WiredWX Hobby Weather ToolsLog in

 


Win32/Cryptor [Help Plz]

2 posters

descriptionWin32/Cryptor [Help Plz] - Page 2 EmptyRe: Win32/Cryptor [Help Plz]

more_horiz
Hello.
You really got yourself into a mess here haven't you. Not only have you got the Koobface infection, but there's also another rootkit here, and it's patched a legit system file, we have to fix all this in one go.

  • Download combofix from here
    Link 1
    Link 2
  • We need to disable your local AV (Anti-virus) before running Combofix.
  • See HERE for how to disable your AV. (AVG8)
  • Double click on ComboFix.exe.
  • Follow the prompts. NOTE:
  • ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
    ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***

    **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.


  • The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.

    Win32/Cryptor [Help Plz] - Page 2 Rcauto10

  • Allow ComboFix to download the Recovery Console.
  • Accept the End-User License Agreement.
  • The Recovery Console will be installed.
  • You will then get this next prompt that asks if you want to continue the malware scan, select yes

    Win32/Cryptor [Help Plz] - Page 2 Whatne10

  • Allow combofix to run
  • Post C:\combofix.txt back here.

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

descriptionWin32/Cryptor [Help Plz] - Page 2 EmptyRe: Win32/Cryptor [Help Plz]

more_horiz
ComboFix 09-05-07.06 - Owner 05/07/2009 17:40.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.254.90 [GMT -4:00]
Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
AV: AVG Anti-Virus *On-access scanning disabled* (Updated)
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\nfr.assembly
c:\windows\system32\pakbvqe.dll . . . . failed to delete

Infected copy of c:\windows\system32\drivers\ndis.sys was found and disinfected
Restored copy from - The cat ate it Smile...

.
((((((((((((((((((((((((( Files Created from 2009-04-07 to 2009-05-07 )))))))))))))))))))))))))))))))
.

2009-05-06 17:44 . 2009-05-06 17:44 -------- d-----w c:\windows\Cache
2009-05-06 17:44 . 2009-05-06 17:44 -------- d-----w c:\program files\Coupons
2009-05-03 04:14 . 2009-05-03 04:14 -------- d-----w c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com
2009-05-03 04:00 . 2009-05-07 20:33 -------- d--h--w C:\$AVG8.VAULT$
2009-05-03 03:21 . 2009-05-03 03:21 -------- d-----w C:\VundoFix Backups
2009-05-03 02:44 . 2009-05-03 02:44 11952 ----a-w c:\windows\system32\avgrsstx.dll
2009-05-03 02:44 . 2009-05-03 02:44 12552 ----a-w c:\windows\system32\drivers\avgrkx86.sys
2009-05-03 02:44 . 2009-05-03 02:44 108552 ----a-w c:\windows\system32\drivers\avgtdix.sys
2009-05-03 02:43 . 2009-05-03 02:43 325896 ----a-w c:\windows\system32\drivers\avgldx86.sys
2009-05-03 02:43 . 2009-05-07 21:28 -------- d-----w c:\windows\system32\drivers\Avg
2009-05-03 02:41 . 2009-05-03 02:41 -------- d-----w c:\program files\AVG
2009-05-03 02:41 . 2009-05-07 20:41 -------- d-----w c:\documents and settings\All Users\Application Data\avg8
2009-05-03 02:32 . 2009-05-03 02:32 -------- d-----w c:\documents and settings\Owner\Application Data\GetRightToGo
2009-05-03 01:22 . 2009-05-03 01:22 -------- d-----w c:\windows\CD95F661A5C444F5A6AAECDD91C240B5.TMP
2009-05-03 00:11 . 2009-05-03 00:11 -------- d-----w c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-05-02 23:29 . 2009-05-02 23:29 -------- d-----w c:\documents and settings\Owner\Application Data\Malwarebytes
2009-05-02 23:29 . 2009-04-06 19:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-05-02 23:29 . 2009-04-06 19:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-02 23:29 . 2009-05-02 23:29 -------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-05-02 23:29 . 2009-05-02 23:29 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-05-02 23:26 . 2009-05-02 23:26 -------- d-----w c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-05-02 23:25 . 2009-05-02 23:26 -------- d-----w c:\program files\SUPERAntiSpyware
2009-05-02 23:25 . 2009-05-02 23:25 -------- d-----w c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com
2009-05-02 23:25 . 2009-05-02 23:25 -------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-05-02 23:25 . 2009-05-02 23:25 -------- d-----w c:\program files\CCleaner
2009-05-02 22:20 . 2009-05-02 22:20 -------- d-----w c:\documents and settings\Owner\Application Data\nwhkuejs
2009-05-02 22:20 . 2009-05-02 22:20 -------- d-----w c:\documents and settings\Owner\Local Settings\Application Data\nwhkuejs
2009-04-27 16:32 . 2009-04-27 16:32 -------- d-----w c:\documents and settings\NetworkService\Application Data\nwhkuejs
2009-04-27 16:32 . 2009-04-27 16:32 -------- d-----w c:\documents and settings\NetworkService\Local Settings\Application Data\nwhkuejs
2009-04-17 11:54 . 2009-03-06 14:44 283648 -c----w c:\windows\system32\dllcache\pdh.dll
2009-04-17 11:54 . 2005-07-26 04:39 60416 -c----w c:\windows\system32\dllcache\colbact.dll
2009-04-17 11:54 . 2009-02-09 10:20 399360 -c----w c:\windows\system32\dllcache\rpcss.dll
2009-04-17 11:54 . 2009-02-06 17:14 110592 -c----w c:\windows\system32\dllcache\services.exe
2009-04-17 11:54 . 2009-02-09 10:20 473088 -c----w c:\windows\system32\dllcache\fastprox.dll
2009-04-17 11:54 . 2009-02-06 16:39 227840 -c----w c:\windows\system32\dllcache\wmiprvse.exe
2009-04-17 11:54 . 2009-02-09 10:20 453120 -c----w c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-17 11:54 . 2009-02-09 10:20 616960 -c----w c:\windows\system32\dllcache\advapi32.dll
2009-04-17 11:54 . 2009-02-09 10:20 714752 -c----w c:\windows\system32\dllcache\ntdll.dll
2009-04-17 11:54 . 2008-04-21 10:02 215552 -c----w c:\windows\system32\dllcache\wordpad.exe
2009-04-12 02:30 . 2009-04-12 02:30 -------- d-----w c:\program files\Google
2009-04-12 02:30 . 2009-04-12 17:07 -------- d-----w c:\documents and settings\All Users\Application Data\NOS
2009-04-12 02:29 . 2009-04-12 17:07 -------- d-----w c:\program files\NOS

