Foro de InfoSpyware - Foro de Hijackthis - Foro de Virus

Me funcionaba mal, iba muy lento y arrancaba muy muy lento el ordenador, he realizado los pasos previos indicados, (desconectar la restauracion del sistema, pasar los SpybotSD i ad-Aware) despues he realizado un escaneado con Kaspersky online y me salen 4 virus y 136 ficheros infectados, algunos no los puede eliminar con el File ASSASSIN, no se que hacer , alguien me puede ayudar, no se como seguir.
¿El Kaspersky Online no pede eliminar los virus?
¿ Porque el Kaspersky normal no me ha detectado los virus?. ¿Que hago?.
Gracias de antemano a quien pueda ayudarme.
Si lo creeis necesario puedo poner el informe del scaneo con el Kasperky Online

Hola

Usa CCleaner para limpiar cookies y temporales.

Haz un escaneo online con:

• Ewido con la opción Remove Infections activada (lee el Manual) <-- Elimina todo lo que encuentre
• Karpersky (lee el Manual)

Y pegas aquí el reporte que te genere el Karpersky

Saludos

Este es el informe del Kaspersky online, es largo:

Thursday, May 17, 2007 4:29:36 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 17/05/2007
Kaspersky Anti-Virus database records: 302228
Scan Settings
Scan using the following antivirus database standard
Scan Archives true
Scan Mail Bases true
Scan Target My Computer
A:\
C:\
D:\
F:\
G:\
H:\
I:\
L:\
M:\
N:\
O:\
Scan Statistics
Total number of scanned objects 79980
Number of viruses found 4
Number of infected objects 136 / 0
Number of suspicious objects 61
Duration of the scan process 04:31:47

