Ayuda con virus Bagle.hb y Horst
Muy buenas he intentado limpiarlo con ayuda de alguno de vuestros manuales,pero tengo un problemilla y esque me ha hecho algo en el antivirus y no funciona y tampoco me deja instalar otro y otra cosa que tampoco me deja es iniciar el pc en modo a prueba de fallos.He pasado el Kapresky online para saber los virus que tenia y he pasado tambien el hijackthis os pego el log de los dos a ver si me podeis echar una mano.Un saludo y gracias.

Logfile of HijackThis v1.99.1
Scan saved at 15:51:18, on 09/01/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Archivos de programa\Archivos comunes\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\Archivos de Programa\AUNA ADSL\dslstat.exe
C:\Archivos de Programa\AUNA ADSL\dslagent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Archivos de programa\Messenger\msmsgs.exe
C:\Archivos de programa\Wanadoo\USB ADSL Modem\dslmon.exe
C:\Archivos de programa\WinRamTurbo Free 2.6\wrtf.exe
C:\WINDOWS\system32\svchost.exe
C:\Archivos de programa\Internet Explorer\IEXPLORE.EXE
C:\Archivos de programa\WinRAR\WinRAR.exe
C:\Archivos de programa\Mozilla Firefox\firefox.exe
C:\Archivos de programa\Internet Explorer\IEXPLORE.EXE
C:\DOCUME~1\PMS\CONFIG~1\Temp\Rar$EX88.829\HijackT his.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://es.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://es.search.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.es/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://es.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://es.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://es.search.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://es.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://es.search.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://es.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://es.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://es.search.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O2 - BHO: Flashget Catch Url Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Archivos de programa\FlashGet\jccatch.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Archivos de programa\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Archivos de programa\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: gFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Archivos de programa\FlashGet\getflash.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Archivos de programa\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: FlashGet - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\Archivos de programa\FlashGet\fgiebar.dll
O4 - HKLM\..\Run: [EPSON Stylus C46 Series] "C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0 T1.EXE" /P23 "EPSON Stylus C46 Series" /O6 "USB001" /M "Stylus C46"
O4 - HKLM\..\Run: [DSLSTATEXE] "C:\Archivos de Programa\AUNA ADSL\dslstat.exe" icon
O4 - HKLM\..\Run: [DSLAGENTEXE] "C:\Archivos de Programa\AUNA ADSL\dslagent.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Archivos de programa\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\\PSDrvCheck.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [.nvsvc] C:\WINDOWS\system\smss.exe /w
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Archivos de programa\Messenger\msmsgs.exe" /background
O4 - Global Startup: Acelerador de inicio de AutoCAD.lnk = C:\Archivos de programa\Archivos comunes\Autodesk Shared\acstart16.exe
O4 - Global Startup: DSLMON.lnk = ?
O8 - Extra context menu item: &Descargar con Fl&ashGet - C:\Archivos de programa\FlashGet\jc_link.htm
O8 - Extra context menu item: &Descargar todo con Flas&hGet - C:\Archivos de programa\FlashGet\jc_all.htm
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\ARCHIV~1\Yahoo!\Common\yhexbmeses.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\ARCHIV~1\Yahoo!\Common\yhexbmeses.dll
O9 - Extra button: Referencia - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARCHIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\ARCHIV~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\ARCHIV~1\FlashGet\flashget.exe
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\PMS\Menú Inicio\Programas\IMVU\Run IMVU.lnk
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/spanish//kavwebscan_unicode.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Archivos de programa\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://patrick-in-wonderland.spaces.live.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} - http://www.sibelius.com/download/software/win/ActiveXPlugin.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{05844777-EEFE-42B6-998A-7AEBB0F73390}: NameServer = 62.81.0.33 62.81.16.129
O17 - HKLM\System\CS1\Services\Tcpip\..\{05844777-EEFE-42B6-998A-7AEBB0F73390}: NameServer = 62.81.0.33 62.81.16.129
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARCHIV~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARCHIV~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Archivos de programa\Archivos comunes\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe



