WiredWX Hobby Weather ToolsLog in

 


Win 32/cryptor

2 posters

descriptionWin 32/cryptor - Page 2 EmptyRe: Win 32/cryptor

more_horiz
Now open a new notepad file.
Input this into the notepad file:

KILLALL::

Driver::
dphkbhyxrlue

File::
c:\documents and settings\Shimri Yancey\Application Data\Mozilla\Firefox\Profiles\24ykkije.default\user.js
c:\windows\system32\drivers\lmielwq.sys
C:\4321f456.bat
c:\program files\something1.exe
c:\program files\something.exe
c:\program files\rmdndup.exe

Folder::
c:\windows\system32\796525
c:\Program Files\LimeWire

Firefox::
FF - ProfilePath - c:\documents and settings\Shimri Yancey\Application Data\Mozilla\Firefox\Profiles\24ykkije.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www1.yoog.com/search.php?q=
FF - prefs.js: browser.search.selectedEngine - Yoog Search
FF - prefs.js: keyword.URL - hxxp://www1.yoog.com/search.php?q=

Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\LimeWire\\LimeWire.exe"=-


Save this as CFScript.txt, save it to your desktop also.
Then drag and drop CFScript.txt into combofix as seen below:
Win 32/cryptor - Page 2 Sfxdaw

This will open combofix again, agree to it's terms and allow it to run.
It may want to reboot after it's done. (It will warn you if it wants to)
Post the resulting log back here.

descriptionWin 32/cryptor - Page 2 EmptyRe: Win 32/cryptor

more_horiz
here is the log...

ComboFix 09-05-20.A1 - Shimri Yancey 05/21/2009 6:18.3 - NTFSx86 NETWORK
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.510.325 [GMT -7:00]
Running from: c:\documents and settings\Shimri Yancey\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\Shimri Yancey\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

FILE ::
C:\4321f456.bat
c:\documents and settings\Shimri Yancey\Application Data\Mozilla\Firefox\Profiles\24ykkije.default\user.js
c:\program files\rmdndup.exe
c:\program files\something.exe
c:\program files\something1.exe
c:\windows\system32\drivers\lmielwq.sys
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\4321f456.bat
c:\documents and settings\Shimri Yancey\Application Data\Mozilla\Firefox\Profiles\24ykkije.default\user.js
c:\program files\LimeWire
c:\program files\LimeWire\.NetworkShare\LimeWirePackedJars4.12.6.7z
c:\program files\LimeWire\.NetworkShare\LimeWireWin4.12.6.exe
c:\program files\LimeWire\clink.jar
c:\program files\LimeWire\commons-httpclient.jar
c:\program files\LimeWire\commons-logging.jar
c:\program files\LimeWire\commons-net.jar
c:\program files\LimeWire\COPYING
c:\program files\LimeWire\daap.jar
c:\program files\LimeWire\data.ser
c:\program files\LimeWire\donotremove.htm
c:\program files\LimeWire\GenericWindowsUtils.dll
c:\program files\LimeWire\hashes
c:\program files\LimeWire\i18n.jar
c:\program files\LimeWire\icu4j.jar
c:\program files\LimeWire\id3v2.jar
c:\program files\LimeWire\install.log
c:\program files\LimeWire\jcraft.jar
c:\program files\LimeWire\jl011.jar
c:\program files\LimeWire\jmdns.jar
c:\program files\LimeWire\language.prop
c:\program files\LimeWire\LimeWire On Startup.lnk
c:\program files\LimeWire\LimeWire.exe
c:\program files\LimeWire\LimeWire.ico
c:\program files\LimeWire\LimeWire.jar
c:\program files\LimeWire\LimeWire20.dll
c:\program files\LimeWire\log4j.jar
c:\program files\LimeWire\log4j.properties
c:\program files\LimeWire\looks.jar
c:\program files\LimeWire\MessagesBundle.properties
c:\program files\LimeWire\MessagesBundles.jar
c:\program files\LimeWire\mp3sp14.jar
c:\program files\LimeWire\pmf.ico
c:\program files\LimeWire\ProgressTabs.jar
c:\program files\LimeWire\root\magnet10\badge.img
c:\program files\LimeWire\root\magnet10\canHandle.img
c:\program files\LimeWire\root\magnet10\limewire.gif
c:\program files\LimeWire\root\magnet10\options.js
c:\program files\LimeWire\root\magnet10\silentdetect.js
c:\program files\LimeWire\SOURCE
c:\program files\LimeWire\spacer.gif
c:\program files\LimeWire\themes.jar
c:\program files\LimeWire\tritonus.jar
c:\program files\LimeWire\uninstall.exe
c:\program files\LimeWire\unpack.log
c:\program files\LimeWire\update.ver
c:\program files\LimeWire\vorbis.jar
c:\program files\LimeWire\WindowsFirewall.dll
c:\program files\LimeWire\WindowsV5PlusUtils.dll
c:\program files\LimeWire\xerces.jar
c:\program files\LimeWire\xml-apis.jar
c:\program files\LimeWire\xml.war
c:\program files\rmdndup.exe
c:\program files\something.exe
c:\program files\something1.exe

descriptionWin 32/cryptor - Page 2 EmptyRe: Win 32/cryptor

more_horiz
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_BOONTY_GAMES
-------\Legacy_DPHKBHYXRLUE
-------\Service_dphkbhyxrlue


((((((((((((((((((((((((( Files Created from 2009-04-21 to 2009-05-21 )))))))))))))))))))))))))))))))
.