Infected Object Name Virus Name Last Action
C:\Documents and Settings\Administrador\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Administrador\NTUSER.dat.LOG Object is locked skipped
C:\Documents and Settings\All Users\Datos de programa\Kaspersky Lab\AVP6\Report\0137_pdm_eventcritlog.rpt Object is locked skipped
C:\Documents and Settings\All Users\Datos de programa\Kaspersky Lab\AVP6\Report\0137_pdm_eventlog.rpt Object is locked skipped
C:\Documents and Settings\All Users\Datos de programa\Kaspersky Lab\AVP6\Report\0138_File_Monitoring_eventlog.rpt Object is locked skipped
C:\Documents and Settings\All Users\Datos de programa\Kaspersky Lab\AVP6\Report\013c_Web_Monitoring_eventlog.rpt Object is locked skipped
C:\Documents and Settings\All Users\Datos de programa\Kaspersky Lab\AVP6\Report\0147_Scan_Startup_eventlog.rpt Object is locked skipped
C:\Documents and Settings\All Users\Datos de programa\Kaspersky Lab\AVP6\Report\detected.idx Object is locked skipped
C:\Documents and Settings\All Users\Datos de programa\Kaspersky Lab\AVP6\Report\detected.rpt Object is locked skipped
C:\Documents and Settings\All Users\Datos de programa\Kaspersky Lab\AVP6\Report\eventlog.rpt Object is locked skipped
C:\Documents and Settings\All Users\Datos de programa\Kaspersky Lab\AVP6\Report\report.rpt Object is locked skipped
C:\Documents and Settings\LocalService\Configuración local\Archivos temporales de Internet\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Configuración local\Historial\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Mi PC\Configuración local\Archivos temporales de Internet\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Mi PC\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Mi PC\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Mi PC\Configuración local\Historial\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Mi PC\Configuración local\Historial\History.IE5\MSHist0120070517200705 18\index.dat Object is locked skipped
C:\Documents and Settings\Mi PC\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Mi PC\Datos de programa\Thunderbird\Profiles\tvnj4jkr.default\Mai l\Local Folders\Junk/[From "Rocio Flores" ][Date Thu, 15 Feb 2007 11:23:06 -0600]/UNNAMED/[From Rucker Ray ][Date Thu, 15 Feb 2007 12:47:40 -0500]/UNNAMED/[From eyeglasses ][Date Thu, 15 Feb 2007 13:25:45 -0600]/UNNAMED/[From Combs" ][Date 1 Jan 1997 00:37:26 -0060]/UNNA ... /[From "radius investments" ][Date Thu, 22 Feb 2007 13:07:13 +0900]/UNNAMED Infected: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Mi PC\Datos de programa\Thunderbird\Profiles\tvnj4jkr.default\Mai l\Local Folders\Junk/[From "Rocio Flores" ][Date Thu, 15 Feb 2007 11:23:06 -0600]/UNNAMED/[From Rucker Ray ][Date Thu, 15 Feb 2007 12:47:40 -0500]/UNNAMED/[From eyeglasses ][Date Thu, 15 Feb 2007 13:25:45 -0600]/UNNAMED/[From Combs" ][Date 1 Jan 1997 00:37:26 -0060]/UNNA ... /[From "radius investments" ][Date 22 Feb 2007 04:27:02 -0200]/UNNAMED Infected: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Mi PC\Datos de programa\Thunderbird\Profiles\tvnj4jkr.default\Mai l\Local Folders\Junk/[From "Rocio Flores" ][Date Thu, 15 Feb 2007 11:23:06 -0600]/UNNAMED/[From Rucker Ray ][Date Thu, 15 Feb 2007 12:47:40 -0500]/UNNAMED/[From eyeglasses ][Date Thu, 15 Feb 2007 13:25:45 -0600]/UNNAMED/[From Combs" ][Date 1 Jan 1997 00:37:26 -0060]/UNNA ... /[From "radius investments" ][Date Thu, 22 Feb 2007 10:14:40 +0900]/UNNAMED Infected: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Mi PC\Datos de programa\Thunderbird\Profiles\tvnj4jkr.default\Mai l\Local Folders\Junk/[From "Rocio Flores" ][Date Thu, 15 Feb 2007 11:23:06 -0600]/UNNAMED/[From Rucker Ray ][Date Thu, 15 Feb 2007 12:47:40 -0500]/UNNAMED/[From eyeglasses ][Date Thu, 15 Feb 2007 13:25:45 -0600]/UNNAMED/[From Combs" ][Date 1 Jan 1997 00:37:26 -0060]/UNNA ... /[From "radius investments" ][Date Thu, 22 