estimados pase el kaspery , hice todo lo que recomiendan para desacerce de virus y trojanos, pero el trojan horse Cliker.FR no es eliminado, y me sale un cartel constantemente avisando que lo tengo en el directorio de windows system 32 en unas cuantas entradas que les dejo para que vean, trate de borrarlos con killbi el programa que recomiendan y no me lo permite:
<history>
<!-- 01c69f98609e72c0 -->
<rec time="2006/06/16 18:38:02" user="SYSTEM" source="Update">
<value>@HL_UpdateOK</value>
<attr name="version">avi:763-752;iavi:375-352;</attr>
</rec>
<rec time="2006/06/16 18:41:25" user="juanmanuel" source="General">
<value>@HL_TestStarted</value>
<attr name="testname">@TestName_02</attr>
</rec>
<rec time="2006/06/16 18:44:07" user="juanmanuel" source="General">
<value>@HL_TestStopped</value>
<attr name="testname">@TestName_02</attr>
<attr name="infectedfiles">0</attr>
</rec>
<rec time="2006/06/16 19:25:44" user="juanmanuel" source="General">
<value>@HL_TestStarted</value>
<attr name="testname">@TestName_02</attr>
</rec>
<rec time="2006/06/16 20:22:44" user="juanmanuel" source="General">
<value>@HL_TestEnded</value>
<attr name="testname">@TestName_02</attr>
<attr name="infectedfiles">0</attr>
</rec>
<rec time="2006/06/16 21:03:15" user="juanmanuel" source="General">
<value>@HL_TestStarted</value>
<attr name="testname">@TestName_02</attr>
</rec>
<rec time="2006/06/16 21:03:19" user="juanmanuel" source="General">
<value>@HL_TestStopped</value>
<attr name="testname">@TestName_02</attr>
<attr name="infectedfiles">0</attr>
</rec>
<rec time="2006/06/19 13:30:05" user="SYSTEM" source="Update">
<value>@HL_UpdateOK</value>
<attr name="version">avi:764-763;iavi:376-375;</attr>
</rec>
<rec time="2006/06/22 08:49:34" user="SYSTEM" source="Update">
<value>@HL_UpdateOK</value>
<attr name="version">avi:765-764;iavi:379-376;</attr>
</rec>
<rec time="2006/06/23 13:28:29" user="juanmanuel" source="General">
<value>@HL_TestStarted</value>
<attr name="testname">@TestName_12</attr>
</rec>
<rec time="2006/06/23 13:28:30" user="juanmanuel" source="General">
<value>@HL_TestEnded</value>
<attr name="testname">@TestName_12</attr>
<attr name="infectedfiles">0</attr>
</rec>
<rec time="2006/06/24 13:15:51" user="SYSTEM" source="Update">
<value>@HL_UpdateOK</value>
<attr name="version">avi:766-765;iavi:381-379;</attr>
</rec>
<rec time="2006/06/25 14:52:18" user="SYSTEM" source="Update">
<value>@HL_UpdateOK</value>
<attr name="version">avi:767-766;iavi:382-381;</attr>
</rec>
<rec time="2006/06/27 11:43:59" user="SYSTEM" source="Update">
<value>@HL_UpdateOK</value>
<attr name="version">avi:768-767;iavi:383-382;</attr>
</rec>
<rec time="2006/06/28 07:26:09" user="SYSTEM" source="Update">
<value>@HL_UpdateOK</value>
<attr name="version">iavi:384-383;</attr>
</rec>
<rec time="2006/06/28 08:00:04" user="SYSTEM" source="General">
<value>@HL_TestStarted</value>
<attr name="testname">@TestName_02</attr>
</rec>
<rec time="2006/06/28 08:03:42" user="SYSTEM" source="Virus">
<value>@HL_ReportFind</value>
<attr name="where">C:\Documents and Settings\juanmanuel\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\cou nt.jar-207f7f25-2538a410.zip</attr>
<attr name="type">@EID_Id_vir</attr>
<attr name="what">Java/ByteVerify</attr>
</rec>
<rec time="2006/06/28 08:05:20" user="SYSTEM" source="Virus">
<value>@HL_ReportFind</value>
<attr name="where">C:\Documents and Settings\juanmanuel\Local Settings\Temporary Internet Files\Content.IE5\0PURKD2N\sploit[1].anr</attr>
