Virus y spyware - no consigo identificar ni resolver

[tatibertolucci]

Hola,

estoy con problemas en el ordenador, el principal es con la conexion a internet que siempre esta fatal y ademas de eso, el equipo esta lento. Utilizé el kaspersky (resultado del scan abajo) y no logró identificar el nombre del virus. Con todos que hable hasta ahora me dijeron que yo tendre que formatar el ordenador. Espero qeu ustedes puedan ayuderme. Sigue el relatorio de kaspersky. Muchas gracias

Thursday, January 11, 2007 10:01:35 PM





Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)

Kaspersky Online Scanner version: 5.0.83.0

Kaspersky Anti-Virus database last update: 10/01/2007

Kaspersky Anti-Virus database records: 257405

Scan Settings

Scan using the following antivirus database extended

Scan Archives true

Scan Mail Bases true

Scan Target My Computer

C:\

D:\

E:\

F:\

Scan Statistics

Total number of scanned objects 82915

Number of viruses found 1

Number of infected objects 7 / 0

Number of suspicious objects 0

Duration of the scan process 01:09:47



Infected Object Name Virus Name Last Action

C:\Documents and Settings\All Users\Application Data\Microsoft\eHome\logs\ehRecvr.log Object is locked skipped

C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\LocalService\NTUSER.DAT.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\NetworkService\NTUSER.DAT.LOG Object is locked skipped

C:\Documents and Settings\Tatiana Bertolucci\Archivos temporales de Internet\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\Tatiana Bertolucci\Configuración local\Datos de programa\ApplicationHistory\hpqimzone.exe.3204510e.ini.inuse Object is locked skipped

C:\Documents and Settings\Tatiana Bertolucci\Configuración local\Datos de programa\HP\Digital Imaging\db\administrativeInfo.dbf Object is locked skipped

C:\Documents and Settings\Tatiana Bertolucci\Configuración local\Datos de programa\HP\Digital Imaging\db\albumImagesTable.cdx Object is locked skipped

C:\Documents and Settings\Tatiana Bertolucci\Configuración local\Datos de programa\HP\Digital Imaging\db\albumImagesTable.dbf Object is locked skipped

C:\Documents and Settings\Tatiana Bertolucci\Configuración local\Datos de programa\HP\Digital Imaging\db\albumTable.cdx Object is locked skipped

C:\Documents and Settings\Tatiana Bertolucci\Configuración local\Datos de programa\HP\Digital Imaging\db\albumTable.dbf Object is locked skipped

C:\Documents and Settings\Tatiana Bertolucci\Configuración local\Datos de programa\HP\Digital Imaging\db\CB_Server_Errors.txt Object is locked skipped

C:\Documents and Settings\Tatiana Bertolucci\Configuración local\Datos de programa\HP\Digital Imaging\db\EXIFTable.cdx Object is locked skipped

C:\Documents and Settings\Tatiana Bertolucci\Configuración local\Datos de programa\HP\Digital Imaging\db\EXIFTable.dbf Object is locked skipped

C:\Documents and Settings\Tatiana Bertolucci\Configuración local\Datos de programa\HP\Digital Imaging\db\imageTable.cdx Object is locked skipped

C:\Documents and Settings\Tatiana Bertolucci\Configuración local\Datos de programa\HP\Digital Imaging\db\imageTable.dbf Object is locked skipped

C:\Documents and Settings\Tatiana Bertolucci\Configuración local\Datos de programa\HP\Digital Imaging\db\imageTable.fpt Object is locked skipped

C:\Documents and Settings\Tatiana Bertolucci\Configuración local\Datos de programa\HP\Digital Imaging\db\keywordImagesTable.cdx Object is locked skipped

C:\Documents and Settings\Tatiana Bertolucci\Configuración local\Datos de programa\HP\Digital Imaging\db\keywordImagesTable.dbf Object is locked skipped

C:\Documents and Settings\Tatiana Bertolucci\Configuración local\Datos de programa\HP\Digital Imaging\db\keywordTable.cdx Object is locked skipped

C:\Documents and Settings\Tatiana Bertolucci\Configuración local\Datos de programa\HP\Digital Imaging\db\keywordTable.dbf Object is locked skipped

C:\Documents and Settings\Tatiana Bertolucci\Configuración local\Datos de programa\HP\Digital Imaging\db\managedFolderTable.dbf Object is locked skipped