Feb 2007 00:14:38 +0100]/UNNAMED Infected: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Mi PC\Datos de programa\Thunderbird\Profiles\tvnj4jkr.default\Mai l\Local Folders\Junk/[From "Rocio Flores" ][Date Thu, 15 Feb 2007 11:23:06 -0600]/UNNAMED/[From Rucker Ray ][Date Thu, 15 Feb 2007 12:47:40 -0500]/UNNAMED/[From eyeglasses ][Date Thu, 15 Feb 2007 13:25:45 -0600]/UNNAMED/[From Combs" ][Date 1 Jan 1997 00:37:26 -0060]/UNNA ... /[From "radius investments" ][Date Wed, 21 Feb 2007 17:05:17 -0600]/UNNAMED Infected: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Mi PC\Datos de programa\Thunderbird\Profiles\tvnj4jkr.default\Mai l\Local Folders\Junk/[From "Rocio Flores" ][Date Thu, 15 Feb 2007 11:23:06 -0600]/UNNAMED/[From Rucker Ray ][Date Thu, 15 Feb 2007 12:47:40 -0500]/UNNAMED/[From eyeglasses ][Date Thu, 15 Feb 2007 13:25:45 -0600]/UNNAMED/[From Combs" ][Date 1 Jan 1997 00:37:26 -0060]/UNNA ... /[From "radius investments" ][Date Wed, 21 Feb 2007 19:55:38 +0100]/UNNAMED Infected: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Mi PC\Datos de programa\Thunderbird\Profiles\tvnj4jkr.default\Mai l\Local Folders\Junk/[From "Rocio Flores" ][Date Thu, 15 Feb 2007 11:23:06 -0600]/UNNAMED/[From Rucker Ray ][Date Thu, 15 Feb 2007 12:47:40 -0500]/UNNAMED/[From eyeglasses ][Date Thu, 15 Feb 2007 13:25:45 -0600]/UNNAMED/[From Combs" ][Date 1 Jan 1997 00:37:26 -0060]/UNNA ... /[From "radius investments" ][Date Sat, 17 Feb 2007 16:20:47 +0300]/html Infected: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Mi PC\Datos de programa\Thunderbird\Profiles\tvnj4jkr.default\Mai l\Local Folders\Junk/[From "Rocio Flores" ][Date Thu, 15 Feb 2007 11:23:06 -0600]/UNNAMED/[From Rucker Ray ][Date Thu, 15 Feb 2007 12:47:40 -0500]/UNNAMED/[From eyeglasses ][Date Thu, 15 Feb 2007 13:25:45 -0600]/UNNAMED/[From Combs" ][Date 1 Jan 1997 00:37:26 -0060]/UNNA ... /[From "radius investments" ][Date Sat, 17 Feb 2007 17:19:18 +0000]/UNNAMED Infected: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Mi PC\Datos de programa\Thunderbird\Profiles\tvnj4jkr.default\Mai l\Local Folders\Junk/[From "Rocio Flores" ][Date Thu, 15 Feb 2007 11:23:06 -0600]/UNNAMED/[From Rucker Ray ][Date Thu, 15 Feb 2007 12:47:40 -0500]/UNNAMED/[From eyeglasses ][Date Thu, 15 Feb 2007 13:25:45 -0600]/UNNAMED/[From Combs" ][Date 1 Jan 1997 00:37:26 -0060]/UNNA ... /[From "radius investments" ][Date Sat, 17 Feb 2007 20:50:17 +0800]/UNNAMED Infected: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Mi PC\Datos de programa\Thunderbird\Profiles\tvnj4jkr.default\Mai l\Local Folders\Junk/[From "Rocio Flores" ][Date Thu, 15 Feb 2007 11:23:06 -0600]/UNNAMED/[From Rucker Ray ][Date Thu, 15 Feb 2007 12:47:40 -0500]/UNNAMED/[From eyeglasses ][Date Thu, 15 Feb 2007 13:25:45 -0600]/UNNAMED/[From Combs" ][Date 1 Jan 1997 00:37:26 -0060]/UNNA ... /[From "radius investments" ][Date Sat, 17 Feb 2007 04:46:08 -0800]/UNNAMED Infected: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Mi PC\Datos de programa\Thunderbird\Profiles\tvnj4jkr.default\Mai l\Local Folders\Junk/[From "Rocio Flores" ][Date Thu, 15 Feb 2007 11:23:06 -0600]/UNNAMED/[From Rucker Ray ][Date Thu, 15 Feb 2007 12:47:40 -0500]/UNNAMED/[From eyeglasses ][Date Thu, 15 Feb 2007 13:25:45 -0600]/UNNAMED/[From Combs" ][Date 1 Jan 1997 00:37:26 -0060]/UNNA ... /[From "radius investments" ][Date Sat, 17 Feb 2007 20:40:22 +0800]/UNNAMED Infected: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Mi PC\Datos de programa\Thunderbird\Profiles\tvnj4jkr.default\Mai l\Local Folders\Junk/[From "Rocio Flores" ][Date Thu, 15 Feb 2007 11:23:06 -0600]/UNNAMED/[From Rucker Ray ][Date Thu, 15 Feb 2007 12:47:40 -0500]/UNNAMED/[From eyeglasses ][Date Thu, 15 Feb 2007 13:25:45 -0600]/UNNAMED/[From Combs" ][Date 1 Jan 1997 00:37:26 -0060]/UNNA ... /[From "radius investments" ][Date Sat, 17 Feb 2007 14:25:46 +0200]/UNNAMED