Problemas en el registro

Al_Owairan · Mensaje por **Al_Owairan** » 13 Feb 2005, 02:32

Parece ser que tengo un virus que me ha modificado el registro de windows y me da problemas al instalar algun programa.

El archivo que el ad-aware me da como infectado es:

HKEY_LOCAL_MACHINE:software\microsoft\windows nt\currentversion\winlogon"Shell" (explorer.exe,msmsgs.exe)

¿que puedo hacer?

Mensaje por **cañera** » 13 Feb 2005, 02:37

pasa antivirus actualizado y antiespias en a modo prueba de errores desactivando restaurar sistema y mira si te dice el nombre del virus que te está afectando haber si podemos hecharte una mano.

esperamos respuesta.

Al_Owairan · Mensaje por **Al_Owairan** » 13 Feb 2005, 02:50

Pues la verdad es que el norton no me lo encontraba, y el ad-aware, me da como scan log:

Ad-Aware SE Build 1.05

Logfile Created on:domingo, 13 de febrero de 2005 2:44:24

Created with Ad-Aware SE Personal, free for private use.

Using definitions file:SE1R27 05.02.2005

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

References detected during the scan:

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

MRU List(TAC index:0):20 total references

Tracking Cookie(TAC index:3):3 total references

Windows(TAC index:3):1 total references

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Ad-Aware SE Settings

===========================

Set : Search for negligible risk entries

Set : Safe mode (always request confirmation)

Set : Scan active processes

Set : Scan registry

Set : Deep-scan registry

Set : Scan my IE Favorites for banned URLs

Set : Scan my Hosts file

Extended Ad-Aware SE Settings

===========================

Set : Unload recognized processes & modules during scan

Set : Scan registry for all users instead of current user only

Set : Always try to unload modules before deletion

Set : During removal, unload Explorer and IE if necessary

Set : Let Windows remove files in use at next reboot

Set : Delete quarantined objects after restoring

Set : Include basic Ad-Aware settings in log file

Set : Include additional Ad-Aware settings in log file

Set : Include reference summary in log file

Set : Include alternate data stream details in log file

Set : Play sound at scan completion if scan locates critical objects

13-02-2005 2:44:24 - Scan started. (Smart mode)

Listing running processes

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

#:1 [smss.exe]

FilePath : \SystemRoot\System32\

ProcessID : 432

ThreadCreationTime : 13-02-2005 1:44:00

BasePriority : Normal

#:2 [csrss.exe]

FilePath : \??\C:\WINDOWS\system32\

ProcessID : 488

ThreadCreationTime : 13-02-2005 1:44:01

BasePriority : Normal

#:3 [winlogon.exe]

FilePath : \??\C:\WINDOWS\SYSTEM32\

ProcessID : 512

ThreadCreationTime : 13-02-2005 1:44:01

BasePriority : High

#:4 [services.exe]

FilePath : C:\WINDOWS\system32\

ProcessID : 556

ThreadCreationTime : 13-02-2005 1:44:01

BasePriority : Normal

FileVersion : 5.1.2600.0 (xpclient.010817-1148)

ProductVersion : 5.1.2600.0

ProductName : Sistema operativo Microsoft® Windows®

CompanyName : Microsoft Corporation

FileDescription : Aplicación de servicios y controlador

InternalName : services.exe

LegalCopyright : Copyright (C) Microsoft Corporation. Reservados todos los derechos.

OriginalFilename : services.exe

#:5 [lsass.exe]

FilePath : C:\WINDOWS\system32\

ProcessID : 568

ThreadCreationTime : 13-02-2005 1:44:01

BasePriority : Normal

FileVersion : 5.1.2600.0 (xpclient.010817-1148)

ProductVersion : 5.1.2600.0

ProductName : Microsoft® Windows® Operating System

CompanyName : Microsoft Corporation

FileDescription : LSA Shell (Export Version)

InternalName : lsass.exe

LegalCopyright : © Microsoft Corporation. All rights reserved.

OriginalFilename : lsass.exe

#:6 [svchost.exe]

FilePath : C:\WINDOWS\system32\

ProcessID : 740

ThreadCreationTime : 13-02-2005 1:44:02

BasePriority : Normal

FileVersion : 5.1.2600.0 (xpclient.010817-1148)

ProductVersion : 5.1.2600.0

ProductName : Microsoft® Windows® Operating System

CompanyName : Microsoft Corporation

FileDescription : Generic Host Process for Win32 Services

InternalName : svchost.exe

LegalCopyright : © Microsoft Corporation. All rights reserved.

