 Bytes JMP 0088000A
.text C:\Windows\system32\wuauclt.exe[2776] ntdll.dll!LdrUnloadDll 7777BF0A 5 Bytes JMP 0089000C
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2884] ntdll.dll!LdrUnloadDll 7777BF0A 5 Bytes JMP 005D000C
.text C:\Windows\system32\svchost.exe[2900] ntdll.dll!LdrLoadDll 7776EB00 5 Bytes JMP 000E000A
.text C:\Program Files\Common Files\LightScribe\LSSrvc.exe[2920] ntdll.dll!LdrLoadDll 7776EB00 5 Bytes JMP 00FF000A
.text C:\Program Files\Common Files\LightScribe\LSSrvc.exe[2920] ntdll.dll!LdrUnloadDll 7777BF0A 5 Bytes JMP 0160000C
.text C:\Windows\System32\mobsync.exe[3000] ntdll.dll!LdrLoadDll 7776EB00 5 Bytes JMP 00CB000A
.text C:\Windows\System32\mobsync.exe[3000] ntdll.dll!LdrUnloadDll 7777BF0A 5 Bytes JMP 00CC000C
.text C:\Windows\System32\svchost.exe[3028] ntdll.dll!LdrLoadDll 7776EB00 5 Bytes JMP 0037000A
.text C:\Windows\System32\svchost.exe[3124] ntdll.dll!LdrLoadDll 7776EB00 5 Bytes JMP 0026000A
.text C:\Windows\system32\svchost.exe[3212] ntdll.dll!LdrLoadDll 7776EB00 5 Bytes JMP 0066000A
.text C:\Windows\System32\TUProgSt.exe[3260] ntdll.dll!LdrLoadDll 7776EB00 5 Bytes JMP 00B2000A
.text C:\Windows\System32\TUProgSt.exe[3260] ntdll.dll!LdrUnloadDll 7777BF0A 5 Bytes JMP 00B3000C
.text C:\Windows\system32\UAService7.exe[3320] ntdll.dll!LdrLoadDll 7776EB00 5 Bytes JMP 00DD000A
.text C:\Windows\system32\UAService7.exe[3320] ntdll.dll!LdrUnloadDll 7777BF0A 5 Bytes JMP 00DE000C
.text C:\Windows\System32\svchost.exe[3340] ntdll.dll!LdrLoadDll 7776EB00 5 Bytes JMP 0029000A
.text C:\Windows\system32\SearchIndexer.exe[3376] ntdll.dll!LdrLoadDll 7776EB00 5 Bytes JMP 00FC000A
.text C:\Windows\system32\SearchIndexer.exe[3376] ntdll.dll!LdrUnloadDll 7777BF0A 5 Bytes JMP 00FD000C
.text C:\Windows\system32\wbem\wmiprvse.exe[3820] ntdll.dll!LdrLoadDll 7776EB00 5 Bytes JMP 00E6000A
.text C:\Windows\system32\wbem\wmiprvse.exe[3820] ntdll.dll!LdrUnloadDll 7777BF0A 5 Bytes JMP 00E9000C
.text C:\Windows\servicing\TrustedInstaller.exe[4084] ntdll.dll!LdrLoadDll 7776EB00 5 Bytes JMP 0095000A
.text C:\Windows\servicing\TrustedInstaller.exe[4084] ntdll.dll!LdrUnloadDll 7777BF0A 5 Bytes JMP 0096000C
.text C:\Windows\system32\conime.exe[5616] ntdll.dll!LdrLoadDll 7776EB00 5 Bytes JMP 00BE000A
.text C:\Windows\system32\conime.exe[5616] ntdll.dll!LdrUnloadDll 7777BF0A 5 Bytes JMP 00BF000C
.text C:\Users\casa\Desktop\cosas y demas de mis padres\programas de antispiware\gemmer abnti rookit\gtjrk79q.exe[5880] ntdll.dll!LdrLoadDll 7776EB00 5 Bytes JMP 010F000A
.text C:\Users\casa\Desktop\cosas y demas de mis padres\programas de antispiware\gemmer abnti rookit\gtjrk79q.exe[5880] ntdll.dll!LdrUnloadDll 7777BF0A 5 Bytes JMP 0110000C