Infected: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Mi PC\Datos de programa\Thunderbird\Profiles\tvnj4jkr.default\Mai l\Local Folders\Junk/[From "Rocio Flores" ][Date Thu, 15 Feb 2007 11:23:06 -0600]/UNNAMED/[From Rucker Ray ][Date Thu, 15 Feb 2007 12:47:40 -0500]/UNNAMED/[From eyeglasses ][Date Thu, 15 Feb 2007 13:25:45 -0600]/UNNAMED/[From Combs" ][Date 1 Jan 1997 00:37:26 -0060]/UNNA ... /[From "radius investments" ][Date Sat, 17 Feb 2007 13:29:37 +0300]/UNNAMED Infected: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Mi PC\Datos de programa\Thunderbird\Profiles\tvnj4jkr.default\Mai l\Local Folders\Junk/[From "Rocio Flores" ][Date Thu, 15 Feb 2007 11:23:06 -0600]/UNNAMED/[From Rucker Ray ][Date Thu, 15 Feb 2007 12:47:40 -0500]/UNNAMED/[From eyeglasses ][Date Thu, 15 Feb 2007 13:25:45 -0600]/UNNAMED/[From Combs" ][Date 1 Jan 1997 00:37:26 -0060]/UNNA ... /[From "radius investments" ][Date Sat, 17 Feb 2007 09:24:03 +0100 (added by postmaster@telefonica.net)]/UNNAMED Infected: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Mi PC\Datos de programa\Thunderbird\Profiles\tvnj4jkr.default\Mai l\Local Folders\Junk/[From "Rocio Flores" ][Date Thu, 15 Feb 2007 11:23:06 -0600]/UNNAMED/[From Rucker Ray ][Date Thu, 15 Feb 2007 12:47:40 -0500]/UNNAMED/[From eyeglasses ][Date Thu, 15 Feb 2007 13:25:45 -0600]/UNNAMED/[From Combs" ][Date 1 Jan 1997 00:37:26 -0060]/UNNAM ... /[From "Fifth Third Bank" ][Date Sat, 17 Feb 2007 17:35:11 +1100]/UNNAMED Infected: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Mi PC\Datos de programa\Thunderbird\Profiles\tvnj4jkr.default\Mai l\Local Folders\Junk/[From "Rocio Flores" ][Date Thu, 15 Feb 2007 11:23:06 -0600]/UNNAMED/[From Rucker Ray ][Date Thu, 15 Feb 2007 12:47:40 -0500]/UNNAMED/[From eyeglasses ][Date Thu, 15 Feb 2007 13:25:45 -0600]/UNNAMED/[From Combs" ][Date 1 Jan 1997 00:37:26 -0060]/UNNAM ... /[From "Fifth Third Bank" ][Date Fri, 16 Feb 2007 18:17:49 -1200]/UNNAMED Infected: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Mi PC\Datos de programa\Thunderbird\Profiles\tvnj4jkr.default\Mai l\Local Folders\Junk/[From "Rocio Flores" ][Date Thu, 15 Feb 2007 11:23:06 -0600]/UNNAMED/[From Rucker Ray ][Date Thu, 15 Feb 2007 12:47:40 -0500]/UNNAMED/[From eyeglasses ][Date Thu, 15 Feb 2007 13:25:45 -0600]/UNNAMED/[From Combs" ][Date 1 Jan 1997 00:37:26 -0060]/UNNAM ... /[From "Fifth Third Bank" ][Date Sat, 17 Feb 2007 05:17:00 +0100]/UNNAMED Infected: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Mi PC\Datos de programa\Thunderbird\Profiles\tvnj4jkr.default\Mai l\Local Folders\Junk/[From "Rocio Flores" ][Date Thu, 15 Feb 2007 11:23:06 -0600]/UNNAMED/[From Rucker Ray ][Date Thu, 15 Feb 2007 12:47:40 -0500]/UNNAMED/[From eyeglasses ][Date Thu, 15 Feb 2007 13:25:45 -0600]/UNNAMED/[From Combs" ][Date 1 Jan 1997 00:37:26 -0060]/UNNAM ... /[From "Fifth Third Bank" ][Date Sat, 17 Feb 2007 11:34:38 +0900]/UNNAMED Infected: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Mi PC\Datos de programa\Thunderbird\Profiles\tvnj4jkr.default\Mai l\Local Folders\Junk/[From "Rocio Flores" ][Date Thu, 15 Feb 2007 11:23:06 -0600]/UNNAMED/[From Rucker Ray ][Date Thu, 15 Feb 2007 12:47:40 -0500]/UNNAMED/[From eyeglasses ][Date Thu, 15 Feb 2007 13:25:45 -0600]/UNNAMED/[From Combs" ][Date 1 Jan 1997 00:37:26 -0060]/UNNAM ... /[From "Fifth Third Bank" ][Date Sat, 17 Feb 2007 10:31:47 +0800]/UNNAMED Infected: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Mi PC\Datos de programa\Thunderbird\Profiles\tvnj4jkr.default\Mai l\Local Folders\Junk/[From "Rocio Flores" ][Date Thu, 15 Feb 2007 11:23:06 -0600]/UNNAMED/[From Rucker Ray ][Date Thu, 15 Feb 2007 12:47:40 -0500]/UNNAMED/[From eyeglasses ][Date Thu, 15 Feb 2007 13:25:45 -0600]/UNNAMED/[From Combs" ][Date 1 Jan 1997 00:37:26 -0060]/UNNAM ... /[From "Fifth Third Bank" ][Date Fri, 16 Feb 2007 18:22:30 -0800]/UNNAMED Infected: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Mi