| lourdeszamalloa |  |
|
2007-07-04 21:16 - Respuestas: 83 - Tema nº: 2455533
con el log de hijack os referís a esto QEN5N ?
El informe de smitfraudfix es el siguiente:
SmitFraudFix v2.199
Scan done at 21:12:40,43, 04/07/2007
Run from C:\Documents and Settings\Propietario\Escritorio\LOURDES\programas\pruebas antivirus\SmitfraudFix
OS: Microsoft Windows XP [Versi¢n 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» Killing process
»»»»»»»»»»»»»»»»»»»»»»»» hosts
127.0.0.1 localhost
»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix
GenericRenosFix by S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files
»»»»»»»»»»»»»»»»»»»»»»»» DNS
Des-c-r-i-p-tion: Motorola SurfBoard 4200 USB Cable Modem - Minipuerto del administrador de paquetes
DNS Server Search Order: 62.42.230.24
DNS Server Search Order: 62.42.63.52
HKLM\SYSTEM\CCS\Services\Tcpip\..\{CE857209-41A8-472B-B0C0-6058F473B530}: DhcpNameServer=62.42.230.24 62.42.63.52
HKLM\SYSTEM\CS1\Services\Tcpip\..\{CE857209-41A8-472B-B0C0-6058F473B530}: DhcpNameServer=62.42.230.24 62.42.63.52
HKLM\SYSTEM\CS2\Services\Tcpip\..\{CE857209-41A8-472B-B0C0-6058F473B530}: DhcpNameServer=62.42.230.24 62.42.63.52
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=62.42.230.24 62.42.63.52
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=62.42.230.24 62.42.63.52
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=62.42.230.24 62.42.63.52
»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files
»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""
»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning
Registry Cleaning done.
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» End
MUCHAS GRACIAS POR TODO, DE VERDAD
| |
|
|
| ruedas | |
|
Re: tengo un virus! (Solucionado) - 2007-07-04 21:41 - Respuesta 17
lourdeszamalloa, el log del Hijackthis como el primero que pusiste y el informe de Kaspersky.
no el de smitfraudfix
Gracias
-
[Mensaje editado por ruedas con fecha: 04-07-2007 21:42:12]. | |
|
|
| lourdeszamalloa | |
|
Re: tengo un virus! (Solucionado) - 2007-07-04 22:00 - Respuesta 18
de kapersky he grabado como cuatro informes, pq podías analizar varias cosas por separado....los pongo todos uno detrás d otro, vale?
lo otro ahora lo busco... | |
|
|
| ruedas | |
|
Re: tengo un virus! (Solucionado) - 2007-07-04 22:04 - Respuesta 19
No mira pon el log del hijackthis de momento mejor | |
|
|
| lourdeszamalloa | |
|
Re: tengo un virus! (Solucionado) - 2007-07-04 22:07 - Respuesta 20
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 22:02:54, on 04/07/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Safe mode with network support
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Archivos de programa\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\Archivos de programa\Outlook Express\msimn.exe
C:\Archivos de programa\Internet Explorer\iexplore.exe
C:\Documents and Settings\Propietario\Escritorio\LOURDES\programas\Instalar-HijackThis.exe
C:\DOCUME~1\PROPIE~1\CONFIG~1\Temp\hijackthis_v2.exe
C:\WINDOWS\system32\NOTEPAD.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Archivos de programa\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {3E47D64C-864D-4203-986F-0A06F2BCC1B3} - C:\WINDOWS\system32\wiavusdd.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARCHIV~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Archivos de programa\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\archivos de programa\google\googletoolbar1.dll
O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file)
O3 - Toolbar: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\archivos de programa\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Archivos de programa\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [UpdateManager] "c:\Archivos de programa\Archivos comunes\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [TkBellExe] "C:\Archivos de programa\Archivos comunes\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [sealmon] C:\Archivos de programa\SealedMedia\sealmon.exe
O4 - HKLM\..\Run: [Uninstall_WinTools] C:\WINDOWS\Temp\WTuninst.exe /remove
O4 - HKLM\..\Run: [Uninstall_TBPS] C:\WINDOWS\Temp\TBuninst.exe /remove
O4 - HKLM\..\Run: [ccApp] "c:\Archivos de programa\Archivos comunes\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SsAAD.exe] C:\ARCHIV~1\Sony\SONICS~1\SsAAD.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Archivos de programa\Archivos comunes\InstallShield\UpdateService\ISUSPM.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Archivos de programa\Archivos comunes\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [avast!] C:\ARCHIV~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [eDonkey2000] "C:\Archivos de programa\eDonkey2000\eDonkey2000.exe" -t
O4 - HKLM\..\Run: [iTunesHelper] C:\Archivos de programa\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Archivos de programa\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Archivos de programa\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Acme.PCHButton] C:\ARCHIV~1\PRESAR~1\Presario\XPHWWRS4\plugin\bin\PCHButton.exe