C:\Documents and Settings\Tatiana Bertolucci\Configuración local\Datos de programa\HP\Digital Imaging\db\pathnameTable.cdx Object is locked skipped

C:\Documents and Settings\Tatiana Bertolucci\Configuración local\Datos de programa\HP\Digital Imaging\db\pathnameTable.dbf Object is locked skipped

C:\Documents and Settings\Tatiana Bertolucci\Configuración local\Datos de programa\HP\Digital Imaging\db\propertiesTable.cdx Object is locked skipped

C:\Documents and Settings\Tatiana Bertolucci\Configuración local\Datos de programa\HP\Digital Imaging\db\propertiesTable.dbf Object is locked skipped

C:\Documents and Settings\Tatiana Bertolucci\Configuración local\Datos de programa\HP\Digital Imaging\db\ROFImagesTable.cdx Object is locked skipped

C:\Documents and Settings\Tatiana Bertolucci\Configuración local\Datos de programa\HP\Digital Imaging\db\ROFImagesTable.dbf Object is locked skipped

C:\Documents and Settings\Tatiana Bertolucci\Configuración local\Datos de programa\HP\Digital Imaging\db\ROFTable.cdx Object is locked skipped

C:\Documents and Settings\Tatiana Bertolucci\Configuración local\Datos de programa\HP\Digital Imaging\db\ROFTable.dbf Object is locked skipped

C:\Documents and Settings\Tatiana Bertolucci\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\Tatiana Bertolucci\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\Tatiana Bertolucci\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\Tatiana Bertolucci\Escritorio\diversos\HopsterSetup.exe/data0003/Webhdll.dll Infected: not-a-virus:AdWare.Win32.WebHancer.320 skipped

C:\Documents and Settings\Tatiana Bertolucci\Escritorio\diversos\HopsterSetup.exe/data0003/WhAgent.exe Infected: not-a-virus:AdWare.Win32.WebHancer.320 skipped

C:\Documents and Settings\Tatiana Bertolucci\Escritorio\diversos\HopsterSetup.exe/data0003/whiehlpr.dll Infected: not-a-virus:AdWare.Win32.WebHancer.320 skipped

C:\Documents and Settings\Tatiana Bertolucci\Escritorio\diversos\HopsterSetup.exe/data0003/whInstaller.exe Infected: not-a-virus:AdWare.Win32.WebHancer.320 skipped

C:\Documents and Settings\Tatiana Bertolucci\Escritorio\diversos\HopsterSetup.exe/data0003/WhSurvey.exe Infected: not-a-virus:AdWare.Win32.WebHancer.320 skipped

C:\Documents and Settings\Tatiana Bertolucci\Escritorio\diversos\HopsterSetup.exe/data0003 Infected: not-a-virus:AdWare.Win32.WebHancer.320 skipped

C:\Documents and Settings\Tatiana Bertolucci\Escritorio\diversos\HopsterSetup.exe Inno: infected - 6 skipped

C:\Documents and Settings\Tatiana Bertolucci\Historial\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\Tatiana Bertolucci\Local Settings\Temp\~DF3498.tmp Object is locked skipped

C:\Documents and Settings\Tatiana Bertolucci\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\Tatiana Bertolucci\ntuser.dat.LOG Object is locked skipped

C:\Program Files\Alwil Software\Avast4\DATA\aswResp.dat Object is locked skipped

C:\Program Files\Alwil Software\Avast4\DATA\Avast4.db Object is locked skipped

C:\Program Files\Alwil Software\Avast4\DATA\log\AshWebSv.ws Object is locked skipped

C:\Program Files\Alwil Software\Avast4\DATA\log\aswMaiSv.log Object is locked skipped

C:\Program Files\Alwil Software\Avast4\DATA\log\nshield.log Object is locked skipped

C:\Program Files\Alwil Software\Avast4\DATA\report\Proteção residente.txt Object is locked skipped

C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

C:\System Volume Information\_restore{5CAAC034-3E9F-4A8E-A3FE-99D20678A761}\RP100\change.log Object is locked skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\ModemLog_HDAUDIO Soft Data Fax Modem with SmartCP.txt Object is locked skipped

C:\WINDOWS\SchedLgU.Txt Object is locked skipped

C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped

C:\WINDOWS\Sti_Trace.log Object is locked skipped

C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped

C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped

C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped

C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\default Object is locked skipped

