Saludos, tengo un problema con este troyano, ya que sigo los pasos mas o menos tipicos para su eliminacion, es decir:
-quito restaurar sistema
-reinicio en modo a prueba de fallos
-lo elimino con hijackthisy killbox y paso el ad-aware
- uso el disk cleaner y luego el regseeker

y una vez hechos estos pasos se me elimina, pero al poco el proceso mssvcc.exe vuelve a aparecer, alguien puede decirme como eliminarlo definitivamente o como protegerme para su eliminacion , muchas gracias

Hola, axel_rose.

Ponnos un log de HijackThis en este mismo tema, junto con un reporte del ewido online y un reporte del kaspersky online.

Saludos
Reitxelle

Aqui dejo el reporte de hijackthis , ewido y kaspersky, he de decir que una vez concluido el analisis con ewido intente eliminar las infecciones detectadas , pero me dio un error el explorer, y lo tuve que cerrar, es esto normal?, aqui van los reportes:

Logfile of HijackThis v1.99.1
Scan saved at 14:28:40, on 10/07/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\ARCHIV~1\CACHEM~1\CachemanXP.exe
C:\WINDOWS\System32\CTSvcCDA.exe
C:\Archivos de programa\Archivos comunes\EPSON\EBAPI\SAgent2.exe
C:\Archivos de programa\Eset\nod32krn.exe
C:\Archivos de programa\Eset\nod32kui.exe
C:\Archivos de programa\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Archivos de programa\Java\jre1.5.0_07\bin\jusched.exe
C:\WINDOWS\System32\mssvcc.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Archivos de programa\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.es/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Archivos de programa\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Archivos de programa\Java\jre1.5.0_07\bin\ssv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Barra Yahoo! con bloqueador de ventanas emergentes - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Archivos de programa\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [nod32kui] "C:\Archivos de programa\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [ATIPTA] C:\Archivos de programa\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Archivos de programa\Java\jre1.5.0_07\bin\jusched.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Archivos de programa\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [msconfig38] mssvcc.exe
O4 - HKLM\..\Run: [spnsvc] rundll32.exe C:\WINDOWS\System32\spnsvc.dll,start
O4 - HKLM\..\RunServices: [msconfig38] mssvcc.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "c:\Archivos de Programa\Messenger\msmsgs.exe /background"
O4 - Global Startup: Inicio rápido de Adobe Reader.lnk = C:\Archivos de programa\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\SYSTEM32\spool\drivers\w32x86\3\E_SRCV0 2.EXE
O8 - Extra context menu item: &MyToolBar Search - res://C:\Archivos de programa\ToolBar888\MyToolBar.dll/MENUSEARCH.HTM
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_07\bin\ssv.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1150890874093
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\ARCHIV~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
O23 - Service: CachemanXP (CachemanXPService) - OuterTechnologies - C:\ARCHIV~1\CACHEM~1\CachemanXP.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTSvcCDA.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Archivos de programa\Archivos comunes\EPSON\EBAPI\SAgent2.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Archivos de programa\Eset\nod32krn.exe


ewido security suite online scanner
http://www.ewido.net
__________________________________________________


Name: Worm.Anker.n
Path: C:\WINDOWS\SYSTEM32\DRIVERS\etc\hosts
Risk: High

Name: Downloader.ConHook.ad
Path: C:\WINDOWS\SYSTEM32\ww32.exe/dotrm.dll
Risk: High

Name: Downloader.Adload.ch
Path: C:\WINDOWS\SYSTEM32\ww32.exe/dotdr.exe
Risk: High

Name: Backdoor.Rbot.aeu
Path: C:\WINDOWS\SYSTEM32\mssvcc.exe
Risk: High

Name: Backdoor.Agent.abc
Path: C:\WINDOWS\SYSTEM32\sck32.exe
Risk: High

Name: Backdoor.Rbot.aeu
Path: C:\WINDOWS\SYSTEM32\winsystems.exe
Risk: High

Name: Downloader.ConHook.ad
Path: C:\WINDOWS\SYSTEM32\dotrm.dll
Risk: High

Name: Adware.Softomate
Path: C:\Archivos de programa\ToolBar888\MyToolBar.dll
Risk: Medium