<attr name="type">@EID_Id_vir</attr>
<attr name="what">Exploit.MS05-002</attr>
</rec>
<rec time="2006/06/28 08:19:47" user="SYSTEM" source="General">
<value>@HL_TestEnded</value>
<attr name="testname">@TestName_02</attr>
<attr name="infectedfiles">4</attr>
</rec>
<rec time="2006/06/28 08:19:48" user="SYSTEM" source="Virus">
<value>@HL_ActionTaken</value>
<attr name="filename">C:\Documents and Settings\juanmanuel\Local Settings\Temporary Internet Files\Content.IE5\0PURKD2N\sploit[1].anr</attr>
<attr name="action">@HL_ActCleaned</attr>
</rec>
<rec time="2006/06/28 08:20:52" user="juanmanuel" source="General">
<value>@HL_TestStarted</value>
<attr name="testname">@TestName_02</attr>
</rec>
<rec time="2006/06/28 08:21:13" user="juanmanuel" source="General">
<value>@HL_TestStopped</value>
<attr name="testname">@TestName_02</attr>
<attr name="infectedfiles">0</attr>
</rec>
<rec time="2006/06/28 08:24:36" user="juanmanuel" source="General">
<value>@HL_TestStarted</value>
<attr name="testname">@TestName_12</attr>
</rec>
<rec time="2006/06/28 08:24:36" user="juanmanuel" source="General">
<value>@HL_TestEnded</value>
<attr name="testname">@TestName_12</attr>
<attr name="infectedfiles">0</attr>
</rec>
<rec time="2006/06/28 10:09:08" user="juanmanuel" source="General">
<value>@HL_TestStarted</value>
<attr name="testname">@TestName_12</attr>
</rec>
<rec time="2006/06/28 10:09:08" user="juanmanuel" source="General">
<value>@HL_TestEnded</value>
<attr name="testname">@TestName_12</attr>
<attr name="infectedfiles">0</attr>
</rec>
<rec time="2006/06/29 08:00:04" user="SYSTEM" source="General">
<value>@HL_TestStarted</value>
<attr name="testname">@TestName_02</attr>
</rec>
<rec time="2006/06/29 08:00:31" user="SYSTEM" source="General">
<value>@HL_TestStopped</value>
<attr name="testname">@TestName_02</attr>
<attr name="infectedfiles">0</attr>
</rec>
<rec time="2006/06/29 08:51:30" user="SYSTEM" source="Update">
<value>@HL_UpdateOK</value>
<attr name="version">avi:769-768;iavi:385-384;</attr>
</rec>
<rec time="2006/06/30 09:36:34" user="SYSTEM" source="Update">
<value>@HL_UpdateOK</value>
<attr name="version">avi:771-769;iavi:387-385;</attr>
</rec>
<rec time="2006/07/01 17:55:56" user="SYSTEM" source="Update">
<value>@HL_UpdateOK</value>
<attr name="version">avi:772-771;iavi:388-387;</attr>
</rec>
<rec time="2006/07/03 21:50:21" user="SYSTEM" source="Update">
<value>@HL_UpdateOK</value>
<attr name="version">iavi:389-388;</attr>
</rec>
<rec time="2006/07/04 11:33:04" user="juanmanuel" source="Virus">
<value>@HL_ReportFindRS</value>
<attr name="filename">C:\WINDOWS\system32\{C7BEB2F1-7FAC-4795-AD5E-98B9DA87428D}.exe</attr>
<attr name="finding">@EID_Id_trj</attr>
<attr name="virusname">Clicker.FR</attr>
</rec>
<rec time="2006/07/04 11:33:19" user="juanmanuel" source="Virus">
<value>@HL_ActionTaken</value>
<attr name="filename">C:\WINDOWS\system32\{C7BEB2F1-7FAC-4795-AD5E-98B9DA87428D}.exe</attr>
<attr name="action">@HL_ActCleaned</attr>
</rec>
<rec time="2006/07/04 11:39:33" user="juanmanuel" source="Virus">
<value>@HL_ReportFindRS</value>
<attr name="filename">C:\WINDOWS\system32\{F3C41B35-FE12-4C2F-ADCD-47A1AA9178C4}.exe</attr>
<attr name="finding">@EID_Id_trj</attr>
<attr name="virusname">Clicker.FR</attr>
</rec>
<rec time="2006/07/04 11:39:42" user="juanmanuel" source="Virus">
<value>@HL_ActionTaken</value>
