La computadora tiene Windows 7 Home Premium con McAfee, ya vencido. malwarebytes pudo detectar muchos trojanos y virus y fueron eliminados con exito, pero al reiniciar, note en el administrador de tareas o Task Manager, que PING.EXE (C:\Windows\SysWOW64\PING.EXE) estaba utilizando muchos recursos; Mas de 500 MB de memoria y a veces llegaba a utilizar 100% del procesador.
Despues de Instalar AVG y detectar mas virus y eliminarlos, Windows 7 no pudo iniciar. Solo se presentaba una pantalla azul con un error STOP. Ejecute un System Restore o restaurar Sistema. Y esta vez, en vez de AVG, utilice el Kaspersky Virus Removal Tool: http://www.kaspersky.com/antivirus-remo ... l-register Aqui quedaron eliminados por completos los virus sin que el sistema operativo perdiera la estabilidad.
Log de Malwarebytes Antimalware
Memory Modules Detected: 1
C:\ProgramData\WindowsBackupService.dll (Trojan.SHarpro.PGen) -> Delete on reboot.
Registry Keys Detected: 2
HKCR\.fsharproj (Trojan.BHO) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\opsmr9ibkfl (Trojan.FakeAlert) -> Quarantined and deleted successfully.
Registry Values Detected: 2
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|WindowsBackupService (Trojan.SHarpro.PGen) -> Data: rundll32.exe "C:\ProgramData\WindowsBackupService.dll",DllRegisterServer -> Quarantined and deleted successfully.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings|ProxyServer (PUM.Bad.Proxy) -> Data: http=127.0.0.1:28091 -> Quarantined and deleted successfully.
Registry Data Items Detected: 1
HKCR\.exe| (Hijacked.exeFile) -> Bad: (ﱄࣚⴋ) Good: (exefile) -> Quarantined and repaired successfully.
Files Detected: 7
C:\Users\usuario\Local Settings\ltr.exe (Trojan.FakeMS) -> Quarantined and deleted successfully.
C:\Users\usuario\Local Settings\ybw.exe (Trojan.FakeMS) -> Quarantined and deleted successfully.
C:\Users\usuario\Local Settings\Application Data\ltr.exe (Trojan.FakeMS) -> Quarantined and deleted successfully.
C:\Users\usuario\Local Settings\Application Data\ybw.exe (Trojan.FakeMS) -> Quarantined and deleted successfully.
C:\Users\usuario\Local Settings\Application Data\Apple Computer\AppleUpdate\Appleupdt32.dll (Trojan.SHarpro) -> Quarantined and deleted successfully.
C:\Users\usuario\AppData\Local\Apple Computer\AppleUpdate\Appleupdt32.dll (Trojan.SHarpro) -> Quarantined and deleted successfully.
C:\ProgramData\WindowsBackupService.dll (Trojan.SHarpro.PGen) -> Delete on reboot.
Shortcut o Acceso Directo encontrado en el escritorio:
Security Protection:
C:\Users\usuario\AppData\Roaming\defender.exe
Log de AVG
"";"C:\Users\usuario\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12\3cc664c-19c7f20c";"Trojan horse Java/Exploit.EN";"Moved to Virus Vault"
"";"C:\Users\usuario\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54\43e67536-124a4aad";"Trojan horse Java/Downloader.DK";"Moved to Virus Vault"
"";"C:\Users\usuario\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54\43e67536-32e5d03b";"Trojan horse Java/Downloader.DK";"Moved to Virus Vault"
"";"C:\Users\usuario\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54\43e67536-57f17e01";"Trojan horse Java/Downloader.DK";"Moved to Virus Vault"
"";"C:\Users\usuario\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54\43e67536-5b8fa6a3";"Trojan horse Java/Downloader.DK";"Moved to Virus Vault"
"";"C:\Users\usuario\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54\43e67536-7095b258";"Trojan horse Java/Downloader.DK";"Moved to Virus Vault"
"";"C:\Users\usuario\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54\43e67536-784cf85d";"Trojan horse Java/Downloader.DK";"Moved to Virus Vault"
"";"C:\Users\usuario\AppData\Local\Apple Computer\AppleData\Appledata.dll";"Virus found Win32/Cryptor";"Moved to Virus Vault"
"";"C:\Users\usuario\Documents\Vf87aAB.exe";"Trojan horse FakeAlert.AGM";"Moved to Virus Vault"
"";"C:\Windows\System32\consrv.dll";"Trojan horse Generic_r.JU";"Moved to Virus Vault"
"";"C:\Windows\SysWOW64\srrstr.dll";"Virus found Win32/Cryptor";"Moved to Virus Vault"
