Hola,

Nos podemos saltar lo del DelPSGuard. Esperemos a ver que da el reporte del ewido, y luego ya nos pasamos al reporte del kaspersky.

Saludos

Este es el nuevo reporte del Ewido: (Encontró 43 infecciones)
__________________________________________________

Name: TrackingCookie.Yieldmanager
Path: C:\Documents and Settings\josefco\Cookies\josefco@ad.yieldmanager[1].txt
Risk: Medium

Name: TrackingCookie.Atdmt
Path: C:\Documents and Settings\josefco\Cookies\josefco@atdmt[2].txt
Risk: Medium

Name: TrackingCookie.Casalemedia
Path: C:\Documents and Settings\josefco\Cookies\josefco@casalemedia[1].txt
Risk: Medium

Name: TrackingCookie.Revenue
Path: C:\Documents and Settings\josefco\Cookies\josefco@revenue[1].txt
Risk: Medium

Name: TrackingCookie.Zedo
Path: C:\Documents and Settings\josefco\Cookies\josefco@zedo[2].txt
Risk: Medium

Name: Trojan.ProcKill.DJ
Path: C:\Documents and Settings\josefco\Configuración local\Archivos temporales de Internet\Content.IE5\27AJIDEX\yzlrku[1].htm
Risk: High

Name: Not-A-Virus.Hoax.Win32.Renos.bw
Path: C:\Documents and Settings\josefco\Configuración local\Archivos temporales de Internet\Content.IE5\27AJIDEX\zhtzspv[1].txt
Risk: Low

Name: Downloader.Small.ctf
Path: C:\Documents and Settings\josefco\Configuración local\Archivos temporales de Internet\Content.IE5\E1E7OF8J\stvslhrb[1].txt
Risk: High

Name: Proxy.Small.bo
Path: C:\Documents and Settings\josefco\Configuración local\Archivos temporales de Internet\Content.IE5\E1E7OF8J\ytioue[1].htm
Risk: High

Name: Hijacker.Costrat.e
Path: C:\Documents and Settings\josefco\Configuración local\Archivos temporales de Internet\Content.IE5\K5Q3S18P\drgqjtdjfy[1].txt
Risk: High

Name: Trojan.ProcKill.DJ
Path: C:\Documents and Settings\josefco\Configuración local\Archivos temporales de Internet\Content.IE5\K5Q3S18P\ptjcvye[1].htm
Risk: High

Name: Trojan.ProcKill.DJ
Path: C:\Documents and Settings\josefco\Configuración local\Archivos temporales de Internet\Content.IE5\XR1COI35\bfrkuat[1].htm
Risk: High

Name: Trojan.Sinowal.ao
Path: C:\Documents and Settings\josefco\Configuración local\Archivos temporales de Internet\Content.IE5\XR1COI35\iltmwc[1].txt
Risk: High

Name: Trojan.ProcKill.DJ
Path: C:\Documents and Settings\josefco\Configuración local\Archivos temporales de Internet\Content.IE5\XR1COI35\kxnxqnjtd[1].htm
Risk: High

Name: TrackingCookie.Yieldmanager
Path: C:\Documents and Settings\josefco\Cookies\josefco@ad.yieldmanager[2].txt
Risk: Medium

Name: TrackingCookie.Casalemedia
Path: C:\Documents and Settings\josefco\Cookies\josefco@casalemedia[1].txt
Risk: Medium

Name: TrackingCookie.Revenue
Path: C:\Documents and Settings\josefco\Cookies\josefco@revenue[1].txt
Risk: Medium

Name: TrackingCookie.Tribalfusion
Path: C:\Documents and Settings\josefco\Cookies\josefco@tribalfusion[1].txt
Risk: Medium

Name: TrackingCookie.Zedo
Path: C:\Documents and Settings\josefco\Cookies\josefco@zedo[2].txt
Risk: Medium

Name: Trojan.Dialer.qs
Path: C:\RECYCLER\S-1-5-21-1635398023-1059604262-24720492-1006\Dc3.exe
Risk: High

