Encontre en este mismo foro algunso pasos pero al llegar al fixlist.ext no pude generarlo agrego toda la info que veo que generalmente pueden ayudar. Gracias
Logs de FRST (fixlist.ext) ELIMINADOS por Moderador. Pues:
2.6 Por la seguridad de nuestros usuarios, esta restringida la utilización de herramientas potentes en la detección y eliminación de Malwares como pueden ser HijackThis, OTL, DDS, FARBAR y ComboFix, al igual que el uso de Scripts personalizados y/o Batch, como así cualquier otra herramienta/programa que no se encuentre disponible desde nuestro sitio principal www.infospyware.com y/o en Guías o Tutoriales del foro, solo podrán ser recomendados por los integrantes de nuestro Staff especializado.
Pueden seguir con el tema.
MALWAREBYTES
Malwarebytes
www.malwarebytes.com
-Log Details-
Scan Date: 12/20/21
Scan Time: 7:33 PM
Log File: 0d09c8be-61fe-11ec-9931-18c04d0ef8e6.json
-Software Information-
Version: 4.5.0.152
Components Version: 1.0.1538
Update Package Version: 1.0.48776
License: Trial
-System Information-
OS: Windows 10 (Build 19044.1415)
CPU: x64
File System: NTFS
User: MOTHERSHIP\PeRaLeIt0r
-Scan Summary-
Scan Type: Custom Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 781781
Threats Detected: 1
Threats Quarantined: 1
Time Elapsed: 2 hr, 7 min, 32 sec
-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Detect
PUM: Detect
-Scan Details-
Process: 0
(No malicious items detected)
Module: 0
(No malicious items detected)
Registry Key: 0
(No malicious items detected)
Registry Value: 0
(No malicious items detected)
Registry Data: 0
(No malicious items detected)
Data Stream: 0
(No malicious items detected)
Folder: 0
(No malicious items detected)
File: 1
Malware.AI.3881495462, C:\USERS\PERALEIT0R\APPDATA\LOCAL\ADOBE\ACROBAT\DISTILLER DC\TAPI32.DLL, Delete-on-Reboot, 1000000, 0, 1.0.48776, D1681E607FFE4346E75AEBA6, dds, 01561870, DC74B4A8EBF12DD1810E3E948CAA0C26, 42C28A5AB0C679315609592F6DDC067FA5E4034570E068795F9E638F360FEBE2
Physical Sector: 0
(No malicious items detected)
WMI: 0
(No malicious items detected)
(end)ADWCLEANER
# -------------------------------
# Malwarebytes AdwCleaner 8.3.1.0
# -------------------------------
# Build: 11-18-2021
# Database: 2021-12-02.1 (Cloud)
# Support: https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Clean
# -------------------------------
# Start: 12-20-2021
# Duration: 00:00:00
# OS: Windows 10 Pro
# Cleaned: 5
# Failed: 0
***** [ Services ] *****
No malicious services cleaned.
***** [ Folders ] *****
Deleted C:\ProgramData\Application Data\Lavasoft\Web Companion
***** [ Files ] *****
No malicious files cleaned.
***** [ DLL ] *****
No malicious DLLs cleaned.
***** [ WMI ] *****
No malicious WMI cleaned.
***** [ Shortcuts ] *****
No malicious shortcuts cleaned.
***** [ Tasks ] *****
No malicious tasks cleaned.
***** [ Registry ] *****
Deleted HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run|Web Companion
Deleted HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\webcompanion.com
Deleted HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{7D2B3E1D-D096-4594-9D8F-A6667F12E0AC}
Deleted HKLM\Software\Wow6432Node\Lavasoft\Web Companion
***** [ Chromium (and derivatives) ] *****
No malicious Chromium entries cleaned.
***** [ Chromium URLs ] *****
No malicious Chromium URLs cleaned.
***** [ Firefox (and derivatives) ] *****
No malicious Firefox entries cleaned.
***** [ Firefox URLs ] *****
No malicious Firefox URLs cleaned.
***** [ Hosts File Entries ] *****
No malicious hosts file entries cleaned.
***** [ Preinstalled Software ] *****
No Preinstalled Software cleaned.
*************************
[+] Delete Tracing Keys
[+] Reset Winsock
*************************
AdwCleaner[S00].txt - [1892 octets] - [19/12/2021 10:46:34]
AdwCleaner[S01].txt - [1953 octets] - [19/12/2021 11:01:09]
AdwCleaner[S02].txt - [2014 octets] - [20/12/2021 22:24:07]
########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C02].txt ##########JRT
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.1.4 (07.09.2017)
Operating System: Windows 10 Enterprise x64
Ran by PeRaLeIt0r (Administrator) on Mon 12/20/2021 at 22:24:59.53
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
File System: 0
Registry: 4
Successfully deleted: HKCU\Software\Microsoft\Internet Explorer\Main\\Start Page (Registry Value)
Successfully deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} (Registry Key)
Successfully deleted: HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} (Registry Key)
Successfully deleted: HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Start Page (Registry Value)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Mon 12/20/2021 at 22:25:39.12
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Espero me puedan ayudar en general el KIS solo me indica que se ha detectado MEM:Trojan.Win32.SPEH.gen e intenta desinfectar sin exito y muy frecuente me aparecen estos bloqueos del antivirus al dllhost.exe y notepad.exe He seguido varios pasos pero siempre llego a donde debo crear el fixlist pero nos e que mas hacer AYUDA!
EN BUSCA / ELIMINACIÓN DE INFECCIONES