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\Windows\Explorer.EXE[2044] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage] [743EFD78] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_65 95b64144ccf1df_1.0.6000.16683_none_9ea0f08ac96e253 7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2044] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI] [743BBBF1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_65 95b64144ccf1df_1.0.6000.16683_none_9ea0f08ac96e253 7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2044] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode] [743AA31F] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_65 95b64144ccf1df_1.0.6000.16683_none_9ea0f08ac96e253 7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2044] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode] [743ACBFF] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_65 95b64144ccf1df_1.0.6000.16683_none_9ea0f08ac96e253 7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2044] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC] [743A8AB2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_65 95b64144ccf1df_1.0.6000.16683_none_9ea0f08ac96e253 7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2044] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStream] [743BD168] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_65 95b64144ccf1df_1.0.6000.16683_none_9ea0f08ac96e253 7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2044] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight] [743A7D98] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_65 95b64144ccf1df_1.0.6000.16683_none_9ea0f08ac96e253 7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2044] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth] [743A7CFF] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_65 95b64144ccf1df_1.0.6000.16683_none_9ea0f08ac96e253 7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2044] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage] [743A6A54] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_65 95b64144ccf1df_1.0.6000.16683_none_9ea0f08ac96e253 7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2044] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFileICM] [7443C1BA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_65 95b64144ccf1df_1.0.6000.16683_none_9ea0f08ac96e253 7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2044] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFile] [743C80FE] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_65 95b64144ccf1df_1.0.6000.16683_none_9ea0f08ac96e253 7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2044] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics] [743A90CD] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_65 95b64144ccf1df_1.0.6000.16683_none_9ea0f08ac96e253 7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2044] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree] [743B223C] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_65 95b64144ccf1df_1.0.6000.16683_none_9ea0f08ac96e253 7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2044] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc] [743B2267] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_65 95b64144ccf1df_1.0.6000.16683_none_9ea0f08ac96e253 7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2044] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown] [743B771C] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_65 95b64144ccf1df_1.0.6000.16683_none_9ea0f08ac96e253 7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2044] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup] [743B753E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_65 95b64144ccf1df_1.0.6000.16683_none_9ea0f08ac96e253 7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2044] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStreamICM] [743E8585] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_65 95b64144ccf1df_1.0.6000.16683_none_9ea0f08ac96e253 7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs eamon.sys (Amon monitor/ESET)
AttachedDevice \Driver\tdx \Device\Tcp epfwtdi.sys (ESET Personal Firewall TDI filter/ESET)
AttachedDevice \Driver\tdx \Device\Udp epfwtdi.sys (ESET Personal Firewall TDI filter/ESET)
AttachedDevice \Driver\tdx \Device\RawIp epfwtdi.sys (ESET Personal Firewall TDI filter/ESET)