<attr name="filename">C:\WINDOWS\system32\{F3C41B35-FE12-4C2F-ADCD-47A1AA9178C4}.exe</attr>
<attr name="action">@HL_ActCleaned</attr>
</rec>
<rec time="2006/07/04 11:40:01" user="juanmanuel" source="General">
<value>@HL_TestStarted</value>
<attr name="testname">@TestName_02</attr>
</rec>
<rec time="2006/07/04 11:40:05" user="juanmanuel" source="General">
<value>@HL_TestEnded</value>
<attr name="testname">@TestName_02</attr>
<attr name="infectedfiles">0</attr>
</rec>
<rec time="2006/07/04 11:40:13" user="juanmanuel" source="General">
<value>@HL_TestStarted</value>
<attr name="testname">@TestName_02</attr>
</rec>
<rec time="2006/07/04 11:45:52" user="juanmanuel" source="Virus">
<value>@HL_ReportFindRS</value>
<attr name="filename">C:\WINDOWS\system32\{B014BF26-9301-4B84-84D6-669AF0AAD603}.exe</attr>
<attr name="finding">@EID_Id_trj</attr>
<attr name="virusname">Clicker.FR</attr>
</rec>
<rec time="2006/07/04 11:52:09" user="juanmanuel" source="Virus">
<value>@HL_ReportFindRS</value>
<attr name="filename">C:\WINDOWS\system32\{1B521B9A-CDFD-4B47-8A96-EFE4600C96E8}.exe</attr>
<attr name="finding">@EID_Id_trj</attr>
<attr name="virusname">Clicker.FR</attr>
</rec>
<rec time="2006/07/04 11:52:29" user="juanmanuel" source="Virus">
<value>@HL_ActionTaken</value>
<attr name="filename">C:\WINDOWS\system32\{1B521B9A-CDFD-4B47-8A96-EFE4600C96E8}.exe</attr>
<attr name="action">@HL_ActCleaned</attr>
</rec>
<rec time="2006/07/04 11:56:53" user="juanmanuel" source="General">
<value>@HL_TestStopped</value>
<attr name="testname">@TestName_02</attr>
<attr name="infectedfiles">0</attr>
</rec>
<rec time="2006/07/04 11:57:28" user="juanmanuel" source="General">
<value>@HL_TestStarted</value>
<attr name="testname">@TestName_13</attr>
</rec>
<rec time="2006/07/04 11:58:27" user="juanmanuel" source="Virus">
<value>@HL_ReportFindRS</value>
<attr name="filename">C:\WINDOWS\system32\{1F832F98-4B41-43CE-8BDA-ADE2EF7E58D4}.exe</attr>
<attr name="finding">@EID_Id_trj</attr>
<attr name="virusname">Clicker.FR</attr>
</rec>
<rec time="2006/07/04 11:58:46" user="juanmanuel" source="Virus">
<value>@HL_ActionTaken</value>
<attr name="filename">C:\WINDOWS\system32\{1F832F98-4B41-43CE-8BDA-ADE2EF7E58D4}.exe</attr>
<attr name="action">@HL_ActVVInserted</attr>
</rec>
<rec time="2006/07/04 12:00:35" user="juanmanuel" source="General">
<value>@HL_TestStopped</value>
<attr name="testname">@TestName_13</attr>
<attr name="infectedfiles">0</attr>
</rec>
<rec time="2006/07/04 12:08:52" user="juanmanuel" source="Virus">
<value>@HL_ReportFindRS</value>
<attr name="filename">C:\WINDOWS\system32\{9F863143-08E3-4DAC-9FA3-6DE8E5DA4FB7}.exe</attr>
<attr name="finding">@EID_Id_trj</attr>
<attr name="virusname">Clicker.FR</attr>
</rec>
<rec time="2006/07/04 12:08:59" user="juanmanuel" source="Virus">
<value>@HL_ReportFindRS</value>
<attr name="filename">C:\WINDOWS\system32\{9F863143-08E3-4DAC-9FA3-6DE8E5DA4FB7}.exe</attr>
<attr name="finding">@EID_Id_trj</attr>
<attr name="virusname">Clicker.FR</attr>
</rec>
<rec time="2006/07/04 12:09:31" user="juanmanuel" source="Virus">
<value>@HL_ReportFindRS</value>
<attr name="filename">C:\WINDOWS\system32\{9F863143-08E3-4DAC-9FA3-6DE8E5DA4FB7}.exe</attr>
<attr name="finding">@EID_Id_trj</attr>
<attr name="virusname">Clicker.FR</attr>
</rec>
<rec time="2006/07/04 1202" user="juanmanuel" source="Virus">
<value>@HL_ReportFindRS</value>
