Malware deshabilita mis programas de protección

Eliminar Malwares
17

Hola @Jaime64

Desinstala con Revo Uninstaller en su Modo Avanzado:

  • Avast Secure Browser

Manual de Revo Uninstaller.

Luego de reiniciar sigue estos pasos:

1.- Muy Importante >>> Realizar una copia de Seguridad de su Registro.

  • Descarga DelFix en el escritorio de Windows.
  • Clic Derecho, “Ejecutar como Administrador”.
  • En la ventana principal, marca solamente la casilla “Create Registry Backup”.
  • Clic en Run.

Al terminar se abrirá un reporte llamado DelFix.txt, guárdelo por si fuera necesario y cierre la herramienta…

2.- Desactiva Temporalmente tu antivirus.

3.- Abre un nuevo archivo Notepad/Bloc de Notas y copia y pega este contenido:

Start
CloseProcesses:
CreateRestorePoint:
HKLM\Software\Microsoft\Active Setup\Installed Components: [{A8504530-742B-42BC-895D-2BAD6406F698}] -> C:\Program Files\AVAST Software\Browser\Application\77.2.2152.121\Installer\chrmstp.exe [2019-12-06] (AVAST Software s.r.o. -> AVAST Software)
FF HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
Task: {3B3FB056-AC60-476C-9FAA-2A173F6CE92E} - System32\Tasks\{71412253-490C-4437-8768-E7BE74A9C98D} => C:\Windows\system32\pcalua.exe -a "C:\Program Files\Konami\Yu-Gi-Oh! Power of Chaos\Yugi The Destiny\unins000.exe" -d "C:\Program Files\Konami\Yu-Gi-Oh! Power of Chaos\Yugi The Destiny"
Task: {81E895A7-18FF-4A8D-AB8C-9811FE10131A} - System32\Tasks\{8CC29FAE-4215-4B0B-8A16-BBED68D50270} => C:\Windows\system32\pcalua.exe -a "C:\Users\ADM-ll\Downloads\Nueva carpeta (2)\UNINSTL.EXE" -d "C:\Users\ADM-ll\Downloads\Nueva carpeta (2)"
Task: {A71007E4-7FE3-4D06-A976-72A4189E09FB} - System32\Tasks\Avast Secure Browser Heartbeat Task (Hourly) => C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe [1850312 2019-11-04] (AVAST Software s.r.o. -> AVAST Software)
Task: {B577233D-F322-4B75-A545-37E5A7B33B16} - System32\Tasks\{45B4ABC5-E5FC-47C6-A1DE-C899171972A6} => C:\Windows\system32\pcalua.exe -a "C:\Users\ADM-ll\Downloads\All Cards by BlizzBoyGames.exe" -d C:\Users\ADM-ll\Downloads
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.yahoo.com/?fr=hp-avast&type=avastbcl
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://search.yahoo.com/yhs/search?type=avastbcl&hspart=avast&hsimp=yhs-001&p={searchTerms}
HKU\S-1-5-21-2707563477-1181458908-4289881501-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://search.yahoo.com/yhs/search?type=avastbcl&hspart=avast&hsimp=yhs-001&p={searchTerms}
HKU\S-1-5-21-2707563477-1181458908-4289881501-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.yahoo.com/?fr=hp-avast&type=avastbcl
SearchScopes: HKLM -> DefaultScope {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = hxxps://search.yahoo.com/yhs/search?type=avastbcl&hspart=avast&hsimp=yhs-001&p={searchTerms}
SearchScopes: HKLM -> {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = hxxps://search.yahoo.com/yhs/search?type=avastbcl&hspart=avast&hsimp=yhs-001&p={searchTerms}
SearchScopes: HKU\S-1-5-21-2707563477-1181458908-4289881501-1000 -> {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = hxxps://search.yahoo.com/yhs/search?type=avastbcl&hspart=avast&hsimp=yhs-001&p={searchTerms}
FF Extension: (Avast SafePrice | Comparaciones, ofertas y cupones) - C:\Users\ADM-ll\AppData\Roaming\Mozilla\Firefox\Profiles\w5oi6h56.default-1551223974728\Extensions\[email protected] [2019-07-17]
FF Extension: (Avast Online Security) - C:\Users\ADM-ll\AppData\Roaming\Mozilla\Firefox\Profiles\w5oi6h56.default-1551223974728\Extensions\[email protected] [2019-10-12]