2009-05-21 02:55 . 2009-05-21 02:55 -------- d-----w c:\documents and settings\Shimri Yancey\Application Data\Malwarebytes
2009-05-20 21:58 . 2009-05-20 21:59 -------- d-----w C:\32788R22FWJFW.0.tmp
2009-05-20 20:45 . 2009-05-20 20:45 16883056 ----a-w c:\program files\IE8-WindowsXP-x86-ENU.exe
2009-05-20 19:36 . 2009-05-20 19:36 -------- d-----w c:\program files\JavaRa
2009-05-20 19:36 . 2009-05-20 19:36 69512 ----a-w c:\program files\JavaRa.zip
2009-05-20 17:39 . 2009-05-20 17:39 -------- d-----w c:\program files\SUPERAntiSpyware
2009-05-20 17:39 . 2009-05-20 17:39 -------- d-----w c:\documents and settings\Shimri Yancey\Application Data\SUPERAntiSpyware.com
2009-05-20 17:39 . 2009-05-20 17:39 -------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-05-20 17:11 . 2009-05-21 03:03 -------- d-----w c:\program files\something3
2009-05-20 16:05 . 2009-05-20 16:05 -------- d-----w c:\documents and settings\Shimri Yancey\Application Data\True Sword
2009-05-20 16:01 . 2005-10-11 21:40 356352 ----a-w c:\windows\eSellerateEngine.dll
2009-05-20 16:01 . 2003-06-06 18:21 81920 ----a-w c:\windows\eSellerateControl350.dll
2009-05-20 16:01 . 2009-05-20 16:50 -------- d-----w c:\program files\True Sword 5
2009-05-20 16:01 . 2009-05-20 16:01 8667730 ----a-w c:\program files\TrueSword5.exe
2009-05-20 13:41 . 2009-05-21 05:09 -------- d--h--w C:\$AVG8.VAULT$
2009-05-20 13:36 . 2009-05-20 13:36 11952 ----a-w c:\windows\system32\avgrsstx.dll
2009-05-20 13:36 . 2009-05-20 13:36 108552 ----a-w c:\windows\system32\drivers\avgtdix.sys
2009-05-20 13:36 . 2009-05-20 13:36 325896 ----a-w c:\windows\system32\drivers\avgldx86.sys
2009-05-20 13:35 . 2009-05-21 01:11 -------- d-----w c:\windows\system32\drivers\Avg
2009-05-20 13:35 . 2009-05-20 13:43 -------- d-----w c:\documents and settings\Shimri Yancey\Application Data\AVGTOOLBAR
2009-05-14 14:47 . 2009-05-14 14:47 -------- d-sh--w c:\documents and settings\Shimri Yancey\IECompatCache
2009-05-08 16:15 . 2009-05-08 16:15 1887408 ----a-w c:\program files\GoogleToolbarInstaller_en_signed.exe
2009-05-03 17:02 . 2009-04-06 22:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-05-03 17:02 . 2009-04-06 22:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-03 17:02 . 2009-05-03 17:02 -------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-05-03 17:02 . 2009-05-20 17:06 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-05-03 17:01 . 2009-05-03 17:02 2967800 ----a-w c:\program files\mbam-setup.com
2009-05-03 02:35 . 2009-05-03 02:35 -------- d-sh--w c:\documents and settings\LocalService\IETldCache
2009-05-03 02:28 . 2009-05-03 02:28 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2009-05-03 00:59 . 2009-05-03 00:59 -------- d-sh--w c:\documents and settings\Administrator\PrivacIE
2009-05-03 00:56 . 2009-05-03 00:56 -------- d-sh--w c:\documents and settings\Shimri Yancey\PrivacIE
2009-05-03 00:55 . 2009-05-03 00:55 -------- d-sh--w c:\windows\system32\config\systemprofile\IETldCache
2009-05-03 00:55 . 2009-05-03 00:55 -------- d-sh--w c:\documents and settings\Shimri Yancey\IETldCache
2009-05-03 00:42 . 2009-05-20 20:47 -------- d-----w c:\windows\ie8updates
2009-05-03 00:38 . 2004-08-04 07:56 81920 ----a-w c:\windows\system32\ieencode.dll
2009-05-03 00:26 . 2009-02-28 04:55 105984 -c----w c:\windows\system32\dllcache\iecompat.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-20 23:10 . 2002-09-13 19:53 -------- d-----w c:\program files\ICQ
2009-05-20 23:10 . 2008-11-26 02:00 -------- d-----w c:\program files\Free Offers from Freeze.com
2009-05-20 23:10 . 2009-01-23 15:10 -------- d-----w c:\program files\Advanced Registry Optimizer
2009-05-20 23:10 . 2005-03-08 00:26 -------- d-----w c:\program files\FinePixViewer
2009-05-15 13:45 . 2004-11-18 23:25 -------- d-----w c:\program files\Google
2009-05-07 00:09 . 2004-09-22 19:45 -------- d-----w c:\program files\Microsoft Digital Image 10
2009-05-03 00:05 . 2009-01-20 16:43 -------- d-----w c:\program files\Panda Security
2009-04-10 01:02 . 2009-04-10 01:02 35822080 ----a-w c:\program files\Freedom-1_8_1_9-setup-windows.exe
2009-03-22 18:13 . 2009-03-22 18:13 -------- d-----w c:\program files\WinPcap
2009-03-06 14:44 . 2002-09-13 18:59 283648 ----a-w c:\windows\system32\pdh.dll
2009-02-24 01:08 . 2003-03-22 18:40 257584 ----a-w c:\documents and settings\Shimri Yancey\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-02-21 21:00 . 2009-02-21 20:59 60939848 ----a-w c:\program files\avg_free_stf_en_8_237a1428.exe