Name: Proxy.Small.bo
Path: C:\System Volume Information\_restore{7FA8A30B-975A-4EA6-BC5D-32CCE0F4ADEE}\RP37\A0007502.exe
Risk: High

Name: Not-A-Virus.Hoax.Win32.Renos.bw
Path: C:\System Volume Information\_restore{7FA8A30B-975A-4EA6-BC5D-32CCE0F4ADEE}\RP37\A0007503.exe
Risk: Low

Name: Trojan.ProcKill.DJ
Path: C:\System Volume Information\_restore{7FA8A30B-975A-4EA6-BC5D-32CCE0F4ADEE}\RP37\A0007504.exe
Risk: High

Name: Trojan.ProcKill.DJ
Path: C:\System Volume Information\_restore{7FA8A30B-975A-4EA6-BC5D-32CCE0F4ADEE}\RP37\A0007505.exe
Risk: High

Name: Downloader.Small.ctf
Path: C:\System Volume Information\_restore{7FA8A30B-975A-4EA6-BC5D-32CCE0F4ADEE}\RP37\A0007506.exe
Risk: High

Name: Downloader.Small.ctf
Path: C:\System Volume Information\_restore{7FA8A30B-975A-4EA6-BC5D-32CCE0F4ADEE}\RP37\A0007507.exe
Risk: High

Name: Trojan.Sinowal.aq
Path: C:\System Volume Information\_restore{7FA8A30B-975A-4EA6-BC5D-32CCE0F4ADEE}\RP37\A0007508.exe
Risk: High

Name: Trojan.ProcKill.DJ
Path: C:\System Volume Information\_restore{7FA8A30B-975A-4EA6-BC5D-32CCE0F4ADEE}\RP37\A0007509.exe
Risk: High

Name: Proxy.Small.bo
Path: C:\System Volume Information\_restore{7FA8A30B-975A-4EA6-BC5D-32CCE0F4ADEE}\RP37\A0007510.exe
Risk: High

Name: Adware.SearchAssistant
Path: C:\System Volume Information\_restore{7FA8A30B-975A-4EA6-BC5D-32CCE0F4ADEE}\RP37\A0007512.dll
Risk: Medium

Name: Adware.SearchAssistant
Path: C:\System Volume Information\_restore{7FA8A30B-975A-4EA6-BC5D-32CCE0F4ADEE}\RP37\A0007513.dll
Risk: Medium

Name: Adware.SearchAssistant
Path: C:\System Volume Information\_restore{7FA8A30B-975A-4EA6-BC5D-32CCE0F4ADEE}\RP37\A0007515.dll
Risk: Medium

Name: Adware.Spysheriff
Path: C:\System Volume Information\_restore{7FA8A30B-975A-4EA6-BC5D-32CCE0F4ADEE}\RP37\A0007517.exe
Risk: Medium

Name: Not-A-Virus.Hoax.Win32.Renos.bw
Path: C:\System Volume Information\_restore{7FA8A30B-975A-4EA6-BC5D-32CCE0F4ADEE}\RP37\A0007523.exe
Risk: Low

Name: Trojan.ProcKill.DJ
Path: C:\System Volume Information\_restore{7FA8A30B-975A-4EA6-BC5D-32CCE0F4ADEE}\RP37\A0007524.exe
Risk: High

Name: Downloader.Small.dib
Path: C:\System Volume Information\_restore{7FA8A30B-975A-4EA6-BC5D-32CCE0F4ADEE}\RP37\A0007525.exe
Risk: High

Name: Trojan.ProcKill.DJ
Path: C:\System Volume Information\_restore{7FA8A30B-975A-4EA6-BC5D-32CCE0F4ADEE}\RP37\A0007526.exe
Risk: High

Name: Downloader.Small.ctf
Path: C:\System Volume Information\_restore{7FA8A30B-975A-4EA6-BC5D-32CCE0F4ADEE}\RP37\A0007527.exe
Risk: High