---- Threads - GMER 1.0.15 ----

Thread System [4:312] 865B7790
---- Processes - GMER 1.0.15 ----

Library \\?\globalroot\systemroot\system32\SKYNETjmiprdql. dll (*** hidden *** ) @ C:\Program Files\Internet Explorer\Iexplore.exe [276] 0x10000000
Library \\?\globalroot\systemroot\system32\SKYNETjmiprdql. dll (*** hidden *** ) @ C:\Windows\System32\spoolsv.exe [444] 0x10000000
Library \\?\globalroot\systemroot\system32\SKYNETjmiprdql. dll (*** hidden *** ) @ C:\Windows\system32\svchost.exe [460] 0x10000000
Library \\?\globalroot\systemroot\system32\SKYNETjmiprdql. dll (*** hidden *** ) @ C:\Windows\system32\taskeng.exe [468] 0x10000000
Library \\?\globalroot\systemroot\system32\SKYNETjmiprdql. dll (*** hidden *** ) @ C:\Program Files\Internet Explorer\IEUser.exe [488] 0x10000000
Library \\?\globalroot\systemroot\system32\SKYNETjmiprdql. dll (*** hidden *** ) @ C:\Windows\system32\wininit.exe [544] 0x10000000
Library \\?\globalroot\systemroot\system32\SKYNETjmiprdql. dll (*** hidden *** ) @ C:\Windows\system32\services.exe [600] 0x10000000
Library \\?\globalroot\systemroot\system32\SKYNETjmiprdql. dll (*** hidden *** ) @ C:\Windows\system32\lsass.exe [612] 0x10000000
Library \\?\globalroot\systemroot\system32\SKYNETjmiprdql. dll (*** hidden *** ) @ C:\Windows\system32\lsm.exe [620] 0x10000000
Library \\?\globalroot\systemroot\system32\SKYNETjmiprdql. dll (*** hidden *** ) @ C:\Windows\system32\winlogon.exe [656] 0x10000000
Library \\?\globalroot\systemroot\system32\SKYNETjmiprdql. dll (*** hidden *** ) @ C:\Windows\system32\svchost.exe [828] 0x01E70000
Library \\?\globalroot\systemroot\system32\SKYNETjmiprdql. dll (*** hidden *** ) @ C:\Program Files\ESET\ESET Smart Security\egui.exe [872] 0x10000000
Library \\?\globalroot\systemroot\system32\SKYNETjmiprdql. dll (*** hidden *** ) @ C:\Windows\system32\taskeng.exe [904] 0x10000000
Library \\?\globalroot\systemroot\system32\SKYNETjmiprdql. dll (*** hidden *** ) @ C:\Windows\system32\svchost.exe [916] 0x10000000
Library \\?\globalroot\systemroot\system32\SKYNETjmiprdql. dll (*** hidden *** ) @ C:\Windows\System32\svchost.exe [972] 0x10000000
Library \\?\globalroot\systemroot\system32\SKYNETjmiprdql. dll (*** hidden *** ) @ C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe [1000] 0x10000000
Library \\?\globalroot\systemroot\system32\SKYNETjmiprdql. dll (*** hidden *** ) @ C:\Windows\system32\svchost.exe [1060] 0x10000000
Library \\?\globalroot\systemroot\system32\SKYNETjmiprdql. dll (*** hidden *** ) @ C:\Windows\System32\svchost.exe [1176] 0x10000000
Library \\?\globalroot\systemroot\system32\SKYNETjmiprdql. dll (*** hidden *** ) @ C:\Windows\System32\svchost.exe [1220] 0x10000000
Library \\?\globalroot\systemroot\system32\SKYNETjmiprdql. dll (*** hidden *** ) @ C:\Windows\System32\svchost.exe [1264] 0x10000000
Library \\?\globalroot\systemroot\system32\SKYNETjmiprdql. dll (*** hidden *** ) @ C:\Windows\system32\svchost.exe [1472] 0x10000000
Library \\?\globalroot\systemroot\system32\SKYNETjmiprdql. dll (*** hidden *** ) @ C:\Windows\system32\SLsvc.exe [1532] 0x10000000
Library \\?\globalroot\systemroot\system32\SKYNETjmiprdql. dll (*** hidden *** ) @ C:\Windows\system32\svchost.exe [1572] 0x10000000
Library \\?\globalroot\systemroot\system32\SKYNETjmiprdql. dll (*** hidden *** ) @ c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [1840] 0x10000000
Library \\?\globalroot\systemroot\system32\SKYNETjmiprdql. dll (*** hidden *** ) @ c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe [1872] 0x10000000
