Troyano que no puedo borrar (kryptic)

Hola!
Bueno a ver, antes de nada quiero aclarar que he hecho todos los pasos que ponia en un post de este foro:
instalar el programa de Malwarebytes, el mensaje de registro no lo pongo porque ya he visto que si no m lo pedis no se puede poner...
he inspeccionado mi pc con CCleaner en modo limpiador y registro y luego he reiniciado en modo seguro y he ejecutado el programa de Malwarebytes, y luego vuelto a pasar el CCleaner....pero mi troyano sigue ahi xq he pasado un escaner con mi antivirus (NOD32) y me lo sigue detectando entonces yo ya no se que hacer, aki os adjunto una imagen para que veais como se llama el troyano...




espero que me podais ayudar

Hola porfavor pega los resultados de MBAM.

Saludos.

Por supuesto! muchas gracias por ser tan rapido!!
lo mas gracioso es que aki en el malwarebytes no me detecta el troyano que sale en la imagen que te adjunto en el anterior post.....
el informe de resgistro es este:

Malwarebytes' Anti-Malware 1.44
Versión de la Base de Datos: 3667
Windows 5.1.2600 Service Pack 3 (Safe Mode)
Internet Explorer 8.0.6001.18702

31/01/2010 18:29:58
mbam-log-2010-01-31 (18-29-58).txt

Tipo de examen : Examen Completo (C:\|D:\|)
Objetos examinados: 245133
Tiempo transcurrido: 2 hour(s), 9 minute(s), 29 second(s)

Procesos en Memoria Infectados: 0
Módulos en Memoria Infectados: 0
Claves del Registro Infectadas: 14
Valores del Registro Infectados: 2
Elementos de Datos del Registro Infectados: 5
Carpetas Infectadas: 7
Ficheros Infectados: 7

Procesos en Memoria Infectados:
(No se han detectado elementos maliciosos)

Módulos en Memoria Infectados:
(No se han detectado elementos maliciosos)

Claves del Registro Infectadas:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Ext\Stats\{00a6faf6-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Ext\Stats\{b69a9db4-d0a1-4722-b56b-f20757a29cdf} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Ext\Settings\{00a6faf6-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Ext\Settings\{b69a9db4-d0a1-4722-b56b-f20757a29cdf} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\Cur rentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\Cur rentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\Cur rentVersion\Explorer\{494e6cec-7483-a4ee-0938-895519a84bc7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explo rer\{19127ad2-394b-70f5-c650-b97867baa1f7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explo rer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explo rer\{494e6cec-7483-a4ee-0938-895519a84bc7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\MADOWN (Worm.Magania) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\FocusInteractive (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Valores del Registro Infectados:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Policies\Explorer\forceclassiccontrolpan el (Hijack.ControlPanelStyle) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\uid (Malware.Trace) -> Quarantined and deleted successfully.

Elementos de Datos del Registro Infectados:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Spyware.Zbot) -> Data: c:\windows\system32\sdra64.exe -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Spyware.Zbot) -> Data: system32\sdra64.exe -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Policies\Explorer\NoSMHelp (Hijack.Help) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Advanced\Folder\Hidden\SHOWALL \CheckedValue (Hijack.System.Hidden) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.Userinit) -> Bad: (C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\syste m32\sdra64.exe,) Good: (Userinit.exe) -> Quarantined and deleted successfully.

Carpetas Infectadas:
C:\Archivos de programa\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Archivos de programa\MyWebSearch\bar (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Archivos de programa\MyWebSearch\bar\1.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Archivos de programa\MyWebSearch\bar\2.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Archivos de programa\MyWebSearch\bar\3.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Archivos de programa\MyWebSearch\bar\Settings (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\lowsec (Stolen.data) -> Delete on reboot.

Ficheros Infectados:
C:\Documents and Settings\HelpAssistant\Configuración local\Temp\uccbki.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
D:\Descargas\Keygen\keygen.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Archivos de programa\MyWebSearch\bar\Settings\s_pid.dat (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\lowsec\local.ds (Stolen.data) -> Delete on reboot.
C:\WINDOWS\system32\lowsec\user.ds (Stolen.data) -> Delete on reboot.
C:\WINDOWS\system32\sdra64.exe (Spyware.Zbot) -> Delete on reboot.
C:\Documents and Settings\Administrador\Configuración local\Temp\ie3.tmp (Trojan.Agent) -> Quarantined and deleted successfully.



espero tu respuesta!!