PC\Datos de programa\Thunderbird\Profiles\tvnj4jkr.default\Mai l\Local Folders\Junk/[From "Rocio Flores" ][Date Thu, 15 Feb 2007 11:23:06 -0600]/UNNAMED/[From Rucker Ray ][Date Thu, 15 Feb 2007 12:47:40 -0500]/UNNAMED/[From eyeglasses ][Date Thu, 15 Feb 2007 13:25:45 -0600]/UNNAMED/[From Combs" ][Date 1 Jan 1997 00:37:26 -0060]/UNNAM ... /[From "Fifth Third Bank" ][Date Fri, 16 Feb 2007 15:01:06 -0800]/UNNAMED Infected: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Mi PC\Datos de programa\Thunderbird\Profiles\tvnj4jkr.default\Mai l\Local Folders\Junk/[From "Rocio Flores" ][Date Thu, 15 Feb 2007 11:23:06 -0600]/UNNAMED/[From Rucker Ray ][Date Thu, 15 Feb 2007 12:47:40 -0500]/UNNAMED/[From eyeglasses ][Date Thu, 15 Feb 2007 13:25:45 -0600]/UNNAMED/[From Combs" ][Date 1 Jan 1997 00:37:26 -0060]/UNNAM ... /[From "Fifth Third Bank" ][Date Fri, 16 Feb 2007 21:57:55 +0100 (added by postmaster@telefonica.net)]/UNNAMED Infected: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Mi PC\Datos de programa\Thunderbird\Profiles\tvnj4jkr.default\Mai l\Local Folders\Junk/[From "Rocio Flores" ][Date Thu, 15 Feb 2007 11:23:06 -0600]/UNNAMED/[From Rucker Ray ][Date Thu, 15 Feb 2007 12:47:40 -0500]/UNNAMED/[From eyeglasses ][Date Thu, 15 Feb 2007 13:25:45 -0600]/UNNAMED/[From Combs" ][Date 1 Jan 1997 00:37:26 -0060]/UNNAMED/[F ... /[From "Radius Group" ][Date Fri, 16 Feb 2007 20:24:40 +0300]/UNNAMED Infected: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Mi PC\Datos de programa\Thunderbird\Profiles\tvnj4jkr.default\Mai l\Local Folders\Junk/[From "Rocio Flores" ][Date Thu, 15 Feb 2007 11:23:06 -0600]/UNNAMED/[From Rucker Ray ][Date Thu, 15 Feb 2007 12:47:40 -0500]/UNNAMED/[From eyeglasses ][Date Thu, 15 Feb 2007 13:25:45 -0600]/UNNAMED/[From Combs" ][Date 1 Jan 1997 00:37:26 -0060]/UNNAMED/[F ... /[From "Radius Group" ][Date Fri, 16 Feb 2007 19:52:19 +0100]/UNNAMED Infected: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Mi PC\Datos de programa\Thunderbird\Profiles\tvnj4jkr.default\Mai l\Local Folders\Junk/[From "Rocio Flores" ][Date Thu, 15 Feb 2007 11:23:06 -0600]/UNNAMED/[From Rucker Ray ][Date Thu, 15 Feb 2007 12:47:40 -0500]/UNNAMED/[From eyeglasses ][Date Thu, 15 Feb 2007 13:25:45 -0600]/UNNAMED/[From Combs" ][Date 1 Jan 1997 00:37:26 -0060]/UNNAMED/[F ... /[From "Radius Group" ][Date Fri, 16 Feb 2007 09:52:07 -0800]/UNNAMED Infected: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Mi PC\Datos de programa\Thunderbird\Profiles\tvnj4jkr.default\Mai l\Local Folders\Junk/[From "Rocio Flores" ][Date Thu, 15 Feb 2007 11:23:06 -0600]/UNNAMED/[From Rucker Ray ][Date Thu, 15 Feb 2007 12:47:40 -0500]/UNNAMED/[From eyeglasses ][Date Thu, 15 Feb 2007 13:25:45 -0600]/UNNAMED/[From Combs" ][Date 1 Jan 1997 00:37:26 -0060]/UNNAMED/[F ... /[From "Radius Group" ][Date Fri, 16 Feb 2007 19:52:39 +0200]/UNNAMED Infected: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Mi PC\Datos de programa\Thunderbird\Profiles\tvnj4jkr.default\Mai l\Local Folders\Junk/[From "Rocio Flores" ][Date Thu, 15 Feb 2007 11:23:06 -0600]/UNNAMED/[From Rucker Ray ][Date Thu, 15 Feb 2007 12:47:40 -0500]/UNNAMED/[From eyeglasses ][Date Thu, 15 Feb 2007 13:25:45 -0600]/UNNAMED/[From Combs" ][Date 1 Jan 1997 00:37:26 -0060]/UNNAMED/[F ... /[From "Radius Group" ][Date 16 Feb 2007 17:39:31 -0120]/UNNAMED Infected: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Mi PC\Datos de programa\Thunderbird\Profiles\tvnj4jkr.default\Mai l\Local Folders\Junk/[From "Rocio Flores" ][Date Thu, 15 Feb 2007 11:23:06 -0600]/UNNAMED/[From Rucker Ray ][Date Thu, 15 Feb 2007 12:47:40 -0500]/UNNAMED/[From eyeglasses ][Date Thu, 15 Feb 2007 13:25:45 -0600]/UNNAMED/[From Combs" ][Date 1 Jan 1997 00:37:26 -0060]/UNNAMED/[F ... /[From "Radius Group" ][Date Fri, 16 Feb 2007 17:22:20 +0200]/UNNAMED Infected: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Mi