<attr name="filename">C:\WINDOWS\system32\{9F863143-08E3-4DAC-9FA3-6DE8E5DA4FB7}.exe</attr>
<attr name="finding">@EID_Id_trj</attr>
<attr name="virusname">Clicker.FR</attr>
</rec>
<rec time="2006/07/04 12:15:10" user="juanmanuel" source="Virus">
<value>@HL_ReportFindRS</value>
<attr name="filename">C:\WINDOWS\system32\{848AD839-1C99-4C9F-8D08-B0B3D1F79B6C}.exe</attr>
<attr name="finding">@EID_Id_trj</attr>
<attr name="virusname">Clicker.FR</attr>
</rec>
<rec time="2006/07/04 12:15:12" user="juanmanuel" source="Virus">
<value>@HL_ReportFindRS</value>
<attr name="filename">C:\WINDOWS\system32\{848AD839-1C99-4C9F-8D08-B0B3D1F79B6C}.exe</attr>
<attr name="finding">@EID_Id_trj</attr>
<attr name="virusname">Clicker.FR</attr>
</rec>
<rec time="2006/07/04 12:15:45" user="juanmanuel" source="Virus">
<value>@HL_ReportFindRS</value>
<attr name="filename">C:\WINDOWS\system32\{848AD839-1C99-4C9F-8D08-B0B3D1F79B6C}.exe</attr>
<attr name="finding">@EID_Id_trj</attr>
<attr name="virusname">Clicker.FR</attr>
</rec>
<rec time="2006/07/04 12:21:34" user="juanmanuel" source="Virus">
<value>@HL_ReportFindRS</value>
<attr name="filename">C:\WINDOWS\system32\{0E6ADB78-815C-4811-95DA-FC3CAB3B01F3}.exe</attr>
<attr name="finding">@EID_Id_trj</attr>
<attr name="virusname">Clicker.FR</attr>
</rec>
<rec time="2006/07/04 12:21:38" user="juanmanuel" source="Virus">
<value>@HL_ReportFindRS</value>
<attr name="filename">C:\WINDOWS\system32\{0E6ADB78-815C-4811-95DA-FC3CAB3B01F3}.exe</attr>
<attr name="finding">@EID_Id_trj</attr>
<attr name="virusname">Clicker.FR</attr>
</rec>
<rec time="2006/07/04 12:27:53" user="juanmanuel" source="Virus">
<value>@HL_ReportFindRS</value>
<attr name="filename">C:\WINDOWS\system32\{ED457918-5EE8-4B6C-91F7-B346A0581E05}.exe</attr>
<attr name="finding">@EID_Id_trj</attr>
<attr name="virusname">Clicker.FR</attr>
</rec>
<rec time="2006/07/04 14:14:23" user="juanmanuel" source="Virus">
<value>@HL_ReportFindRS</value>
<attr name="filename">C:\WINDOWS\system32\{98AF23F1-BCC3-47C4-903B-8DD0342C40CA}.exe</attr>
<attr name="finding">@EID_Id_trj</attr>
<attr name="virusname">Clicker.FR</attr>
</rec>
<rec time="2006/07/04 14:14:28" user="juanmanuel" source="Virus">
<value>@HL_ReportFindRS</value>
<attr name="filename">C:\WINDOWS\system32\{98AF23F1-BCC3-47C4-903B-8DD0342C40CA}.exe</attr>
<attr name="finding">@EID_Id_trj</attr>
<attr name="virusname">Clicker.FR</attr>
</rec>
<rec time="2006/07/04 14:15:00" user="juanmanuel" source="Virus">
<value>@HL_ReportFindRS</value>
<attr name="filename">C:\WINDOWS\system32\{98AF23F1-BCC3-47C4-903B-8DD0342C40CA}.exe</attr>
<attr name="finding">@EID_Id_trj</attr>
<attr name="virusname">Clicker.FR</attr>
</rec>
<rec time="2006/07/04 14:15:32" user="juanmanuel" source="Virus">
<value>@HL_ReportFindRS</value>
<attr name="filename">C:\WINDOWS\system32\{98AF23F1-BCC3-47C4-903B-8DD0342C40CA}.exe</attr>
<attr name="finding">@EID_Id_trj</attr>
<attr name="virusname">Clicker.FR</attr>
</rec>
<rec time="2006/07/04 14:16:04" user="juanmanuel" source="Virus">
<value>@HL_ReportFindRS</value>
<attr name="filename">C:\WINDOWS\system32\{98AF23F1-BCC3-47C4-903B-8DD0342C40CA}.exe</attr>
<attr name="finding">@EID_Id_trj</attr>
<attr name="virusname">Clicker.FR</attr>
</rec>
<rec time="2006/07/04 14:16:35" user="juanmanuel" source="Virus">
<value>@HL_ReportFindRS</value>
<attr name="filename">C:\WINDOWS\system32\{98AF23F1-BCC3-47C4-903B-8DD0342C40CA}.exe</attr>
