[CERRADO] virus PUP/MultiToolbar.A que luego de formateo desaparece y vuelve a aparecer

[pablo dipas]

hola, soy nuevo en este foro, hace unas semanas atras mi pc se empezo a descomponer, se congelaba, internet se ponia superlenta, me pedia que compruebe el disco c: y esas cosas, como vi que eran sintomas tipicos de virus me dispuse a usar panda activescan on line que es una herramienta que uso siempre y resulta que encuentra un virus muy fuerte PUP/MultiToolbar.A HackTools c:\users\doctor picado\appdata\local\google\chrome\user data\default\file system\000\t\00\00000000
luego de probar distintos programas y otros antivirus el unico que me reconocia este virus era el panda, utilize el panda cloud a ver si me lo eliminaba y tampoco pude, asi que me dispuse a formatear, luego de formatear pase nuevamente el panda activescan on line y me tiro el resultado de que la pc estaba limpia este fue el informe:

ANALYSIS: 2014-05-11 23:46:12
PROTECTIONS: 1
MALWARE: 8
SUSPECTS: 0
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description Version Active Updated
;===================================================================================================================================================================================
Avira Desktop Yes Yes
;===================================================================================================================================================================================
MALWARE
Id Description Type Active Severity Disinfectable Disinfected Location
;===================================================================================================================================================================================
00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No d:\kwijibo\backup set 2013-07-21 190001\backup files 2013-07-21 190001\backup files 18.zip[c\users\homero jimeno\appdata\roaming\microsoft\windows\cookies\homero_jimeno@casalemedia[1].txt]
00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No d:\kwijibo\backup set 2013-07-21 190001\backup files 2013-07-21 190001\backup files 18.zip[c\users\homero jimeno\appdata\roaming\microsoft\windows\cookies\low\homero_jimeno@casalemedia[1].txt]
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No d:\kwijibo\backup set 2013-07-21 190001\backup files 2013-07-21 190001\backup files 18.zip[c\users\homero jimeno\appdata\roaming\microsoft\windows\cookies\low\homero_jimeno@doubleclick[1].txt]
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No d:\kwijibo\backup set 2013-07-21 190001\backup files 2013-07-21 190001\backup files 18.zip[c\users\homero jimeno\appdata\roaming\microsoft\windows\cookies\homero_jimeno@doubleclick[1].txt]
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No c:\users\doctor picado\appdata\roaming\microsoft\windows\cookies\low\doctor_picado@doubleclick[1].txt
00167647 Cookie/Yadro TrackingCookie No 0 Yes No d:\kwijibo\backup set 2013-07-21 190001\backup files 2013-07-21 190001\backup files 18.zip[c\users\homero jimeno\appdata\roaming\microsoft\windows\cookies\low\homero_jimeno@yadro[1].txt]
00167753 Cookie/Statcounter TrackingCookie No 0 Yes No d:\kwijibo\backup set 2013-07-21 190001\backup files 2013-07-21 190001\backup files 18.zip[c\users\homero jimeno\appdata\roaming\microsoft\windows\cookies\low\homero_jimeno@statcounter[2].txt]
00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No d:\kwijibo\backup set 2013-07-21 190001\backup files 2013-07-21 190001\backup files 18.zip[c\users\homero jimeno\appdata\roaming\microsoft\windows\cookies\low\homero_jimeno@serving-sys[2].txt]
00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No d:\kwijibo\backup set 2013-07-21 190001\backup files 2013-07-21 190001\backup files 18.zip[c\users\homero jimeno\appdata\roaming\microsoft\windows\cookies\homero_jimeno@serving-sys[2].txt]
00168106 Cookie/Weborama TrackingCookie No 0 Yes No d:\kwijibo\backup set 2013-07-21 190001\backup files 2013-07-21 190001\backup files 18.zip[c\users\homero jimeno\appdata\roaming\microsoft\windows\cookies\low\homero_jimeno@weborama[1].txt]
00169190 Cookie/Advertising TrackingCookie No 0 Yes No d:\kwijibo\backup set 2013-07-21 190001\backup files 2013-07-21 190001\backup files 18.zip[c\users\homero jimeno\appdata\roaming\microsoft\windows\cookies\homero_jimeno@advertising[2].txt]
00169190 Cookie/Advertising TrackingCookie No 0 Yes No d:\kwijibo\backup set 2013-07-21 190001\backup files 2013-07-21 190001\backup files 18.zip[c\users\homero jimeno\appdata\roaming\microsoft\windows\cookies\low\homero_jimeno@advertising[1].txt]
00172221 Cookie/Zedo TrackingCookie No 0 Yes No d:\kwijibo\backup set 2013-07-21 190001\backup files 2013-07-21 190001\backup files 18.zip[c\users\homero jimeno\appdata\roaming\microsoft\windows\cookies\low\homero_jimeno@zedo[1].txt]
;====================================================================================
SUSPECTS
Sent Location
;====================================================================================
VULNERABILITIES
Id Severity Description


una semana despues note cosas raras en la pc como por ejemplo, algo de lentitud y por si acaso pase de nuevo el panda active scan on line ya que siempre lo uso y es el unico que me reconoce este virus y me encontre que el virus estaba alli seguia latente cuando antes me habia desaparecido, no se si se escondio luego del formateo o hay algo que yo hice que me lo pego de nuevo, no se estoy bastante desesperado, ojala me puedan ayudar, aca les dejo el ultimo informe del panda active scan on line:

ANALYSIS: 2014-05-17 04:22:22
PROTECTIONS: 1
MALWARE: 9
SUSPECTS: 0
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description Version Active Updated
;===================================================================================================================================================================================
Avira Desktop Yes Yes
;===================================================================================================================================================================================
MALWARE
Id Description Type Active Severity Disinfectable Disinfected Location
;===================================================================================================================================================================================
00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No d:\kwijibo\backup set 2013-07-21 190001\backup files 2013-07-21 190001\backup files 18.zip[c\users\homero jimeno\appdata\roaming\microsoft\windows\cookies\homero_jimeno@casalemedia[1].txt]
00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No d:\kwijibo\backup set 2013-07-21 190001\backup files 2013-07-21 190001\backup files 18.zip[c\users\homero jimeno\appdata\roaming\microsoft\windows\cookies\low\homero_jimeno@casalemedia[1].txt]
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No d:\kwijibo\backup set 2013-07-21 190001\backup files 2013-07-21 190001\backup files 18.zip[c\users\homero jimeno\appdata\roaming\microsoft\windows\cookies\homero_jimeno@doubleclick[1].txt]
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No d:\kwijibo\backup set 2013-07-21 190001\backup files 2013-07-21 190001\backup files 18.zip[c\users\homero jimeno\appdata\roaming\microsoft\windows\cookies\low\homero_jimeno@doubleclick[1].txt]
00167647 Cookie/Yadro TrackingCookie No 0 Yes No d:\kwijibo\backup set 2013-07-21 190001\backup files 2013-07-21 190001\backup files 18.zip[c\users\homero jimeno\appdata\roaming\microsoft\windows\cookies\low\homero_jimeno@yadro[1].txt]
00167753 Cookie/Statcounter TrackingCookie No 0 Yes No d:\kwijibo\backup set 2013-07-21 190001\backup files 2013-07-21 190001\backup files 18.zip[c\users\homero jimeno\appdata\roaming\microsoft\windows\cookies\low\homero_jimeno@statcounter[2].txt]
00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No d:\kwijibo\backup set 2013-07-21 190001\backup files 2013-07-21 190001\backup files 18.zip[c\users\homero jimeno\appdata\roaming\microsoft\windows\cookies\homero_jimeno@serving-sys[2].txt]
00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No d:\kwijibo\backup set 2013-07-21 190001\backup files 2013-07-21 190001\backup files 18.zip[c\users\homero jimeno\appdata\roaming\microsoft\windows\cookies\low\homero_jimeno@serving-sys[2].txt]
00168106 Cookie/Weborama TrackingCookie No 0 Yes No d:\kwijibo\backup set 2013-07-21 190001\backup files 2013-07-21 190001\backup files 18.zip[c\users\homero jimeno\appdata\roaming\microsoft\windows\cookies\low\homero_jimeno@weborama[1].txt]
00169190 Cookie/Advertising TrackingCookie No 0 Yes No d:\kwijibo\backup set 2013-07-21 190001\backup files 2013-07-21 190001\backup files 18.zip[c\users\homero jimeno\appdata\roaming\microsoft\windows\cookies\homero_jimeno@advertising[2].txt]
00169190 Cookie/Advertising TrackingCookie No 0 Yes No d:\kwijibo\backup set 2013-07-21 190001\backup files 2013-07-21 190001\backup files 18.zip[c\users\homero jimeno\appdata\roaming\microsoft\windows\cookies\low\homero_jimeno@advertising[1].txt]
00172221 Cookie/Zedo TrackingCookie No 0 Yes No d:\kwijibo\backup set 2013-07-21 190001\backup files 2013-07-21 190001\backup files 18.zip[c\users\homero jimeno\appdata\roaming\microsoft\windows\cookies\low\homero_jimeno@zedo[1].txt]
14620318 PUP/MultiToolbar.A HackTools No 0 Yes No c:\users\doctor picado\appdata\local\google\chrome\user data\default\file system\000\t\00\00000000
;====================================================================================
SUSPECTS
Sent Location
;====================================================================================
VULNERABILITIES
Id Severity Description

[PandaSupport1]

Los PUP (potentially Unwanted Program) o programas indeseables, acostumbran a ser instalados por downwares que los ofrecen al instalar programas desde webs que no son las del fabricante.

Asi este MULTITOOLBAR: 14620318 PUP/MultiToolbar.A HackTools No 0 Yes No c:\users\doctor picado\appdata\local\google\chrome\user data\default\file system\000\t\00\00000000 posiblemente lo descargó la instalacion del Chrome, desde una web que no era de Google, y, aunque ofrecía no instalarlo desmarcando la correspondiente casilla, si no se dijo lo contrario, hizo lo que quiso...

Prueba a pasar de nuevo CloudCleaner y asegúrate de marcar todo lo relacionado con los PUP's en el resultado final del análisis.

[PandaSupport1]

Cerramos la incidencia por falta de respuesta

TEMA CERRADO