PC\Datos de programa\Thunderbird\Profiles\tvnj4jkr.default\Mai l\Local Folders\Junk/[From "Rocio Flores" ][Date Thu, 15 Feb 2007 11:23:06 -0600]/UNNAMED/[From Rucker Ray ][Date Thu, 15 Feb 2007 12:47:40 -0500]/UNNAMED/[From eyeglasses ][Date Thu, 15 Feb 2007 13:25:45 -0600]/UNNAMED/[From Combs" ][Date 1 Jan 1997 00:37:26 -0060]/UNNAMED/[F ... /[From "Radius Group" ][Date Fri, 16 Feb 2007 15:55:15 +0100]/UNNAMED Infected: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Mi PC\Datos de programa\Thunderbird\Profiles\tvnj4jkr.default\Mai l\Local Folders\Junk/[From "Rocio Flores" ][Date Thu, 15 Feb 2007 11:23:06 -0600]/UNNAMED/[From Rucker Ray ][Date Thu, 15 Feb 2007 12:47:40 -0500]/UNNAMED/[From eyeglasses ][Date Thu, 15 Feb 2007 13:25:45 -0600]/UNNAMED/[From Combs" ][Date 1 Jan 1997 00:37:26 -0060]/UNNAMED/[F ... /[From "Radius Group" ][Date Fri, 16 Feb 2007 15:52:09 +0100]/UNNAMED Infected: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Mi PC\Datos de programa\Thunderbird\Profiles\tvnj4jkr.default\Mai l\Local Folders\Junk/[From "Rocio Flores" ][Date Thu, 15 Feb 2007 11:23:06 -0600]/UNNAMED/[From Rucker Ray ][Date Thu, 15 Feb 2007 12:47:40 -0500]/UNNAMED/[From eyeglasses ][Date Thu, 15 Feb 2007 13:25:45 -0600]/UNNAMED/[From Combs" ][Date 1 Jan 1997 00:37:26 -0060]/UNNAMED/[F ... /[From "Radius Group" ][Date Fri, 16 Feb 2007 16:18:29 +0200]/UNNAMED Infected: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Mi PC\Datos de programa\Thunderbird\Profiles\tvnj4jkr.default\Mai l\Local Folders\Junk/[From "Rocio Flores" ][Date Thu, 15 Feb 2007 11:23:06 -0600]/UNNAMED/[From Rucker Ray ][Date Thu, 15 Feb 2007 12:47:40 -0500]/UNNAMED/[From eyeglasses ][Date Thu, 15 Feb 2007 13:25:45 -0600]/UNNAMED/[From Combs" ][Date 1 Jan 1997 00:37:26 -0060]/UNNAMED/[F ... /[From "Radius Group" ][Date Fri, 16 Feb 2007 20:04:26 +0800]/UNNAMED Infected: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Mi PC\Datos de programa\Thunderbird\Profiles\tvnj4jkr.default\Mai l\Local Folders\Junk/[From "Rocio Flores" ][Date Thu, 15 Feb 2007 11:23:06 -0600]/UNNAMED/[From Rucker Ray ][Date Thu, 15 Feb 2007 12:47:40 -0500]/UNNAMED/[From eyeglasses ][Date Thu, 15 Feb 2007 13:25:45 -0600]/UNNAMED/[From Combs" ][Date 1 Jan 1997 00:37:26 -0060]/UNNAMED/[F ... /[From "Radius Group" ][Date Fri, 16 Feb 2007 04:52:48 -0600]/UNNAMED Infected: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Mi PC\Datos de programa\Thunderbird\Profiles\tvnj4jkr.default\Mai l\Local Folders\Junk/[From "Rocio Flores" ][Date Thu, 15 Feb 2007 11:23:06 -0600]/UNNAMED/[From Rucker Ray ][Date Thu, 15 Feb 2007 12:47:40 -0500]/UNNAMED/[From eyeglasses ][Date Thu, 15 Feb 2007 13:25:45 -0600]/UNNAMED/[From Combs" ][Date 1 Jan 1997 00:37:26 -0060]/UNNAMED/[F ... /[From "Radius Group" ][Date 16 Feb 2007 09:51:31 -0420]/UNNAMED Infected: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Mi PC\Datos de programa\Thunderbird\Profiles\tvnj4jkr.default\Mai l\Local Folders\Junk/[From "Rocio Flores" ][Date Thu, 15 Feb 2007 11:23:06 -0600]/UNNAMED/[From Rucker Ray ][Date Thu, 15 Feb 2007 12:47:40 -0500]/UNNAMED/[From eyeglasses ][Date Thu, 15 Feb 2007 13:25:45 -0600]/UNNAMED/[From Combs" ][Date 1 Jan 1997 00:37:26 -0060]/UNNAMED/[F ... /[From "Radius Group" ][Date Thu, 01 Mar 2007 10:48:56 +0400]/UNNAMED Infected: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Mi PC\Datos de programa\Thunderbird\Profiles\tvnj4jkr.default\Mai l\Local Folders\Junk/[From "Rocio Flores" ][Date Thu, 15 Feb 2007 11:23:06 -0600]/UNNAMED/[From Rucker Ray ][Date Thu, 15 Feb 2007 12:47:40 -0500]/UNNAMED/[From eyeglasses ][Date Thu, 15 Feb 2007 13:25:45 -0600]/UNNAMED/[From Combs" ][Date 1 Jan 1997 00:37:26 -0060]/UNNAMED/[F ... /[From "Radius Group" ][Date Fri, 16 Feb 2007 07:47:33 +0100 (added by postmaster@telefonica.net)]/UNNAMED Infected: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Mi PC\Datos de