<attr name="finding">@EID_Id_trj</attr>
<attr name="virusname">Clicker.FR</attr>
</rec>
<rec time="2006/07/04 14:20:42" user="juanmanuel" source="Virus">
<value>@HL_ReportFindRS</value>
<attr name="filename">C:\WINDOWS\system32\{69507A76-490C-4BAF-B7D7-7D5DA69ADD5D}.exe</attr>
<attr name="finding">@EID_Id_trj</attr>
<attr name="virusname">Clicker.FR</attr>
</rec>
<rec time="2006/07/04 14:24:29" user="juanmanuel" source="Virus">
<value>@HL_ReportFindRS</value>
<attr name="filename">C:\WINDOWS\system32\{F8CB08D6-F8ED-4B4F-A99E-3C1ADADC93FB}.exe</attr>
<attr name="finding">@EID_Id_trj</attr>
<attr name="virusname">Clicker.FR</attr>
</rec>
<rec time="2006/07/04 14:24:32" user="juanmanuel" source="Virus">
<value>@HL_ReportFindRS</value>
<attr name="filename">C:\WINDOWS\system32\{F8CB08D6-F8ED-4B4F-A99E-3C1ADADC93FB}.exe</attr>
<attr name="finding">@EID_Id_trj</attr>
<attr name="virusname">Clicker.FR</attr>
</rec>
<rec time="2006/07/04 14:25:03" user="juanmanuel" source="Virus">
<value>@HL_ReportFindRS</value>
<attr name="filename">C:\WINDOWS\system32\{F8CB08D6-F8ED-4B4F-A99E-3C1ADADC93FB}.exe</attr>
<attr name="finding">@EID_Id_trj</attr>
<attr name="virusname">Clicker.FR</attr>
</rec>
<rec time="2006/07/04 14:25:35" user="juanmanuel" source="Virus">
<value>@HL_ReportFindRS</value>
<attr name="filename">C:\WINDOWS\system32\{F8CB08D6-F8ED-4B4F-A99E-3C1ADADC93FB}.exe</attr>
<attr name="finding">@EID_Id_trj</attr>
<attr name="virusname">Clicker.FR</attr>
</rec>
<rec time="2006/07/04 14:30:47" user="juanmanuel" source="Virus">
<value>@HL_ReportFindRS</value>
<attr name="filename">C:\WINDOWS\system32\{6B3066DE-2360-46E0-AD25-62DB791E3820}.exe</attr>
<attr name="finding">@EID_Id_trj</attr>
<attr name="virusname">Clicker.FR</attr>
</rec>
<rec time="2006/07/04 14:37:05" user="juanmanuel" source="Virus">
<value>@HL_ReportFindRS</value>
<attr name="filename">C:\WINDOWS\system32\{C5B89E8F-7861-4BB2-9A13-1833AA0AD181}.exe</attr>
<attr name="finding">@EID_Id_trj</attr>
<attr name="virusname">Clicker.FR</attr>
</rec>
<rec time="2006/07/04 14:43:22" user="juanmanuel" source="Virus">
<value>@HL_ReportFindRS</value>
<attr name="filename">C:\WINDOWS\system32\{E19D7C86-07F0-4195-8CD7-F53DD5CA5248}.exe</attr>
<attr name="finding">@EID_Id_trj</attr>
<attr name="virusname">Clicker.FR</attr>
</rec>
<rec time="2006/07/04 14:49:47" user="juanmanuel" source="Virus">
<value>@HL_ReportFindRS</value>
<attr name="filename">C:\WINDOWS\system32\{3B8117C2-E77C-44A2-AF94-6C9C966D15C8}.exe</attr>
<attr name="finding">@EID_Id_trj</attr>
<attr name="virusname">Clicker.FR</attr>
</rec>
<rec time="2006/07/04 14:56:05" user="juanmanuel" source="Virus">
<value>@HL_ReportFindRS</value>
<attr name="filename">C:\WINDOWS\system32\{D66EBF60-6281-4482-962A-A12B2C038382}.exe</attr>
<attr name="finding">@EID_Id_trj</attr>
<attr name="virusname">Clicker.FR</attr>
</rec>
<rec time="2006/07/04 15:02:48" user="juanmanuel" source="Virus">
<value>@HL_ReportFindRS</value>
<attr name="filename">C:\WINDOWS\system32\{8F0D4BCA-5AAD-47F4-A533-C028D3DE36B5}.exe</attr>
<attr name="finding">@EID_Id_trj</attr>
<attr name="virusname">Clicker.FR</attr>
</rec>
<rec time="2006/07/04 15:27:23" user="juanmanuel" source="Virus">
<value>@HL_ReportFindRS</value>
<attr name="filename">C:\WINDOWS\system32\{9F863143-08E3-4DAC-9FA3-6DE8E5DA4FB7}.exe</attr>
<attr name="finding">@EID_Id_trj</attr>
<attr name="virusname">Clicker.FR</attr>
</rec>