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-07 21:42 . 2002-09-03 16:50 104448 ----a-w c:\windows\system32\mouizhu.dll
2009-05-07 21:37 . 2002-09-03 16:47 182912 ----a-w c:\windows\system32\drivers\ndis.sys
2009-03-29 18:23 . 2007-05-26 04:51 -------- d-----w c:\program files\QUICKENW
2009-03-06 14:44 . 2002-09-03 16:51 283648 ----a-w c:\windows\system32\pdh.dll
2009-03-03 00:18 . 2006-06-23 15:33 826368 ----a-w c:\windows\system32\wininet.dll
2009-02-20 18:09 . 2004-08-04 07:56 78336 ----a-w c:\windows\system32\ieencode.dll
2009-02-09 10:20 . 2005-07-26 04:31 399360 ----a-w c:\windows\system32\rpcss.dll
2009-02-09 10:20 . 2002-09-03 16:39 723456 ----a-w c:\windows\system32\lsasrv.dll
2009-02-09 10:20 . 2002-09-03 16:49 714752 ----a-w c:\windows\system32\ntdll.dll
2009-02-09 10:20 . 2002-09-03 16:27 616960 ----a-w c:\windows\system32\advapi32.dll
2009-02-09 10:19 . 2002-09-03 17:11 1846272 ----a-w c:\windows\system32\win32k.sys
2002-09-03 17:07 . 2002-09-03 17:07 94784 --sh--w c:\windows\twain.dll
2004-08-04 07:56 . 2002-09-03 17:07 50688 --sh--w c:\windows\twain_32.dll
2004-08-04 07:56 . 2002-09-03 16:41 1028096 --sh--w c:\windows\system32\mfc42.dll
2004-08-04 07:56 . 2002-09-03 16:46 54784 --sh--w c:\windows\system32\msvcirt.dll
2004-08-04 07:56 . 2002-09-03 16:46 413696 --sh--w c:\windows\system32\msvcp60.dll
2004-08-04 07:56 . 2002-09-03 16:46 343040 --sh--w c:\windows\system32\msvcrt.dll
2007-12-04 18:38 . 2002-09-03 16:51 550912 --sh--w c:\windows\system32\oleaut32.dll
2004-08-04 07:56 . 2002-09-03 16:51 83456 --sh--w c:\windows\system32\olepro32.dll
2004-08-04 07:56 . 2002-09-03 16:56 11776 --sh--w c:\windows\system32\regsvr32.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7B13B443-BEC9-4942-ABE3-6C9028587E08}]
2002-09-03 16:50 104448 ----a-w c:\windows\system32\pakbvqe.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\System32\igfxtray.exe" [2003-01-13 155648]
"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2003-01-13 114688]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-05-03 1947928]
"BCMSMMSG"="BCMSMMSG.exe" - c:\windows\BCMSMMSG.exe [2003-08-29 122880]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HPAiODevice(hp psc 900 series) - 1.lnk - c:\program files\Hewlett-Packard\AiO\hp psc 900 series\Bin\hpobrt07.exe [2002-9-26 487484]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 16:05 356352 ----a-w c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-05-03 02:44 11952 ----a-w c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dgkkchch]
2002-09-03 16:50 104448 ----a-w c:\windows\system32\pakbvqe.dll