O4 - HKCU\..\Run: [PcSync] C:\Archivos de programa\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICIO LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Servicio de red')
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Archivos de programa\Archivos comunes\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Archivos de programa\Archivos comunes\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Archivos de programa\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Google Search - res://c:\archivos de programa\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\archivos de programa\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\archivos de programa\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\archivos de programa\google\GoogleToolbar1.dll/cmsimilar.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\ARCHIV~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\ARCHIV~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} -
O16 - DPF: {1E5592CB-8F5B-46F8-9EA6-65C01213808A} (InstaladorBetyByte Control) - http://www.cocacola.es/uploads/cab/instaladorbetybyte.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} -
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by106fd.bay106.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/win/ActiveXPlugin.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/yautocomplete.cab
O22 - SharedTaskScheduler: Precargador Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Demonio de caché de las categorías de componente - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Archivos de programa\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Archivos de programa\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Archivos de programa\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Archivos de programa\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: DirectX Service (DirectLuvv) - Unknown owner - C:\WINDOWS\system32\directx.exe (file missing)
O23 - Service: Servicio del administrador de discos lógicos (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Registro de sucesos (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Fax - Unknown owner - C:\WINDOWS\system32\fxssvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Archivos de programa\Archivos comunes\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Servicio COM de grabación de CD de IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\System32\imapi.exe
O23 - Service: Servicio del iPod (iPod Service) - Apple Inc. - C:\Archivos de programa\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Archivos de programa\Archivos comunes\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Escritorio remoto compartido de NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\System32\mnmsrvc.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Archivos de programa\Archivos comunes\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Archivos de programa\Archivos comunes\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Plug and Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Administrador de sesión de Ayuda de escritorio remoto (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Tarjeta inteligente (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Archivos de programa\Archivos comunes\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Archivos de programa\Archivos comunes\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
O23 - Service: Registros y alertas de rendimiento (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Instantáneas de volumen (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Adaptador de rendimiento de WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\System32\wbem\wmiapsrv.exe
End of file - 11229 bytes
Y EL DE KAPERSKY:
EL PRIMERO:
-
KASPERSKY ONLINE SCANNER REPORT
Wednesday, July 04, 2007 3:25:37 AM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.93.0
Kaspersky Anti-Virus database last update: 4/07/2007
Kaspersky Anti-Virus database records: 357486
-
Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true
Scan Target - Critical Areas:
C:\WINDOWS
C:\DOCUME~1\PROPIE~1\CONFIG~1\Temp\
Scan Statistics:
Total number of scanned objects: 26641
Number of viruses found: 2
Number of infected objects: 4
Number of suspicious objects: 0
Duration of the scan process: 00:23:41
Infected Object Name / Virus Name / Last Action
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\EHome\explorer.exe Infected: Backdoor.Win32.Rukap.gen skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\DOCUME~1\PROPIE~1\CONFIG~1\Temp\Rar$EX05.390\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\DOCUME~1\PROPIE~1\CONFIG~1\Temp\Rar$EX05.781\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\DOCUME~1\PROPIE~1\CONFIG~1\Temp\Rar$EX07.953\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
Scan process completed.