Name: Adware.Agent
Path: C:\Archivos de programa\CachemanXP\Readme.exe
Risk: Medium

Name: Downloader.IstBar.ai
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Archivos temporales de Internet\Content.IE5\0UARH4VC\popup[2].php
Risk: High

Name: Downloader.IstBar.ai
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Archivos temporales de Internet\Content.IE5\BJVRZJLA\popup[1].php
Risk: High

Name: TrackingCookie.Reliablestats
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Cookies\bobes@stats1.reliablestats[1].txt
Risk: Medium

Name: TrackingCookie.Hitbox
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Cookies\bobes@hitbox[1].txt
Risk: Medium

Name: TrackingCookie.Hitbox
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Cookies\bobes@ehg-sigames.hitbox[2].txt
Risk: Medium

Name: TrackingCookie.Yieldmanager
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Cookies\bobes@ad.yieldmanager[2].txt
Risk: Medium

Name: TrackingCookie.Casalemedia
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Cookies\bobes@casalemedia[1].txt
Risk: Medium

Name: TrackingCookie.Paypopup
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Cookies\bobes@paypopup[2].txt
Risk: Medium

Name: TrackingCookie.Adserver
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Cookies\bobes@z1.adserver[1].txt
Risk: Medium

Name: TrackingCookie.Shopathomeselect
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Cookies\bobes@www.shopathomeselect[2].txt
Risk: Medium

Name: TrackingCookie.Doubleclick
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Cookies\bobes@doubleclick[1].txt
Risk: Medium

Name: TrackingCookie.Paypopup
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Cookies\bobes@popunder.paypopup[2].txt
Risk: Medium

Name: TrackingCookie.Advertising
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Cookies\bobes@advertising[1].txt
Risk: Medium

Name: TrackingCookie.Atdmt
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Cookies\bobes@atdmt[2].txt
Risk: Medium

Name: TrackingCookie.Fastclick
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Cookies\bobes@fastclick[2].txt
Risk: Medium

Name: TrackingCookie.Itrack
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Cookies\bobes@ilead.itrack[1].txt
Risk: Medium

Name: TrackingCookie.Serving-sys
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Cookies\bobes@bs.serving-sys[1].txt
Risk: Medium

Name: TrackingCookie.Serving-sys
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Cookies\bobes@serving-sys[2].txt
Risk: Medium

Name: TrackingCookie.Tribalfusion
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Cookies\bobes@tribalfusion[1].txt
Risk: Medium

Name: TrackingCookie.Mediaplex
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Cookies\bobes@mediaplex[1].txt
Risk: Medium

Name: TrackingCookie.Advertising
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Cookies\bobes@servedby.advertising[2].txt
Risk: Medium

Name: TrackingCookie.Clickhype
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Cookies\bobes@ad1.clickhype[1].txt
Risk: Medium

Name: TrackingCookie.Falkag
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Cookies\bobes@as-eu.falkag[2].txt
Risk: Medium

Name: TrackingCookie.Revenue
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Cookies\bobes@revenue[2].txt
Risk: Medium

Name: TrackingCookie.Targetnet
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Cookies\bobes@targetnet[1].txt
Risk: Medium

Name: TrackingCookie.Tradedoubler
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Cookies\bobes@tradedoubler[2].txt
Risk: Medium

Name: TrackingCookie.Estat
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Cookies\bobes@estat[1].txt
Risk: Medium

Name: TrackingCookie.Falkag
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Cookies\bobes@as1.falkag[2].txt
Risk: Medium

Name: TrackingCookie.Falkag
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Cookies\bobes@as-us.falkag[1].txt
Risk: Medium

Name: TrackingCookie.Weborama
Path: C:\Documents and Settings\Bobes\Configuración local\Temp\Cookies\bobes@weborama[2].txt
Risk: Medium

Name: Dropper.VB.cd
Path: C:\Documents and Settings\Bobes\Datos de programa\Pribi\v29.exe
Risk: High

Name: Hijacker.StartPage.ku
Path: C:\Documents and Settings\Bobes\Datos de programa\Setup\Setup.dll
Risk: High