<rec time="2006/07/04 15:27:26" user="juanmanuel" source="Virus">
<value>@HL_ReportFindRS</value>
<attr name="filename">C:\WINDOWS\system32\{9F863143-08E3-4DAC-9FA3-6DE8E5DA4FB7}.exe</attr>
<attr name="finding">@EID_Id_trj</attr>
<attr name="virusname">Clicker.FR</attr>
</rec>
<rec time="2006/07/04 15:28:05" user="juanmanuel" source="Virus">
<value>@HL_ReportFindRS</value>
<attr name="filename">C:\WINDOWS\system32\{9F863143-08E3-4DAC-9FA3-6DE8E5DA4FB7}.exe</attr>
<attr name="finding">@EID_Id_trj</attr>
<attr name="virusname">Clicker.FR</attr>
</rec>
<rec time="2006/07/04 15:28:07" user="juanmanuel" source="Virus">
<value>@HL_ReportFindRS</value>
<attr name="filename">C:\WINDOWS\system32\{9F863143-08E3-4DAC-9FA3-6DE8E5DA4FB7}.exe</attr>
<attr name="finding">@EID_Id_trj</attr>
<attr name="virusname">Clicker.FR</attr>
</rec>
<rec time="2006/07/04 15:28:41" user="juanmanuel" source="Virus">
<value>@HL_ReportFindRS</value>
<attr name="filename">C:\WINDOWS\system32\{9F863143-08E3-4DAC-9FA3-6DE8E5DA4FB7}.exe</attr>
<attr name="finding">@EID_Id_trj</attr>
<attr name="virusname">Clicker.FR</attr>
</rec>
<rec time="2006/07/04 18:17:23" user="juanmanuel" source="General">
<value>@HL_TestStarted</value>
<attr name="testname">@TestName_02</attr>
</rec>
<rec time="2006/07/04 18:33:42" user="juanmanuel" source="General">
<value>@HL_TestStopped</value>
<attr name="testname">@TestName_02</attr>
<attr name="infectedfiles">0</attr>
</rec>
<rec time="2006/07/04 18:43:43" user="juanmanuel" source="Virus">
<value>@HL_ReportFindRS</value>
<attr name="filename">C:\WINDOWS\system32\{4080639F-0CFA-40EA-A537-35B3A156ED9D}.exe</attr>
<attr name="finding">@EID_Id_trj</attr>
<attr name="virusname">Clicker.FR</attr>
</rec>
<rec time="2006/07/04 18:43:47" user="juanmanuel" source="Virus">
<value>@HL_ReportFindRS</value>
<attr name="filename">C:\WINDOWS\system32\{4080639F-0CFA-40EA-A537-35B3A156ED9D}.exe</attr>
<attr name="finding">@EID_Id_trj</attr>
<attr name="virusname">Clicker.FR</attr>
</rec>
<rec time="2006/07/04 18:50:01" user="juanmanuel" source="Virus">
<value>@HL_ReportFindRS</value>
<attr name="filename">C:\WINDOWS\system32\{1864FCA7-A431-4605-B58C-7EC0C19EDDBB}.exe</attr>
<attr name="finding">@EID_Id_trj</attr>
<attr name="virusname">Clicker.FR</attr>
</rec>
<rec time="2006/07/04 18:50:06" user="juanmanuel" source="Virus">
<value>@HL_ReportFindRS</value>
<attr name="filename">C:\WINDOWS\system32\{1864FCA7-A431-4605-B58C-7EC0C19EDDBB}.exe</attr>
<attr name="finding">@EID_Id_trj</attr>
<attr name="virusname">Clicker.FR</attr>
</rec>
<rec time="2006/07/04 18:50:39" user="juanmanuel" source="Virus">
<value>@HL_ReportFindRS</value>
<attr name="filename">C:\WINDOWS\system32\{1864FCA7-A431-4605-B58C-7EC0C19EDDBB}.exe</attr>
<attr name="finding">@EID_Id_trj</attr>
<attr name="virusname">Clicker.FR</attr>
</rec>
<rec time="2006/07/04 18:51:11" user="juanmanuel" source="Virus">
<value>@HL_ReportFindRS</value>
<attr name="filename">C:\WINDOWS\system32\{1864FCA7-A431-4605-B58C-7EC0C19EDDBB}.exe</attr>
<attr name="finding">@EID_Id_trj</attr>
<attr name="virusname">Clicker.FR</attr>
</rec>
</history>
Esto es lo que me encuentra el antivirus online:
ASPERSKY ONLINE SCANNER REPORT
Tuesday, July 04, 2006 6:04:46 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 4/07/2006
Kaspersky Anti-Virus database records: 204722
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - Folders:
C:\WINDOWS\