2009-02-21 20:52 . 2009-02-21 20:52 140288 ----a-w c:\program files\vcleaner.exe
2009-01-23 15:10 . 2009-01-23 15:10 2803448 ----a-w c:\program files\AROTrial_bt.exe
2009-01-23 15:06 . 2009-01-23 15:06 3166208 ----a-w c:\program files\saSetup64.exe
2008-12-22 14:50 . 2008-12-22 14:50 34031720 ----a-w c:\program files\GoogleSketchUpWEN.exe
2008-10-08 00:45 . 2008-10-08 00:45 8155992 ----a-w c:\program files\sd8_smartpdf.exe
2008-09-15 02:41 . 2008-09-15 02:40 300272 ----a-w c:\program files\MySpaceIM_Setup.exe
2008-03-06 01:30 . 2008-03-06 01:30 8317952 ----a-w c:\program files\epson11220.exe
2008-02-04 16:12 . 2008-02-04 16:12 60536 ----a-w c:\program files\delicious.exe
2008-02-04 16:11 . 2008-02-04 16:11 397312 ----a-w c:\program files\delicious.msi
2008-01-20 20:51 . 2008-01-20 20:51 2400784 ----a-w c:\program files\WLinstaller.exe
2007-09-18 00:09 . 2007-09-18 00:06 353598016 ----a-w c:\program files\SimpleStartFSEDirect.exe
2007-04-11 03:10 . 2007-04-11 02:29 306240 ----a-w c:\program files\Install_AIM.exe
2007-03-26 20:41 . 2007-03-26 20:41 722992 ----a-w c:\program files\aolsetup.exe
2007-03-26 20:41 . 2007-03-26 20:41 4424 ----a-w c:\program files\aolsetup.bin
2007-02-14 20:13 . 2007-02-14 20:08 21822168 ----a-w c:\program files\AdbeRdr80_en_US.exe
2006-10-31 08:10 . 2006-10-31 08:10 671845 ----a-w c:\program files\data1.cab
2006-10-31 08:10 . 2006-10-31 08:10 552214 ----a-w c:\program files\ISSetup.dll
2006-10-31 08:10 . 2006-10-31 08:10 546 ----a-w c:\program files\setup.iss
2006-10-31 08:10 . 2006-10-31 08:10 491 ----a-w c:\program files\setup.ini
2006-10-31 08:10 . 2006-10-31 08:10 455 ----a-w c:\program files\layout.bin
2006-10-31 08:10 . 2006-10-31 08:10 385968 ----a-w c:\program files\_Setup.dll
2006-10-31 08:10 . 2006-10-31 08:10 364218 ----a-w c:\program files\data2.cab
2006-10-31 08:10 . 2006-10-31 08:10 205926 ----a-w c:\program files\setup.inx
2006-10-31 08:10 . 2006-10-31 08:10 17991 ----a-w c:\program files\data1.hdr
2006-06-27 05:39 . 2006-06-27 05:39 12527920 ----a-w c:\program files\IE7BETA2-WindowsXP-x86-enu.exe
2006-06-24 01:20 . 2006-06-24 01:19 3044468 ----a-w c:\program files\cpg272.exe
2005-11-28 03:06 . 2005-11-28 03:06 15666960 ----a-w c:\program files\avg71free_362a652.exe
2005-11-20 19:16 . 2005-11-20 19:16 78597807 ----a-w c:\program files\OOo_2.0.0_Win32Intel_install.exe
2005-11-09 04:16 . 2005-03-23 22:35 29232536 ----a-w c:\program files\pcs4.exe
2005-10-09 22:51 . 2005-05-20 22:53 1695 ----a-w c:\program files\TBass4.INI
2005-09-16 16:24 . 2004-09-25 03:07 2855080 ----a-w c:\program files\aawsepersonal.exe
2005-08-10 04:08 . 2005-05-23 23:43 0 ----a-w c:\program files\filenames.txt
2005-06-07 03:59 . 2005-06-07 03:59 7363784 ----a-w c:\program files\INSTALL_MSN_MESSENGER_DL.EXE
2005-05-21 16:29 . 2005-05-21 16:26 75029 ----a-w c:\program files\DeIsL1.isu
2005-05-08 00:46 . 2005-05-07 23:01 33388 ----a-w c:\program files\FxSobr.log
2005-05-07 22:53 . 2005-05-07 22:53 198784 ----a-w c:\program files\FxSobr.exe
2005-02-22 01:54 . 2005-02-22 01:54 3742383 ----a-w c:\program files\CoffeeFreeFTPInstaller.exe
2005-02-22 01:42 . 2005-02-22 01:42 3797175 ----a-w c:\program files\CoffeeFTP62.exe
2005-01-09 21:06 . 2005-01-09 21:05 6342279 ----a-w c:\program files\fcp45setup.exe
2004-02-20 07:44 . 2004-02-20 07:44 5545537 ----a-w c:\program files\win2k_xp140.exe
2004-01-18 21:04 . 2004-01-18 21:04 1881144 ----a-w c:\program files\GrouperSetup.exe
2004-01-02 17:41 . 2004-01-02 17:41 893712 ----a-w c:\program files\proxyconn.exe
2001-04-10 21:30 . 2004-10-10 20:17 1949 ----a-w c:\program files\Alien Skinformation.html
2001-04-02 23:31 . 2004-10-10 20:17 550602 ----a-w c:\program files\EyeCand3.8bf
2001-04-02 23:22 . 2004-10-10 20:17 409600 ----a-w c:\program files\EC3-ENG.8BF
2000-09-26 19:45 . 2000-09-26 19:45 7356 ----a-w c:\program files\readmePatch1004.txt
2000-08-23 16:02 . 2000-08-23 16:02 702 ----a-w c:\program files\Update1.tbv
1999-06-25 17:56 . 2004-10-10 20:17 127184 ----a-w c:\program files\UNWISE.EXE
2007-06-02 20:18 . 2006-06-28 16:53 61038 ----a-w c:\program files\mozilla firefox\components\jar50.dll
2007-06-02 20:18 . 2006-06-28 16:53 49256 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll
2007-06-02 20:18 . 2006-06-28 16:53 166000 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll
2009-02-12 07:06 . 2009-02-12 07:06 5465 --sh--w c:\windows\system32\huvewahi.dll
2009-02-11 19:06 . 2009-02-11 19:06 5465 --sh--w c:\windows\system32\nutedede.dll
.

