Buenas, pues resulta q el dia de ayer 21 de abril a las 1:30 p.m me di cuenta que en una de las maquinas de mi red q consta de 10 computadoras, habia un archivo muy raro un tal chenzi.vbs y un chenzi .exe (me imagino q el dia anterior alguien lo tuvo q haber descargado) entonces me di cuenta q esa maquina no tenia antivirus entonces instale el avira ( el resto de mis maquinas posee dicho antivirus) entonces lo elimino; pero al reiniciar, otra vez aparecia entonces me di cuenta q cuando abria el internet explorer en la parte inferior donde dice conectando a xxx.xx.xxx.xx o conectando a google.com salia la siguiente direccion :
http://u.asdfaf.com (era algo asi no lo recuerdo bien)
http://5.web.laY cada vez q abria internet con pagina de inicio google salia debajo eso era terrible se descargaba automaticamente el chenzi.exe y chenzi.vbs. Pero eso no fue lo peor, lo peor sucedio cuando encendi el resto de computadoras me di cuenta q en todas ellas q tenian el avira encendido y q se activaban con el sistema operativo colapsaban de mensajes de virus pero por mas q ponia delete no los eliminaba, y tambien me di cuenta de que en cada una de ellas abajo me señalaban las mismas direcciones:
http://u.asdfaf.com (era algo asi no lo recuerdo bien)
http://5.web.laFue un pesadilla
no sabia q hacer
. Me dije este antivirus no pasa nada de inmediato me puse a probar el eset online (nod32 online) y los elimino pero al reiniciar la misma historia denuevo el bendito chenzi.exe, pero ademas tambien vi otros procesos desde la utilidad de configuracion esa q haces haciendo run + msconfig estabn:
2008x.exe
weiyuan.exe
svch0st.exe
braviax.exe
Bueno al darme cuenta de q salian las direcciones:
http://u.asdfaf.com (era algo asi no lo recuerdo bien)
http://5.web.laentonces me dije reinicio el modem y se acabo, eso funciono un momento, estuve asi por 4 horas hasta las 5:45 aproximadamente q reinicie nuevamente el modem y dejaron de salir esas direcciones extrañas q les mencione :
http://u.asdfaf.com (era algo asi no lo recuerdo bien)
http://5.web.laYa me mandaba defrente a los servidores de google. El resultado cuando la maquina reiniciaba se levantaban los siguientes procesos:
2008x.exe
weiyuan.exe
svch0st.exe
soundma[2]
Y me quede sin poder hacer ctrl +alt +supr ya no sale el task manager
en ninguna de las maquinas. Me supongo que es el saldo de todo lo q hizo el dichoso virus o troyano este. Hoy he tomado el antivirus y lo he vuelto a pasar el resultado es este
Avira AntiVir Personal
Report file date: Martes, 22 de Abril de 2008 14:26
Scanning for 1227832 virus strains and unwanted programs.
Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Boot mode: Normally booted
Username: SYSTEM
Computer name: PC04
Version information:
BUILD.DAT : 8.1.00.295 16479 Bytes 09/04/2008 16:24:00
AVSCAN.EXE : 8.1.2.12 311553 Bytes 17/04/2008 00:02:40
AVSCAN.DLL : 8.1.1.0 53505 Bytes 17/04/2008 00:02:40
LUKE.DLL : 8.1.2.9 151809 Bytes 17/04/2008 00:02:40
LUKERES.DLL : 8.1.2.1 12033 Bytes 17/04/2008 00:02:40
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 20:27:16
ANTIVIR1.VDF : 7.0.3.2 5447168 Bytes 07/03/2008 20:02:20
ANTIVIR2.VDF : 7.0.3.156 795136 Bytes 11/04/2008 14:52:28
ANTIVIR3.VDF : 7.0.3.195 472576 Bytes 21/04/2008 20:11:16
Engineversion : 8.1.0.32
AEVDF.DLL : 8.1.0.5 102772 Bytes 17/04/2008 00:02:42
AESCRIPT.DLL : 8.1.0.26 233850 Bytes 18/04/2008 17:39:40
