Foro de InfoSpyware - Foro de Hijackthis - Foro de Virus

Hola, con este último reporte ya se solucionó el problema (á é í ó ú). Muchas gracias por perder el tiempo conmigo :-) . Si no es mucha molestia, ¿podrías describirme brevemente lo que me ha pasado? Suelo apuntar las cosas que me pasan, ya sea para evitar que se repita en el futuro o para saber por donde empezar a buscar si alguna vez veo un caso similiar.

De nuevo gracias.

Te pego el reporte

All processes killed
========== REGISTRY ==========
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\\Userinit|"d:\windows\s ystem32\userinit.exe" /E : value set successfully!
========== FILES ==========
D:\WINDOWS\unins000.dat moved successfully.
D:\WINDOWS\unins000.exe moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: calvito
->Temp folder emptied: 53757 bytes
->Temporary Internet Files folder emptied: 1043839 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 48078773 bytes
->Google Chrome cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService
File delete failed. D:\Documents and Settings\LocalService\Configuración local\Temp\Historial\History.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. D:\Documents and Settings\LocalService\Configuración local\Temp\Cookies\index.dat scheduled to be deleted on reboot.
File delete failed. D:\Documents and Settings\LocalService\Configuración local\Temp\Archivos temporales de Internet\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temp folder emptied: 65716 bytes
File delete failed. D:\Documents and Settings\LocalService\Configuración local\Archivos temporales de Internet\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 32902 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
File delete failed. D:\WINDOWS\temp\ZLT01e56.TMP scheduled to be deleted on reboot.
File delete failed. D:\WINDOWS\temp\ZLT02f47.TMP scheduled to be deleted on reboot.
Windows Temp folder emptied: 512 bytes
RecycleBin emptied: 68311 bytes

Total Files Cleaned = 47,09 mb


OTM by OldTimer - Version 3.0.0.6 log created on 11042009_013253

Files moved on Reboot...
File D:\WINDOWS\temp\ZLT01e56.TMP not found!
D:\WINDOWS\temp\ZLT02f47.TMP moved successfully.

Registry entries deleted on Reboot...

retiro lo dicho, tras un reinicio ha vuelto el problema de los acentos `` ´´

Vamos a ver que otra infecció se esconde en el sistema, ya que ese problema es debido a infección. Mientras tanto no uses las aplicasiones P2P como Emule y los otros que tienes.

En modo Normal Realiza un Scan Online con el Panda ActiveScan+Manual y pega el reporte que genere.

No suelo usar P2P casi nada ( y menos para archivos de programas) asi que no hay problema con eso.

Este es el reporte de panda, para variar cada uno dice una cosa distinta ..