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32
"wave"= serwvdrv.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgam.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgdiag.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"39453:TCP"= 39453:TCP:@xpsp2res.dll,-22009

R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [5/2/2009 10:44 PM 12552]
R0 xysxbauo;xysxbauo;c:\windows\system32\drivers\xysxbauo.sys [9/3/2002 12:50 PM 23424]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [5/2/2009 10:43 PM 325896]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [5/2/2009 10:44 PM 108552]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [4/28/2009 11:33 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [4/28/2009 11:33 AM 72944]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [5/2/2009 10:41 PM 298776]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [4/28/2009 11:33 AM 7408]

--- Other Services/Drivers In Memory ---

*Deregistered* - MDM
*Deregistered* - Netman
*Deregistered* - Nla
*Deregistered* - PolicyAgent
*Deregistered* - ProtectedStorage
*Deregistered* - RasMan
*Deregistered* - RpcSs
*Deregistered* - SamSs
*Deregistered* - Schedule
*Deregistered* - seclogon
*Deregistered* - SENS
*Deregistered* - SharedAccess
*Deregistered* - ShellHWDetection
*Deregistered* - Spooler
*Deregistered* - srservice
*Deregistered* - SSDPSRV
*Deregistered* - stisvc
*Deregistered* - TapiSrv
*Deregistered* - TermService
*Deregistered* - Themes
*Deregistered* - TrkWks
*Deregistered* - W32Time
*Deregistered* - WebClient
*Deregistered* - winmgmt
*Deregistered* - wscsvc
*Deregistered* - wuauserv
*Deregistered* - WZCSVC

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
kzjaxcqp
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.charter.net/index.php
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local;
uInternet Settings,ProxyServer = http=localhost:7171
IE: &Search
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-07 17:45
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(660)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\progra~1\AVG\AVG8\avgam.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\progra~1\HEWLET~1\AiO\Shared\Bin\hpoevm07.exe
c:\program files\Hewlett-Packard\AiO\Shared\Bin\hposts07.exe
c:\program files\Hewlett-Packard\AiO\Shared\Bin\hpofxm07.exe
.
**************************************************************************
.
Completion time: 2009-05-07 17:51 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-07 21:51

Pre-Run: 51,788,951,552 bytes free
Post-Run: 51,960,651,776 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

214 --- E O F --- 2009-04-29 23:26

descriptionWin32/Cryptor [Help Plz] - Page 2 EmptyRe: Win32/Cryptor [Help Plz]

more_horiz
Hello.

Now open a new notepad file.
Input this into the notepad file:

KILLALL::

Driver::
xysxbauo

File::
c:\windows\system32\mouizhu.dll
c:\windows\system32\drivers\xysxbauo.sys
c:\windows\system32\pakbvqe.dll

Folder::
c:\program files\Coupons
c:\windows\Cache
C:\VundoFix Backups

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7B13B443-BEC9-4942-ABE3-6C9028587E08}]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dgkkchch]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=-
"FirewallOverride"=-

NetSvc::
kzjaxcqp

DDS::
uInternet Settings,ProxyOverride = *.local;
uInternet Settings,ProxyServer = http=localhost:7171
IE: &Search


Save this as CFScript.txt, save it to your desktop also.
Then drag and drop CFScript.txt into combofix as seen below:
Win32/Cryptor [Help Plz] - Page 2 Sfxdaw

This will open combofix.exe again, agree to it's terms and allow it to run, it may want to reboot after it's done. Post the resulting log back here.