OriginalFilename : svchost.exe

#:7 [svchost.exe]

FilePath : C:\WINDOWS\System32\

ProcessID : 792

ThreadCreationTime : 13-02-2005 1:44:02

BasePriority : Normal

FileVersion : 5.1.2600.0 (xpclient.010817-1148)

ProductVersion : 5.1.2600.0

ProductName : Microsoft® Windows® Operating System

CompanyName : Microsoft Corporation

FileDescription : Generic Host Process for Win32 Services

InternalName : svchost.exe

LegalCopyright : © Microsoft Corporation. All rights reserved.

OriginalFilename : svchost.exe

#:8 [svchost.exe]

FilePath : C:\WINDOWS\System32\

ProcessID : 896

ThreadCreationTime : 13-02-2005 1:44:02

BasePriority : Normal

FileVersion : 5.1.2600.0 (xpclient.010817-1148)

ProductVersion : 5.1.2600.0

ProductName : Microsoft® Windows® Operating System

CompanyName : Microsoft Corporation

FileDescription : Generic Host Process for Win32 Services

InternalName : svchost.exe

LegalCopyright : © Microsoft Corporation. All rights reserved.

OriginalFilename : svchost.exe

#:9 [svchost.exe]

FilePath : C:\WINDOWS\System32\

ProcessID : 960

ThreadCreationTime : 13-02-2005 1:44:02

BasePriority : Normal

FileVersion : 5.1.2600.0 (xpclient.010817-1148)

ProductVersion : 5.1.2600.0

ProductName : Microsoft® Windows® Operating System

CompanyName : Microsoft Corporation

FileDescription : Generic Host Process for Win32 Services

InternalName : svchost.exe

LegalCopyright : © Microsoft Corporation. All rights reserved.

OriginalFilename : svchost.exe

#:10 [ccsetmgr.exe]

FilePath : C:\Archivos de programa\Archivos comunes\Symantec Shared\

ProcessID : 1076

ThreadCreationTime : 13-02-2005 1:44:03

BasePriority : Normal

FileVersion : 103.0.1.26

ProductVersion : 103.0.1.26

ProductName : Client and Host Security Platform

CompanyName : Symantec Corporation

FileDescription : Symantec Settings Manager Service

InternalName : ccSetMgr

LegalCopyright : Copyright (c) 2000-2004 Symantec Corporation. All rights reserved.

OriginalFilename : ccSetMgr.exe

#:11 [userinit.exe]

FilePath : C:\WINDOWS\system32\

ProcessID : 1160

ThreadCreationTime : 13-02-2005 1:44:03

BasePriority : Normal

FileVersion : 5.1.2600.0 (xpclient.010817-1148)

ProductVersion : 5.1.2600.0

ProductName : Sistema operativo Microsoft® Windows®

CompanyName : Microsoft Corporation

FileDescription : Aplicación de inicio de sesión (Userinit)

InternalName : userinit

LegalCopyright : © Microsoft Corporation. Reservados todos los derechos.

OriginalFilename : USERINIT.EXE

#:12 [sndsrvc.exe]

FilePath : C:\Archivos de programa\Archivos comunes\Symantec Shared\

ProcessID : 1184

ThreadCreationTime : 13-02-2005 1:44:03

BasePriority : Normal

FileVersion : 5.4.4.17

ProductVersion : 5.4

ProductName : Symantec Security Drivers

CompanyName : Symantec Corporation

FileDescription : Network Driver Service

InternalName : SndSrvc

LegalCopyright : Copyright 2002, 2003, 2004 Symantec Corporation

OriginalFilename : SndSrvc.exe

#:13 [spbbcsvc.exe]

FilePath : C:\Archivos de programa\Archivos comunes\Symantec Shared\SPBBC\

ProcessID : 1272

ThreadCreationTime : 13-02-2005 1:44:03

BasePriority : Normal

FileVersion : 1,0,1,47

ProductVersion : 1,0,1,47

ProductName : SPBBC

CompanyName : Symantec Corporation

FileDescription : SPBBC Service

InternalName : SPBBCSvc

LegalCopyright : Copyright (c) 2004 Symantec Corporation. All rights reserved.

OriginalFilename : SPBBCSvc.exe

#:14 [ccevtmgr.exe]

FilePath : C:\Archivos de programa\Archivos comunes\Symantec Shared\

ProcessID : 1292

ThreadCreationTime : 13-02-2005 1:44:03

BasePriority : Normal

FileVersion : 103.0.1.26

ProductVersion : 103.0.1.26

ProductName : Client and Host Security Platform

CompanyName : Symantec Corporation

FileDescription : Symantec Event Manager Service

InternalName : ccEvtMgr

LegalCopyright : Copyright (c) 2000-2004 Symantec Corporation. All rights reserved.