;************************************************* ************************************************** ************************************************** ******************************
ANALYSIS: 2009-11-04 20:55:47
PROTECTIONS: 0
MALWARE: 6
SUSPECTS: 3
;************************************************* ************************************************** ************************************************** ******************************
PROTECTIONS
Description Version Active Updated
;================================================= ================================================== ================================================== ==============================
;================================================= ================================================== ================================================== ==============================
MALWARE
Id Description Type Active Severity Disinfectable Disinfected Location
;================================================= ================================================== ================================================== ==============================
00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No d:\documents and settings\calvito\cookies\calvito@atdmt[1].txt
02885963 Rootkit/Booto.C Virus/Worm No 0 Yes No d:\system volume information\_restore{add9b85f-a388-460d-8976-d54b847fc382}\rp367\a0169484.sys
03074964 Trj/CI.A Virus/Trojan No 0 Yes No d:\windows\skypng32.dll
03074964 Trj/CI.A Virus/Trojan No 0 Yes No d:\system volume information\_restore{add9b85f-a388-460d-8976-d54b847fc382}\rp361\a0167604.exe
04338635 Bck/IRCFlood.CW Virus/Trojan Yes 2 Yes No d:\ircap\mirc32.exe
05052586 Generic Trojan Virus/Trojan No 0 No No d:\programas\edicion de video\stream\hidownload pro v6.8 incl keygen-arn.rar[keygen.exe]
05195832 Generic Trojan Virus/Trojan No 0 Yes No d:\programas\sistema\lister directorios\folder list (txt)\folderlist.exe
;================================================= ================================================== ================================================== ==============================
SUSPECTS
Sent Location
;================================================= ================================================== ================================================== ==============================
No d:\emule0.45b-phoenix1.16b-binaries-sources\incoming\x dvd ripper v1.2.1 (full).exe[x dvd ripper v1.2.1\keygen.exe]
No d:\programas\seguridad\kremlins 2.21 & 3.0\kremlins 2.21 & 3.0\kremlin v3.0\crack\keygen.exe
No f:\snes\amstrad\cpce131.zip[cpce95.exe]
;================================================= ================================================== ================================================== ==============================
VULNERABILITIES
Id Severity Description
;================================================= ================================================== ================================================== ==============================
214076 HIGH MS09-059
971486 HIGH MS09-058
214074 HIGH MS09-057
214073 HIGH MS09-056
214072 HIGH MS09-055
214071 HIGH MS09-054
213109 HIGH MS09-046
212494 HIGH MS09-042
212493 HIGH MS09-041
212490 HIGH MS09-038
212530 HIGH MS09-034
211784 HIGH MS09-032
211781 HIGH MS09-029
210625 HIGH MS09-026
210624 HIGH MS09-025
210621 HIGH MS09-022
210618 HIGH MS09-019
208380 HIGH MS09-015
208379 HIGH MS09-014
208378 HIGH MS09-013
208377 HIGH MS09-012
206981 HIGH MS09-007
206980 HIGH MS09-006
201258 HIGH MS08-066
196455 MEDIUM MS08-037
194862 HIGH MS08-032
191616 HIGH MS08-023
191613 HIGH MS08-020
187733 HIGH MS08-008
184380 MEDIUM MS08-002
184379 MEDIUM MS08-001
182046 HIGH MS07-067
179553 HIGH MS07-061
176383 HIGH MS07-058
170904 HIGH MS07-043
164915 HIGH MS07-035
164911 HIGH MS07-031
157261 HIGH MS07-021
157260 HIGH MS07-020
157259 HIGH MS07-019
156477 HIGH MS07-017
150249 HIGH MS07-013
150248 HIGH MS07-012
150247 HIGH MS07-011
150243 HIGH MS07-008
150242 HIGH MS07-007
150241 MEDIUM MS07-006
141033 MEDIUM MS06-075
137571 HIGH MS06-070
133386 MEDIUM MS06-064
133379 HIGH MS06-057
129977 MEDIUM MS06-053
129976 MEDIUM MS06-052
126093 HIGH MS06-051
126092 MEDIUM MS06-050
126087 HIGH MS06-046
126086 MEDIUM MS06-045
126082 HIGH MS06-041
123421 HIGH MS06-036
120825 MEDIUM MS06-032
120818 HIGH MS06-025
120815 HIGH MS06-022
117384 MEDIUM MS06-018
114666 HIGH MS06-015
108744 MEDIUM MS06-008
108743 MEDIUM MS06-007
108742 MEDIUM MS06-006
104567 HIGH MS06-002
96574 HIGH MS05-053
93395 HIGH MS05-051
93454 MEDIUM MS05-049
;================================================= ================================================== ================================================== ==============================

Vamos a elimianr algunas cosas y a descartar otras más..................

Ejecuta la Herramienta OTMoveIt:

• Haz doble clic sobre OTMoveIt.exe para ejecutarlo.
• Asegurate que esté marcado "Unregister Dll's and Ocx's".
• Copia el texto que te dejo en el recuadrado de abajo, y
  pega el texto en el marco izquierdo de OTMoveIt2 llamado "Paste Standard List of Files / Folders to be Moved"

• Pulsa sobre MoveIt!para lanzar la supresión.
• Cuando el resultado aparezca en el marco Results, pulsa en Exit
• Si no reinicia automáticamente, entonces debes Reiniciar (muy importante para eliminar todo)
• Se creará un reporte en C: \ _ OTMoveIt\MovedFiles con la extensión ".log" lo
  buscas y lo dejas en tu siguiente Post.

Dejame ese reporte como antes y también me comentas la situación.

De nuevo se arregló. Voy a reiniciar a ver si continúan los cambios para bien o vuelven a aparecer los dobles acentos como ayer.