AESCN.DLL : 8.1.0.14 119156 Bytes 18/04/2008 17:39:32
AERDL.DLL : 8.1.0.19 418164 Bytes 17/04/2008 00:02:42
AEPACK.DLL : 8.1.1.2 364917 Bytes 18/04/2008 17:39:30
AEOFFICE.DLL : 8.1.0.18 192890 Bytes 18/04/2008 17:39:16
AEHEUR.DLL : 8.1.0.18 1167735 Bytes 17/04/2008 00:02:42
AEHELP.DLL : 8.1.0.14 115063 Bytes 18/04/2008 17:39:08
AEGEN.DLL : 8.1.0.17 299380 Bytes 18/04/2008 17:39:04
AEEMU.DLL : 8.1.0.5 430450 Bytes 17/04/2008 00:02:40
AECORE.DLL : 8.1.0.27 168310 Bytes 18/04/2008 17:38:48
AVWINLL.DLL : 1.0.0.7 14593 Bytes 17/04/2008 00:02:40
AVPREF.DLL : 8.0.0.1 25857 Bytes 17/04/2008 00:02:40
AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 19:16:24
AVREG.DLL : 8.0.0.0 30977 Bytes 17/04/2008 00:02:40
AVARKT.DLL : 1.0.0.23 307457 Bytes 17/04/2008 00:02:40
AVEVTLOG.DLL : 8.0.0.11 114945 Bytes 17/04/2008 00:02:40
SQLITE3.DLL : 3.3.17.1 339968 Bytes 17/04/2008 00:02:40
SMTPLIB.DLL : 1.2.0.19 28929 Bytes 17/04/2008 00:02:40
NETNT.DLL : 8.0.0.1 7937 Bytes 17/04/2008 00:02:40
RCIMAGE.DLL : 8.0.0.35 2371841 Bytes 17/04/2008 00:02:36
RCTEXT.DLL : 8.0.32.0 86273 Bytes 17/04/2008 00:02:36
Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\archivos de programa\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:, D:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium
Start of the scan: Martes, 22 de Abril de 2008 14:26
The scan of running processes will be started
Scan process 'AVSCAN.EXE' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'iexplore.exe' - '1' Module(s) have been scanned
Scan process 'WSCNTFY.EXE' - '1' Module(s) have been scanned
Scan process 'ALG.EXE' - '1' Module(s) have been scanned
Scan process 'R_SERVER.EXE' - '1' Module(s) have been scanned
Scan process 'SCHED.EXE' - '1' Module(s) have been scanned
Scan process 'MSNMSGR.EXE' - '1' Module(s) have been scanned
Scan process 'AVGNT.EXE' - '1' Module(s) have been scanned
Scan process 'AVGUARD.EXE' - '1' Module(s) have been scanned
Scan process 'SPOOLSV.EXE' - '1' Module(s) have been scanned
Scan process 'EXPLORER.EXE' - '1' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'LSASS.EXE' - '1' Module(s) have been scanned
Scan process 'SERVICES.EXE' - '1' Module(s) have been scanned
Scan process 'WINLOGON.EXE' - '1' Module(s) have been scanned
Scan process 'CSRSS.EXE' - '1' Module(s) have been scanned
Scan process 'SMSS.EXE' - '1' Module(s) have been scanned
22 processes with 22 modules were scanned
Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!
Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Boot sector 'D:\'
[INFO] No virus was found!
Starting to scan the registry.
The registry was scanned ( '15' files ).
Starting the file scan:
Begin scan in 'C:\'
C:\hiberfil.sys
[WARNING] The file could not be opened!
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\WINDOWS\system32\DNSver.dll
[DETECTION] Contains suspicious code HEUR/Malware
[NOTE] The file was deleted!
C:\Documents and Settings\juanito\Configuración local\Archivos temporales de Internet\Content.IE5\O1IZOXQN\index[1].htm
[DETECTION] Contains detection pattern of the HTML script virus HTML/Rce.Gen
[NOTE] The file was deleted!
C:\Documents and Settings\juanito\Configuración local\Archivos temporales de Internet\Content.IE5\QNQRQDMV\kaka[1].htm
[DETECTION] Contains detection pattern of the VBS script virus VBS/Dldr.Agent.DH
[NOTE] The file was deleted!