Name: Downloader.Small.ctf
Path: C:\System Volume Information\_restore{7FA8A30B-975A-4EA6-BC5D-32CCE0F4ADEE}\RP37\A0007528.exe
Risk: High

Name: Trojan.Sinowal.aq
Path: C:\System Volume Information\_restore{7FA8A30B-975A-4EA6-BC5D-32CCE0F4ADEE}\RP37\A0007529.exe
Risk: High

Name: Trojan.ProcKill.DJ
Path: C:\System Volume Information\_restore{7FA8A30B-975A-4EA6-BC5D-32CCE0F4ADEE}\RP37\A0007530.exe
Risk: High

Name: Proxy.Small.bo
Path: C:\System Volume Information\_restore{7FA8A30B-975A-4EA6-BC5D-32CCE0F4ADEE}\RP37\A0007531.exe
Risk: High

Name: Proxy.Small.bo
Path: C:\System Volume Information\_restore{7FA8A30B-975A-4EA6-BC5D-32CCE0F4ADEE}\RP37\A0007532.exe
Risk: High

Hola josefco,

Lo bueno es que las infecciones estan el los archivos de restuarar sistema, vuelve a descativar restaurar sistema . Los demas son cookies (y algo en la papelera), que se van usando Disk Cleaner .

Despues de esto, ya pasa el kaspesky online.

Saludos

Ya hice lo que me dijistes y ahora estoy pasando el kapersky, han aparecido hasta ahora 3 objectos infectados y 2 virus, muchas gracias por todo. Cuando termine el análisis te traigo el informe o borro todo de una vez?

Hola,

Pues, por lo regular se borra y ya, solo hay algunso casos especiales en los que hay que hacer otra cosa. Si quieres borralos, pero vuelve a pasra el antivirus, si vuelven a aparecer, pega ahora si el log.

Bueno, en dado caso que ya no te detecten nada los virus, nos cuentas como est'a tu PC, si ya no hay nada raro (como lo de la spropiedades del escritorio bloqueadas) o popus.

Saludos

Hola Antonio, recién acaba de terminar el análisis. No se pudo borrar nada. Aqui te dejo el informe, porfavor podrías decirme que tengo que borrar manualmente o que tengo que hacer?

Todavía tengo las propiedades del escritorio bloqueadas

---

Scan Statistics:
Total number of scanned objects: 64871
Number of viruses found: 5
Number of infected objects: 7 / 0
Number of suspicious objects: 0
Duration of the scan process: 01:29:08