descriptionWin32/Cryptor [Help Plz] - Page 2 EmptyRe: Win32/Cryptor [Help Plz]

more_horiz
ComboFix 09-05-07.06 - Owner 05/07/2009 18:07.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.254.134 [GMT -4:00]
Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt
AV: AVG Anti-Virus *On-access scanning disabled* (Updated)

FILE ::
c:\windows\system32\drivers\xysxbauo.sys
c:\windows\system32\mouizhu.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Coupons
c:\program files\Coupons\Coupons.com.url
c:\program files\Coupons\uninstall.exe
c:\program files\Coupons\Uninstall\IRIMG1.JPG
c:\program files\Coupons\Uninstall\IRIMG2.JPG
c:\program files\Coupons\Uninstall\IRIMG3.JPG
c:\program files\Coupons\Uninstall\IRIMG4.JPG
c:\program files\Coupons\Uninstall\IRIMG5.JPG
c:\program files\Coupons\Uninstall\IRIMG6.JPG
c:\program files\Coupons\Uninstall\IRIMG7.JPG
c:\program files\Coupons\Uninstall\IRIMG8.JPG
c:\program files\Coupons\Uninstall\uninstall.dat
c:\program files\Coupons\Uninstall\uninstall.xml
C:\VundoFix Backups
c:\windows\Cache
c:\windows\system32\drivers\xysxbauo.sys
c:\windows\system32\mouizhu.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_XYSXBAUO
-------\Service_xysxbauo


((((((((((((((((((((((((( Files Created from 2009-04-07 to 2009-05-07 )))))))))))))))))))))))))))))))
.

2009-05-03 04:14 . 2009-05-03 04:14 -------- d-----w c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com
2009-05-03 04:00 . 2009-05-07 20:33 -------- d--h--w C:\$AVG8.VAULT$
2009-05-03 02:44 . 2009-05-03 02:44 11952 ----a-w c:\windows\system32\avgrsstx.dll
2009-05-03 02:44 . 2009-05-03 02:44 12552 ----a-w c:\windows\system32\drivers\avgrkx86.sys
2009-05-03 02:44 . 2009-05-03 02:44 108552 ----a-w c:\windows\system32\drivers\avgtdix.sys
2009-05-03 02:43 . 2009-05-03 02:43 325896 ----a-w c:\windows\system32\drivers\avgldx86.sys
2009-05-03 02:43 . 2009-05-07 21:28 -------- d-----w c:\windows\system32\drivers\Avg
2009-05-03 02:41 . 2009-05-03 02:41 -------- d-----w c:\program files\AVG
2009-05-03 02:41 . 2009-05-07 20:41 -------- d-----w c:\documents and settings\All Users\Application Data\avg8
2009-05-03 02:32 . 2009-05-03 02:32 -------- d-----w c:\documents and settings\Owner\Application Data\GetRightToGo
2009-05-03 01:22 . 2009-05-03 01:22 -------- d-----w c:\windows\CD95F661A5C444F5A6AAECDD91C240B5.TMP
2009-05-03 00:11 . 2009-05-03 00:11 -------- d-----w c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-05-02 23:29 . 2009-05-02 23:29 -------- d-----w c:\documents and settings\Owner\Application Data\Malwarebytes
2009-05-02 23:29 . 2009-04-06 19:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-05-02 23:29 . 2009-04-06 19:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-02 23:29 . 2009-05-02 23:29 -------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-05-02 23:29 . 2009-05-02 23:29 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-05-02 23:26 . 2009-05-02 23:26 -------- d-----w c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-05-02 23:25 . 2009-05-02 23:26 -------- d-----w c:\program files\SUPERAntiSpyware
2009-05-02 23:25 . 2009-05-02 23:25 -------- d-----w c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com
2009-05-02 23:25 . 2009-05-02 23:25 -------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-05-02 23:25 . 2009-05-02 23:25 -------- d-----w c:\program files\CCleaner
2009-05-02 22:20 . 2009-05-02 22:20 -------- d-----w c:\documents and settings\Owner\Application Data\nwhkuejs
2009-05-02 22:20 . 2009-05-02 22:20 -------- d-----w c:\documents and settings\Owner\Local Settings\Application Data\nwhkuejs
2009-04-27 16:32 . 2009-04-27 16:32 -------- d-----w c:\documents and settings\NetworkService\Application Data\nwhkuejs
2009-04-27 16:32 . 2009-04-27 16:32 -------- d-----w c:\documents and settings\NetworkService\Local Settings\Application Data\nwhkuejs
2009-04-17 11:54 . 2009-03-06 14:44 283648 -c----w c:\windows\system32\dllcache\pdh.dll
2009-04-17 11:54 . 2005-07-26 04:39 60416 -c----w c:\windows\system32\dllcache\colbact.dll
2009-04-17 11:54 . 2009-02-09 10:20 399360 -c----w c:\windows\system32\dllcache\rpcss.dll
2009-04-17 11:54 . 2009-02-06 17:14 110592 -c----w c:\windows\system32\dllcache\services.exe
2009-04-17 11:54 . 2009-02-09 10:20 473088 -c----w c:\windows\system32\dllcache\fastprox.dll
2009-04-17 11:54 . 2009-02-06 16:39 227840 -c----w c:\windows\system32\dllcache\wmiprvse.exe
2009-04-17 11:54 . 2009-02-09 10:20 453120 -c----w c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-17 11:54 . 2009-02-09 10:20 616960 -c----w c:\windows\system32\dllcache\advapi32.dll
2009-04-17 11:54 . 2009-02-09 10:20 714752 -c----w c:\windows\system32\dllcache\ntdll.dll
2009-04-17 11:54 . 2008-04-21 10:02 215552 -c----w c:\windows\system32\dllcache\wordpad.exe
2009-04-12 02:30 . 2009-04-12 02:30 -------- d-----w c:\program files\Google
2009-04-12 02:30 . 2009-04-12 17:07 -------- d-----w c:\documents and settings\All Users\Application Data\NOS
2009-04-12 02:29 . 2009-04-12 17:07 -------- d-----w c:\program files\NOS

