Hoal como estas, de verdad gracias por lo aconsejado pero...
todo lo he intentado.. si me audaron a eliminar unas cosillas que el norton ni detecta...pero en bendito trojano esta ahi.... me baje el anti-trojan, el scan apyware, el a-squared y detectan cosas y las eliminan pero todavia esta el trojano de porra... crei que lo habia eliminado porque estuvo inactivo como por tres dias ya que no bajava ningun programilla maligno... pero hace dos dias reaparecio no se si es que no la habia eliminado o es que entro de nuevo...y ahora esta diferente todo lo que baja coloca iconos de casino online y poker solo eso y todos esos malwares tienes nombres diferentes... antes los bajaba con tiempo de por medio ahora los baja a cada momento, los borro manuelmente desde modo aprueva de fallos y al instante los buelve a bajar y los coloca en el inicio.... de verdad ya no se que hacer.... y no se que tan grave sea tenerlo.... aqui les mando las expecificaciones de la pagina de fortigate a ver si es de ayuda....
----------------------
W32/Swizzor.K-tr
A system compromised by this Trojan may have icons created on the desktop that point to Internet websites. The Trojan creates these link files -
Bingo .lnk
Card Games.lnk
Casino Online.lnk
Internet .lnk
Poker .lnk
Printer Cartridges.lnk
Travel .lnk
Website Hosting.lnk
Each link directs the browser either to "search200.com" or other gambling web sites.
Additionally, the Trojan creates at least 148 "favorite" URL links in the browser and stores them as these names, creating groups in the process -
Antivirus.url
Casino Online.url
Computers.url
Games.url
Instant Messaging.url
Internet.url
Movie.url
Web Hosting.url
Computers\Antivirus.url
Computers\Communication Technology.url
Computers\Computer Jobs .url
Computers\Computer Programming.url
Computers\Domain Hosting.url
Computers\Dvd.url
Computers\Hosting.url
Computers\Inkjet Cartridge.url
Computers\Instant Messenger.url
Computers\Internet.url
Computers\Working From Home.url
Computers\Games\Computer game.url
Computers\Games\Gamecube.url
Computers\Games\Microsoft.url
Computers\Games\Playstation.url
Computers\Games\Quake.url
Computers\Games\Sega Dreamcast.url
Computers\Games\Xbox.url
Cool Stuff\Dating.url
Cool Stuff\Descrambler.url
Cool Stuff\Dvd To Cd.url
Cool Stuff\Mp3.url
Cool Stuff\Online Pharmacy.url
Cool Stuff\Pass Drug Test.url
Cool Stuff\Printer Cartridge.url
Cool Stuff\Satellite Television.url
Cool Stuff\Scratch Card.url
Cool Stuff\Video Surveillance.url
Dating\Christian dating.url
Dating\Dating Agency.url
Dating\Dating Service.url
Dating\Internet Dating.url
Dating\Jewish Dating.url
Dating\Online Dating.url
Home\Adjustable Bed.url
Home\Food Nutrition.url
Home\Health Plan.url
Home\Home Equity Loan.url
Home\Home Improvements.url
Home\Home Refinancing.url
Home\Home Security.url
Home\Interior Decorating .url
Home\Office Space.url
Home\Outdoor Cooking.url
Home\Outdoor Furniture.url
Home\Phone System.url
Home\Satellite Television.url
Home\Sleep Aids.url
Home\Timeshare.url
Home\Working From Home.url
Internet\Domain Registrations.url
Internet\Firewall.url
Internet\Flowers.url
Internet\Free Long Distance.url
Internet\Hosting.url
Internet\Internet Business.url
Internet\Investing Money.url
Internet\Jokes.url
Internet\Newsgroup.url
Internet\Online Football Games.url
Internet\Online Gaming.url
Internet\Spyware.url
Internet\Starting A Business.url
Internet\Web Marketing.url
Internet\Education\Adult Education.url
Internet\Education\Book.url
Internet\Education\College.url
Internet\Education\Community.url
Internet\Education\Education.url
Internet\Education\Essay.url
Internet\Education\School.url
Online Gaming\Bingo.url
Online Gaming\Black Jack Poker.url
Online Gaming\Casino Online.url
Online Gaming\Craps.url
Online Gaming\Gamble.url
Online Gaming\Jackpot.url
Online Gaming\Roulette Gambling.url
Online Gaming\Slots.url
Online Gaming\Sport Betting.url
Online Gaming\Sport Book.url
Online Gaming\Time Cards.url
Online Pharmacy\Buy Adipex.url
Online Pharmacy\Buy Celebrex.url
Online Pharmacy\Buy Fidrex.url
Online Pharmacy\Buy Ionamin.url
Online Pharmacy\Buy Meridia .url
Online Pharmacy\Buy Phentermine.url
Online Pharmacy\Buy Propecia.url