Hola pues si que tenias virus

Descarga ccleaner que aqui te lo dejo con su manual: Manual de CCleaner.

Pasalo en su opcion limpiador para borrar cookies, temporales, etc. y tambien en su opcion de registro haciendo copia de seguridad.

Has un escan completo con Panda active scan que aqui te lo dejo con su manual: Manual de Panda ActiveScan 2.0.

Saludos.

jajaajaj si hijo si tenia 55 virus pero sq no se porque el NOD32 me decia k tenia solo el troyano este que te digo que no puedo eliminar....stoy pasando el scan del panda que me has dixo ...ahora te digo que tal ha ido la cosa....


editado:

oye esto xq tarda tanto? llevo desde las 12 de la mñn y va aun x el 26% esto es peor que un parto xD

vale ya ha terminado por fin despues de 7 horas y media aqui te dejo los resultados m ha detectado bastantes cosas pero solo me ha borrado 5 xq los otros hay que pagar money!! y mi super troyano mas otros cuantos (muchos) mas siguen ahi....

resultados:

;************************************************* ************************************************** ************************************************** ******************************
ANALYSIS: 2010-02-01 19:24:16
PROTECTIONS: 1
MALWARE: 26
SUSPECTS: 19
;************************************************* ************************************************** ************************************************** ******************************
PROTECTIONS
Description Version Active Updated
;================================================= ================================================== ================================================== ==============================
ESET NOD32 Antivirus 4.0 4.0 Yes Yes
;================================================= ================================================== ================================================== ==============================
MALWARE
Id Description Type Active Severity Disinfectable Disinfected Location
;================================================= ================================================== ================================================== ==============================
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No c:\documents and settings\administrador\cookies\administrador@doubl eclick[2].txt
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No c:\documents and settings\helpassistant\cookies\administrador@doubl eclick[2].txt
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No c:\documents and settings\helpassistant\cookies\administrador@doubl eclick[1].txt
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No c:\documents and settings\administrador\cookies\administrador@doubl eclick[1].txt
00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No c:\documents and settings\administrador\cookies\administrador@atdmt[1].txt
00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No c:\documents and settings\helpassistant\cookies\administrador@atdmt[2].txt
00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No c:\documents and settings\administrador\cookies\administrador@atdmt[3].txt
00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No c:\documents and settings\helpassistant\cookies\administrador@atdmt[1].txt
00145393 Cookie/Tradedoubler TrackingCookie No 0 Yes No c:\documents and settings\helpassistant\cookies\administrador@trade doubler[1].txt
00145393 Cookie/Tradedoubler TrackingCookie No 0 Yes No c:\documents and settings\administrador\cookies\administrador@trade doubler[2].txt
00145393 Cookie/Tradedoubler TrackingCookie No 0 Yes No c:\documents and settings\administrador\cookies\administrador@trade doubler[1].txt
00145405 Cookie/RealMedia TrackingCookie No 0 Yes No c:\documents and settings\helpassistant\cookies\administrador@247re almedia[1].txt
00167704 Cookie/Xiti TrackingCookie No 0 Yes No c:\documents and settings\helpassistant\cookies\administrador@xiti[1].txt
00167753 Cookie/Statcounter TrackingCookie No 0 Yes No c:\documents and settings\helpassistant\cookies\administrador@statc ounter[1].txt
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No c:\documents and settings\helpassistant\cookies\administrador@ad.yi eldmanager[1].txt
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No c:\documents and settings\helpassistant\cookies\administrador@ad.yi eldmanager[2].txt
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No c:\documents and settings\administrador\cookies\administrador@ad.yi eldmanager[1].txt
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No c:\documents and settings\helpassistant\cookies\administrador@ad.yi eldmanager[3].txt
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No c:\documents and settings\administrador\cookies\administrador@ad.yi eldmanager[2].txt
00168076 Cookie/BurstNet TrackingCookie No 0 Yes No c:\documents and settings\helpassistant\cookies\administrador@burst net[2].txt
00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No c:\documents and settings\helpassistant\cookies\administrador@servi ng-sys[2].txt
00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No c:\documents and settings\administrador\cookies\administrador@servi ng-sys[2].txt
00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No c:\documents and settings\administrador\cookies\administrador@servi ng-sys[3].txt
00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No c:\documents and settings\helpassistant\cookies\administrador@servi ng-sys[1].txt
00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No c:\documents and settings\administrador\cookies\administrador@bs.se rving-sys[2].txt
00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No c:\documents and settings\administrador\cookies\administrador@bs.se rving-sys[1].txt
00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No c:\documents and settings\helpassistant\cookies\administrador@bs.se rving-sys[1].txt
00168095 Cookie/888 TrackingCookie No 0 Yes No c:\documents and settings\helpassistant\cookies\administrador@888[2].txt