Scan Statistics:
Infected Object Name / Virus Name / Last Action
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\jhapb.exe Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MA P Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MA P Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DAT A Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped

Scan process completed.

Espero que em puedan ayudar desde ya muchas gracias a todos.

Hola,

Lo que pusiste antes del reporte del Kaspersky es dificl de leer, no los puyedes pegar sin los tags de formato?

Saludos

Estimados les dejo los dos Logs, el de Hijackthis y el de los virus que me recomendaron , encontro 10 virus y 6 errores, despues vean el log les paso la parte de los virus, otra cosa, no puedo limpiar el registro con el Regsker porque se me cuelga cuando lo ejecuto , la maquina me anda lenta, pegue un nuevo tema y me dijieron que primero resuelva este, es que no sabia bien como funsionaba el sistema pense que este al ser antiguo no me lo contestarían, gracia spor todo

006 => ***** Sistema de ficheros del registro y de la exploración para Adware/Spyware *****
Tue Jul 04 20:21:49 2006 => Loading Spyware Signatures from new External Database (Size: 161180).
Tue Jul 04 20:21:57 2006 => Indexed Spyware Databases Successfully Created...

Tue Jul 04 20:22:08 2006 => System found infected with unspypc Unclassified ({bf69df00-2734-477f-8257-27cd04f88779})! Action taken: Ninguna Accion fue realizada.
Tue Jul 04 20:22:13 2006 => Offending Key found: HKLM\Software\searchtoolbar !!!
Tue Jul 04 20:22:13 2006 => ¡El objeto “wareout Adware” encontró en sistema de ficheros! Acción tomada: Ninguna Accion fue realizada .

Tue Jul 04 20:22:13 2006 => Offending Key found: HKCU\Software\searchtoolbar !!!
Tue Jul 04 20:22:13 2006 => ¡El objeto “wareout Adware” encontró en sistema de ficheros! Acción tomada: Ninguna Accion fue realizada .

Tue Jul 04 20:22:13 2006 => Offending Key found: HKLM\Software\Microsoft\Windows\CurrentVersion\url s !!!
Tue Jul 04 20:22:13 2006 => ¡El objeto “wareout Adware” encontró en sistema de ficheros! Acción tomada: Ninguna Accion fue realizada .

Tue Jul 04 20:22:13 2006 => Offending Key found: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\ruins !!!
Tue Jul 04 20:22:13 2006 => ¡El objeto “Wareout adware” encontró en sistema de ficheros! Acción tomada: Ninguna Accion fue realizada .

Tue Jul 04 20:22:13 2006 => Poisoned DNS Server Entry 85.255.112.108 (85.255.112.*) found!!!
Tue Jul 04 20:22:13 2006 => Poisoned DNS Server Entry 85.255.115.67 (85.255.115.*) found!!!
Tue Jul 04 20:22:13 2006 => ¡El objeto “UnSpyPC adware” encontró en sistema de ficheros! Acción tomada: Ninguna Accion fue realizada .

Tue Jul 04 20:22:13 2006 => Offending Key found: HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartupReg\errorguard !!!
Tue Jul 04 20:22:13 2006 => ¡El objeto “errorguard Spyware/Adware” encontró en sistema de ficheros! Acción tomada: Ninguna Accion fue realizada .