descriptionWin 32/cryptor - Page 2 EmptyRe: Win 32/cryptor

more_horiz
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-05-06 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2005-06-09 98304]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-05-20 1947928]
"Synchronization Manager"="c:\windows\system32\mobsync.exe" [2004-08-04 143360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2008-12-12 9555968]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 19:05 356352 ----a-w c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-05-20 13:36 11952 ----a-w c:\windows\system32\avgrsstx.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^$McRebootA5E6DEAA56$.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\$McRebootA5E6DEAA56$.lnk
backup=c:\windows\pss\$McRebootA5E6DEAA56$.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adware Filter.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adware Filter.lnk
backup=c:\windows\pss\Adware Filter.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AdwareFilter Background Protection.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\AdwareFilter Background Protection.lnk
backup=c:\windows\pss\AdwareFilter Background Protection.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^BigFix.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\BigFix.lnk
backup=c:\windows\pss\BigFix.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Creating Keepsakes Scrapbook Designer Event Reminder.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Creating Keepsakes Scrapbook Designer Event Reminder.lnk
backup=c:\windows\pss\Creating Keepsakes Scrapbook Designer Event Reminder.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Exif Launcher.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Exif Launcher.lnk
backup=c:\windows\pss\Exif Launcher.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Free WebSite Tools.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Free WebSite Tools.lnk
backup=c:\windows\pss\Free WebSite Tools.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk
backup=c:\windows\pss\Google Updater.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=c:\windows\pss\Kodak EasyShare software.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^KODAK Software Updater.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\KODAK Software Updater.lnk
backup=c:\windows\pss\KODAK Software Updater.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Works Calendar Reminders.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Works Calendar Reminders.lnk
backup=c:\windows\pss\Microsoft Works Calendar Reminders.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk
backup=c:\windows\pss\QuickBooks Update Agent.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Shimri Yancey^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
path=c:\documents and settings\Shimri Yancey\Start Menu\Programs\Startup\LimeWire On Startup.lnk
backup=c:\windows\pss\LimeWire On Startup.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Shimri Yancey^Start Menu^Programs^Startup^OpenOffice.org 1.9.79.lnk]
path=c:\documents and settings\Shimri Yancey\Start Menu\Programs\Startup\OpenOffice.org 1.9.79.lnk
backup=c:\windows\pss\OpenOffice.org 1.9.79.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Shimri Yancey^Start Menu^Programs^Startup^OpenOffice.org 2.0.lnk]
path=c:\documents and settings\Shimri Yancey\Start Menu\Programs\Startup\OpenOffice.org 2.0.lnk
backup=c:\windows\pss\OpenOffice.org 2.0.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Shimri Yancey^Start Menu^Programs^Startup^PowerReg Scheduler V3.exe]
path=c:\documents and settings\Shimri Yancey\Start Menu\Programs\Startup\PowerReg Scheduler V3.exe
backup=c:\windows\pss\PowerReg Scheduler V3.exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Shimri Yancey^Start Menu^Programs^Startup^Yahoo! Widgets.lnk]
path=c:\documents and settings\Shimri Yancey\Start Menu\Programs\Startup\Yahoo! Widgets.lnk
backup=c:\windows\pss\Yahoo! Widgets.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"WLSetupSvc"=3 (0x3)
"usnjsvc"=3 (0x3)
"mcupdmgr.exe"=3 (0x3)
"McTskshd.exe"=2 (0x2)
"McDetect.exe"=2 (0x2)
"McciCMService"=2 (0x2)
"IDriverT"=3 (0x3)
"gusvc"=2 (0x2)
"GoogleDesktopManager-061008-081103"=3 (0x3)
"Boonty Games"=3 (0x3)
"avg8wd"=2 (0x2)
"avg8emc"=2 (0x2)
"aspnet_state"=3 (0x3)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\wjview.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\CoffeeCup Software\\CoffeeCup Free FTP\\FreeFTP.exe"=
"c:\\Program Files\\IncrediMail\\bin\\IncMail.exe"=
"c:\\Program Files\\IncrediMail\\bin\\IMApp.exe"=
"c:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Virtual Mechanics\\SiteSpinner V2.7\\bin\\SiteSpinnerV2.exe"=
"c:\\Program Files\\Avanquest\\Web Easy Professional 7\\WebEasy.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1999:UDP"= 1999:UDP:Windows Media Format SDK (firefox.exe)
"1998:UDP"= 1998:UDP:Windows Media Format SDK (firefox.exe)

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [5/20/2009 6:36 AM 325896]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [5/20/2009 6:36 AM 108552]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [5/20/2009 6:35 AM 908568]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [5/20/2009 6:35 AM 298776]
R2 npf;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [11/15/2007 1:30 PM 34064]
S2 PPSCAN;PPSCAN;c:\windows\system32\drivers\ppscan.sys [3/19/2003 12:55 PM 91520]
.
Contents of the 'Scheduled Tasks' folder

2009-05-21 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 19:20]

2009-05-21 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-05-06 18:25]

2009-05-21 c:\windows\Tasks\SDMsgUpdate (TE).job
- c:\progra~1\SmartDraw 2009\Messages\SDNotify.exe [2008-10-07 14:29]
.
.

descriptionWin 32/cryptor - Page 2 EmptyRe: Win 32/cryptor

more_horiz
------- Supplementary Scan -------
.
uStart Page = hxxp://www.buttelife.com/
mStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr7/*http://www.yahoo.com/ext/search/search.html
uInternet Settings,ProxyOverride = *.r4.attbi.com;localhost
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {6AE4CC6E-999C-11D4-A3F0-009027427750} - hxxp://us.i1.yimg.com/us.yimg.com/i/msgr/yauto_remove.cab
FF - ProfilePath - c:\documents and settings\Shimri Yancey\Application Data\Mozilla\Firefox\Profiles\24ykkije.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.buttelife.com/

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.cookie.p3plevel", 1); // 0=low, 1=medium, 2=high, 3=custom
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.enablePad", false); // Allow client to do proxy autodiscovery
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.search.param.Google.1.default", "chrome://branding/content/searchconfig.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.search.param.Google.1.custom", "chrome://branding/content/searchconfig.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("signon.prefillForms", true);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-21 06:25
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(488)
c:\program files\SUPERAntiSpyware\SASWINLO.dll

- - - - - - - > 'explorer.exe'(620)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\program files\AVG\AVG8\avgcsrvx.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-05-21 6:39 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-21 13:39
ComboFix2.txt 2009-05-21 02:03

Pre-Run: 23,411,867,648 bytes free
Post-Run: 23,163,326,464 bytes free

371 --- E O F --- 2009-05-21 13:34

descriptionWin 32/cryptor - Page 2 EmptyRe: Win 32/cryptor

more_horiz
I will say this much, I didn't catch the safe mode when the combo fix rebooted me and guess what....the computer hasn't shut down on me yet! Cheesy Grin (sparkly

descriptionWin 32/cryptor - Page 2 EmptyRe: Win 32/cryptor

more_horiz
Hello.
The rebooting problem was caused by the malware, I've played with this myself, I know what it does.