programa\Thunderbird\Profiles\tvnj4jkr.default\Mai l\Local Folders\Junk/[From "Rocio Flores" ][Date Thu, 15 Feb 2007 11:23:06 -0600]/UNNAMED/[From Rucker Ray ][Date Thu, 15 Feb 2007 12:47:40 -0500]/UNNAMED/[From eyeglasses ][Date Thu, 15 Feb 2007 13:25:45 -0600]/UNNAMED/[From Combs" ][Date 1 Jan 1997 00:37:26 -0060]/UNNAMED/[From Helene Riddle ][Date Thu, 15 Feb 2007 21:08:06 -0800]/UNNAMED Infected: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Mi PC\Datos de programa\Thunderbird\Profiles\tvnj4jkr.default\Mai l\Local Folders\Junk/[From "Rocio Flores" ][Date Thu, 15 Feb 2007 11:23:06 -0600]/UNNAMED/[From Rucker Ray ][Date Thu, 15 Feb 2007 12:47:40 -0500]/UNNAMED/[From eyeglasses ][Date Thu, 15 Feb 2007 13:25:45 -0600]/UNNAMED/[From Combs" ][Date 1 Jan 1997 00:37:26 -0060]/UNNAMED/[From Helene Riddle ][Date Thu, 15 Feb 2007 19:20:47 -0600]/UNNAMED Infected: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Mi PC\Datos de programa\Thunderbird\Profiles\tvnj4jkr.default\Mai l\Local Folders\Junk/[From "Rocio Flores" ][Date Thu, 15 Feb 2007 11:23:06 -0600]/UNNAMED/[From Rucker Ray ][Date Thu, 15 Feb 2007 12:47:40 -0500]/UNNAMED/[From eyeglasses ][Date Thu, 15 Feb 2007 13:25:45 -0600]/UNNAMED/[From Combs" ][Date 1 Jan 1997 00:37:26 -0060]/UNNAMED/[From Helene Riddle ][Date Fri, 16 Feb 2007 00:04:41 +0100]/UNNAMED Infected: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Mi PC\Datos de programa\Thunderbird\Profiles\tvnj4jkr.default\Mai l\Local Folders\Junk/[From "Rocio Flores" ][Date Thu, 15 Feb 2007 11:23:06 -0600]/UNNAMED/[From Rucker Ray ][Date Thu, 15 Feb 2007 12:47:40 -0500]/UNNAMED/[From eyeglasses ][Date Thu, 15 Feb 2007 13:25:45 -0600]/UNNAMED/[From Combs" ][Date 1 Jan 1997 00:37:26 -0060]/UNNAMED Infected: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Mi PC\Datos de programa\Thunderbird\Profiles\tvnj4jkr.default\Mai l\Local Folders\Junk/[From "Rocio Flores" ][Date Thu, 15 Feb 2007 11:23:06 -0600]/UNNAMED/[From Rucker Ray ][Date Thu, 15 Feb 2007 12:47:40 -0500]/UNNAMED/[From eyeglasses ][Date Thu, 15 Feb 2007 13:25:45 -0600]/UNNAMED Infected: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Mi PC\Datos de programa\Thunderbird\Profiles\tvnj4jkr.default\Mai l\Local Folders\Junk/[From "Rocio Flores" ][Date Thu, 15 Feb 2007 11:23:06 -0600]/UNNAMED/[From Rucker Ray ][Date Thu, 15 Feb 2007 12:47:40 -0500]/UNNAMED Infected: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Mi PC\Datos de programa\Thunderbird\Profiles\tvnj4jkr.default\Mai l\Local Folders\Junk/[From "Rocio Flores" ][Date Thu, 15 Feb 2007 11:23:06 -0600]/UNNAMED Infected: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Mi PC\Datos de programa\Thunderbird\Profiles\tvnj4jkr.default\Mai l\Local Folders\Junk Mail Berkeley mbox: infected - 135, suspicious - 61 skipped
C:\Documents and Settings\Mi PC\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Mi PC\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Puri\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Puri\NTUSER.dat.LOG Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\pfirewall.log Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.lo g Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\drivers\fidbox.dat Object is locked skipped
C:\WINDOWS\system32\drivers\fidbox.idx Object is locked skipped
C:\WINDOWS\system32\drivers\fidbox2.dat Object is locked skipped
C:\WINDOWS\system32\drivers\fidbox2.idx Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MA P Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MA P Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DAT A Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\~DFD8D2.tmp Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
F:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
G:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
I:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
Scan process completed.