OriginalFilename : ccEvtMgr.exe

#:15 [spoolsv.exe]

FilePath : C:\WINDOWS\system32\

ProcessID : 1476

ThreadCreationTime : 13-02-2005 1:44:04

BasePriority : Normal

FileVersion : 5.1.2600.0 (XPClient.010817-1148)

ProductVersion : 5.1.2600.0

ProductName : Microsoft® Windows® Operating System

CompanyName : Microsoft Corporation

FileDescription : Spooler SubSystem App

InternalName : spoolsv.exe

LegalCopyright : © Microsoft Corporation. All rights reserved.

OriginalFilename : spoolsv.exe

#:16 [htpatch.exe]

FilePath : C:\WINDOWS\

ProcessID : 1572

ThreadCreationTime : 13-02-2005 1:44:05

BasePriority : Normal

#:17 [explorer.exe]

FilePath : C:\WINDOWS\

ProcessID : 1720

ThreadCreationTime : 13-02-2005 1:44:08

BasePriority : Normal

FileVersion : 6.00.2600.0000 (xpclient.010817-1148)

ProductVersion : 6.00.2600.0000

ProductName : Sistema operativo Microsoft® Windows®

CompanyName : Microsoft Corporation

FileDescription : Explorador de Windows

InternalName : explorer

LegalCopyright : © Microsoft Corporation. Reservados todos los derechos.

OriginalFilename : EXPLORER.EXE

#:18 [alg.exe]

FilePath : C:\WINDOWS\System32\

ProcessID : 1820

ThreadCreationTime : 13-02-2005 1:44:11

BasePriority : Normal

FileVersion : 5.1.2600.0 (xpclient.010817-1148)

ProductVersion : 5.1.2600.0

ProductName : Microsoft® Windows® Operating System

CompanyName : Microsoft Corporation

FileDescription : Application Layer Gateway Service

InternalName : ALG.exe

LegalCopyright : © Microsoft Corporation. All rights reserved.

OriginalFilename : ALG.exe

#:19 [navapsvc.exe]

FilePath : C:\Archivos de programa\Norton AntiVirus\

ProcessID : 1860

ThreadCreationTime : 13-02-2005 1:44:11

BasePriority : Normal

FileVersion : 11.0.1.3

ProductVersion : 11.0.1

ProductName : Norton AntiVirus

CompanyName : Symantec Corporation

FileDescription : Norton AntiVirus Auto-Protect Service

InternalName : NAVAPSVC

LegalCopyright : Norton AntiVirus 2005 for Windows 98/ME/2000/XP Copyright © 2004 Symantec Corporation. All rights reserved.

OriginalFilename : NAVAPSVC.EXE

#:20 [npfmntor.exe]

FilePath : C:\Archivos de programa\Norton AntiVirus\IWP\

ProcessID : 1880

ThreadCreationTime : 13-02-2005 1:44:11

BasePriority : Normal

FileVersion : 11.0.1.3

ProductVersion : 11.0.1

ProductName : Norton AntiVirus

CompanyName : Symantec Corporation

FileDescription : Norton AntiVirus Firewall Install Monitor

InternalName : NPFMonitor

LegalCopyright : Norton AntiVirus 2005 for Windows 98/ME/2000/XP Copyright © 2004 Symantec Corporation. All rights reserved.

OriginalFilename : NPFMonitor.EXE

#:21 [nvsvc32.exe]

FilePath : C:\WINDOWS\System32\

ProcessID : 1916

ThreadCreationTime : 13-02-2005 1:44:11

BasePriority : Normal

FileVersion : 6.14.10.4523

ProductVersion : 6.14.10.4523

ProductName : NVIDIA Driver Helper Service, Version 45.23

CompanyName : NVIDIA Corporation

FileDescription : NVIDIA Driver Helper Service, Version 45.23

InternalName : NVSVC

LegalCopyright : (C) NVIDIA Corporation. All rights reserved.

OriginalFilename : nvsvc32.exe

#:22 [smagent.exe]

FilePath : C:\Archivos de programa\Analog Devices\SoundMAX\

ProcessID : 188

ThreadCreationTime : 13-02-2005 1:44:11

BasePriority : Normal

FileVersion : 3, 2, 6, 0

ProductVersion : 3, 2, 6, 0

ProductName : SoundMAX service agent

CompanyName : Analog Devices, Inc.