Online Pharmacy\Buy Soma.url
Online Pharmacy\Buy Tenuate.url
Online Pharmacy\Buy Ultram Online.url
Online Pharmacy\Buy Viagra.url
Online Pharmacy\Buy Xenical.url
Online Pharmacy\Consumer Consulting.url
Online Pharmacy\Doctor.url
Online Pharmacy\Mexican Pharmacy.url
Online Pharmacy\Pass Drug Test.url
Online Pharmacy\Pet Med.url
Online Pharmacy\Pharmacy Online.url
Shopping Gifts\Birthday Gift.url
Shopping Gifts\Cellular.url
Shopping Gifts\Christmas Gift.url
Shopping Gifts\Corporate Gift.url
Shopping Gifts\Digital Cameras.url
Shopping Gifts\Dress Fashion.url
Shopping Gifts\DVD Players.url
Shopping Gifts\Gift Basket.url
Shopping Gifts\Jewelry.url
Shopping Gifts\Leather Jackets.url
Shopping Gifts\Perfume.url
Shopping Gifts\Sexy Lingerie.url
Shopping Gifts\Shoes.url
Shopping Gifts\Smoke Shop.url
Shopping Gifts\Underwear.url
Shopping Gifts\Video Surveillance.url
Shopping Gifts\Watches.url
Shopping Gifts\Wedding Gifts.url
Shopping Gifts\Wine Gifts.url
Shopping Gifts\Womens Clothing.url
Travel\Air Travel.url
Travel\Cancun vacation.url
Travel\Car Rental.url
Travel\Cruises.url
Travel\Discount Travel.url
Travel\Europe Travel.url
Travel\Family Vacation.url
Travel\Hawaii Travel.url
Travel\Hotels.url
Travel\Las Vegas Hotel.url
Travel\London Hotel.url
Travel\New York.url
Travel\Orlando Hotel.url
Travel\Resort.url
Travel\Skiing.url
Travel\Timeshare.url
Travel\Travel Agent.url
Travel\Travel Insurance.url
Travel\Vacation.url
Travel\World Travel.url
Threat Analysis
This Trojan is 32-bit with an UPC packed file size of 292,695 bytes. If the Trojan is run, it will initiate a hidden Internet Explorer process and inject its code into the running process. The Trojan will retrieve binary files from hard-coded websites.
File Download Routine
The Trojan downloads other UPC packed files from domains that fall in the "lop.com" domain. This Trojan will get the files from
%random%.bins.lop.com/bins/int/
Where %random% is a random string. The Trojan performs a DNS query against the name which resolves to the IP address 66.220.17.158. TCP trace utilities indicate the Trojan makes connections with other similar IP addresses -
66.220.17.154
66.220.17.158
66.220.17.169
The downloaded files are in the form of binary files with ".int" extension, such as -
upAYB.int
dkgen_up.int
tp_map6.int
updbho2.int
upd_admn.int
kr2.int
The downloaded files are written to newly created folders on the system. The Trojan may create strangely named folders such as these -
C:\..\All Users\Application Data\admin title delete defy\
C:\..\%user name%\Application Data\JUMP ROAD NOUN\
In these folders, the Trojan will copy the downloaded files as .EXE files. The names of the files are also strange, such as these -
Close amen remote more.exe
GRIM THE SURF.exe
hope drv readme.exe
Owns This Vc.exe
sjypglqj.exe
Drive bin.exe
Many of the downloaded files are spyware/adware programs.
Loading at Windows startup
The Trojan may register some of the retrieved files to load at Windows startup by adding entries into the registry such as these examples -
HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Run
"thunkburn" = %path%\Owns This Vc.exe
HKEY_CLASSES_ROOT\CLSID\{%unique CLSID%}
"64535DBE" = 2C0411726CB7B446F792
HKEY_CLASSES_ROOT\CLSID\{%unique CLSID%}\InprocServer32\
"(Default)" = %path%\Drive bin.exe
"ThreadingModel" = Apartment
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
"DeleteDefySendRoad" = %path%\Thunkfilm.exe
In one "nice" aspect, at least one of the downloaded files has an uninstall routine which can be accessed by the "Add/Remove Software" applet from the control panel -
HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Uninstall\64 slow user\
"DisplayName" = Search Plugin
"UninstallString" = %path%\Owns This Vc.exe -uninstall
Action
Check the main screen using the web interface for your FortiGate unit to ensure that the latest AV/NIDS database has been downloaded and installed on your system - if required, enable the "Allow Push Update" option.
--------------
esto es lo que aparece en la pagina... no he encontrado ningun download ni nada que me yude con esta herramienta de fortigate.... les agradesco su ayuda... chao...