EL SEGUNDO:
-
KASPERSKY ONLINE SCANNER REPORT
Wednesday, July 04, 2007 12:47:37 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.93.0
Kaspersky Anti-Virus database last update: 4/07/2007
Kaspersky Anti-Virus database records: 357505
-
Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true
Scan Target - Folders:
C:\Documents and Settings\Propietario\
Scan Statistics:
Total number of scanned objects: 158572
Number of viruses found: 4
Number of infected objects: 15
Number of suspicious objects: 10
Duration of the scan process: 04:36:33
Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\Propietario\Configuración local\Archivos temporales de Internet\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\Propietario\Configuración local\Archivos temporales de Internet\Content.IE5\index.dat Object is locked skipped
C:\Archivos de programa\eMule\Temp\022.part.met/[From 100028952@alumnos.uc3m.es][Date Mon, 2 Jul 2007 18:16:12 +0200]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload skipped
C:\Archivos de programa\eMule\Temp\022.part.met/[From 100028952@alumnos.uc3m.es][Date Mon, 2 Jul 2007 18:16:12 +0200]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload skipped
C:\Archivos de programa\eMule\Temp\022.part.met/[From 100028952@alumnos.uc3m.es][Date Mon, 2 Jul 2007 18:16:12 +0200]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload skipped
C:\Archivos de programa\eMule\Temp\022.part.met/[From 100028952@alumnos.uc3m.es][Date Mon, 2 Jul 2007 18:16:12 +0200]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload skipped
C:\Archivos de programa\eMule\Temp\022.part.met Mail MS Outlook 5: suspicious - 4 skipped
C:\Documents and Settings\Propietario\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Propietario\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Propietario\Configuración local\Historial\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Propietario\Configuración local\Temp\Acr3031.tmp Object is locked skipped
C:\Documents and Settings\Propietario\Configuración local\Temp\Acr3057.tmp Object is locked skipped
C:\Documents and Settings\Propietario\Configuración local\Temp\Acr3187.tmp Object is locked skipped
C:\Documents and Settings\Propietario\Configuración local\Temp\Acr3189.tmp Object is locked skipped
C:\Documents and Settings\Propietario\Configuración local\Temp\Acr318B.tmp Object is locked skipped
C:\Documents and Settings\Propietario\Configuración local\Temp\D93B63.dmp Object is locked skipped
C:\Documents and Settings\Propietario\Configuración local\Temp\Perflib_Perfdata_184.dat Object is locked skipped
C:\Archivos de programa\GAMES\chat3d\cache\art\www.chat3d-hispania.com\textures\lama8.ras Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Archivos de programa\GAMES\chat3d\cache\art\www.chat3d-hispania.com\textures\lsuel3.ras Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Archivos de programa\GAMES\chat3d\cache\art\www.chat3d-hispania.com\textures\mon4.ras Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\Propietario\Cookies\index.dat Object is locked skipped
C:\Archivos de programa\Java\jre1.5.0_06\lib\zi\America\Nome Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Archivos de programa\Java\jre1.5.0_06\lib\zi\Asia\Jayapura/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Archivos de programa\Java\jre1.5.0_06\lib\zi\Asia\Jayapura ZIP: infected - 1 skipped
C:\Documents and Settings\Propietario\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Propietario\ntuser.dat.LOG Object is locked skipped
C:\Archivos de programa\MSN Messenger\riched20.dll Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped
C:\Documents and Settings\All Users\Escritorio\EHome\explorer.exe Infected: Backdoor.Win32.Rukap.gen skipped
C:\Documents and Settings\LocalService\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Propietario\Configuración local\Archivos temporales de Internet\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\Propietario\Configuración local\Archivos temporales de Internet\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Propietario\Configuración local\Datos de programa\Identities\{F930A62C-16DF-4A43-BCAE-85558D222139}\Microsoft\Outlook Express\Elementos eliminados.dbx/[From 100028952@alumnos.uc3m.es][Date Mon, 2 Jul 2007 18:16:12 +0200]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Propietario\Configuración local\Datos de programa\Identities\{F930A62C-16DF-4A43-BCAE-85558D222139}\Microsoft\Outlook Express\Elementos eliminados.dbx/[From 