FileDescription : SoundMAX service agent component

InternalName : SMAgent

LegalCopyright : Copyright © 2002

OriginalFilename : SMAgent.exe

#:23 [symlcsvc.exe]

FilePath : C:\Archivos de programa\Archivos comunes\Symantec Shared\CCPD-LC\

ProcessID : 352

ThreadCreationTime : 13-02-2005 1:44:15

BasePriority : Normal

FileVersion : 1, 8, 54, 419

ProductVersion : 1, 8, 54, 419

ProductName : Symantec Core Component

CompanyName : Symantec Corporation

FileDescription : Symantec Core Component

InternalName : symlcsvc

LegalCopyright : Copyright (C) 2003

OriginalFilename : symlcsvc.exe

#:24 [wdfmgr.exe]

FilePath : C:\WINDOWS\System32\

ProcessID : 392

ThreadCreationTime : 13-02-2005 1:44:15

BasePriority : Normal

FileVersion : 5.2.3790.1230 built by: DNSRV(bld4act)

ProductVersion : 5.2.3790.1230

ProductName : Microsoft® Windows® Operating System

CompanyName : Microsoft Corporation

FileDescription : Windows User Mode Driver Manager

InternalName : WdfMgr

LegalCopyright : © Microsoft Corporation. All rights reserved.

OriginalFilename : WdfMgr.exe

#:25 [ad-aware.exe]

FilePath : C:\Archivos de programa\Lavasoft\Ad-Aware SE Personal\

ProcessID : 456

ThreadCreationTime : 13-02-2005 1:44:15

BasePriority : Normal

FileVersion : 6.2.0.206

ProductVersion : VI.Second Edition

ProductName : Lavasoft Ad-Aware SE

CompanyName : Lavasoft Sweden

FileDescription : Ad-Aware SE Core application

InternalName : Ad-Aware.exe

LegalCopyright : Copyright © Lavasoft Sweden

OriginalFilename : Ad-Aware.exe

Comments : All Rights Reserved

Memory scan result:

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

New critical objects: 0

Objects found so far: 0

Started registry scan

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Windows Object Recognized!

Type : RegData

Data : explorer.exe, msmsgs.exe

Category : Vulnerability

Comment : Shell Possibly Compromised

Rootkey : HKEY_LOCAL_MACHINE

Object : software\microsoft\windows nt\currentversion\winlogon

Value : Shell

Data : explorer.exe, msmsgs.exe

Registry Scan result:

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

New critical objects: 1

Objects found so far: 1

Started deep registry scan

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Deep registry scan result:

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

New critical objects: 0

Objects found so far: 1

Started Tracking Cookie scan

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Tracking Cookie Object Recognized!

Type : IECache Entry

Data : álvaro@0[1].txt

Category : Data Miner

Comment : Hits:5

Value : Cookie:álvaro@j.2004cms.com/HTM/307/0

Expires : 12/02/2006 21:10:52

LastSync : Hits:5

UseCount : 0

Hits : 5

Tracking Cookie Object Recognized!

Type : IECache Entry

Data : álvaro@0[2].txt

Category : Data Miner

Comment : Hits:2

Value : Cookie:álvaro@jedonkey.cjt1.net/HTM/307/0

Expires : 12/02/2006 21:10:50

LastSync : Hits:2

UseCount : 0

Hits : 2

Tracking Cookie Object Recognized!

Type : IECache Entry

Data : álvaro@cgi-bin[1].txt

Category : Data Miner

Comment : Hits:1

Value : Cookie:álvaro@imrworldwide.com/cgi-bin

Expires : 19/01/2009

LastSync : Hits:1

UseCount : 0

Hits : 1

Tracking cookie scan result:

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

New critical objects: 3

Objects found so far: 4

Deep scanning and examining files...

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Disk Scan Result for C:\WINDOWS

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

New critical objects: 0

Objects found so far: 4

Disk Scan Result for C:\WINDOWS\System32

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

New critical objects: 0

Objects found so far: 4

Disk Scan Result for C:\DOCUME~1\LVARO~1\CONFIG~1\Temp\

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

New critical objects: 0

Objects found so far: 4

Scanning Hosts file......

Hosts file location:"C:\WINDOWS\system32\drivers\etc\hosts".

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Hosts file scan result:

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

1 entries scanned.

New critical objects:0

Objects found so far: 4

MRU List Object Recognized!

Location: : S-1-5-21-1123561945-725345543-314051477-1003\software\microsoft\windows\currentversion\applets\wordpad\recent file list

Description : list of recent files opened using wordpad

MRU List Object Recognized!