Name: Adware.PowerScan
Path: C:\Documents and Settings\pedro\Menú Inicio\Programas\Power Scan
Risk: Medium

Name: Downloader.Small.bpk
Path: C:\Documents and Settings\LocalService.NT AUTHORITY.002\Configuración local\Archivos temporales de Internet\Content.IE5\H0SBZVNF\is399[1].txt
Risk: High

Name: Downloader.Small.bpk
Path: C:\Documents and Settings\LocalService.NT AUTHORITY.002\Configuración local\Archivos temporales de Internet\Content.IE5\E1G71AYQ\is399[1].txt
Risk: High

Name: Downloader.Small.bpk
Path: C:\Documents and Settings\LocalService.NT AUTHORITY.002\Configuración local\Archivos temporales de Internet\Content.IE5\E1G71AYQ\is399[2].txt
Risk: High

Name: Downloader.ConHook.y
Path: C:\Documents and Settings\Bobes.BOBES-K0JZF7W99\ca32.exe/rm32.dll
Risk: High

Name: Downloader.ConHook.y
Path: C:\Documents and Settings\Bobes.BOBES-K0JZF7W99\cx32.exe/rm32.dll
Risk: High

Name: Downloader.VB.vz
Path: C:\Documents and Settings\Bobes.BOBES-K0JZF7W99\cx32.exe/dr32.exe
Risk: High

Name: Adware.Virtumonde
Path: C:\Documents and Settings\Bobes.BOBES-K0JZF7W99\ch32.exe/rmz.dll
Risk: Medium

Name: Downloader.Adload.ap
Path: C:\Documents and Settings\Bobes.BOBES-K0JZF7W99\ch32.exe/drz.exe
Risk: High

Name: Trojan.Sinowal.aa
Path: C:\Documents and Settings\LocalService.NT AUTHORITY.003\Configuración local\Archivos temporales de Internet\Content.IE5\0M56M504\emvkunkg[1].txt
Risk: High

Name: TrackingCookie.Googleadservices
Path: :mozilla.53:C:\Documents and Settings\Administrador.PEDRO-MWBQFCGMC\Datos de programa\Mozilla\Firefox\Profiles\ip4r3vxt.default \cookies.txt
Risk: Medium

Name: Downloader.ConHook.ad
Path: C:\Documents and Settings\Administrador.PEDRO-MWBQFCGMC\ww32.exe/dotrm.dll
Risk: High

Name: Downloader.Adload.ch
Path: C:\Documents and Settings\Administrador.PEDRO-MWBQFCGMC\ww32.exe/dotdr.exe
Risk: High

Name: Downloader.ConHook.ad
Path: C:\Documents and Settings\Administrador.PEDRO-MWBQFCGMC\dotrm.dll
Risk: High

Name: Adware.MediaMotor
Path: C:\Documents and Settings\Invitado\Configuración local\Archivos temporales de Internet\Content.IE5\OAXAUO6H\util[1].js
Risk: Medium

Name: TrackingCookie.Doubleclick
Path: C:\Documents and Settings\Invitado\Cookies\invitado@doubleclick[1].txt
Risk: Medium

Name: Backdoor.Agobot.agw
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP1\A0000038.exe
Risk: High

Name: Backdoor.Agobot.agw
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP1\A0000055.exe
Risk: High

Name: Backdoor.Agobot.agw
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP1\A0000065.exe
Risk: High

Name: Backdoor.SdBot.asc
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP1\A0000077.exe
Risk: High

Name: Backdoor.Beok
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP1\A0000093.exe
Risk: High

Name: Backdoor.SdBot.asc
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP1\A0000201.exe
Risk: High

Name: Backdoor.Agobot.agw
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP1\A0000207.exe
Risk: High

Name: Backdoor.Agobot.agw
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP1\A0000208.exe
Risk: High

Name: Backdoor.Agobot.agw
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP1\A0000216.exe
Risk: High

Name: Backdoor.Agobot.agw
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP1\A0000284.exe
Risk: High

Name: Backdoor.Agobot.agw
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP1\A0000285.exe
Risk: High

Name: Backdoor.Agobot.agw
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP1\A0000297.exe
Risk: High