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-07 22:07 . 2002-09-03 16:50 23424 ----a-w c:\windows\system32\drivers\cpwlsxbq.sys
2009-05-07 21:37 . 2002-09-03 16:47 182912 ----a-w c:\windows\system32\drivers\ndis.sys
2009-03-29 18:23 . 2007-05-26 04:51 -------- d-----w c:\program files\QUICKENW
2009-03-06 14:44 . 2002-09-03 16:51 283648 ----a-w c:\windows\system32\pdh.dll
2009-03-03 00:18 . 2006-06-23 15:33 826368 ----a-w c:\windows\system32\wininet.dll
2009-02-20 18:09 . 2004-08-04 07:56 78336 ----a-w c:\windows\system32\ieencode.dll
2009-02-09 10:20 . 2005-07-26 04:31 399360 ----a-w c:\windows\system32\rpcss.dll
2009-02-09 10:20 . 2002-09-03 16:39 723456 ----a-w c:\windows\system32\lsasrv.dll
2009-02-09 10:20 . 2002-09-03 16:49 714752 ----a-w c:\windows\system32\ntdll.dll
2009-02-09 10:20 . 2002-09-03 16:27 616960 ----a-w c:\windows\system32\advapi32.dll
2009-02-09 10:19 . 2002-09-03 17:11 1846272 ----a-w c:\windows\system32\win32k.sys
2002-09-03 17:07 . 2002-09-03 17:07 94784 --sh--w c:\windows\twain.dll
2004-08-04 07:56 . 2002-09-03 17:07 50688 --sh--w c:\windows\twain_32.dll
2004-08-04 07:56 . 2002-09-03 16:41 1028096 --sh--w c:\windows\system32\mfc42.dll
2004-08-04 07:56 . 2002-09-03 16:46 54784 --sh--w c:\windows\system32\msvcirt.dll
2004-08-04 07:56 . 2002-09-03 16:46 413696 --sh--w c:\windows\system32\msvcp60.dll
2004-08-04 07:56 . 2002-09-03 16:46 343040 --sh--w c:\windows\system32\msvcrt.dll
2007-12-04 18:38 . 2002-09-03 16:51 550912 --sh--w c:\windows\system32\oleaut32.dll
2004-08-04 07:56 . 2002-09-03 16:51 83456 --sh--w c:\windows\system32\olepro32.dll
2004-08-04 07:56 . 2002-09-03 16:56 11776 --sh--w c:\windows\system32\regsvr32.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\System32\igfxtray.exe" [2003-01-13 155648]
"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2003-01-13 114688]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-05-03 1947928]
"BCMSMMSG"="BCMSMMSG.exe" - c:\windows\BCMSMMSG.exe [2003-08-29 122880]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HPAiODevice(hp psc 900 series) - 1.lnk - c:\program files\Hewlett-Packard\AiO\hp psc 900 series\Bin\hpobrt07.exe [2002-9-26 487484]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 16:05 356352 ----a-w c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-05-03 02:44 11952 ----a-w c:\windows\system32\avgrsstx.dll