Tue Jul 04 20:22:13 2006 => Offending Key found: HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartupReg\ist service !!!
Tue Jul 04 20:22:13 2006 => ¡El objeto “istbar Spyware/Adware” encontró en sistema de ficheros! Acción tomada: Ninguna Accion fue realizada .

Tue Jul 04 20:22:13 2006 => Offending Key found: HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartupReg\surfaccuracy !!!
Tue Jul 04 20:22:13 2006 => ¡El objeto “surfaccuracy Spyware/Adware” encontró en sistema de ficheros! Acción tomada: Ninguna Accion fue realizada .

Tue Jul 04 20:22:18 2006 => Offending file found: C:\WINDOWS\system32\start.cdi
Tue Jul 04 20:22:18 2006 => System found infected with cydoor Spyware/Adware (start.cdi)! Action taken: Ninguna Accion fue realizada.

__________________________________________________ _____________
Logfile of HijackThis v1.99.1
Scan saved at 08:32:55 p.m., on 04/07/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Eset\nod32.exe
C:\program files\BitComet\BitComet.exe
C:\Documents and Settings\juanmanuel\Desktop\Ultimo todo aca\IEXPLORE.EXE
C:\program files\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.clarin.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Referencia - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {0835BC90-6ABC-4F52-A103-4FC3A61F2C33} (A18X Control) - http://www.albatross18.com/cabs/A18X.ocx
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://download.games.yahoo.com/games/voice/yacscom.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{8FCC6F29-AA1B-4528-9BD6-68BDE29B1FB0}: NameServer = 85.255.115.67,85.255.112.108
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.115.67 85.255.112.108
O17 - HKLM\System\CS1\Services\Tcpip\..\{8FCC6F29-AA1B-4528-9BD6-68BDE29B1FB0}: NameServer = 85.255.115.67,85.255.112.108
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.67 85.255.112.108
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

Bueno,
Con el permiso de Jimmy12, intervengo de mientras que el viene a revisar tu log:
Con KillBox elimina:
C:\WINDOWS\system32\start.cdi

tienes instalado esto?:
UnSpyPC
ErrorGuard
istBar

si es asi, desintalalos y elimina las carpetas que hayan creado con KillBox.

Pasa el ewido online (lo ejecutas desde aqui).

Despues pasa el RegSeeker y el Disk Cleaner, los bajas aqui:
http://www.infospyware.com/Herramientas.htm
El RegSeeker (opcion Clean Registry), lo pasas y borras todo lo que te marque hasta que ya no quede nada.

Despues vuelve a pasar los antivirus y pegas los reportes, a ver que te sigue marcando.

Saludos

Hola compañeros

Hasta hoy no habia pasado por aca,

Esto no debria estar alli:
C:\Documents and Settings\juanmanuel\Desktop\Ultimo todo aca\IEXPLORE.EXE, subelo a virus total y pegas el reporte aqui.

Saludos.-

muchas gracias a los dos, ya esta todo bien gracias igual les dejo el log.

Logfile of HijackThis v1.99.1
Scan saved at 12:35:18 p.m., on 07/07/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Documents and Settings\juanmanuel\Desktop\Ultimo todo aca\IEXPLORE.EXE
C:\program files\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.clarin.com.ar/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Referencia - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {0835BC90-6ABC-4F52-A103-4FC3A61F2C33} (A18X Control) - http://www.albatross18.com/cabs/A18X.ocx
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://download.games.yahoo.com/games/voice/yacscom.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe

perdon ahi lo ocrreji. gracias.
ogfile of HijackThis v1.99.1
Scan saved at 05:29:42 p.m., on 08/07/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Eset\nod32kui.exe
C:\program files\Mozilla Firefox\firefox.exe
C:\program files\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.clarin.com.ar/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O9 - Extra button: Referencia - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {0835BC90-6ABC-4F52-A103-4FC3A61F2C33} (A18X Control) - http://www.albatross18.com/cabs/A18X.ocx
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://download.games.yahoo.com/games/voice/yacscom.cab
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Trend Micro ActiveX Scan Agent 6.5) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

Hola azimperium,

Con tu permiso Jimmy12

Sólo queda una cosa en tu log, dale Fix Checked con el Hijackthis a esta entrada:

O16 - DPF: {0835BC90-6ABC-4F52-A103-4FC3A61F2C33} (A18X Control) - http://www.albatross18.com/cabs/A18X.ocx

Luego instalá SpywareBlaster+Manual y lo actualizás.

Estando esto casi terminado, damos el tema por solucionado.

Suerte

bueno muchas gracias.