C:\Documents and Settings\juanito\Configuración local\Archivos temporales de Internet\Content.IE5\C5GDAVCD\ms0614[1].htm
[DETECTION] Contains suspicious code HEUR/HTML.Malware
[NOTE] The fund was classified as suspicious.
[NOTE] The file was moved to '483e3db9.qua'!
C:\Documents and Settings\Invitado\Configuración local\Archivos temporales de Internet\Content.IE5\SDQNG96F\index[1].htm
[DETECTION] Contains detection pattern of the HTML script virus HTML/Rce.Gen
[NOTE] The file was deleted!
C:\Documents and Settings\Invitado\Configuración local\Archivos temporales de Internet\Content.IE5\SDQNG96F\down[1].exe
[DETECTION] Is the Trojan horse TR/Agent.12288.E
[NOTE] The file was deleted!
C:\Documents and Settings\Invitado\Configuración local\Archivos temporales de Internet\Content.IE5\40CS1F8P\fuckXXX[1].htm
[DETECTION] Contains detection pattern of the Java script virus JS/Dldr.Psyme.GX.3
[NOTE] The file was deleted!
C:\Documents and Settings\Invitado\Configuración local\Archivos temporales de Internet\Content.IE5\40CS1F8P\ms0614[1].htm
[DETECTION] Contains suspicious code HEUR/HTML.Malware
[NOTE] The fund was classified as suspicious.
[NOTE] The file was moved to '483e3e4f.qua'!
C:\Documents and Settings\Invitado\Configuración local\Archivos temporales de Internet\Content.IE5\VANS0N6E\kaka[1].htm
[DETECTION] Contains detection pattern of the VBS script virus VBS/Dldr.Agent.DH
[NOTE] The file was deleted!
C:\System Volume Information\_restore{3B0D700B-00E7-4F47-B665-7DD87CD4FED9}\RP23\A0001919.exe
[DETECTION] Is the Trojan horse TR/Agent.12288.E
[NOTE] The file was deleted!
C:\System Volume Information\_restore{3B0D700B-00E7-4F47-B665-7DD87CD4FED9}\RP23\A0001930.exe
[DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
[NOTE] The file was deleted!
C:\System Volume Information\_restore{3B0D700B-00E7-4F47-B665-7DD87CD4FED9}\RP23\A0001942.exe
[DETECTION] Is the Trojan horse TR/Agent.12288.E
[NOTE] The file was deleted!
C:\System Volume Information\_restore{3B0D700B-00E7-4F47-B665-7DD87CD4FED9}\RP23\A0001972.sys
[DETECTION] Is the Trojan horse TR/Rootkit.Gen
[NOTE] The file was deleted!
C:\System Volume Information\_restore{3B0D700B-00E7-4F47-B665-7DD87CD4FED9}\RP23\A0001973.dll
[DETECTION] Contains suspicious code HEUR/Malware
[NOTE] The file was deleted!
Begin scan in 'D:\' <DISK1PART03>
D:\System Volume Information\_restore{3B0D700B-00E7-4F47-B665-7DD87CD4FED9}\Chenzi.vbs
[DETECTION] Contains detection pattern of the Java script virus JS/Dldr.Agen.6260.B
[NOTE] The file was deleted!
End of the scan: Martes, 22 de Abril de 2008 14:39
Used time: 14:04 min
The scan has been done completely.
2151 Scanning directories
67759 Files were scanned
11 viruses and/or unwanted programs were found
4 Files were classified as suspicious:
13 files were deleted
0 files were repaired
2 files were moved to quarantine
0 files were renamed
2 Files cannot be scanned
67748 Files not concerned
2320 Archives were scanned
2 Warnings
15 Notes
Bueno si alguien sabe como restaurar el task manager q me lo haga saber y un antivirus q logre eliminar todo esto. Solo para terminar logre reinstalar windows xp en una de las maquinas pero cuando entre en red con otra se infecto y esta en la misma situacion. No poseo proxy ni firewal quisiera su consejo en este asunto a ver si alguien tiene informacion sobre este virus y como eliminarlo. Por el momento todo anda normal pero estoy seguro q sigue alli el virus o toryano este.Gracias
weiyuan.exe chenzi.vbs, alguien ha tenido estos en su pc
Apr 22 2008, 09:02 PM