00168106 Cookie/Weborama TrackingCookie No 0 Yes No c:\documents and settings\helpassistant\cookies\administrador@webor ama[1].txt
00168106 Cookie/Weborama TrackingCookie No 0 Yes No c:\documents and settings\administrador\cookies\administrador@webor ama[1].txt
00168106 Cookie/Weborama TrackingCookie No 0 Yes No c:\documents and settings\administrador\cookies\administrador@webor ama[2].txt
00168109 Cookie/Adtech TrackingCookie No 0 Yes No c:\documents and settings\administrador\cookies\administrador@adtec h[1].txt
00168109 Cookie/Adtech TrackingCookie No 0 Yes No c:\documents and settings\helpassistant\cookies\administrador@adtec h[1].txt
00168114 Cookie/onestat.com TrackingCookie No 0 Yes No c:\documents and settings\helpassistant\cookies\administrador@stat. onestat[2].txt
00169190 Cookie/Advertising TrackingCookie No 0 Yes No c:\documents and settings\helpassistant\cookies\administrador@adver tising[2].txt
00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No c:\documents and settings\helpassistant\cookies\administrador@quest ionmarket[1].txt
00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No c:\documents and settings\helpassistant\cookies\administrador@quest ionmarket[2].txt
00172221 Cookie/Zedo TrackingCookie No 0 Yes No c:\documents and settings\administrador\cookies\administrador@zedo[1].txt
00172221 Cookie/Zedo TrackingCookie No 0 Yes No c:\documents and settings\helpassistant\cookies\administrador@zedo[3].txt
00172221 Cookie/Zedo TrackingCookie No 0 Yes No c:\documents and settings\helpassistant\cookies\administrador@zedo[1].txt
00172221 Cookie/Zedo TrackingCookie No 0 Yes No c:\documents and settings\administrador\cookies\administrador@zedo[2].txt
00172221 Cookie/Zedo TrackingCookie No 0 Yes No c:\documents and settings\helpassistant\cookies\administrador@zedo[2].txt
00172483 Cookie/888 TrackingCookie No 0 Yes No c:\documents and settings\helpassistant\cookies\administrador@int.s itestat[1].txt
00172484 Cookie/Cassava TrackingCookie No 0 Yes No c:\documents and settings\helpassistant\cookies\administrador@int.s itestat[2].txt
00262020 Cookie/Atwola TrackingCookie No 0 Yes No c:\documents and settings\helpassistant\cookies\administrador@atwol a[1].txt
00273339 Cookie/Smartadserver TrackingCookie No 0 Yes No c:\documents and settings\helpassistant\cookies\administrador@smart adserver[1].txt
00402623 trj/sinowal.gen Virus/Trojan No 0 Yes No hkey_local_machine\software\microsoft\windows nt\currentversion\winlogon\userinit
00402623 trj/sinowal.gen Virus/Trojan No 0 Yes No hkey_local_machine\software\microsoft\windows nt\currentversion\winlogon\userinit
01455144 trj/sinowal.win Virus/Trojan No 0 Yes Yes hkey_local_machine\software\microsoft\windows nt\currentversion\winlogon\userinit
02607602 trj/sinowal.wmt Virus/Trojan No 1 Yes Yes c:\windows\system32\sdra64.exe
03074964 Trj/CI.A Virus/Trojan No 0 Yes No c:\windows\system32\userinit.exe
04779562 trj/sinowal.wos Virus/Trojan No 1 Yes Yes c:\windows\system32\lowsec
;================================================= ================================================== ================================================== ==============================
SUSPECTS
Sent Location
;================================================= ================================================== ================================================== ==============================
Yes c:\documents and settings\all users\wordpad\{eeeeeeee-eeee-eeee-eeee-eeeeeeeeeeee}\cftmon.exe
Yes c:\documents and settings\all users\wordpad\{bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb}\cftmon.exe
Yes c:\documents and settings\all users\wordpad\{11111111-1111-1111-1111-111111111111}\cftmon.exe
Yes c:\documents and settings\all users\wordpad\{22222222-2222-2222-2222-222222222222}\cftmon.exe
Yes c:\documents and settings\all users\wordpad\{33333333-3333-3333-3333-333333333333}\cftmon.exe
Yes c:\documents and settings\all users\wordpad\{44444444-4444-4444-4444-444444444444}\cftmon.exe
Yes c:\documents and settings\all users\wordpad\{55555555-5555-5555-5555-555555555555}\cftmon.exe
Yes c:\documents and settings\all users\wordpad\{55555555-5555-5555-5555-555555999999}\cftmon.exe
Yes c:\documents and settings\all users\wordpad\{66666666-6666-6666-6666-666666666666}\cftmon.exe
Yes c:\documents and settings\all users\wordpad\{77777777-7777-7777-7777-777777777777}\cftmon.exe
Yes c:\documents and settings\all users\wordpad\{88888888-8888-8888-8888-888888888888}\cftmon.exe
Yes c:\documents and settings\all users\wordpad\{99999999-9999-9999-9999-999999999999}\cftmon.exe
Yes c:\documents and settings\all users\wordpad\{aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa}\cftmon.exe
Yes c:\documents and settings\all users\wordpad\{ae7cfd11-63ad-bfd2-55ac-6e7b55ff5d82}\cftmon.exe
Yes c:\documents and settings\all users\wordpad\{cccccccc-cccc-cccc-cccc-cccccccccccc}\cftmon.exe
Yes c:\documents and settings\all users\wordpad\{dddddddd-dddd-dddd-dddd-dddddddddddd}\cftmon.exe
Yes c:\documents and settings\all users\wordpad\{ffffffff-ffff-ffff-ffff-ffffffffffff}\cftmon.exe
Yes c:\documents and settings\helpassistant\configuración local\temp\mxcebj.exe
Yes c:\documents and settings\localservice\configuración local\archivos temporales de internet\content.ie5\s9urk5qj\cftmon[1].exe
;================================================= ================================================== ================================================== ==============================
VULNERABILITIES
Id Severity Description
;================================================= ================================================== ================================================== ==============================
;================================================= ================================================== ================================================== ==============================