Infected Object Name / Virus Name / Last Action
C:\36110103225.exe Infected: Trojan-Downloader.Win32.Small.dib skipped
C:\Archivos de programa\Archivos comunes\Microsoft Shared\Web Folders\ibm00001.dll Infected: Trojan-PSW.Win32.Sinowal.aq skipped
C:\Archivos de programa\Archivos comunes\Microsoft Shared\Web Folders\ibm00002.dll Infected: Trojan-PSW.Win32.Sinowal.aq skipped
C:\Archivos de programa\eMule\Temp\001.part Object is locked skipped
C:\Archivos de programa\eMule\Temp\002.part Object is locked skipped
C:\Archivos de programa\eMule\Temp\004.part Object is locked skipped
C:\Archivos de programa\eMule\Temp\006.part Object is locked skipped
C:\Archivos de programa\eMule\Temp\007.part Object is locked skipped
C:\Documents and Settings\All Users\Datos de programa\Microsoft\Dr Watson\user.dmp Object is locked skipped
C:\Documents and Settings\All Users\Datos de programa\Microsoft\Encarta Reference Library\ST02EDLXC\Updates\02E00001.its Object is locked skipped
C:\Documents and Settings\All Users\Datos de programa\Microsoft\Encarta Reference Library\ST02EDLXC\Updates\02E00002.its Object is locked skipped
C:\Documents and Settings\All Users\Datos de programa\Microsoft\Encarta Reference Library\ST02EDLXC\Updates\02E00003.its Object is locked skipped
C:\Documents and Settings\All Users\Datos de programa\Microsoft\Encarta Reference Library\ST02EDLXC\Updates\02E00004.its Object is locked skipped
C:\Documents and Settings\All Users\Datos de programa\Microsoft\Encarta Reference Library\ST02EDLXC\Updates\02E00005.its Object is locked skipped
C:\Documents and Settings\All Users\Datos de programa\Microsoft\Encarta Reference Library\ST02EDLXC\Updates\02E00006.its Object is locked skipped
C:\Documents and Settings\All Users\Datos de programa\Microsoft\Encarta Reference Library\ST02EDLXC\Updates\02E00007.its Object is locked skipped
C:\Documents and Settings\All Users\Datos de programa\Microsoft\Encarta Reference Library\ST02EDLXC\Updates\02E00008.its Object is locked skipped
C:\Documents and Settings\All Users\Datos de programa\Microsoft\Encarta Reference Library\ST02EDLXC\Updates\02E00009.its Object is locked skipped
C:\Documents and Settings\All Users\Datos de programa\Microsoft\Encarta Reference Library\ST02EDLXC\Updates\02E00010.its Object is locked skipped
C:\Documents and Settings\All Users\Datos de programa\Microsoft\Encarta Reference Library\ST02EDLXC\Updates\02E00011.its Object is locked skipped
C:\Documents and Settings\All Users\Datos de programa\Microsoft\Encarta Reference Library\ST02EDLXC\Updates\02E00012.its Object is locked skipped
C:\Documents and Settings\All Users\Datos de programa\Microsoft\Encarta Reference Library\ST02EDLXC\Updates\02E00013.its Object is locked skipped
C:\Documents and Settings\All Users\Datos de programa\Microsoft\Encarta Reference Library\ST02EDLXC\Updates\02E00014.its Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Datos de programa\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Datos de programa\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\josefco\Configuración local\Archivos temporales de Internet\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\josefco\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\josefco\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\josefco\Configuración local\Historial\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\josefco\Configuración local\Temp\Perflib_Perfdata_a38.dat Object is locked skipped
C:\Documents and Settings\josefco\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\josefco\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\josefco\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\JOSÈ MADRID\ntuser.dat Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Configuración local\Archivos temporales de Internet\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Configuración local\Historial\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\MARIA JOSÉ MADRID\Installer\{D6DE02C7-1F47-11D4-9515-00105AE4B89A}\AnimDoc.exe Object is locked skipped
C:\Documents and Settings\MARIA JOSÉ MADRID\Installer\{D6DE02C7-1F47-11D4-9515-00105AE4B89A}\as3.exe Object is locked skipped
C:\Documents and Settings\MARIA JOSÉ MADRID\Installer\{D6DE02C7-1F47-11D4-9515-00105AE4B89A}\browse7b.exe Object is locked skipped
C:\Documents and Settings\MARIA JOSÉ MADRID\Installer\{D6DE02C7-1F47-11D4-9515-00105AE4B89A}\mip.exe Object is locked skipped
C:\Documents and Settings\MARIA JOSÉ MADRID\Installer\{D6DE02C7-1F47-11D4-9515-00105AE4B89A}\psp7.exe Object is locked skipped
C:\Documents and Settings\MARIA JOSÉ MADRID\Installer\{D6DE02C7-1F47-11D4-9515-00105AE4B89A}\Psp7File.exe Object is locked skipped
C:\Documents and Settings\MARIA JOSÉ MADRID\Installer\{D6DE02C7-1F47-11D4-9515-00105AE4B89A}\PSP7workspace.exe Object is locked skipped
C:\Documents and Settings\MARIA JOSÉ MADRID\Installer\{D6DE02C7-1F47-11D4-9515-00105AE4B89A}\tubeconverter.exe Object is locked skipped
C:\Documents and Settings\MARIA JOSÉ MADRID\Installer\{D6DE02C7-1F47-11D4-9515-00105AE4B89A}\workspace2as.exe Object is locked skipped
C:\Documents and Settings\MARIA JOSÉ MADRID\ntuser.dat Object is locked skipped
C:\Documents and Settings\NetworkService.NT AUTHORITY\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService.NT AUTHORITY\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService.NT AUTHORITY\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService.NT AUTHORITY\ntuser.dat.LOG Object is locked skipped
C:\found.000\file0000.chk Object is locked skipped
C:\qpwucqio.exe Infected: Trojan-Downloader.Win32.Agent.alz skipped
C:\RECYCLER\S-1-5-21-1635398023-1059604262-24720492-1006\Dc3.exe Infected: Trojan.Win32.Dialer.qs skipped
C:\RECYCLER\S-1-5-21-1635398023-1059604262-24720492-1006\Dc5.rar/winrzf32.dll Infected: Packed.Win32.Klone.g skipped
C:\RECYCLER\S-1-5-21-1635398023-1059604262-24720492-1006\Dc5.rar RAR: infected - 1 skipped
C:\RECYCLER\S-1-5-21-1635398023-1059604262-24720492-1007\Dc1.jpg Object is locked skipped
C:\RECYCLER\S-1-5-21-1635398023-1059604262-24720492-1007\Dc2.jpg Object is locked skipped
C:\System Volume Information\_restore{7FA8A30B-975A-4EA6-BC5D-32CCE0F4ADEE}\RP38\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.lo g Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MA P Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MA P Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DAT A Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.

