Infected by Win32/cryptor

2 posters

GeekPolice :: GeekPolice tech support archive :: Technical Support

Infected by Win32/cryptor5th April 2009, 6:13 pm

My laptop is infected with Win32/cryptor. Here is a copy of the Hijack log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:36:10 PM, on 4/5/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\dllhost.exe
C:\DOCUME~1\Owner\LOCALS~1\Temp\1402857984.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\Iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: C:\WINDOWS\system32\nhser43uhjnefr.dll - {C2BA40A2-74F3-42BD-F434-2604812C8954} - C:\WINDOWS\system32\nhser43uhjnefr.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [17176] C:\qavose.exe
O4 - HKLM\..\Run: [Eqicesu] rundll32.exe "C:\WINDOWS\okolokahubo.dll",e
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Diagnostic Manager] C:\DOCUME~1\Owner\LOCALS~1\Temp\1402857984.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo2.walgreens.com/WalgreensActivia.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1234822378296
O16 - DPF: {80B626D6-BC34-4BCF-B5A1-7149E4FD9CFA} (UnoCtrl Class) - http://zone.msn.com/bingame/zpagames/GAME_UNO1.cab60096.cab
O16 - DPF: {8C279F4E-917E-4CD2-8DF0-D9C73C0CE763} (ZPA_WheelOfFortune Object) - http://zone.msn.com/bingame/zpagames/zpa_wof.cab55579.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZPAFramework.cab56649.cab
O22 - SharedTaskScheduler: kjm6t5rinmhp8o87t7r6gh - {C2BA40A2-74F3-42BD-F434-2604812C8954} - C:\WINDOWS\system32\nhser43uhjnefr.dll
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Background Intelligent Transfer Service (BITS) - Unknown owner - C:\WINDOWS\
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ICF (icf) - Unknown owner - C:\WINDOWS\system32\svchost.exe:ext.exe (file missing)
O23 - Service: Automatic Updates (wuauserv) - Unknown owner - C:\WINDOWS\

--
End of file - 3854 bytes

I am able to access the internet most of the time, but it is very slow and none of the graphics/images are loading.

Thank you for your help.

Diana

Re: Infected by Win32/cryptor5th April 2009, 6:20 pm

Hello.

Open HijackThis
Choose "Do a system scan only"
Check the boxes in front of these lines:

R3 - Default URLSearchHook is missing
O2 - BHO: C:\WINDOWS\system32\nhser43uhjnefr.dll - {C2BA40A2-74F3-42BD-F434-2604812C8954} - C:\WINDOWS\system32\nhser43uhjnefr.dll
O4 - HKLM\..\Run: [17176] C:\qavose.exe
O4 - HKLM\..\Run: [Eqicesu] rundll32.exe "C:\WINDOWS\okolokahubo.dll",e
O4 - HKCU\..\Run: [Diagnostic Manager] C:\DOCUME~1\Owner\LOCALS~1\Temp\1402857984.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O22 - SharedTaskScheduler: kjm6t5rinmhp8o87t7r6gh - {C2BA40A2-74F3-42BD-F434-2604812C8954} - C:\WINDOWS\system32\nhser43uhjnefr.dll
Press "Fix Checked"
Close Hijack This.

I suggest you copy these instructions into a notepad file, because we need to use safe mode and you won't have internet access to read from here.

Download SDFix and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following :

Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, the Advanced Options Menu should appear;
Select the first option, to run Windows in Safe Mode, then press Enter.
Choose your usual account.

Open the extracted SDFix folder and double click RunThis.bat to start the script.
Type Y to begin the cleanup process.
It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
Press any Key and it will restart the PC.
When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
(Report.txt will also be copied to Clipboard ready for posting back on the forum).
Finally paste the contents of the Report.txt back on the forum with a new HijackThis log

Re: Infected by Win32/cryptor5th April 2009, 7:13 pm

Thank you for your response.

I was able to follow the instructions to:

Download SDFix and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

When I double-click the SDFix icon a box pop up stating the following:

Open File - Security Warning
The publisher could not be verified. Are you sure you want to run this software?
Name: SDFix.exe
Publisher: Unknown Publisher
Type: Application
From: C:/Documents and Settings\Owner\Desktop

It gives me an option to Run or Cancel. When I press Run the box closes and nothing else happens.

Please advise.

Re: Infected by Win32/cryptor5th April 2009, 7:15 pm

Avira probably doesn't like it.
SDFix works better in SAFE MODE.

Did you run it from safe mode?