Library \\?\globalroot\systemroot\system32\SKYNETjmiprdql. dll (*** hidden *** ) @ C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe [1968] 0x10000000
Library \\?\globalroot\systemroot\system32\SKYNETjmiprdql. dll (*** hidden *** ) @ C:\Windows\system32\Dwm.exe [1996] 0x10000000
Library \\?\globalroot\systemroot\system32\SKYNETjmiprdql. dll (*** hidden *** ) @ C:\Windows\Explorer.EXE [2044] 0x10000000
Library \\?\globalroot\systemroot\system32\SKYNETjmiprdql. dll (*** hidden *** ) @ C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [2456] 0x10000000
Library \\?\globalroot\systemroot\system32\SKYNETjmiprdql. dll (*** hidden *** ) @ C:\Windows\system32\svchost.exe [2476] 0x10000000
Library \\?\globalroot\systemroot\system32\SKYNETjmiprdql. dll (*** hidden *** ) @ C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe [2524] 0x003E0000
Library \\?\globalroot\systemroot\system32\SKYNETjmiprdql. dll (*** hidden *** ) @ C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2560] 0x10000000
Library \\?\globalroot\systemroot\system32\SKYNETjmiprdql. dll (*** hidden *** ) @ C:\Program Files\Mozilla Thunderbird\thunderbird.exe [2724] 0x10000000
Library \\?\globalroot\systemroot\system32\SKYNETjmiprdql. dll (*** hidden *** ) @ C:\Windows\system32\wuauclt.exe [2776] 0x10000000
Library \\?\globalroot\systemroot\system32\SKYNETjmiprdql. dll (*** hidden *** ) @ C:\Program Files\Windows Media Player\wmpnetwk.exe [2884] 0x10000000
Library \\?\globalroot\systemroot\system32\SKYNETjmiprdql. dll (*** hidden *** ) @ C:\Windows\system32\svchost.exe [2900] 0x10000000
Library \\?\globalroot\systemroot\system32\SKYNETjmiprdql. dll (*** hidden *** ) @ C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2920] 0x10000000
Library \\?\globalroot\systemroot\system32\SKYNETjmiprdql. dll (*** hidden *** ) @ C:\Windows\System32\mobsync.exe [3000] 0x10000000
Library \\?\globalroot\systemroot\system32\SKYNETjmiprdql. dll (*** hidden *** ) @ C:\Windows\System32\svchost.exe [3028] 0x10000000
Library \\?\globalroot\systemroot\system32\SKYNETjmiprdql. dll (*** hidden *** ) @ C:\Windows\System32\svchost.exe [3124] 0x10000000
Library \\?\globalroot\systemroot\system32\SKYNETjmiprdql. dll (*** hidden *** ) @ C:\Windows\system32\svchost.exe [3212] 0x10000000
Library \\?\globalroot\systemroot\system32\SKYNETjmiprdql. dll (*** hidden *** ) @ C:\Windows\System32\TUProgSt.exe [3260] 0x10000000
Library \\?\globalroot\systemroot\system32\SKYNETjmiprdql. dll (*** hidden *** ) @ C:\Windows\system32\UAService7.exe [3320] 0x10000000
Library \\?\globalroot\systemroot\system32\SKYNETjmiprdql. dll (*** hidden *** ) @ C:\Windows\System32\svchost.exe [3340] 0x10000000
Library \\?\globalroot\systemroot\system32\SKYNETjmiprdql. dll (*** hidden *** ) @ C:\Windows\system32\SearchIndexer.exe [3376] 0x10000000
Library \\?\globalroot\systemroot\system32\SKYNETjmiprdql. dll (*** hidden *** ) @ C:\Windows\system32\svchost.exe [3580] 0x10000000
Library \\?\globalroot\systemroot\system32\SKYNETjmiprdql. dll (*** hidden *** ) @ C:\Windows\system32\wbem\wmiprvse.exe [3820] 0x10000000
Library \\?\globalroot\systemroot\system32\SKYNETjmiprdql. dll (*** hidden *** ) @ C:\Windows\servicing\TrustedInstaller.exe [4084] 0x10000000
Library \\?\globalroot\systemroot\system32\SKYNETjmiprdql. dll (*** hidden *** ) @ C:\Windows\system32\conime.exe [5616] 0x10000000
Library \\?\globalroot\systemroot\system32\SKYNETjmiprdql. dll (*** hidden *** ) @ C:\Users\casa\Desktop\cosas y demas de mis padres\programas de antispiware\gemmer abnti rookit\gtjrk79q.exe [5880] 0x10000000