FF SearchPlugin: C:\Users\ADM-ll\AppData\Roaming\Mozilla\Firefox\Profiles\w5oi6h56.default-1551223974728\searchplugins\yahoo-avast.xml [2019-07-29]
CHR Extension: (Avast Online Security) - C:\Users\ADM-ll\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2019-07-16]
CHR Extension: (Chrome Media Router) - C:\Users\ADM-ll\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2019-11-01]
CHR HKLM\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck]
CHR HKLM\...\Chrome\Extension: [fagakgcelolinfnkfgekcnedpaklfcok]
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki]
OPR Extension: (Avast Online Security) - C:\Users\ADM-ll\AppData\Roaming\Opera Software\Opera Stable\Extensions\daanglpcpkjjlkhcbladppjphglbigam [2019-11-23]
S4 panda_url_filtering; C:\Program Files\Panda Security URL Filtering\Panda_URL_Filteringb.exe -- [X]
C:\Program Files\Panda Security URL Filtering
U3 iswSvc; no ImagePath
2019-12-06 21:06 - 2019-12-06 21:06 - 000003720 _____ C:\Windows\system32\Tasks\Avast Secure Browser Heartbeat Task (Hourly)
2019-12-06 21:06 - 2019-12-06 21:06 - 000003138 _____ C:\Windows\system32\Tasks\Avast Secure Browser Heartbeat Task (Logon)
2019-12-06 21:06 - 2019-12-06 21:06 - 000002449 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast Secure Browser.lnk
2019-12-06 21:06 - 2019-12-06 21:06 - 000002406 _____ C:\Users\Public\Desktop\Avast Secure Browser.lnk
2019-12-06 21:06 - 2019-12-06 21:06 - 000002406 _____ C:\ProgramData\Desktop\Avast Secure Browser.lnk
2019-12-06 20:55 - 2019-12-06 20:56 - 002793832 _____ C:\Users\ADM-ll\Downloads\avast_secure_browser_setup.exe
2019-12-04 17:36 - 2019-12-04 17:36 - 000000000 ____D C:\Program Files\Malwarebytes
2019-11-15 15:28 - 2019-12-07 17:06 - 000002970 _____ C:\Windows\system32\Tasks\{E239BC8F-9439-4779-B8AB-D19DC9E7F85B}
2019-12-07 17:06 - 2019-10-27 13:44 - 000003210 _____ C:\Windows\system32\Tasks\{8CC29FAE-4215-4B0B-8A16-BBED68D50270}
2019-12-07 17:06 - 2019-10-16 14:03 - 000003024 _____ C:\Windows\system32\Tasks\{930691F8-3F6D-4037-ABA4-C70E99C382F4}
2019-12-07 17:06 - 2019-10-16 14:01 - 000003024 _____ C:\Windows\system32\Tasks\{C019E3AC-4A62-442F-A8F9-A809428A0BCB}
2019-12-07 17:06 - 2019-10-16 14:01 - 000003024 _____ C:\Windows\system32\Tasks\{11118543-EB2F-4408-95F5-678A1332DF7D}
2019-12-07 17:06 - 2019-10-16 14:00 - 000003300 _____ C:\Windows\system32\Tasks\{71412253-490C-4437-8768-E7BE74A9C98D}
2019-12-07 17:06 - 2019-10-14 18:49 - 000003172 _____ C:\Windows\system32\Tasks\{45B4ABC5-E5FC-47C6-A1DE-C899171972A6}
2019-12-07 01:41 - 2019-03-27 03:22 - 000000000 ____D C:\ProgramData\Malwarebytes
CustomCLSID: HKU\S-1-5-21-2707563477-1181458908-4289881501-1000_Classes\CLSID\{cb4c77f0-ab2a-407c-93ac-963769824b18}\localserver32 -> no filepath
FirewallRules: [{BD16914B-F965-48EE-B93A-DD322F9FD32C}] => (Allow) C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe (AVAST Software s.r.o. -> AVAST Software)

CMD: ipconfig /flushdns
CMD: ipconfig /renew
CMD: bitsadmin /reset /allusers
CMD: netsh winsock reset
CMD: netsh advfirewall reset
CMD: netsh advfirewall set allprofiles state ON
CMD: netsh int ipv4 reset
CMD: netsh int ipv6 reset
RemoveProxy:
EmptyTemp:
Hosts:
END
  • Lo guardas bajo el nombre de fixlist.txt en el escritorio <<< Esto es muy importante.

Nota: Es necesario que el ejecutable Frst.exe y fixlist.txt se encuentren en la misma ubicación (escritorio) o si no la herramienta no trabajara.

  • Ejecutas Frst.exe.
  • Presionas el botón Fix y aguardas a que termine.
  • La Herramienta guardara el reporte en tu escritorio (Fixlog.txt).
  • Lo pegas en tu próxima respuesta.

Nos comentas .

Salu2.