Hola algunas cosas con el ccleaner te tiene que borrar que son las cookies, para desinfectar eso que tienes pasa el SAS que aqui te lo dejo con su manual: Manual del SUPERAntiSpyware.

Despues de eso pasa el dr web cure-it que aqui te lo dejo, primero has un escan express y despues uno completo, Manual de Dr.Web CureIt!.

Despues de desinfectar pasas el ccleaner como te lo dije.

Y la pregunta grande: ¿Tu antivirus es original o pirata?

Espero tus respuestas.

Saludos.

nu se miantivirus me lo instaló un informatico, que fue el que instaló el windows y tal...x?

voy a hacer lo que me has dixo...x cierto si instalo esto que me has dixo no m dara problemas l antivirus mio???

Hola la verdad que no hay incompatibilidad, otra cosa te pregunte que si es pirata porque si es asi por eso es que tienes muchos virus ya que no defiende como deberia, mira si es falso sabiendo que si le han puesto algo tendras muchos dias de licencia, o que nunca terminara la de prueba.

Aqui esperare esos resultados.

Saludos.

Hola 7_sil_7 Realiza lo siguiente:


En modo normal

• - Descarga ComboFix.exe
  
  • Debes de cambiar el nombre antes de guardarlo en tu escritorio por Combo-Fix

• Desactiva temporalmente el Antivirus y/o Antispyware.
• Cierra todas las ventanas abiertas.
• Da doble clic al archivo ComboFix.exe y sigue las instrucciones.
• Cuando termine, generara un registro en C:\ComboFix.txt.
  • *Nota* Mientras CF este trabajando no mover el mouse ya que pararía su proceso.
  • *Nota* ComboFix puede reiniciar automáticamente el PC para completar el proceso de eliminación.

Pega los reportes de C:\ComboFix.txt