---- EOF - GMER 1.0.15 ----

Y para completar el diagnóstico:

Descarga el ESET Smart Installer

º Lo ejecutas

º Marcas las casillas de Eliminar las amenazas detectadas y analizar archivos.

º Haces clic en Configuración adicional y ahi marcas las casillas:

Analizar en busca de aplicaciones potencialmente indeseables,
Analizar en busca de aplicaciones potencialmente peligrosas
Activar la tecnoligía Anti-Stealth.

º Pulsas en Iniciar para que empiece a descargar la base firmas de virus y posteriormente empiece a analizar tu sistema.

Cuando acabe haz clic en Finalizar

º Localizar el reporte en C:\Archivos de programa\ESET\ESET Online Scanner\log

En tu próxima respuesta, pones el reporte generado.

Saludos.

bUENAS TARDES parece que avanzamos he hecho el analisisi con ese y da esto:

ESETSmartInstaller@High as downloader log:
all ok
# version=6
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.5886
# api_version=3.0.2
# EOSSerial=3d761a50ff3ff848b3cadef15c0805d8
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2009-07-06 04:56:19
# local_time=2009-07-06 06:56:19 (+0100, Hora de verano romance)
# country="Spain"
# lang=3082
# osver=6.0.6000 NT
# compatibility_mode=3586 62 60 1 839776893379788
# compatibility_mode=5889 61 66 100 623246712045068
# compatibility_mode=8201 61 100 100 2847824020093
# scanned=141367
# found=1
# cleaned=1
# scan_time=4206
# nod_component=V3 Build:0x30000000
C:\Users\casa\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\CAPITAL DECOR\2C8425F0-0000006E.eml probablemente una variante de Win32/Agent Troyano (contiene archivos infectados) 00000000000000000000000000000000 C


muchas gracias

Bueno...le falta una partecita al final del reporte que pegaste, que es justo donde dice si eliminó o puso en cuarentena esa infección-

De todas maneras, me comentas como funciona tu pc ahora y si sigue saliendo ese alerta que te daba tu antivirus.

salu2

C:\Users\casa\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\CAPITAL DECOR\2C8425F0-0000006E.eml probablemente una variante de Win32/Agent Troyano contiene archivos infectados


es esta de todas las maneras te lo mando otra vez todo lo que ha salido

ESETSmartInstaller@High as downloader log:
all ok
# version=6
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.5886
# api_version=3.0.2
# EOSSerial=3d761a50ff3ff848b3cadef15c0805d8
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2009-07-06 04:56:19
# local_time=2009-07-06 06:56:19 (+0100, Hora de verano romance)
# country="Spain"
# lang=3082
# osver=6.0.6000 NT
# compatibility_mode=3586 62 60 1 839776893379788
# compatibility_mode=5889 61 66 100 623246712045068
# compatibility_mode=8201 61 100 100 2847824020093
# scanned=141367
# found=1
# cleaned=1
# scan_time=4206
# nod_component=V3 Build:0x30000000
C:\Users\casa\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\CAPITAL DECOR\2C8425F0-0000006E.eml probablemente una variante de Win32/Agent Troyano (contiene archivos infectados) 00000000000000000000000000000000 C

Bueno....y solo falta que me digas como va todo ahora....