Foro de InfoSpyware - Foro de Hijackthis - Foro de Virus

Hola mi pagina de myspace se trava mucho no puedo hacer casi nada
cuando quiero responder un comment o mensaje dura mucho y me dice q hay un error y lo cancelo por que se traba mucho y estuve investigando y al parecer tiene un virus pero no se cual de estos dos sea :JS.Qspace o Net-Worm.Win32.Koobface (A y B) y kiero eliminarlos y ademas en mi computadora salen muchas paginas de publicidad que antes no salian y se abren muchas paginas de internet de la nada.!!


Necesito ayuda alguien me podria ayudar??

Hola jeipi, bienvenido al Foro de Infospyware!

.- Procura introducir el mensaje o el tema en el Foro adecuado, así como un nivel aceptable de ortografía y gramática. Evita el uso de abreviaciones y la inclusión de términos codificados, te recordamos que al hacerlo dificultas que tu mensaje pueda ser respondido por la falta de claridad.

• Políticas del Foro de InfoSpyware
• Consejos para antes de publicar un nuevo mensaje
• FAQs de Problemas con el Foro

Como bien dice el tema de Koobface en Facebook, primero de todo realiza estos pasos y posteriormente verificaremos, si es que realmente hay infección, si ha desaparecido por completo. Sigue estos pasos:

Primero de todo, descarga estas herramientas:

• Superantispyware
• Malwarebyte's Antimalware
• Dr Web Cure It
• CCleaner

Apaga Restaurar Sistema.

Inicia el PC a Modo a prueba de fallos (Modo seguro).

Ejecuta SuperAntispyware. Realiza un examen completo y manda a cuarentena todo lo que este encuentre.

Ejecuta la herramienta Malwarebyte's dándole a Quitar lo Seleccionado para proceder a la desinfección del equipo en caso de que te encontrara alguna infección y posteriormente nos pegas aquí en este mismo tema el análisis.

También, descarga y ejecuta Dr Web Cure It haciendo un escaneo completo del PC y eliminando todas las infecciones que te encuentre.

Ejecuta por último CCleaner en su opción de "Limpiador" para borrar cookies, temporales de Internet y todos los archivos que este te muestre como obsoletos, y luego usar su opción de "Registro" para limpiar todo el registro de Windows (haciendo copia de seguridad). Ejecuta el programa tantas veces haga falta hasta que ya no te aparezca nada por eliminar.

Finalmente, nos pegas aquí el reporte que te genere Malwarebyte's y coméntanos el reporte de Dr. Web Cure-IT.

*NOTAS* cualquier duda sobre el uso de ambos programas la puedes solventar fácilmente ya que en los links que te pasé se encuentran los Manuales de los programas.
Si no puedes realizar alguno de los pasos sáltalo y continúa.
Puedes imprimir los pasos para que sea más fácil seguirlos.

Ya nos comentas!

Salu2

Malwarebytes' Anti-Malware 1.41
Versión de la Base de Datos: 3109
Windows 5.1.2600 Service Pack 2

11/6/2009 1:32:37 AM
mbam-log-2009-11-06 (01-32-37).txt

Tipo de examen : Examen Completo (C:\|D:\|K:\|)
Objetos examinados: 292111
Tiempo transcurrido: 1 hour(s), 28 minute(s), 14 second(s)

Procesos en Memoria Infectados: 0
Módulos en Memoria Infectados: 1
Claves del Registro Infectadas: 28
Valores del Registro Infectados: 5
Elementos de Datos del Registro Infectados: 3
Carpetas Infectadas: 15
Ficheros Infectados: 27

Procesos en Memoria Infectados:
(No se han detectado elementos maliciosos)

Módulos en Memoria Infectados:
c:\WINDOWS\system32\kebajuvi.dll (Trojan.Vundo.H) -> Delete on reboot.

Claves del Registro Infectadas:
HKEY_CLASSES_ROOT\CLSID\{cbb0b5db-6da8-4bee-8e4a-ed883c0b1813} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CLASSES_ROOT\shoppingreport.hbax (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport.hbax.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport.hbinfoband (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport.hbinfoband.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport.iebutton (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport.iebutton.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport.iebuttona (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport.iebuttona.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport.rprtctrl (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport.rprtctrl.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{8ad9ad05-36be-4e40-ba62-5422eb0d02fb} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{aebf09e2-0c15-43c8-99bf-928c645d98a0} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{d8560ac2-21b5-4c1a-bdd4-bd12bc83b082} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{100eb1fd-d03e-47fd-81f3-ee91287f9465} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{20ea9658-6bc3-4599-a87d-6371fe9295fc} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a16ad1e9-f69a-45af-9462-b1c286708842} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a7cddcdc-beeb-4685-a062-978f5e07ceee} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c9ccbb35-d123-4a31-affc-9b2933132116} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{cdca70d8-c6a6-49ee-9bed-7429d6c477a2} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{d136987f-e1c4-4ccc-a220-893df03ec5df} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{e343edfc-1e6c-4cb5-aa29-e9c922641c80} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Ext\Stats\{100eb1fd-d03e-47fd-81f3-ee91287f9465} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Ext\Stats\{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Ext\Stats\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\shoppingreport (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\ShoppingReport (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\ShoppingReport (Adware.ShopperReports) -> Quarantined and deleted successfully.