100028952@alumnos.uc3m.es][Date Mon, 2 Jul 2007 18:16:12 +0200]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Propietario\Configuración local\Datos de programa\Identities\{F930A62C-16DF-4A43-BCAE-85558D222139}\Microsoft\Outlook Express\Elementos eliminados.dbx/[From 100028952@alumnos.uc3m.es][Date Mon, 2 Jul 2007 18:16:12 +0200]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Propietario\Configuración local\Datos de programa\Identities\{F930A62C-16DF-4A43-BCAE-85558D222139}\Microsoft\Outlook Express\Elementos eliminados.dbx/[From 100028952@alumnos.uc3m.es][Date Mon, 2 Jul 2007 18:16:12 +0200]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Propietario\Configuración local\Datos de programa\Identities\{F930A62C-16DF-4A43-BCAE-85558D222139}\Microsoft\Outlook Express\Elementos eliminados.dbx Suspicious: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Propietario\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Propietario\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Propietario\Configuración local\Historial\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Propietario\Configuración local\Temp\Acr3031.tmp Object is locked skipped
C:\Documents and Settings\Propietario\Configuración local\Temp\Acr3057.tmp Object is locked skipped
C:\Documents and Settings\Propietario\Configuración local\Temp\Acr3187.tmp Object is locked skipped
C:\Documents and Settings\Propietario\Configuración local\Temp\Acr3189.tmp Object is locked skipped
C:\Documents and Settings\Propietario\Configuración local\Temp\Acr318B.tmp Object is locked skipped
C:\Documents and Settings\Propietario\Configuración local\Temp\D93B63.dmp Object is locked skipped
C:\Documents and Settings\Propietario\Configuración local\Temp\Perflib_Perfdata_184.dat Object is locked skipped
C:\Documents and Settings\Propietario\Configuración local\Temp\Rar$EX05.390\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\Propietario\Configuración local\Temp\Rar$EX05.781\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\Propietario\Configuración local\Temp\Rar$EX07.953\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\Propietario\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Propietario\Escritorio\LOURDES\programas\pruebas antivirus\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\Propietario\Escritorio\LOURDES\programas\SmitfraudFix-antivirus concreto eficaz.zip/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\Propietario\Escritorio\LOURDES\programas\SmitfraudFix-antivirus concreto eficaz.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Propietario\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Propietario\ntuser.dat.LOG Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{B9562B58-F49F-4348-9ED6-175ACD911ADD}\RP585\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\EHome\explorer.exe Infected: Backdoor.Win32.Rukap.gen skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
Scan process completed.
EL TERCERO:
-
KASPERSKY ONLINE SCANNER REPORT
Wednesday, July 04, 2007 12:48:32 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.93.0
Kaspersky Anti-Virus database last update: 4/07/2007
Kaspersky Anti-Virus database records: 357523
-
Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true
Scan Target - Critical Areas:
C:\WINDOWS
C:\DOCUME~1\PROPIE~1\CONFIG~1\Temp\
Scan Statistics:
Total number of scanned objects: 27281
Number of viruses found: 2
Number of infected objects: 4
Number of suspicious objects: 0
Duration of the scan process: 01:03:33
Infected Object Name / Virus Name / Last Action
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\EHome\explorer.exe Infected: Backdoor.Win32.Rukap.gen skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\DOCUME~1\PROPIE~1\CONFIG~1\Temp\Acr3031.tmp Object is locked skipped
C:\DOCUME~1\PROPIE~1\CONFIG~1\Temp\Acr3057.tmp Object is locked skipped
C:\DOCUME~1\PROPIE~1\CONFIG~1\Temp\Acr3185.tmp Object is locked skipped
C:\DOCUME~1\PROPIE~1\CONFIG~1\Temp\AVP7844.tmp Object is locked skipped
C:\DOCUME~1\PROPIE~1\CONFIG~1\Temp\AVP7845.tmp Object is locked skipped
C:\DOCUME~1\PROPIE~1\CONFIG~1\Temp\Perflib_Perfdata_184.dat Object is locked skipped
C:\DOCUME~1\PROPIE~1\CONFIG~1\Temp\Rar$EX05.390\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\DOCUME~1\PROPIE~1\CONFIG~1\Temp\Rar$EX05.781\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\DOCUME~1\PROPIE~1\CONFIG~1\Temp\Rar$EX07.953\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
Scan process completed.