Tuesday, January 09, 2007 2:30:02 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.84.0
Kaspersky Anti-Virus database last update: 9/01/2007
Kaspersky Anti-Virus database records: 256959
Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true
Scan Target My Computer
A:\
C:\
D:\
E:\
F:\
G:\
H:\
I:\
J:\
Scan Statistics
Total number of scanned objects 186561
Number of viruses found 4
Number of infected objects 12 / 0
Number of suspicious objects 0
Duration of the scan process 02:49:57

Infected Object Name Virus Name Last Action
C:\Archivos de programa\eMule\Incoming\Ad-Aware SE Personal Edition crack serial.exe Infected: Trojan-Proxy.Win32.Horst.ua skipped
C:\Documents and Settings\All Users\Datos de programa\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Datos de programa\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\LocalService\Configuración local\Archivos temporales de Internet\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Configuración local\Historial\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\PMS\Configuración local\Archivos temporales de Internet\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\PMS\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\PMS\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\PMS\Configuración local\Historial\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\PMS\Configuración local\Historial\History.IE5\MSHist0120070109200701 10\index.dat Object is locked skipped
C:\Documents and Settings\PMS\Configuración local\Temp\19exssd32.a2.exe Infected: Trojan-Downloader.Win32.Horst.aj skipped
C:\Documents and Settings\PMS\Configuración local\Temp\29exmodul32g.1.exe Infected: Trojan-Proxy.Win32.Horst.pt skipped
C:\Documents and Settings\PMS\Configuración local\Temp\37exmodul32g.1.exe Infected: Trojan-Proxy.Win32.Horst.pt skipped
C:\Documents and Settings\PMS\Configuración local\Temp\73exhdd.w.exe Infected: Trojan-Downloader.Win32.Horst.aj skipped
C:\Documents and Settings\PMS\Configuración local\Temp\86exssd32.a2.exe Infected: Trojan-Downloader.Win32.Horst.aj skipped
C:\Documents and Settings\PMS\Configuración local\Temp\94exhdd.w.exe Infected: Trojan-Downloader.Win32.Horst.aj skipped
C:\Documents and Settings\PMS\Configuración local\Temp\setup.exe Infected: Trojan-Proxy.Win32.Horst.ua skipped
C:\Documents and Settings\PMS\Configuración local\Temp\~21.exe Infected: Email-Worm.Win32.Bagle.hc skipped
C:\Documents and Settings\PMS\Configuración local\Temp\~22.exe Infected: Email-Worm.Win32.Bagle.hc skipped
C:\Documents and Settings\PMS\Configuración local\Temp\~23.exe Infected: Email-Worm.Win32.Bagle.hc skipped
C:\Documents and Settings\PMS\Configuración local\Temp\~24.exe Infected: Email-Worm.Win32.Bagle.hc skipped
C:\Documents and Settings\PMS\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\PMS\ntuser.dat Object is locked skipped
C:\Documents and Settings\PMS\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\PMS\UserData\index.dat Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\config\ACEEvent.evt Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\drivers\atapi.sys Object is locked skipped
C:\WINDOWS\system32\drivers\fidbox.dat Object is locked skipped
C:\WINDOWS\system32\drivers\fidbox.idx Object is locked skipped
C:\WINDOWS\system32\drivers\fidbox2.dat Object is locked skipped
C:\WINDOWS\system32\drivers\fidbox2.idx Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MA P Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MA P Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DAT A Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
Scan process completed.

Hola y Bienvenid@ a Forospyware!



Descarga las siguientes herramientas:

• Killbox
  
• Regseeker
  
• Disk Cleaner

Paso 1:

• Desactiva la restauracion del sistema
  
• Configura el sistema para ver todos los archivos ocultos

Paso 2:

Ejecuta el hijackthis sin tener ningn otro programa abierto, marca y dale FixChecked a las siguientes entradas:

O4 - HKLM\..\Run: [.nvsvc] C:\WINDOWS\system\smss.exe /w



Paso 3:

Copia y pega las siguientes entradas en el Killbox (una a la vez) donde dice "Full Path of File to Delete" y le das click al boton rojo con cruz blanca del programa para eliminar el archivo:

C:\WINDOWS\system\smss.exe

C:\Documents and Settings\PMS\Configuración local\Temp\19exssd32.a2.exe

C:\Documents and Settings\PMS\Configuración local\Temp\29exmodul32g.1.exe

C:\Documents and Settings\PMS\Configuración local\Temp\37exmodul32g.1.exe

C:\Documents and Settings\PMS\Configuración local\Temp\73exhdd.w.exe

C:\Documents and Settings\PMS\Configuración local\Temp\86exssd32.a2.exe

C:\Documents and Settings\PMS\Configuración local\Temp\94exhdd.w.exe

C:\Documents and Settings\PMS\Configuración local\Temp\setup.exe

C:\Documents and Settings\PMS\Configuración local\Temp\~21.exe

C:\Documents and Settings\PMS\Configuración local\Temp\~22.exe

C:\Documents and Settings\PMS\Configuración local\Temp\~23.exe

C:\Documents and Settings\PMS\Configuración local\Temp\~24.exe


Limpia los temporales y cookies con el Disk Cleaner

Limpia el registro de windows con el Regseeker (pasalo varias veces hasta que no quede nada por limpiar)



Paso 4:

Reincia el sistema en modo normal

Haz un chequeo con los antivirus online Kaspersky y Ewido


Nos comentas como te fue y dejas un nuevo log para ver como quedo junto con los reportes de los antivirus online (si detectaron infecciones)



Salu2

Muchas gracias estoy en ello pero ahora me voy a trabajar.Luego os digo como ha ido.
Saludos

Bueno pues creo que no lo ha terminado de limpiar.

Aquí os dejo los informes de los antivirus:

__________________________________________________
ewido anti-spyware online scanner
http://www.ewido.net
__________________________________________________


Name: TrackingCookie.Atdmt
Path: C:\Documents and Settings\PMS\Cookies\pms@atdmt[1].txt
Risk: Medium

Name: TrackingCookie.Doubleclick
Path: C:\Documents and Settings\PMS\Cookies\pms@doubleclick[1].txt
Risk: Medium

Name: Downloader.Agent.aii
Path: C:\!KillBox\setup.exe
Risk: High

Name: Downloader.Agent.beg
Path: C:\!KillBox\Temp\19exssd32.a2.exe
Risk: High

Name: Proxy.Horst.pt
Path: C:\!KillBox\Temp\29exmodul32g.1.exe
Risk: High

Name: Proxy.Horst.pt
Path: C:\!KillBox\Temp\37exmodul32g.1.exe
Risk: High

Name: Downloader.Agent.beg
Path: C:\!KillBox\Temp\86exssd32.a2.exe
Risk: High

Name: Downloader.Agent.aii
Path: C:\!KillBox\Temp\setup.exe
Risk: High

Name: Worm.Bagle.hc
Path: C:\!KillBox\Temp\~22.exe
Risk: High

Name: Worm.Bagle.hc
Path: C:\!KillBox\Temp\~24.exe
Risk: High

Name: Worm.Bagle.hc
Path: C:\!KillBox\Temp\~5283.exe
Risk: High

Name: Worm.Bagle.hc
Path: C:\!KillBox\Temp\~52CD.exe
Risk: High

Name: Worm.Bagle.hc
Path: C:\!KillBox\Temp\~52CF.exe
Risk: High

Name: Worm.Bagle.hc
Path: C:\!KillBox\Temp\~52D1.exe
Risk: High

Name: Worm.Bagle.hc
Path: C:\!KillBox\~22.exe
Risk: High

Name: Worm.Bagle.hc
Path: C:\!KillBox\~24.exe
Risk: High

Name: Not-A-Virus.HackTool.Win32.Homac
Path: C:\Archivos de programa\amsn\uninstall.exe
Risk: Low

Name: TrackingCookie.2o7
Path: :mozilla.18:C:\Documents and Settings\PMS\Datos de programa\Mozilla\Firefox\Profiles\8r1vfsbg.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Doubleclick
Path: :mozilla.19:C:\Documents and Settings\PMS\Datos de programa\Mozilla\Firefox\Profiles\8r1vfsbg.default \cookies.txt
Risk: Medium