Mientras tanto, dejo el reporte.


All processes killed
========== REGISTRY ==========
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\\Userinit|"d:\windows\s ystem32\userinit.exe" /E : value set successfully!
========== FILES ==========
d:\system volume information\_restore{add9b85f-a388-460d-8976-d54b847fc382}\rp367\A0169484.sys moved successfully.
DllUnregisterServer procedure not found in d:\windows\SKYPNG32.DLL
d:\windows\SKYPNG32.DLL NOT unregistered.
d:\windows\SKYPNG32.DLL moved successfully.
d:\system volume information\_restore{add9b85f-a388-460d-8976-d54b847fc382}\rp361\A0167604.exe moved successfully.
d:\ircap\mirc32.exe moved successfully.
d:\programas\edicion de video\stream\Hidownload Pro v6.8 Incl Keygen-Arn.rar moved successfully.
d:\programas\sistema\lister directorios\folder list (txt)\FolderList.exe moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: calvito
->Temp folder emptied: 59893561 bytes
->Temporary Internet Files folder emptied: 975087 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 76773093 bytes
->Google Chrome cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService
File delete failed. D:\Documents and Settings\LocalService\Configuración local\Temp\Historial\History.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. D:\Documents and Settings\LocalService\Configuración local\Temp\Cookies\index.dat scheduled to be deleted on reboot.
File delete failed. D:\Documents and Settings\LocalService\Configuración local\Temp\Archivos temporales de Internet\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temp folder emptied: 65984 bytes
File delete failed. D:\Documents and Settings\LocalService\Configuración local\Archivos temporales de Internet\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
File delete failed. D:\Documents and Settings\NetworkService\Configuración local\Archivos temporales de Internet\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 33170 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
File delete failed. D:\WINDOWS\temp\ZLT04707.TMP scheduled to be deleted on reboot.
File delete failed. D:\WINDOWS\temp\ZLT0470b.TMP scheduled to be deleted on reboot.
Windows Temp folder emptied: 512 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 131,39 mb


OTM by OldTimer - Version 3.0.0.6 log created on 11052009_001609

Files moved on Reboot...
D:\WINDOWS\temp\ZLT04707.TMP moved successfully.
File D:\WINDOWS\temp\ZLT0470b.TMP not found!

Registry entries deleted on Reboot...

Nada, al reiniciar, volvieron los dobles acentos ``´´ (y me acabo de dar cuenta que dobles dieresis ¨¨)

Hola,

La infección que tienes a primera vista en los reportes no se detecta, incluso en el de Panda, asi que mientras pido sugerencias a los otros compañeros del Staff te pido no ejecutar ninguna de las herramientas, nos leemos dentro de no mucho

Ok, ire mirando el tema esperando vuestros consejos.

Muchas gracias

Hi,,

Vamos a revisar un poco más a fondo, con lo siguiente:

Descarga OTL.exe by Oldtimer en el Escritorio

1.-Actualiza MalwareBytes porfavor. (importante actualizarlo)
2.-Descarga Panda USB vaccine
3.-Desactiva tanto Ad-Aware como Spyware Doctor, para que no interfieran.

4.-Conecta cualquier Dispositivo USB (Pendrives, MP3/4, IPod, ..etec) que tengas e Instala USB Vaccine. Durante la instalación:

• Activa la casilla de vacunar automaticamente dispostivos usb detectados
• Al finalizar la instalación, Selecciona:
• Vacuna PC y Vacunaciónde Dispositivos USB

5.-Sin retirar los dispositivos usb, procede a escanear con MalwareBytes en su opcción de examen completo, dejas el reporte al finalizar.


6.-Luego del reinicio, Ejecuta OTL con Double click sobre su ícono y solo configura lo siguiente dejando lo demas por default:

1. Activa la casilla de "Scan All Users"
2. Activa la casilla de "Skip Microsoft Files"
3. Cambia a Safe List, donde dice Extra Registry
4. Pulsa el Botón Run Scan
5. Al finalizar, dos reportes se abriran, copia y pega solamente el de nombre:

OTListIt.txt <-- (este es el que veras automaticamnte al finalizar)