Valores del Registro Infectados:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run\japegetej (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\SharedTaskScheduler\{cbb0b5db-6da8-4bee-8e4a-ed883c0b1813} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\ShellServiceObjectDelayLoad\tipimiruy (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.ShopperReports) -> Quarantined and deleted successfully.

Elementos de Datos del Registro Infectados:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: c:\windows\system32\kebajuvi.dll -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: system32\kebajuvi.dll -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Carpetas Infectadas:
C:\Documents and Settings\All Users\Application Data\00048500 (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\05821203 (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrator\Application Data\ShoppingReport (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrator\Application Data\ShoppingReport\cs (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrator\Application Data\ShoppingReport\cs\db (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrator\Application Data\ShoppingReport\cs\dwld (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrator\Application Data\ShoppingReport\cs\report (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrator\Application Data\ShoppingReport\cs\res2 (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files\Common Files\Uninstall\PersonalAV (Rogue.PersonalAntiVirus) -> Quarantined and deleted successfully.
C:\Program Files\PersonalAV (Rogue.PersonalAntiVirus) -> Quarantined and deleted successfully.
C:\Program Files\ShoppingReport (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files\ShoppingReport\Bin (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files\ShoppingReport\Bin\2.6.56 (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\RECYCLER\S-1-5-21-0243636035-3055115376-381863306-1556 (TrojanProxy.Slenugga) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Start Menu\PersonalAV (Rogue.PersonalAntiVirus) -> Quarantined and deleted successfully.

Ficheros Infectados:
c:\WINDOWS\system32\kebajuvi.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP158\A0023090.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP158\A0023118.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP158\A0023139.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\pularewi.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\gawodara.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\nukavuso.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\tugokubu.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\05821203\05821203.glu (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\05821203\pc05821203cnf (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\05821203\pc05821203ins (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrator\Application Data\ShoppingReport\cs\Config.xml (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrator\Application Data\ShoppingReport\cs\db\Aliases.dbs (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrator\Application Data\ShoppingReport\cs\db\Sites.dbs (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrator\Application Data\ShoppingReport\cs\dwld\WhiteList.xip (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrator\Application Data\ShoppingReport\cs\report\aggr_storage.xml (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrator\Application Data\ShoppingReport\cs\report\send_storage.xml (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrator\Application Data\ShoppingReport\cs\res2\WhiteList.dbs (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files\Common Files\Uninstall\PersonalAV\Uninstall.lnk (Rogue.PersonalAntiVirus) -> Quarantined and deleted successfully.
C:\Program Files\ShoppingReport\Uninst.exe (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\RECYCLER\S-1-5-21-0243636035-3055115376-381863306-1556\Desktop.ini (TrojanProxy.Slenugga) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Start Menu\PersonalAV\Personal Antivirus.lnk (Rogue.PersonalAntiVirus) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Start Menu\PersonalAV\Uninstall.lnk (Rogue.PersonalAntiVirus) -> Quarantined and deleted successfully.
C:\fkajlvl.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\010112010146118114.dat (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\WINDOWS\0101120101464849.dat (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\WINDOWS\934fdfg34fgjf23 (Worm.KoobFace) -> Quarantined and deleted successfully.

Malwarebyte's Antimalware ya se encargó de poner casi todas las infecciones en cuarentena
Para que acabe de eliminar todo aquello que encontró debes reiniciar el PC.

Ejecutaste posteriormente Dr. Web Cure It y CCleaner tal y como te dije?

Ya nos comentas!

Salu2

Si ya ejecute Dr. Web y me escaneo 3 virus troyanos y algunos otros en total eran 14 y los guarde en una carpeta.
y lo q sucedió con el malwarebytes copie solo esto por que me pedía que reiniciara la computadora y cuando volví a abrir el programa estaban los demás virus en cuarentena y los quería eliminar y le di a la opción borrar no pasa nada si hice esto.??

jeipi, entonces si ya ejecutaste todos los programas y las infecciones fueron llevadas a cuarentena y también eliminadas... como va ahora el funcionamiento del PC?

Página de Myspace? Páginas de publicidad siguen saliendo? Lentitud del sistema?

Ya nos comentas!

Salu2