Buenas, desde hace días tengo varios virus, los cuales al escanearlos con malwarebytes y distintos antivirus y borrandolos, nuevamente aparecen tras un reinicio.
El virus principal parece que es un “mrsys.exe”, el cual ejecuta un cmd a cada inicio del computador. También permanece infectado mi Explorer.exe y svchost.exe. Temas similares a mi problema serian Este y Este otro.
También aparentemente esparce un tipo de virus generic.backdoor en muchos de mis archivos, ya que archivos que antes aseguro que estaban totalmente sanos, de vez en cuando aparecen como infactados con dicho virus. Lo cual me resulta bastante molesto ya que voy poco a poco borrando todos mis archivos importantes.
Escaneo de Malwarebytes
Malwarebytes
www.malwarebytes.com
-Log Details-
Scan Date: 10/21/19
Scan Time: 8:33 AM
Log File: f530c7a2-f3fe-11e9-8902-eca86b0d242d.json
-Software Information-
Version: 3.8.3.2965
Components Version: 1.0.613
Update Package Version: 1.0.11534
License: Free
-System Information-
OS: Windows 7 Service Pack 1
CPU: x86
File System: NTFS
User: Usuario-PC\Usuario
-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 184854
Threats Detected: 30
Threats Quarantined: 0
Time Elapsed: 11 min, 50 sec
-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect
-Scan Details-
Process: 3
Backdoor.Bot, C:\WINDOWS\SYSTEM\EXPLORER.EXE, No Action By User, [3452], [207664],1.0.11534
Trojan.Agent, C:\WINDOWS\SYSTEM\SVCHOST.EXE, No Action By User, [442], [196488],1.0.11534
Trojan.MWF.Gen, C:\WINDOWS\10460838318592429\WINEOZL.EXE, No Action By User, [6376], [196481],1.0.11534
Module: 3
Backdoor.Bot, C:\WINDOWS\SYSTEM\EXPLORER.EXE, No Action By User, [3452], [207664],1.0.11534
Trojan.Agent, C:\WINDOWS\SYSTEM\SVCHOST.EXE, No Action By User, [442], [196488],1.0.11534
Trojan.MWF.Gen, C:\WINDOWS\10460838318592429\WINEOZL.EXE, No Action By User, [6376], [196481],1.0.11534
Registry Key: 1
Trojan.Gosys, HKLM\SOFTWARE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}, No Action By User, [4138], [199097],1.0.11534
Registry Value: 6
Backdoor.Bot, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE|Explorer, No Action By User, [3452], [207664],1.0.11534
Backdoor.Bot, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|Explorer, No Action By User, [3452], [207664],1.0.11534
Trojan.Agent, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE|Svchost, No Action By User, [442], [196488],1.0.11534
Trojan.Agent, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|SVCHOST, No Action By User, [442], [196488],1.0.11534
Trojan.MWF.Gen, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|Microsoft Windows Services, No Action By User, [6376], [196481],1.0.11534
Trojan.MWF.Gen, HKU\S-1-5-21-2933920947-2731864605-3484268354-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|MICROSOFT WINDOWS SERVICES, No Action By User, [6376], [196481],1.0.11534
Registry Data: 4
Backdoor.Bot, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON|Shell, No Action By User, [3452], [207664],1.0.11534
PUM.Optional.DisabledSecurityCenter, HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER|ANTIVIRUSDISABLENOTIFY, No Action By User, [13257], [293294],1.0.11534
PUM.Optional.DisabledSecurityCenter, HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER|UPDATESDISABLENOTIFY, No Action By User, [13257], [293296],1.0.11534
PUM.Optional.DisabledSecurityCenter, HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER|FIREWALLDISABLENOTIFY, No Action By User, [13257], [293295],1.0.11534
Data Stream: 0
(No malicious items detected)
Folder: 0
(No malicious items detected)
File: 13
Trojan.Gosys, C:\USERS\USUARIO\APPDATA\ROAMING\MRSYS.EXE, No Action By User, [4138], [199097],1.0.11534
Backdoor.Bot, C:\WINDOWS\SYSTEM\EXPLORER.EXE, No Action By User, [3452], [207664],1.0.11534
RiskWare.HeuristicsReservedWordExploit, C:\WINDOWS\SYSTEM\SPOOLSV.EXE, No Action By User, [5671], [293552],1.0.11534
Trojan.Agent, C:\WINDOWS\SYSTEM\SVCHOST.EXE, No Action By User, [442], [196488],1.0.11534
Trojan.MWF.Gen, C:\WINDOWS\10460838318592429\WINEOZL.EXE, No Action By User, [6376], [196481],1.0.11534
Backdoor.Agent.Generic, C:\USERS\USUARIO\DESKTOP\DELFIX_1.010.EXE, No Action By User, [5697], [355551],1.0.11534
Backdoor.Agent.Generic, C:\USERS\USUARIO\DESKTOP\CCSETUP563.EXE, No Action By User, [5697], [355551],1.0.11534
Backdoor.Agent.Generic, C:\USERS\USUARIO\DESKTOP\FRST.EXE, No Action By User, [5697], [355551],1.0.11534
Backdoor.Agent.Generic, C:\USERS\USUARIO\DOWNLOADS\SUMATRAPDF-3.1.2-INSTALL.EXE, No Action By User, [5697], [355551],1.0.11534
Backdoor.Agent.Generic, C:\USERS\USUARIO\DESKTOP\ADWCLEANER_7.4.1.EXE, No Action By User, [5697], [355551],1.0.11534
Backdoor.Agent.Generic, C:\USERS\USUARIO\DOWNLOADS\WINDOWS7-USB-DVD-DOWNLOAD-TOOL-INSTALLER-ES-ES.EXE, No Action By User, [5697], [355551],1.0.11534
Backdoor.Agent.Generic, C:\USERS\USUARIO\APPDATA\LOCAL\STSYS.EXE, No Action By User, [5697], [355551],1.0.11534
PUP.Optional.WinYahoo, C:\USERS\USUARIO\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Secure Preferences, No Action By User, [240], [454790],1.0.11534
Physical Sector: 0
(No malicious items detected)
WMI: 0
(No malicious items detected)
(end)