Foro de InfoSpyware - Foro de Hijackthis - Foro de Virus

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 10/25/2009 at 08:25 PM

Application Version : 4.29.1004

Core Rules Database Version : 4189
Trace Rules Database Version: 2103

Scan type       : Complete Scan
Total Scan Time : 02:27:17

Memory items scanned      : 585
Memory threats detected   : 0
Registry items scanned    : 6331
Registry threats detected : 1
File items scanned        : 40312
File threats detected     : 9

Adware.Tracking Cookie
	C:\Documents and Settings\Josemi A\Cookies\josemi_a@bs.serving-sys[2].txt
	C:\Documents and Settings\Josemi A\Cookies\josemi_a@atdmt[2].txt
	C:\Documents and Settings\Josemi A\Cookies\josemi_a@doubleclick[2].txt
	C:\Documents and Settings\Josemi A\Cookies\josemi_a@serving-sys[1].txt

Trojan.DNSChanger-Codec
	HKU\S-1-5-21-3513770044-155041902-282234382-1005\Software\fcn

Trojan.Agent/Gen
	C:\SYSTEM VOLUME INFORMATION\_RESTORE{A1A22DB1-8332-49AA-86F8-E6960C5AC86A}\RP88\A0035211.EXE
	C:\SYSTEM VOLUME INFORMATION\_RESTORE{A1A22DB1-8332-49AA-86F8-E6960C5AC86A}\RP88\A0035232.EXE
	C:\SYSTEM VOLUME INFORMATION\_RESTORE{A1A22DB1-8332-49AA-86F8-E6960C5AC86A}\RP88\A0036243.EXE
	C:\SYSTEM VOLUME INFORMATION\_RESTORE{A1A22DB1-8332-49AA-86F8-E6960C5AC86A}\RP88\A0037243.EXE

Trojan.Dropper/Sys-MS32Clod
	C:\WINDOWS\SYSTEM32\MS32CLOD.DLL

Malwarebytes' Anti-Malware 1.41
Versión de la Base de Datos: 3029
Windows 5.1.2600 Service Pack 3

25/10/2009 23:28:31
mbam-log-2009-10-25 (23-28-31).txt

Tipo de examen : Examen Completo (C:\|D:\|E:\|G:\|)
Objetos examinados: 460137
Tiempo transcurrido: 2 hour(s), 34 minute(s), 36 second(s)

Procesos en Memoria Infectados: 1
Módulos en Memoria Infectados: 0
Claves del Registro Infectadas: 3
Valores del Registro Infectados: 2
Elementos de Datos del Registro Infectados: 2
Carpetas Infectadas: 0
Ficheros Infectados: 5

Procesos en Memoria Infectados:
C:\documents and settings\Josemi A\local settings\application data\bfjvzgb.exe (Adware.Navipromo.H) -> Unloaded process successfully.

Módulos en Memoria Infectados:
(No se han detectado elementos maliciosos)

Claves del Registro Infectadas:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{f62g62bc-4266-43f0-b6ed-9d76c4202c7e} (Generic.Bot.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\fcn (Rogue.Residue) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe (Security.Hijack) -> Quarantined and deleted successfully.

Valores del Registro Infectados:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bfjvzgb (Adware.Navipromo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\rhccu9j0evge (Rogue.AntiVirusXP) -> Quarantined and deleted successfully.

Elementos de Datos del Registro Infectados:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Carpetas Infectadas:
(No se han detectado elementos maliciosos)

Ficheros Infectados:
C:\Documents and Settings\Josemi A\Local Settings\Application Data\bfjvzgb_navps.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
C:\Documents and Settings\Josemi A\Local Settings\Application Data\bfjvzgb_nav.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
C:\Documents and Settings\Josemi A\Local Settings\Application Data\bfjvzgb.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
C:\Documents and Settings\Josemi A\Local Settings\Application Data\bfjvzgb.exe (Adware.Navipromo.H) -> Quarantined and deleted successfully.
G:\System Volume Information\_restore{A1A22DB1-8332-49AA-86F8-E6960C5AC86A}\RP88\A0057788.dll (Malware.Packer.T) -> Quarantined and deleted successfully.