Name: Backdoor.Agobot.agw
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP1\A0000360.exe
Risk: High

Name: Backdoor.Agobot.agw
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP2\A0000402.exe
Risk: High

Name: Adware.RXToolbar
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP4\A0000455.dll
Risk: Medium

Name: Backdoor.Agobot.agw
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP4\A0001444.exe
Risk: High

Name: Proxy.Slaper.b
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP4\A0001498.exe
Risk: High

Name: Adware.Virtumonde
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP4\A0001900.exe/rmz.dll
Risk: Medium

Name: Downloader.Adload.ap
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP4\A0001900.exe/drz.exe
Risk: High

Name: Backdoor.Rbot.ayt
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP4\A0001905.exe
Risk: High

Name: Backdoor.Rbot
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP4\A0001906.exe
Risk: High

Name: Backdoor.SdBot.arz
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP4\A0001911.exe
Risk: High

Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP4\A0001912.exe
Risk: High

Name: Adware.Virtumonde
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP4\A0001915.dll
Risk: Medium

Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP4\A0002038.exe
Risk: High

Name: Proxy.Slaper.b
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP4\A0002039.exe
Risk: High

Name: Backdoor.Agobot.agw
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP4\A0002045.exe
Risk: High

Name: Adware.Virtumonde
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP4\A0002054.dll
Risk: Medium

Name: Dropper.Small
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP4\A0002060.exe
Risk: High

Name: Backdoor.Rbot.ats
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP4\A0002116.exe
Risk: High

Name: Backdoor.Rbot.ayt
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP4\A0002121.exe
Risk: High

Name: Adware.404Search
Path: C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP4\A0002156.exe
Risk: Medium

Name: Backdoor.Agobot.agw
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP4\A0001797.exe
Risk: High

Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP4\A0001798.exe
Risk: High

Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP10\A0002682.exe
Risk: High

Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP10\A0002683.exe
Risk: High

Name: Backdoor.Rbot
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP10\A0002706.exe
Risk: High

Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP10\A0002710.exe
Risk: High

Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP10\A0002769.exe
Risk: High

Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP11\A0002825.exe
Risk: High

Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP12\A0003879.EXE
Risk: High

Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP13\A0005018.exe
Risk: High

Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP13\A0005090.exe
Risk: High

Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP13\A0005091.exe
Risk: High

Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP13\A0005093.exe
Risk: High

Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP13\A0005094.exe
Risk: High

Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP13\A0006128.exe
Risk: High

Name: Backdoor.Agobot.agw
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP13\A0006130.exe
Risk: High

Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP13\A0006131.exe
Risk: High

Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP14\A0006326.exe
Risk: High

Name: Backdoor.SdBot.aoz
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP14\A0006514.exe
Risk: High

Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP14\A0006541.exe
Risk: High

Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP14\A0006543.exe
Risk: High

Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP17\A0008039.exe
Risk: High

Name: Backdoor.Rbot
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP17\A0008082.exe
Risk: High

Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP17\A0008098.exe
Risk: High

Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP17\A0008099.exe
Risk: High

Name: Adware.IEBar
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP17\A0008237.dll
Risk: Medium

Name: Dropper.VB.mz
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP17\A0008238.exe
Risk: High

Name: Adware.Cydoor
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP17\A0008239.exe/cd_clint.dll
Risk: Medium

Name: Adware.Cydoor
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP17\A0008239.exe/cd_htm.dll
Risk: Medium

Name: Backdoor.Theef.111
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP17\A0008240.exe
Risk: High

Name: Backdoor.Hupigon.aco
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP18\A0008334.exe
Risk: High

Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP19\A0008506.exe
Risk: High

Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP24\A0008779.exe
Risk: High

Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP24\A0008781.exe
Risk: High

Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP24\A0008845.exe
Risk: High

Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP24\A0008847.EXE
Risk: High

Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP24\A0008883.exe
Risk: High

Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP24\A0008885.exe
Risk: High

Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP24\A0008896.exe
Risk: High

Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP24\A0008922.exe
Risk: High

Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP25\A0009059.exe
Risk: High

Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP25\A0009061.exe
Risk: High

Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP26\A0010155.exe
Risk: High

Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP26\A0010172.exe
Risk: High

Name: Downloader.ConHook.ad
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP27\A0010225.exe/dotrm.dll
Risk: High