One last script to pick up some leftovers I missed.

Now open a new notepad file.
Input this into the notepad file:

KILLALL::

File::
c:\windows\system32\huvewahi.dll
c:\windows\system32\nutedede.dll
c:\documents and settings\Shimri Yancey\Start Menu\Programs\Startup\LimeWire On Startup.lnk

Registry::
[-HKLM\~\startupfolder\C:^Documents and Settings^Shimri Yancey^Start Menu^Programs^Startup^LimeWire On Startup.lnk]


Save this as CFScript.txt, save it to your desktop also.
Then drag and drop CFScript.txt into combofix as seen below:
Win 32/cryptor - Page 2 Sfxdaw

This will open combofix again, agree to it's terms and allow it to run.
It may want to reboot after it's done. (It will warn you if it wants to)
Post the resulting log back here.

descriptionWin 32/cryptor - Page 2 EmptyRe: Win 32/cryptor

more_horiz
ComboFix 09-05-20.A1 - Shimri Yancey 05/21/2009 9:07.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.510.203 [GMT -7:00]
Running from: c:\documents and settings\Shimri Yancey\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\Shimri Yancey\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

FILE ::
c:\documents and settings\Shimri Yancey\Start Menu\Programs\Startup\LimeWire On Startup.lnk
c:\windows\system32\huvewahi.dll
c:\windows\system32\nutedede.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\huvewahi.dll
c:\windows\system32\nutedede.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_BOONTY_GAMES


((((((((((((((((((((((((( Files Created from 2009-04-21 to 2009-05-21 )))))))))))))))))))))))))))))))
.

2009-05-21 02:55 . 2009-05-21 02:55 -------- d-----w c:\documents and settings\Shimri Yancey\Application Data\Malwarebytes
2009-05-20 21:58 . 2009-05-20 21:59 -------- d-----w C:\32788R22FWJFW.0.tmp
2009-05-20 20:45 . 2009-05-20 20:45 16883056 ----a-w c:\program files\IE8-WindowsXP-x86-ENU.exe
2009-05-20 19:36 . 2009-05-20 19:36 -------- d-----w c:\program files\JavaRa
2009-05-20 19:36 . 2009-05-20 19:36 69512 ----a-w c:\program files\JavaRa.zip
2009-05-20 17:39 . 2009-05-20 17:39 -------- d-----w c:\program files\SUPERAntiSpyware
2009-05-20 17:39 . 2009-05-20 17:39 -------- d-----w c:\documents and settings\Shimri Yancey\Application Data\SUPERAntiSpyware.com
2009-05-20 17:39 . 2009-05-20 17:39 -------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-05-20 17:11 . 2009-05-21 03:03 -------- d-----w c:\program files\something3
2009-05-20 16:05 . 2009-05-20 16:05 -------- d-----w c:\documents and settings\Shimri Yancey\Application Data\True Sword
2009-05-20 16:01 . 2005-10-11 21:40 356352 ----a-w c:\windows\eSellerateEngine.dll
2009-05-20 16:01 . 2003-06-06 18:21 81920 ----a-w c:\windows\eSellerateControl350.dll
2009-05-20 16:01 . 2009-05-20 16:50 -------- d-----w c:\program files\True Sword 5
2009-05-20 16:01 . 2009-05-20 16:01 8667730 ----a-w c:\program files\TrueSword5.exe
2009-05-20 13:41 . 2009-05-21 05:09 -------- d--h--w C:\$AVG8.VAULT$
2009-05-20 13:36 . 2009-05-20 13:36 11952 ----a-w c:\windows\system32\avgrsstx.dll
2009-05-20 13:36 . 2009-05-20 13:36 108552 ----a-w c:\windows\system32\drivers\avgtdix.sys
2009-05-20 13:36 . 2009-05-20 13:36 325896 ----a-w c:\windows\system32\drivers\avgldx86.sys
2009-05-20 13:35 . 2009-05-21 01:11 -------- d-----w c:\windows\system32\drivers\Avg
2009-05-20 13:35 . 2009-05-20 13:43 -------- d-----w c:\documents and settings\Shimri Yancey\Application Data\AVGTOOLBAR
2009-05-14 14:47 . 2009-05-14 14:47 -------- d-sh--w c:\documents and settings\Shimri Yancey\IECompatCache
2009-05-08 16:15 . 2009-05-08 16:15 1887408 ----a-w c:\program files\GoogleToolbarInstaller_en_signed.exe
2009-05-03 17:02 . 2009-04-06 22:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-05-03 17:02 . 2009-04-06 22:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-03 17:02 . 2009-05-03 17:02 -------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-05-03 17:02 . 2009-05-20 17:06 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-05-03 17:01 . 2009-05-03 17:02 2967800 ----a-w c:\program files\mbam-setup.com
2009-05-03 02:35 . 2009-05-03 02:35 -------- d-sh--w c:\documents and settings\LocalService\IETldCache
2009-05-03 02:28 . 2009-05-03 02:28 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2009-05-03 00:59 . 2009-05-03 00:59 -------- d-sh--w c:\documents and settings\Administrator\PrivacIE
2009-05-03 00:56 . 2009-05-03 00:56 -------- d-sh--w c:\documents and settings\Shimri Yancey\PrivacIE
2009-05-03 00:55 . 2009-05-03 00:55 -------- d-sh--w c:\windows\system32\config\systemprofile\IETldCache
2009-05-03 00:55 . 2009-05-03 00:55 -------- d-sh--w c:\documents and settings\Shimri Yancey\IETldCache
2009-05-03 00:42 . 2009-05-20 20:47 -------- d-----w c:\windows\ie8updates
2009-05-03 00:38 . 2004-08-04 07:56 81920 ----a-w c:\windows\system32\ieencode.dll
2009-05-03 00:26 . 2009-02-28 04:55 105984 -c----w c:\windows\system32\dllcache\iecompat.dll