He recortado el texto era de 100.000 caracteres, lo quitado es del tipo de mensajes de from "Rocio Flores"

Pues los que dicen [From Rocio Flores] son todos virus, así que yo te recomiendo su eliminación

Gracias Claw por el tiempo yla respuesta. He adjuntado parte del informe del Kaspersky Online, tambien he pasado el Ewido al finalizar aparecieron 4 infenciones que al parecer ha solucionado. Espero tus noticias

El anitvirus Kaspersky online ha puesto todos los fichero infectados en un fichero llamado Report de este tipo
"C:\Documents and Settings\All Users\Datos de programa\Kaspersky Lab\AVP6\Report\013c_Web_Monitoring_eventlog.rpt "
intento eliminarlos con el File ASSASSIN, pero no puede dice que no puede eliminarlo.
¿Como consigo eliminarlos?

Hola aalegre22

Kaspersky Online no tiene opcion de limpieza, solo muestra ese reporte y sirbe para que lo hagas manualmente.

Borra esta carpeta con todo su contenido:

C:\Documents and Settings\Mi PC\Datos de programa\Thunderbird\Profiles\tvnj4jkr.default\

Puedes hacerlo con el KillBox, usando la opcion delete on reboot. O con FileASSASSIN

Luego Reinicia en Modo Seguro

Le pasas:

• El SuperAntiSpyware actualizado.
• El CCleaner, debes usar la opción Limpiar Registro, pásalo las veces que sean necesarias hasta que no aparezca nada.
• Luego lo usas para limpiar cookies y temporales.

Haslo y me cuentas

Saludos

Hola Jimmy12, he realizado lo que has comrentado, tras la limpieza le he pasado el HijackThis v1.99.1 y este es el informe, te agradeceria que le pegaras un vistazo y me des tu opinion. Gracias por adelantado.

Logfile of HijackThis v1.99.1
Scan saved at 10:04:01, on 19/05/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Archivos de programa\Eset\nod32krn.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Archivos de programa\Eset\nod32kui.exe
C:\Archivos de programa\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Mi PC\Escritorio\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.es/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Archivos de programa\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARCHIV~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Archivos de programa\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG -off
O4 - HKLM\..\Run: [nod32kui] "C:\Archivos de programa\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Archivos de programa\SUPERAntiSpyware\SUPERAntiSpyware.exe
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Referencia - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARCHIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O9 - Extra button: (no name) - SolidConverterPDF - (no file) (HKCU)
O16 - DPF: {0D6709DD-4ED8-40CA-B459-2757AEEF7BEE} (Dldrv2 Control) - http://download.gigabyte.com.tw/object/Dldrv.ocx
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B785FA3C-1DE9-4D20-8396-613C486FE95E} (AeatCtl Class) - https://www5.aeat.es/ES13/D/cactivex.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A5BD1298-6F47-468B-88CE-48BA3E3A685C}: NameServer = 80.58.63.250,80.58.61.254
O17 - HKLM\System\CCS\Services\Tcpip\..\{AB159403-C27D-43D7-A7F0-4ADC29C37BBF}: NameServer = 80.58.63.250,80.58.61.254
O20 - Winlogon Notify: !SASWinLogon - C:\Archivos de programa\SUPERAntiSpyware\SASWINLO.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - C:\Archivos de programa\Archivos comunes\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Archivos de programa\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Archivos de programa\Eset\nod32krn.exe






Un saludo

Ampliacion de informacion:

He comprobado que no existen en el informe entradas tipo 015, pero si 016 que no se si son peligrosas, si que existen entradas tipo 023 pero tampoco se si las que hay son peligrosas.

Hola de nuevo

El log esta limpio, pero no era necesario

¿Como esta tu maquina?

Saludos

Hola Jimmy 12, gracias por tu atención y dedicación, el ordenador arranca muy lento ( en concreto con windows XP durante el arranque en la barra que aparece desplazándose con cuadraditos azules le cuesta un minuto pasarla después se queda la pantalla en negro y tras unos 10 o 15 segundos continua, me parece muy raro, o yo estoy ya histérico y excesivamente sensible.
Cuentame que te parece esto.

Cuando comentas que esta limpio te refieres a SpyWare solo o también a virus.
Gracias por atenderme