Location: : S-1-5-21-1123561945-725345543-314051477-1003\software\microsoft\windows\currentversion\explorer\runmru

Description : mru list for items opened in start | run

MRU List Object Recognized!

Location: : S-1-5-21-1123561945-725345543-314051477-1003\software\microsoft\search assistant\acmru

Description : list of recent search terms used with the search assistant

MRU List Object Recognized!

Location: : S-1-5-21-1123561945-725345543-314051477-1003\software\microsoft\windows\currentversion\explorer\comdlg32\opensavemru

Description : list of recently saved files, stored according to file extension

MRU List Object Recognized!

Location: : S-1-5-21-1123561945-725345543-314051477-1003\software\microsoft\windows\currentversion\explorer\comdlg32\lastvisitedmru

Description : list of recent programs opened

MRU List Object Recognized!

Location: : S-1-5-21-1123561945-725345543-314051477-1003\software\microsoft\windows\currentversion\explorer\recentdocs

Description : list of recent documents opened

MRU List Object Recognized!

Location: : S-1-5-21-1123561945-725345543-314051477-1003\software\microsoft\office\8.0\excel\recent file list

Description : list of recent files used by microsoft excel

MRU List Object Recognized!

Location: : S-1-5-21-1123561945-725345543-314051477-1003\software\realnetworks\realplayer\6.0\preferences

Description : list of recent skins in realplayer

MRU List Object Recognized!

Location: : S-1-5-21-1123561945-725345543-314051477-1003\software\microsoft\internet explorer

Description : last download directory used in microsoft internet explorer

MRU List Object Recognized!

Location: : software\microsoft\directdraw\mostrecentapplication

Description : most recent application to use microsoft directdraw

MRU List Object Recognized!

Location: : S-1-5-21-1123561945-725345543-314051477-1003\software\microsoft\internet explorer\typedurls

Description : list of recently entered addresses in microsoft internet explorer

MRU List Object Recognized!

Location: : software\microsoft\direct3d\mostrecentapplication

Description : most recent application to use microsoft direct3d

MRU List Object Recognized!

Location: : S-1-5-21-1123561945-725345543-314051477-1003\software\microsoft\mediaplayer\preferences

Description : last playlist index loaded in microsoft windows media player

MRU List Object Recognized!

Location: : S-1-5-21-1123561945-725345543-314051477-1003\software\realnetworks\realplayer\6.0\preferences

Description : list of recent clips in realplayer

MRU List Object Recognized!

Location: : S-1-5-21-1123561945-725345543-314051477-1003\software\microsoft\windows\currentversion\applets\regedit

Description : last key accessed using the microsoft registry editor

MRU List Object Recognized!

Location: : S-1-5-21-1123561945-725345543-314051477-1003\software\microsoft\mediaplayer\preferences

Description : last playlist loaded in microsoft windows media player

MRU List Object Recognized!

Location: : S-1-5-21-1123561945-725345543-314051477-1003\software\microsoft\mediaplayer\medialibraryui

Description : last selected node in the microsoft windows media player media library

MRU List Object Recognized!

Location: : software\microsoft\direct3d\mostrecentapplication

Description : most recent application to use microsoft direct X

MRU List Object Recognized!

Location: : S-1-5-21-1123561945-725345543-314051477-1003\software\microsoft\windows media\wmsdk\general

Description : windows media sdk

MRU List Object Recognized!

Location: : C:\Documents and Settings\Álvaro\recent

Description : list of recently opened documents

Performing conditional scans...

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Conditional scan result:

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

New critical objects: 0

Objects found so far: 24

2:45:39 Scan Complete

Summary Of This Scan

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Total scanning time:00:01:15.32

Objects scanned:65175

Objects identified:4

Objects ignored:0

New critical objects:4

la verdad es que estoy un poco perdido, pero esto de que afecte al registro me pinta muy mal. El nombre del virus no lo he visto por ningun lao

caito · Mensaje por **caito** » 13 Feb 2005, 14:38

Ejecuta otra vez el AdAware Se :

Start-Scan Mode-Next-fijarse que "Search for negligible risk entries" este en rojo(X)

ejecutarlo y solucionar lo que encuentre(eliminar).

Cuenta si se solucionó.

Salu2

Caito

Mensaje por **msc hotline sat** » 16 Feb 2005, 12:31

Recuerda hacerlo arrancando en modo seguro y deshabilitar la restauracion de sistema !!!

saludos

ms, 16-02-2005