C:\WINDOWS\system32\config\default.LOG Object is locked skipped

C:\WINDOWS\system32\config\Media Ce.evt Object is locked skipped

C:\WINDOWS\system32\config\SAM Object is locked skipped

C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SECURITY Object is locked skipped

C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

C:\WINDOWS\system32\config\software Object is locked skipped

C:\WINDOWS\system32\config\software.LOG Object is locked skipped

C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\system Object is locked skipped

C:\WINDOWS\system32\config\system.LOG Object is locked skipped

C:\WINDOWS\system32\h323log.txt Object is locked skipped

C:\WINDOWS\system32\MsDtc\MSDTC.LOG Object is locked skipped

C:\WINDOWS\system32\MsDtc\Trace\dtctrace.log Object is locked skipped

C:\WINDOWS\system32\msmq\storage\QMLog Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped

C:\WINDOWS\Temp\Perflib_Perfdata_760.dat Object is locked skipped

C:\WINDOWS\Temp\_avast4_\Webshlock.txt Object is locked skipped

C:\WINDOWS\wiadebug.log Object is locked skipped

C:\WINDOWS\wiaservc.log Object is locked skipped

C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.

[Nuker]

Pruebe ELISTARA en modo seguro al igual que SPYBOT este lo actualiza antes de usarlo. El ELISTARA le creara a ud un log el cual se alojara en Unidad C, con nombre de infoSAT.txt al terminar el escaneo, copielo y peguelo aqui porfavor.



ELISTARA:



http://www.zonavirus.com/descargas/elistara.asp





SPYBOT:



http://www.zonavirus.com/descargas/spybot-sd.asp

[tatibertolucci]

Sigue lo que me pidiste... pero el no pudo accesar una serie de carpetas de c:recovery





Sat Jan 13 00:47:43 2007

EliStartPage v13.07 (c)2007 S.G.H. / Satinfo S.L.

--------------------------------------------------

Lista de Acciones (por Acción Directa):

Eliminados Ficheros Temporales del IE



Sat Jan 13 00:54:08 2007

EliStartPage v13.07 (c)2007 S.G.H. / Satinfo S.L.

--------------------------------------------------

Lista de Acciones (por Acción Directa):

Eliminados Ficheros Temporales del IE



Sat Jan 13 00:55:21 2007

EliStartPage v13.07 (c)2007 S.G.H. / Satinfo S.L.

--------------------------------------------------

Lista de Acciones (por Exploración):

C:\Program Files\Microsoft Works\WKDBOLE.DLL --> Eliminado, ZangoSA (BHO)

C:\Program Files\Microsoft Works\WKSSOLE.DLL --> Eliminado, ZangoSA (BHO)

C:\Program Files\OpenOffice.org 2.0\program\CANVASFACTORY.UNO.DLL --> Eliminado, SaveNow

C:\Program Files\Windows XP MUI Pack\MP10SETUP_MUIESN.EXE --> Eliminado, Hack-MSN (dropper)

C:\SWSetup\MSWorks\SP\PFiles\MSWorks\WKDBOLE.DLL --> Eliminado, ZangoSA (BHO)

C:\SWSetup\MSWorks\SP\PFiles\MSWorks\WKSSOLE.DLL --> Eliminado, ZangoSA (BHO)

C:\WINDOWS\system32\WEXTRACT.EXE --> Eliminado, Hack-MSN (dropper)

[Nuker]

Y pruebe ELITRIIP , peguenos el log generado tambien, gracias.

Comentenos si paso SPYBOT y al terminar ELITRIIP reinicie y comente resultado.



Nota: Elitriip en modo seguro.



ELITRIIP:



http://www.zonavirus.com/descargas/elitriip.asp

[msc hotline sat]

Y diganos si el problema de lentitud persiste o no ..., gracias



saludos



ms, 12-01-2007

[tatibertolucci]

El problema de lentitud persiste y el ordenador está aun peor. Ya no lo sé que hacer!!!



Muchas gracias

[Nuker]

Posteenos el log de HijackThis arrancando en modo seguro (le da en scan and save log file, copia y pega contenido de bloc aqui como parte de su respuesta) y posteenos el log de ELITRIIP si no lo a pasado pruebelo en modo seguro tambien.



HIJACKTHIS:



http://www.zonavirus.com/descargas/trendmicro-hijackthis.asp