descriptionWin 32/cryptor - Page 2 EmptyRe: Win 32/cryptor

more_horiz
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-20 23:10 . 2002-09-13 19:53 -------- d-----w c:\program files\ICQ
2009-05-20 23:10 . 2008-11-26 02:00 -------- d-----w c:\program files\Free Offers from Freeze.com
2009-05-20 23:10 . 2009-01-23 15:10 -------- d-----w c:\program files\Advanced Registry Optimizer
2009-05-20 23:10 . 2005-03-08 00:26 -------- d-----w c:\program files\FinePixViewer
2009-05-15 13:45 . 2004-11-18 23:25 -------- d-----w c:\program files\Google
2009-05-07 00:09 . 2004-09-22 19:45 -------- d-----w c:\program files\Microsoft Digital Image 10
2009-05-03 00:05 . 2009-01-20 16:43 -------- d-----w c:\program files\Panda Security
2009-04-10 01:02 . 2009-04-10 01:02 35822080 ----a-w c:\program files\Freedom-1_8_1_9-setup-windows.exe
2009-03-22 18:13 . 2009-03-22 18:13 -------- d-----w c:\program files\WinPcap
2009-03-06 14:44 . 2002-09-13 18:59 283648 ----a-w c:\windows\system32\pdh.dll
2009-02-24 01:08 . 2003-03-22 18:40 257584 ----a-w c:\documents and settings\Shimri Yancey\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-02-21 21:00 . 2009-02-21 20:59 60939848 ----a-w c:\program files\avg_free_stf_en_8_237a1428.exe
2009-02-21 20:52 . 2009-02-21 20:52 140288 ----a-w c:\program files\vcleaner.exe
2009-01-23 15:10 . 2009-01-23 15:10 2803448 ----a-w c:\program files\AROTrial_bt.exe
2009-01-23 15:06 . 2009-01-23 15:06 3166208 ----a-w c:\program files\saSetup64.exe
2008-12-22 14:50 . 2008-12-22 14:50 34031720 ----a-w c:\program files\GoogleSketchUpWEN.exe
2008-10-08 00:45 . 2008-10-08 00:45 8155992 ----a-w c:\program files\sd8_smartpdf.exe
2008-09-15 02:41 . 2008-09-15 02:40 300272 ----a-w c:\program files\MySpaceIM_Setup.exe
2008-03-06 01:30 . 2008-03-06 01:30 8317952 ----a-w c:\program files\epson11220.exe
2008-02-04 16:12 . 2008-02-04 16:12 60536 ----a-w c:\program files\delicious.exe
2008-02-04 16:11 . 2008-02-04 16:11 397312 ----a-w c:\program files\delicious.msi
2008-01-20 20:51 . 2008-01-20 20:51 2400784 ----a-w c:\program files\WLinstaller.exe
2007-09-18 00:09 . 2007-09-18 00:06 353598016 ----a-w c:\program files\SimpleStartFSEDirect.exe
2007-04-11 03:10 . 2007-04-11 02:29 306240 ----a-w c:\program files\Install_AIM.exe
2007-03-26 20:41 . 2007-03-26 20:41 722992 ----a-w c:\program files\aolsetup.exe
2007-03-26 20:41 . 2007-03-26 20:41 4424 ----a-w c:\program files\aolsetup.bin
2007-02-14 20:13 . 2007-02-14 20:08 21822168 ----a-w c:\program files\AdbeRdr80_en_US.exe
2006-10-31 08:10 . 2006-10-31 08:10 671845 ----a-w c:\program files\data1.cab
2006-10-31 08:10 . 2006-10-31 08:10 552214 ----a-w c:\program files\ISSetup.dll
2006-10-31 08:10 . 2006-10-31 08:10 546 ----a-w c:\program files\setup.iss
2006-10-31 08:10 . 2006-10-31 08:10 491 ----a-w c:\program files\setup.ini
2006-10-31 08:10 . 2006-10-31 08:10 455 ----a-w c:\program files\layout.bin
2006-10-31 08:10 . 2006-10-31 08:10 385968 ----a-w c:\program files\_Setup.dll
2006-10-31 08:10 . 2006-10-31 08:10 364218 ----a-w c:\program files\data2.cab
2006-10-31 08:10 . 2006-10-31 08:10 205926 ----a-w c:\program files\setup.inx
2006-10-31 08:10 . 2006-10-31 08:10 17991 ----a-w c:\program files\data1.hdr
2006-06-27 05:39 . 2006-06-27 05:39 12527920 ----a-w c:\program files\IE7BETA2-WindowsXP-x86-enu.exe
2006-06-24 01:20 . 2006-06-24 01:19 3044468 ----a-w c:\program files\cpg272.exe
2005-11-28 03:06 . 2005-11-28 03:06 15666960 ----a-w c:\program files\avg71free_362a652.exe
2005-11-20 19:16 . 2005-11-20 19:16 78597807 ----a-w c:\program files\OOo_2.0.0_Win32Intel_install.exe
2005-11-09 04:16 . 2005-03-23 22:35 29232536 ----a-w c:\program files\pcs4.exe
2005-10-09 22:51 . 2005-05-20 22:53 1695 ----a-w c:\program files\TBass4.INI
2005-09-16 16:24 . 2004-09-25 03:07 2855080 ----a-w c:\program files\aawsepersonal.exe
2005-08-10 04:08 . 2005-05-23 23:43 0 ----a-w c:\program files\filenames.txt
2005-06-07 03:59 . 2005-06-07 03:59 7363784 ----a-w c:\program files\INSTALL_MSN_MESSENGER_DL.EXE
2005-05-21 16:29 . 2005-05-21 16:26 75029 ----a-w c:\program files\DeIsL1.isu
2005-05-08 00:46 . 2005-05-07 23:01 33388 ----a-w c:\program files\FxSobr.log
2005-05-07 22:53 . 2005-05-07 22:53 198784 ----a-w c:\program files\FxSobr.exe
2005-02-22 01:54 . 2005-02-22 01:54 3742383 ----a-w c:\program files\CoffeeFreeFTPInstaller.exe
2005-02-22 01:42 . 2005-02-22 01:42 3797175 ----a-w c:\program files\CoffeeFTP62.exe
2005-01-09 21:06 . 2005-01-09 21:05 6342279 ----a-w c:\program files\fcp45setup.exe
2004-02-20 07:44 . 2004-02-20 07:44 5545537 ----a-w c:\program files\win2k_xp140.exe
2004-01-18 21:04 . 2004-01-18 21:04 1881144 ----a-w c:\program files\GrouperSetup.exe
2004-01-02 17:41 . 2004-01-02 17:41 893712 ----a-w c:\program files\proxyconn.exe
2001-04-10 21:30 . 2004-10-10 20:17 1949 ----a-w c:\program files\Alien Skinformation.html
2001-04-02 23:31 . 2004-10-10 20:17 550602 ----a-w c:\program files\EyeCand3.8bf
2001-04-02 23:22 . 2004-10-10 20:17 409600 ----a-w c:\program files\EC3-ENG.8BF
2000-09-26 19:45 . 2000-09-26 19:45 7356 ----a-w c:\program files\readmePatch1004.txt
2000-08-23 16:02 . 2000-08-23 16:02 702 ----a-w c:\program files\Update1.tbv
1999-06-25 17:56 . 2004-10-10 20:17 127184 ----a-w c:\program files\UNWISE.EXE
2007-06-02 20:18 . 2006-06-28 16:53 61038 ----a-w c:\program files\mozilla firefox\components\jar50.dll
2007-06-02 20:18 . 2006-06-28 16:53 49256 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll
2007-06-02 20:18 . 2006-06-28 16:53 166000 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-05-21_01.56.30 )))))))))))))))))))))))))))))))))))))))))
.
+ 2002-09-13 18:59 . 2007-12-18 14:40 417792 c:\windows\system32\vbscript.dll
- 2002-09-13 18:59 . 2004-08-04 07:56 417792 c:\windows\system32\vbscript.dll
- 2003-01-13 21:57 . 2006-05-18 05:24 450560 c:\windows\system32\jscript.dll
+ 2003-01-13 21:57 . 2007-12-18 14:40 450560 c:\windows\system32\jscript.dll
+ 2003-01-13 21:57 . 2007-12-18 14:40 450560 c:\windows\system32\dllcache\jscript.dll
- 2003-01-13 21:57 . 2006-05-18 05:24 450560 c:\windows\system32\dllcache\jscript.dll
.