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32
"wave"= serwvdrv.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgam.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgdiag.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"39453:TCP"= 39453:TCP:@xpsp2res.dll,-22009

R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [5/2/2009 10:44 PM 12552]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [5/2/2009 10:43 PM 325896]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [5/2/2009 10:44 PM 108552]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [4/28/2009 11:33 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [4/28/2009 11:33 AM 72944]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [5/2/2009 10:41 PM 298776]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [4/28/2009 11:33 AM 7408]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - XYSXBAUO
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.charter.net/index.php
uInternet Connection Wizard,ShellNext = iexplore
IE: &Search
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-07 18:11
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(660)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\progra~1\AVG\AVG8\avgam.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\windows\system32\wscntfy.exe
c:\progra~1\HEWLET~1\AiO\Shared\Bin\hpoevm07.exe
c:\program files\Hewlett-Packard\AiO\Shared\Bin\hposts07.exe
c:\program files\Hewlett-Packard\AiO\Shared\Bin\hpofxm07.exe
.
**************************************************************************
.
Completion time: 2009-05-07 18:15 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-07 22:15
ComboFix2.txt 2009-05-07 21:51

Pre-Run: 51,987,673,088 bytes free
Post-Run: 51,928,125,440 bytes free

189 --- E O F --- 2009-04-29 23:26

descriptionWin32/Cryptor [Help Plz] - Page 2 EmptyRe: Win32/Cryptor [Help Plz]

more_horiz
Hello.
One more round and we should be done here.

Now open a new notepad file.
Input this into the notepad file:

KILLALL::

Driver::
XYSXBAUO

File::
c:\windows\system32\drivers\cpwlsxbq.sys
c:\windows\system32\pakbvqe.dll


Save this as CFScript.txt, save it to your desktop also.
Then drag and drop CFScript.txt into combofix as seen below:
Win32/Cryptor [Help Plz] - Page 2 Sfxdaw

This will open combofix.exe again, agree to it's terms and allow it to run, it may want to reboot after it's done. Post the resulting log back here.

descriptionWin32/Cryptor [Help Plz] - Page 2 EmptyRe: Win32/Cryptor [Help Plz]

more_horiz
ComboFix 09-05-07.06 - Owner 05/07/2009 18:23.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.254.106 [GMT -4:00]
Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt
AV: AVG Anti-Virus *On-access scanning disabled* (Updated)

FILE ::
c:\windows\system32\drivers\cpwlsxbq.sys
c:\windows\system32\pakbvqe.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\drivers\cpwlsxbq.sys
c:\windows\system32\pakbvqe.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_XYSXBAUO


((((((((((((((((((((((((( Files Created from 2009-04-07 to 2009-05-07 )))))))))))))))))))))))))))))))
.