Hola,

Prueba iniciando a modo prueba de fallos, y si aun asi no se dejan, utiliza (todavia a mdodo prueba de fallos0 el KillBox y elimina:

C:\36110103225.exe
C:\Archivos de programa\Archivos comunes\Microsoft Shared\Web Folders\ibm00001.dll
C:\Archivos de programa\Archivos comunes\Microsoft Shared\Web Folders\ibm00002.dll
C:\qpwucqio.exe

Estos estan en la papelera de reciclaje, intenta vaciando dicha papelera:
C:\RECYCLER\S-1-5-21-1635398023-1059604262-24720492-1006\Dc3.exe
C:\RECYCLER\S-1-5-21-1635398023-1059604262-24720492-1006\Dc5.rar
Si no se elimina, activa ver archivos ocultos y con esto aparecera la carpeta C:\RECYCLER\, ahi busca los archvios y eliminalos (no borres la carpeta RECYCLER )

Estos archvios estan sospechosos (aunque no los marca como infectados):
C:\Archivos de programa\eMule\Temp\001.part
C:\Archivos de programa\eMule\Temp\002.part
C:\Archivos de programa\eMule\Temp\004.part
C:\Archivos de programa\eMule\Temp\006.part
C:\Archivos de programa\eMule\Temp\007.part

Ve si los puedes eliminar o subelos a Virus Total y pegas el reporte que da.

Nos comentas como esta tu PC...

Saludos

El problema con el escritorio ya se soluciono, pero la computadora está muy lenta, le paso los antispywares y aparentemente elimina los virus pero la computadora esta muy lenta.

Que puedo hacer?

hola,

Vuelven a parecer los virus?

Para ver si se arregla tu PC (en cuanto a la velocidad) has un limpieza de archivos temporales y similares con Disk Cleaner.

Tambien usa el RegSeeker para limpiar el registro. Se usa la opcion "Clean Registry", y vas eliminado todo lo que aparezca. Lo vuelves a pasar hasta que ya no te marque nada.

Tambien esto podria serte 'util:
Trucos para que Windows XP sea mas rápido

Nos comentas...

Saludos

La computadora parece ir un poco mas rapida, pero aún así esta lenta, sobre todo en el internet explorer

Sobre los virus el problema es que paso el Ewido y muestra virus y los borra, luego le paso el ad-aware consigue virus y los borra y luego paso el super antispyware (¿es confiable éste último?) y consigue, y así suscesivamente... ya no se que hacer