Foro de InfoSpyware - Foro de Hijackthis - Foro de Virus

Hola
Gracias por la ayuda el prob lema que tengo es que al pasar el antivirus del Panda y despues de tener problemas con la pc, entre ellos el no poder abrir ciertas paginas como el correo del yahoo y hotmail; me sale un reporte donde dice lo sgte:
Virus:trj/sters.d Desinfectado Sistema Operativo
Virus:trj/venker.a Desinfectado Sitema Operativo
Adware:adware/razespyware No desinfectado c:\windows\system32\white.lst
Adware:adware/cashdeluxe No desinfectado c:\windows\system32\wlo32.ini
Adware:adware/dollarrevenue No desinfetado c:\windows\timessquare1.dat
Adware:adware/webattake No desinfectado c:\windows\uniq
Adware:adware/craft No desinfectado Registro de Windows
Virus:trj/small.lv Desinfectado Sistema Operativo
Adware:adware/stoolbar No desinfectado Registro de Windows
Adware:adware/mediatickets No desinfectado Registro de Windows

Luego hice una limpieza y me dio este reporte:

Virus:trj/sters.d Desinfectado Sistema Operativo
Adware:adware/cashdeluxe No desinfectado c:\windows\system32\wlo32.ini
Adware:adware/craft No desinfectado Registro de Windows
Adware:adware/stoolbar No desinfectado Registro de Windows
Adware:adware/mediatickets No desinfectado Registro de Windows

Antes no podia acceder al foro ahora si gracias por la ayuda que me puedan dar

hola, a ver, busca y elimina esto:

c:\windows\system32\wlo32.ini

si no se deja, utiliza killbox

luego procede a escanear con el ewido y el kaspersky online, en ese orden, peganos el reporte de kaspersky y de lo que el ewido no te elimine


salu2

Gracias por la pronta respuesta a continuacion envio los resultados del Ewido y Kapersky, los pase en ese orden:

EWIDO
__________________________________________________
ewido anti-spyware online scanner
http://www.ewido.net
__________________________________________________


Name: Proxy.Wopla.c
Path: C:\System Volume Information\_restore{D3230E03-57BE-4A9E-A2FC-1A055A5B9BA7}(2)\RP110\A0117802.dll
Risk: High

Name: Proxy.Wopla.c
Path: C:\System Volume Information\_restore{D3230E03-57BE-4A9E-A2FC-1A055A5B9BA7}(2)\RP110\A0117803.dll
Risk: High

Name: Hijacker.Small.hx
Path: C:\System Volume Information\_restore{D3230E03-57BE-4A9E-A2FC-1A055A5B9BA7}(2)\RP110\A0117804.exe
Risk: High

Name: Worm.Bagz.i
Path: C:\System Volume Information\_restore{D3230E03-57BE-4A9E-A2FC-1A055A5B9BA7}(2)\RP111\A0117875.exe
Risk: High

Name: Worm.Bagz.i
Path: C:\System Volume Information\_restore{D3230E03-57BE-4A9E-A2FC-1A055A5B9BA7}(2)\RP111\A0117876.exe
Risk: High

Name: Worm.Bagz.i
Path: C:\System Volume Information\_restore{D3230E03-57BE-4A9E-A2FC-1A055A5B9BA7}(2)\RP111\A0117877.exe
Risk: High

KAPERSKY-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Tuesday, November 21, 2006 2:07:46 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 21/11/2006
Kaspersky Anti-Virus database records: 243671
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\

Scan Statistics:
Total number of scanned objects: 48486
Number of viruses found: 0
Number of infected objects: 0 / 0
Number of suspicious objects: 0
Duration of the scan process: 00:34:43

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\Administrador\Configuración local\Archivos temporales de Internet\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Administrador\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Administrador\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Administrador\Configuración local\Historial\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Administrador\Configuración local\Temp\Perflib_Perfdata_494.dat Object is locked skipped
C:\Documents and Settings\Administrador\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Administrador\ntuser.dat Object is locked skipped
C:\Documents and Settings\Administrador\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\All Users\Datos de programa\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Datos de programa\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\LocalService\Configuración local\Archivos temporales de Internet\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Configuración local\Historial\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{D3230E03-57BE-4A9E-A2FC-1A055A5B9BA7}\RP243\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.lo g Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MA P Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MA P Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DAT A Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.


Y con respecto a c:\windows\system32\wlo32.ini
no lo encontre, solo halle: wlo32.bin
¿Debo eliminar este archivo o no?
Mil gracias

Hola...





Desactiva restaurar sistema

Reinicia

Activalo

Reinicia

Gracias
Hice todo segun lo indicado.

buehh, presentaas algun otro problema?

salu2

Hasta ahora todo bien , asi que espero que este solucionado todo Gracias por las respuestas y por la atención rapida.