2009-05-03 04:14 . 2009-05-03 04:14 -------- d-----w c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com
2009-05-03 04:00 . 2009-05-07 20:33 -------- d--h--w C:\$AVG8.VAULT$
2009-05-03 02:44 . 2009-05-03 02:44 11952 ----a-w c:\windows\system32\avgrsstx.dll
2009-05-03 02:44 . 2009-05-03 02:44 12552 ----a-w c:\windows\system32\drivers\avgrkx86.sys
2009-05-03 02:44 . 2009-05-03 02:44 108552 ----a-w c:\windows\system32\drivers\avgtdix.sys
2009-05-03 02:43 . 2009-05-03 02:43 325896 ----a-w c:\windows\system32\drivers\avgldx86.sys
2009-05-03 02:43 . 2009-05-07 21:28 -------- d-----w c:\windows\system32\drivers\Avg
2009-05-03 02:41 . 2009-05-03 02:41 -------- d-----w c:\program files\AVG
2009-05-03 02:41 . 2009-05-07 20:41 -------- d-----w c:\documents and settings\All Users\Application Data\avg8
2009-05-03 02:32 . 2009-05-03 02:32 -------- d-----w c:\documents and settings\Owner\Application Data\GetRightToGo
2009-05-03 01:22 . 2009-05-03 01:22 -------- d-----w c:\windows\CD95F661A5C444F5A6AAECDD91C240B5.TMP
2009-05-03 00:11 . 2009-05-03 00:11 -------- d-----w c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-05-02 23:29 . 2009-05-02 23:29 -------- d-----w c:\documents and settings\Owner\Application Data\Malwarebytes
2009-05-02 23:29 . 2009-04-06 19:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-05-02 23:29 . 2009-04-06 19:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-02 23:29 . 2009-05-02 23:29 -------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-05-02 23:29 . 2009-05-02 23:29 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-05-02 23:26 . 2009-05-02 23:26 -------- d-----w c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-05-02 23:25 . 2009-05-02 23:26 -------- d-----w c:\program files\SUPERAntiSpyware
2009-05-02 23:25 . 2009-05-02 23:25 -------- d-----w c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com
2009-05-02 23:25 . 2009-05-02 23:25 -------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-05-02 23:25 . 2009-05-02 23:25 -------- d-----w c:\program files\CCleaner
2009-05-02 22:20 . 2009-05-02 22:20 -------- d-----w c:\documents and settings\Owner\Application Data\nwhkuejs
2009-05-02 22:20 . 2009-05-02 22:20 -------- d-----w c:\documents and settings\Owner\Local Settings\Application Data\nwhkuejs
2009-04-27 16:32 . 2009-04-27 16:32 -------- d-----w c:\documents and settings\NetworkService\Application Data\nwhkuejs
2009-04-27 16:32 . 2009-04-27 16:32 -------- d-----w c:\documents and settings\NetworkService\Local Settings\Application Data\nwhkuejs
2009-04-17 11:54 . 2009-03-06 14:44 283648 -c----w c:\windows\system32\dllcache\pdh.dll
2009-04-17 11:54 . 2005-07-26 04:39 60416 -c----w c:\windows\system32\dllcache\colbact.dll
2009-04-17 11:54 . 2009-02-09 10:20 399360 -c----w c:\windows\system32\dllcache\rpcss.dll
2009-04-17 11:54 . 2009-02-06 17:14 110592 -c----w c:\windows\system32\dllcache\services.exe
2009-04-17 11:54 . 2009-02-09 10:20 473088 -c----w c:\windows\system32\dllcache\fastprox.dll
2009-04-17 11:54 . 2009-02-06 16:39 227840 -c----w c:\windows\system32\dllcache\wmiprvse.exe
2009-04-17 11:54 . 2009-02-09 10:20 453120 -c----w c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-17 11:54 . 2009-02-09 10:20 616960 -c----w c:\windows\system32\dllcache\advapi32.dll
2009-04-17 11:54 . 2009-02-09 10:20 714752 -c----w c:\windows\system32\dllcache\ntdll.dll
2009-04-17 11:54 . 2008-04-21 10:02 215552 -c----w c:\windows\system32\dllcache\wordpad.exe
2009-04-12 02:30 . 2009-04-12 02:30 -------- d-----w c:\program files\Google
2009-04-12 02:30 . 2009-04-12 17:07 -------- d-----w c:\documents and settings\All Users\Application Data\NOS
2009-04-12 02:29 . 2009-04-12 17:07 -------- d-----w c:\program files\NOS

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-07 21:37 . 2002-09-03 16:47 182912 ----a-w c:\windows\system32\drivers\ndis.sys
2009-03-29 18:23 . 2007-05-26 04:51 -------- d-----w c:\program files\QUICKENW
2009-03-06 14:44 . 2002-09-03 16:51 283648 ----a-w c:\windows\system32\pdh.dll
2009-03-03 00:18 . 2006-06-23 15:33 826368 ----a-w c:\windows\system32\wininet.dll
2009-02-20 18:09 . 2004-08-04 07:56 78336 ----a-w c:\windows\system32\ieencode.dll
2009-02-09 10:20 . 2005-07-26 04:31 399360 ----a-w c:\windows\system32\rpcss.dll
2009-02-09 10:20 . 2002-09-03 16:39 723456 ----a-w c:\windows\system32\lsasrv.dll
2009-02-09 10:20 . 2002-09-03 16:49 714752 ----a-w c:\windows\system32\ntdll.dll
2009-02-09 10:20 . 2002-09-03 16:27 616960 ----a-w c:\windows\system32\advapi32.dll
2009-02-09 10:19 . 2002-09-03 17:11 1846272 ----a-w c:\windows\system32\win32k.sys
2002-09-03 17:07 . 2002-09-03 17:07 94784 --sh--w c:\windows\twain.dll
2004-08-04 07:56 . 2002-09-03 17:07 50688 --sh--w c:\windows\twain_32.dll
2004-08-04 07:56 . 2002-09-03 16:41 1028096 --sh--w c:\windows\system32\mfc42.dll
2004-08-04 07:56 . 2002-09-03 16:46 54784 --sh--w c:\windows\system32\msvcirt.dll
2004-08-04 07:56 . 2002-09-03 16:46 413696 --sh--w c:\windows\system32\msvcp60.dll
2004-08-04 07:56 . 2002-09-03 16:46 343040 --sh--w c:\windows\system32\msvcrt.dll
2007-12-04 18:38 . 2002-09-03 16:51 550912 --sh--w c:\windows\system32\oleaut32.dll
2004-08-04 07:56 . 2002-09-03 16:51 83456 --sh--w c:\windows\system32\olepro32.dll
2004-08-04 07:56 . 2002-09-03 16:56 11776 --sh--w c:\windows\system32\regsvr32.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\System32\igfxtray.exe" [2003-01-13 155648]
"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2003-01-13 114688]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-05-03 1947928]
"BCMSMMSG"="BCMSMMSG.exe" - c:\windows\BCMSMMSG.exe [2003-08-29 122880]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HPAiODevice(hp psc 900 series) - 1.lnk - c:\program files\Hewlett-Packard\AiO\hp psc 900 series\Bin\hpobrt07.exe [2002-9-26 487484]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 16:05 356352 ----a-w c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-05-03 02:44 11952 ----a-w c:\windows\system32\avgrsstx.dll