Name: TrackingCookie.2o7
Path: :mozilla.20:C:\Documents and Settings\PMS\Datos de programa\Mozilla\Firefox\Profiles\8r1vfsbg.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Tradedoubler
Path: :mozilla.43:C:\Documents and Settings\PMS\Datos de programa\Mozilla\Firefox\Profiles\8r1vfsbg.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Tradedoubler
Path: :mozilla.44:C:\Documents and Settings\PMS\Datos de programa\Mozilla\Firefox\Profiles\8r1vfsbg.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Webtrendslive
Path: :mozilla.54:C:\Documents and Settings\PMS\Datos de programa\Mozilla\Firefox\Profiles\8r1vfsbg.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Serving-sys
Path: :mozilla.57:C:\Documents and Settings\PMS\Datos de programa\Mozilla\Firefox\Profiles\8r1vfsbg.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Serving-sys
Path: :mozilla.58:C:\Documents and Settings\PMS\Datos de programa\Mozilla\Firefox\Profiles\8r1vfsbg.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Serving-sys
Path: :mozilla.59:C:\Documents and Settings\PMS\Datos de programa\Mozilla\Firefox\Profiles\8r1vfsbg.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Serving-sys
Path: :mozilla.60:C:\Documents and Settings\PMS\Datos de programa\Mozilla\Firefox\Profiles\8r1vfsbg.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Serving-sys
Path: :mozilla.61:C:\Documents and Settings\PMS\Datos de programa\Mozilla\Firefox\Profiles\8r1vfsbg.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Serving-sys
Path: :mozilla.62:C:\Documents and Settings\PMS\Datos de programa\Mozilla\Firefox\Profiles\8r1vfsbg.default \cookies.txt
Risk: Medium

Name: TrackingCookie.2o7
Path: :mozilla.77:C:\Documents and Settings\PMS\Datos de programa\Mozilla\Firefox\Profiles\8r1vfsbg.default \cookies.txt
Risk: Medium

Name: TrackingCookie.Statcounter
Path: :mozilla.92:C:\Documents and Settings\PMS\Datos de programa\Mozilla\Firefox\Profiles\8r1vfsbg.default \cookies.txt
Risk: Medium


------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Thursday, January 11, 2007 9:20:37 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 11/01/2007
Kaspersky Anti-Virus database records: 243062
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: standard
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\
H:\
I:\
J:\

Scan Statistics:
Total number of scanned objects: 188182
Number of viruses found: 1
Number of infected objects: 2 / 0
Number of suspicious objects: 0
Duration of the scan process: 02:59:18

Infected Object Name / Virus Name / Last Action
C:\!KillBox\~21.exe Infected: Email-Worm.Win32.Bagle.hc skipped
C:\!KillBox\~23.exe Infected: Email-Worm.Win32.Bagle.hc skipped
C:\Documents and Settings\All Users\Datos de programa\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Datos de programa\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\LocalService\Configuración local\Archivos temporales de Internet\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Configuración local\Historial\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\PMS\Configuración local\Archivos temporales de Internet\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\PMS\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\PMS\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\PMS\Configuración local\Historial\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\PMS\Configuración local\Historial\History.IE5\MSHist0120070111200701 12\index.dat Object is locked skipped
C:\Documents and Settings\PMS\Configuración local\Temp\Perflib_Perfdata_728.dat Object is locked skipped
C:\Documents and Settings\PMS\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\PMS\ntuser.dat Object is locked skipped
C:\Documents and Settings\PMS\ntuser.dat.LOG Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\ACEEvent.evt Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\drivers\atapi.sys Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MA P Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MA P Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DAT A Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped

Scan process completed.

Buenas acabo de reiniciar despues de pasar el kaspersky y se me han empezado a abrir muchas paginas web al conectar a internet me he fijado que me crea una carpeta en c:WINDOWS llamada "exefld" dentro de esa carpeta me crea archivos como del tipo 4321.exe la borré antes y ahora está otra vez y me he fijado que en los temporales me crea archivos del mismo tipo y los borré pero me vuelven a salir.

Primero, entra en Mi PC -> Disco Local (C:) y elimina la carpeta !Killbox


Segundo, descarga y ejecuta el AVG Antispyware, haz un chequeo con dicho programa primero en modo normal y luego en modo a prueba de fallos


Por último, por favor, instala un antivirus




Salu2

No me deja iniciar en modo a prueba de fallos y no me deja insalar ningun antivirus.

Haz un chequeo con el Panda y el BitDefender online y deja los reportes




Salu2