Name: Adware.Agent
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP27\A0010228.exe
Risk: Medium

Name: Adware.Softomate
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP27\A0010229.dll
Risk: Medium

Name: Downloader.ConHook.ad
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP27\A0010240.exe/dotrm.dll
Risk: High

Name: Downloader.Adload.ch
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP27\A0010240.exe/dotdr.exe
Risk: High

Name: Adware.Agent
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP27\A0010242.exe
Risk: Medium

Name: Adware.Softomate
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP27\A0010249.dll
Risk: Medium

Name: Backdoor.Rbot.aeu
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP27\A0010267.exe
Risk: High

Name: Downloader.ConHook.ad
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP27\A0010323.exe/dotrm.dll
Risk: High

Name: Downloader.Adload.ch
Path: C:\System Volume Information\_restore{F8122911-1908-422E-88C6-57A7F542E474}\RP27\A0010323.exe/dotdr.exe
Risk: High

Name: Backdoor.Rbot.aeu
Path: C:\!KillBox\lat.exe
Risk: High

Name: Backdoor.Rbot.aeu
Path: C:\!KillBox\mssvcc.exe
Risk: High

Name: Backdoor.Rbot.aeu
Path: C:\!KillBox\lat.exe( 1)
Risk: High

Name: Backdoor.Rbot.aeu
Path: C:\!KillBox\winsystems.exe
Risk: High

Name: Not-A-Virus.Downloader.Win32.WinFixer.c
Path: C:\FOUND.013\FILE0002.CHK
Risk: Low

Name: Trojan.Sinowal.aa
Path: C:\dpcyac.exe
Risk: High


-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Monday, July 10, 2006 2:14:46 PM
Operating System: Microsoft Windows XP Professional, Service Pack 1 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 10/07/2006
Kaspersky Anti-Virus database records: 193780
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: standard
Scan Archives: true
Scan Mail Bases: true

Scan Target - Folders:
C:\

Scan Statistics:
Total number of scanned objects: 34845
Number of viruses found: 6
Number of infected objects: 10 / 0
Number of suspicious objects: 0
Duration of the scan process: 01:29:19

Infected Object Name / Virus Name / Last Action
C:\WINDOWS\SYSTEM32\config\system.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\config\software.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\config\default.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SECURITY Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SAM Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SYSTEM Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SOFTWARE Object is locked skipped
C:\WINDOWS\SYSTEM32\config\DEFAULT Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\Repository\FS\OBJECTS.DAT A Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\SYSTEM32\i Infected: Trojan-Downloader.BAT.Ftp.ab skipped
C:\WINDOWS\SYSTEM32\spnsvc.dll Infected: Backdoor.Win32.Agent.vc skipped
C:\WINDOWS\SYSTEM32\ww32.exe/data.rar/dotrm.dll Infected: Trojan-Downloader.Win32.ConHook.ad skipped
C:\WINDOWS\SYSTEM32\ww32.exe/data.rar/dotdr.exe Infected: Trojan-Downloader.Win32.Adload.ch skipped
C:\WINDOWS\SYSTEM32\ww32.exe/data.rar Infected: Trojan-Downloader.Win32.Adload.ch skipped
C:\WINDOWS\SYSTEM32\ww32.exe RarSFX: infected - 3 skipped
C:\WINDOWS\SYSTEM32\mssvcc.exe Infected: Backdoor.Win32.Rbot.aeu skipped
C:\WINDOWS\SYSTEM32\sck32.exe Infected: Backdoor.Win32.Agent.abc skipped
C:\WINDOWS\SYSTEM32\winsystems.exe Infected: Backdoor.Win32.Rbot.aeu skipped
C:\WINDOWS\SYSTEM32\dotrm.dll Infected: Trojan-Downloader.Win32.ConHook.ad skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

hola axel_rose

con tu permiso Reitxelle

lo del reporte del EwidoRealiza lo siguiente:

Descarga esta herramientas:
RegSeeker+Manual
Ccleaner+Manual
KillBox

1)Apaga Restaurar Sistema

2)Ver archivos ocultos

3)Reinicia a prueba de fallos

4)Busca y elimina estos archivos y/o carpetas,Para archivos que no se dejen eliminar usa KillBox

C:\WINDOWS\SYSTEM32\ww32.exe/dotrm.dll
C:\WINDOWS\SYSTEM32\ww32.exe/dotdr.exe
C:\WINDOWS\SYSTEM32\mssvcc.exe
C:\WINDOWS\SYSTEM32\sck32.exe
C:\WINDOWS\SYSTEM32\winsystems.exe
C:\WINDOWS\SYSTEM32\dotrm.dll
C:\Archivos de programa\ToolBar888\MyToolBar.dll<--Borra la carpeta
C:\Archivos de programa\CachemanXP\Readme.exe<--Borra la carpeta
C:\Documents and Settings\Bobes\Datos de programa\Pribi\v29.exe<--Borra la capeta
C:\Documents and Settings\Administrador.PEDRO-MWBQFCGMC\dotrm.dll<--Borra la carpeta
C:\System Volume Information\_restore{30D41713-9FAE-4ABC-842D-B734FA857D56}\RP1\A0000285.exe
C:\FOUND.013\FILE0002.CHK
C:\dpcyac.exe

5)Sin reiniciar Limpia el registro con RegSeeker,Elimina cookies y temporales con Ccleaner

6)ve a Inicio-->Mi pc-->Disco local-->!KillBox<--Borra todo lo que este en esa carpeta

7)reinicias el pc Normal,Activa restaurar sistema y Nuevamente realizá un Scan Online con Ewidoy comentas como esta tu pc...

espera que Reitxelle revise el log de HijackThis

salu2

Hola.

A parte de lo que te a comentado **Devil May cry, te pongo ahora lo del log y una corrección a uno de los archivos que te dijeron.

Este archivo no hace falta que lo elimines manual. Aparte es un poco engorroso de hacer. Cuando deshabilites el 'Restaurar sistema' esa carpeta se vacía.

Realiza estos pasos para limpiar el log:

Actualiza tu sistema operativo en WindowsUpdate. Esto es muy importante para que tu sistema no tenga ninguna vulnerabilidad que ya haya sido corregida.

1.- Deshabilita el Restaurar Sistema

2.- Activa la opción Ver Archivos Ocultos

3.- Reinicia en Modo a Prueba de Fallos

4.- Desinstala estos programas desde 'Agregar/Quitar programas':

ToolBar888

5.- Cierra todos los programas, ejecuta HijackThis y dale "Fix Cheked" a estas entradas:

O4 - HKLM\..\Run: [msconfig38] mssvcc.exe

O4 - HKLM\..\RunServices: [msconfig38] mssvcc.exe

O8 - Extra context menu item: &MyToolBar Search - res://C:\Archivos de programa\ToolBar888\MyToolBar.dll/MENUSEARCH.HTM

6.- Sin reiniciar, busca y elimina estos archivos, si no se dejan eliminar descarga el programa "Killbox" y sigue las indicaciones del mensaje, copia y pega los archivos para que los elimine al reiniciar.

C:\WINDOWS\System32\mssvcc.exe

C:\WINDOWS\System32\spnsvc.dll

C:\Archivos de programa\ToolBar888\MyToolBar.dll/MENUSEARCH.HTM ---> borra esta carpeta con todo su contenido

7.- Pasa estas herramientas:

- Ad-Aware 1.06 SE Personal

- Disk Cleaner para limpiar cookies y temporales

- RegSeeker para limpiar el registro de Windows y su manual pasalo varias veces hasta que ya no te salga nada para eliminar.

8.- Reinicia el pc

- Instálate el SpywareBlaster 3.4 manual

9.- Pasa dos de estos antivirus online (ewido y kaspersky preferentemente) y nos comentas si te detectaron algo o no. Si hay algo que te detecten nos pegas el reporte que te generen.

10.- Comprueba los resultados y nos pegas un nuevo log para comprobar que quedó limpio.

De preferencia, imprime las indicaciones para que se te haga más fácil seguirlas.

Saludos
Reitxelle