descriptionWin 32/cryptor - Page 2 EmptyRe: Win 32/cryptor

more_horiz
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-05-06 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2005-06-09 98304]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-05-20 1947928]
"Synchronization Manager"="c:\windows\system32\mobsync.exe" [2004-08-04 143360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2008-12-12 9555968]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 19:05 356352 ----a-w c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-05-20 13:36 11952 ----a-w c:\windows\system32\avgrsstx.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^$McRebootA5E6DEAA56$.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\$McRebootA5E6DEAA56$.lnk
backup=c:\windows\pss\$McRebootA5E6DEAA56$.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adware Filter.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adware Filter.lnk
backup=c:\windows\pss\Adware Filter.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AdwareFilter Background Protection.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\AdwareFilter Background Protection.lnk
backup=c:\windows\pss\AdwareFilter Background Protection.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^BigFix.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\BigFix.lnk
backup=c:\windows\pss\BigFix.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Creating Keepsakes Scrapbook Designer Event Reminder.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Creating Keepsakes Scrapbook Designer Event Reminder.lnk
backup=c:\windows\pss\Creating Keepsakes Scrapbook Designer Event Reminder.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Exif Launcher.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Exif Launcher.lnk
backup=c:\windows\pss\Exif Launcher.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Free WebSite Tools.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Free WebSite Tools.lnk
backup=c:\windows\pss\Free WebSite Tools.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk
backup=c:\windows\pss\Google Updater.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=c:\windows\pss\Kodak EasyShare software.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^KODAK Software Updater.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\KODAK Software Updater.lnk
backup=c:\windows\pss\KODAK Software Updater.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Works Calendar Reminders.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Works Calendar Reminders.lnk
backup=c:\windows\pss\Microsoft Works Calendar Reminders.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk
backup=c:\windows\pss\QuickBooks Update Agent.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Shimri Yancey^Start Menu^Programs^Startup^OpenOffice.org 1.9.79.lnk]
path=c:\documents and settings\Shimri Yancey\Start Menu\Programs\Startup\OpenOffice.org 1.9.79.lnk
backup=c:\windows\pss\OpenOffice.org 1.9.79.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Shimri Yancey^Start Menu^Programs^Startup^OpenOffice.org 2.0.lnk]
path=c:\documents and settings\Shimri Yancey\Start Menu\Programs\Startup\OpenOffice.org 2.0.lnk
backup=c:\windows\pss\OpenOffice.org 2.0.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Shimri Yancey^Start Menu^Programs^Startup^PowerReg Scheduler V3.exe]
path=c:\documents and settings\Shimri Yancey\Start Menu\Programs\Startup\PowerReg Scheduler V3.exe
backup=c:\windows\pss\PowerReg Scheduler V3.exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Shimri Yancey^Start Menu^Programs^Startup^Yahoo! Widgets.lnk]
path=c:\documents and settings\Shimri Yancey\Start Menu\Programs\Startup\Yahoo! Widgets.lnk
backup=c:\windows\pss\Yahoo! Widgets.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"WLSetupSvc"=3 (0x3)
"usnjsvc"=3 (0x3)
"mcupdmgr.exe"=3 (0x3)
"McTskshd.exe"=2 (0x2)
"McDetect.exe"=2 (0x2)
"McciCMService"=2 (0x2)
"IDriverT"=3 (0x3)
"gusvc"=2 (0x2)
"GoogleDesktopManager-061008-081103"=3 (0x3)
"Boonty Games"=3 (0x3)
"avg8wd"=2 (0x2)
"avg8emc"=2 (0x2)
"aspnet_state"=3 (0x3)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\wjview.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\CoffeeCup Software\\CoffeeCup Free FTP\\FreeFTP.exe"=
"c:\\Program Files\\IncrediMail\\bin\\IncMail.exe"=
"c:\\Program Files\\IncrediMail\\bin\\IMApp.exe"=
"c:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Virtual Mechanics\\SiteSpinner V2.7\\bin\\SiteSpinnerV2.exe"=
"c:\\Program Files\\Avanquest\\Web Easy Professional 7\\WebEasy.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1999:UDP"= 1999:UDP:Windows Media Format SDK (firefox.exe)
"1998:UDP"= 1998:UDP:Windows Media Format SDK (firefox.exe)