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32
"wave"= serwvdrv.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgam.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgdiag.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"39453:TCP"= 39453:TCP:@xpsp2res.dll,-22009

R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [5/2/2009 10:44 PM 12552]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [5/2/2009 10:43 PM 325896]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [5/2/2009 10:44 PM 108552]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [4/28/2009 11:33 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [4/28/2009 11:33 AM 72944]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [5/2/2009 10:41 PM 298776]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [4/28/2009 11:33 AM 7408]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.charter.net/index.php
uInternet Connection Wizard,ShellNext = iexplore
IE: &Search
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-07 18:27
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(660)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\progra~1\AVG\AVG8\avgam.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\windows\system32\wscntfy.exe
c:\progra~1\HEWLET~1\AiO\Shared\Bin\hpoevm07.exe
c:\program files\Hewlett-Packard\AiO\Shared\Bin\hposts07.exe
c:\program files\Hewlett-Packard\AiO\Shared\Bin\hpofxm07.exe
.
**************************************************************************
.
Completion time: 2009-05-07 18:31 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-07 22:31
ComboFix2.txt 2009-05-07 22:16
ComboFix3.txt 2009-05-07 21:51

Pre-Run: 51,934,167,040 bytes free
Post-Run: 51,924,955,136 bytes free

171 --- E O F --- 2009-04-29 23:26

descriptionWin32/Cryptor [Help Plz] - Page 2 EmptyRe: Win32/Cryptor [Help Plz]

more_horiz
Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /u

Win32/Cryptor [Help Plz] - Page 2 CF_Cleanup

This will also reset your restore points.

How is the machine running now?

descriptionWin32/Cryptor [Help Plz] - Page 2 EmptyRe: Win32/Cryptor [Help Plz]

more_horiz
Machine seems to be running better than before but to actually say that should i re enable AVG 8.5 to see if resident shield detects anything?

descriptionWin32/Cryptor [Help Plz] - Page 2 EmptyRe: Win32/Cryptor [Help Plz]

more_horiz
Yeah, do that. Smile... If it picks up anything, let me know where.

descriptionWin32/Cryptor [Help Plz] - Page 2 EmptyRe: Win32/Cryptor [Help Plz]

more_horiz
THANK YOU SO MUCH! I APPRECIATE THE HELP! GREAT FORUM! GREAT STAFF!

NOTHING ITS FINALLY CLEAR... ONE MORE QUESTION (SORTA OFF TOPIC) BUT IS THERE SOMETHING I CAN DO SOFTWARE WISE TO FREE UP SOME RAM THIS COMPUTER RUNS SORTA SLOW I THOUGHT MAYBE IT WAS BECAUSE OF THE VIRUS BUT THATS NOT THE CASE!!!

descriptionWin32/Cryptor [Help Plz] - Page 2 EmptyRe: Win32/Cryptor [Help Plz]

more_horiz
Probably the startup stuff.

Please download the current version of HijackThis from HERE

  • Double click and run the installer.
  • It will install to C:\Program Files\Trend Micro\HijackThis\hijackthis.exe
  • After installing, you should get the user agreement, press accept and Hijack This will run.
  • Select Do a system scan and save a log file. This will open a notepad file of everything Hijack This found, copy and paste it back here.

descriptionWin32/Cryptor [Help Plz] - Page 2 EmptyRe: Win32/Cryptor [Help Plz]

more_horiz
privacy_tip Permissions in this forum:
You cannot reply to topics in this forum