EL CUARTO:
-
KASPERSKY ONLINE SCANNER REPORT
Wednesday, July 04, 2007 12:49:20 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.93.0
Kaspersky Anti-Virus database last update: 4/07/2007
Kaspersky Anti-Virus database records: 357505
-
Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true
Scan Target - My Email:
C:\
D:\
Scan Statistics:
Total number of scanned objects: 170
Number of viruses found: 1
Number of infected objects: 0
Number of suspicious objects: 5
Duration of the scan process: 00:47:48
Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\Propietario\Configuración local\Datos de programa\Identities\{F930A62C-16DF-4A43-BCAE-85558D222139}\Microsoft\Outlook Express\Elementos eliminados.dbx/[From 100028952@alumnos.uc3m.es][Date Mon, 2 Jul 2007 18:16:12 +0200]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Propietario\Configuración local\Datos de programa\Identities\{F930A62C-16DF-4A43-BCAE-85558D222139}\Microsoft\Outlook Express\Elementos eliminados.dbx/[From 100028952@alumnos.uc3m.es][Date Mon, 2 Jul 2007 18:16:12 +0200]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Propietario\Configuración local\Datos de programa\Identities\{F930A62C-16DF-4A43-BCAE-85558D222139}\Microsoft\Outlook Express\Elementos eliminados.dbx/[From 100028952@alumnos.uc3m.es][Date Mon, 2 Jul 2007 18:16:12 +0200]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Propietario\Configuración local\Datos de programa\Identities\{F930A62C-16DF-4A43-BCAE-85558D222139}\Microsoft\Outlook Express\Elementos eliminados.dbx/[From 100028952@alumnos.uc3m.es][Date Mon, 2 Jul 2007 18:16:12 +0200]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Propietario\Configuración local\Datos de programa\Identities\{F930A62C-16DF-4A43-BCAE-85558D222139}\Microsoft\Outlook Express\Elementos eliminados.dbx Mail MS Outlook 5: suspicious - 4 skipped
Scan process completed.
Y OTRO (NU SÉ CUÁL)
-
KASPERSKY ONLINE SCANNER REPORT
Wednesday, July 04, 2007 12:48:56 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.93.0
Kaspersky Anti-Virus database last update: 4/07/2007
Kaspersky Anti-Virus database records: 357523
-
Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true
Scan Target - Critical Areas:
C:\WINDOWS
C:\DOCUME~1\PROPIE~1\CONFIG~1\Temp\
Scan Statistics:
Total number of scanned objects: 27281
Number of viruses found: 2
Number of infected objects: 4
Number of suspicious objects: 0
Duration of the scan process: 01:03:33
Infected Object Name / Virus Name / Last Action
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\EHome\explorer.exe Infected: Backdoor.Win32.Rukap.gen skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\DOCUME~1\PROPIE~1\CONFIG~1\Temp\Acr3031.tmp Object is locked skipped
C:\DOCUME~1\PROPIE~1\CONFIG~1\Temp\Acr3057.tmp Object is locked skipped
C:\DOCUME~1\PROPIE~1\CONFIG~1\Temp\Acr3185.tmp Object is locked skipped
C:\DOCUME~1\PROPIE~1\CONFIG~1\Temp\AVP7844.tmp Object is locked skipped
C:\DOCUME~1\PROPIE~1\CONFIG~1\Temp\AVP7845.tmp Object is locked skipped
C:\DOCUME~1\PROPIE~1\CONFIG~1\Temp\Perflib_Perfdata_184.dat Object is locked skipped
C:\DOCUME~1\PROPIE~1\CONFIG~1\Temp\Rar$EX05.390\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\DOCUME~1\PROPIE~1\CONFIG~1\Temp\Rar$EX05.781\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\DOCUME~1\PROPIE~1\CONFIG~1\Temp\Rar$EX07.953\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
Scan process completed.
gracia aaaaaaas! | |
|
|
|