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [5/20/2009 6:36 AM 325896]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [5/20/2009 6:36 AM 108552]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [5/20/2009 6:35 AM 908568]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [5/20/2009 6:35 AM 298776]
R2 npf;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [11/15/2007 1:30 PM 34064]
S2 PPSCAN;PPSCAN;c:\windows\system32\drivers\ppscan.sys [3/19/2003 12:55 PM 91520]
.
Contents of the 'Scheduled Tasks' folder

2009-05-21 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 19:20]

2009-05-21 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-05-06 18:25]

2009-05-21 c:\windows\Tasks\SDMsgUpdate (TE).job
- c:\progra~1\SmartDraw 2009\Messages\SDNotify.exe [2008-10-07 14:29]

descriptionWin 32/cryptor - Page 2 EmptyRe: Win 32/cryptor

more_horiz
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.buttelife.com/
mStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr7/*http://www.yahoo.com/ext/search/search.html
uInternet Settings,ProxyOverride = *.r4.attbi.com;localhost
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {6AE4CC6E-999C-11D4-A3F0-009027427750} - hxxp://us.i1.yimg.com/us.yimg.com/i/msgr/yauto_remove.cab
FF - ProfilePath - c:\documents and settings\Shimri Yancey\Application Data\Mozilla\Firefox\Profiles\24ykkije.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.buttelife.com/

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.cookie.p3plevel", 1); // 0=low, 1=medium, 2=high, 3=custom
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.enablePad", false); // Allow client to do proxy autodiscovery
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.search.param.Google.1.default", "chrome://branding/content/searchconfig.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.search.param.Google.1.custom", "chrome://branding/content/searchconfig.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("signon.prefillForms", true);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-21 09:14
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(488)
c:\program files\SUPERAntiSpyware\SASWINLO.dll

- - - - - - - > 'explorer.exe'(1488)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\AVG\AVG8\avgrsx.exe
c:\program files\AVG\AVG8\avgcsrvx.exe
c:\windows\system32\wscntfy.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
.
**************************************************************************
.
Completion time: 2009-05-21 9:24 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-21 16:24
ComboFix2.txt 2009-05-21 13:39
ComboFix3.txt 2009-05-21 02:03

Pre-Run: 23,280,222,208 bytes free
Post-Run: 23,281,831,936 bytes free

316 --- E O F --- 2009-05-21 13:34

descriptionWin 32/cryptor - Page 2 EmptyRe: Win 32/cryptor

more_horiz
Okay, that should do it.

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /u

Win 32/cryptor - Page 2 CF_Cleanup

This will also reset your restore points.

How is the machine running now?

descriptionWin 32/cryptor - Page 2 EmptyRe: Win 32/cryptor

more_horiz
So far it has been wonderful....that is all I need to do?

descriptionWin 32/cryptor - Page 2 EmptyRe: Win 32/cryptor

more_horiz
Yep.

Below I have included a number of recommendations for how to protect your computer in order to prevent future malware infections. Please take these recommendations seriously; these few simple steps can stave off the vast majority of spyware problems. As happy as we are to help you, for your sake we would rather not have repeat customers. Goofy

1) Please navigate to http://windowsupdate.microsoft.com and download all the "critical updates" for Windows. This can patch many of the security holes through which attackers can gain access to your computer.

Please either enable Automatic Updates under Start -> Control Panel -> Automatic Updates , or get into the habit of checking for Windows updates regularly. I cannot stress enough how important this is.

2) In order to protect yourself against spyware, you should consider installing and running the following free programs:

Ad-Aware SE
A tutorial on using Ad-Aware to remove spyware from your computer may be found here.

Spybot-Search & Destroy
A tutorial on using Spybot to remove spyware from your computer may be found here. Please also remember to enable Spybot's "Immunize" and "TeaTimer" features.

SpywareBlaster
A tutorial on using SpywareBlaster to prevent spyware from ever installing on your computer may be found here.

SpywareGuard
A tutorial on using SpywareGuard for realtime protection against spyware and hijackers may be found here.

Make sure to keep these programs up-to-date and to run them regularly, as this can prevent a great deal of spyware hassle.

3) Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in popup blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from here:
http://www.mozilla.org/products/firefox/
I also recommand the following add-ons for Firefox, they will help keep you safe from malicious scripts or activeX exploits.
https://addons.mozilla.org/en-US/firefox/addon/722
https://addons.mozilla.org/en-US/firefox/addon/1865
https://addons.mozilla.org/en-US/firefox/addon/433

4) Also make sure to run your antivirus software regularly, and to keep it up-to-date.

To help you keep your software updated, please considering using this free software program that will check for program updates.
Update Checker

5) Finally, consider maintaining a firewall. Some good free firewalls are Kerio, or
Outpost
A tutorial on understanding and using firewalls may be found here.

Please also read Tony Klein's excellent article: How I got Infected in the First Place

If you would take a moment to fill out our feedback form, we would appreciate it.
The link can be found here.

Hopefully this should take care of your problems! Good luck. Big Grin

descriptionWin 32/cryptor - Page 2 EmptyRe: Win 32/cryptor

more_horiz
privacy_tip Permissions in this forum:
You cannot reply to topics in this forum