Re: Infected by Win32/cryptor5th April 2009, 7:26 pm

I have tried it in safe mode and normal both times and I am getting the same error message both times.

Re: Infected by Win32/cryptor5th April 2009, 7:27 pm

Okay, did you do the Hijack This fix anyway?

Please download and run this tool.

Download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.

Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.

Post the contents of the MBAM Log.

Re: Infected by Win32/cryptor5th April 2009, 7:49 pm

Yes, I did the Hijack This fix anyway.

I have now downloaded the Malwarebytes' Anti-Malware, but when I double-click the icon nothing happens, when I right click it a menu open and I have clicked on Scan with Malwarebytes'Anti-Malware, but again nothing happens.

Re: Infected by Win32/cryptor5th April 2009, 7:52 pm

Hello.
Thanks for letting me know, I know what's causing the problem now.

1. Please download The Avenger by Swandog46 to your Desktop
Link: HERE or HERE.

Click on Avenger.zip to open the file
Extract avenger.exe to your desktop

2. Now, start The Avenger program by clicking on its icon on your desktop.

Leave the script box empty.
Leave the ticked box "Scan for rootkit" ticked.
Then tick "Disable any rootkits found"
Now click on the Execute to begin execution of the script.
Answer "Yes" twice when prompted.

The Avenger will automatically do the following:
It will Restart your computer.
On reboot, it will briefly open a black command window on your desktop, this is normal.
After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.

3. Please copy/paste the content of c:\avenger.txt into your reply.

Re: Infected by Win32/cryptor5th April 2009, 8:14 pm

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.

Hidden driver "uacd.sys" found!
ImagePath: \systemroot\system32\drivers\UACjwomdnmn.sys
Driver disabled successfully.

Rootkit scan completed.

Completed script processing.

*******************

Finished! Terminate.

Re: Infected by Win32/cryptor5th April 2009, 8:17 pm

Hello.
The rootkit is disabled, now we just have to delete it.
Once it's deleted, MBAM/SDFix will work. Smile...

2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Drivers to delete:
uacd.sys

Files to delete:
C:\WINDOWS\system32\drivers\UACjwomdnmn.sys

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, start The Avenger program by clicking on its icon on your desktop.

Under "Input script here:", paste in the script from the quote box above.
Leave the ticked box "Scan for rootkit" ticked.
Then tick "Disable any rootkits found"
Now click on the Execute to begin execution of the script.
Answer "Yes" twice when prompted.

The Avenger will automatically do the following:
It will Restart your computer.
On reboot, it will briefly open a black command window on your desktop, this is normal.
After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.

4. Please copy/paste the content of c:\avenger.txt into your reply.

Re: Infected by Win32/cryptor5th April 2009, 8:24 pm

Sorry, I don't have an icon for Avenger Sad tearing

. I did see it under My Computer and under the C: drive, but I don't know how to open it from there.

Re: Infected by Win32/cryptor5th April 2009, 8:39 pm

The report file you mean?

C:\avenger.txt?

It's just a text file, double click it to open it.

Re: Infected by Win32/cryptor5th April 2009, 8:42 pm

No, I could not even get that far. I am having problems with the first step:

"Now start The Avenger program by clicking on its icon on your desktop"

Re: Infected by Win32/cryptor5th April 2009, 8:48 pm

Hello.
Did you run avenger from your Desktop last time?

"Now start The Avenger program by clicking on its icon on your desktop"

This just means open the program like you did before.

Re: Infected by Win32/cryptor5th April 2009, 9:14 pm

here you go!

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

Driver "uacd.sys" deleted successfully.
File "C:\WINDOWS\system32\drivers\UACjwomdnmn.sys" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

Re: Infected by Win32/cryptor5th April 2009, 9:15 pm

Hello. Please boot back to safe mode now and try to run the SDFix installer again, it will work this time.

Re: Infected by Win32/cryptor12th April 2009, 1:34 pm

Sorry, it took me a whole week to come back to this, but here is the Hijack this log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:25:16 AM, on 4/12/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\frmwrk32.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\DOCUME~1\Owner\LOCALS~1\Temp\2758371036.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: C:\WINDOWS\system32\nhser43uhjnefr.dll - {C2BA40A2-74F3-42BD-F434-2604812C8954} - C:\WINDOWS\system32\nhser43uhjnefr.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [Eqicesu] rundll32.exe "C:\WINDOWS\okolokahubo.dll",e
O4 - HKLM\..\Run: [Framework Windows] frmwrk32.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Diagnostic Manager] C:\DOCUME~1\Owner\LOCALS~1\Temp\2758371036.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\docume~1\owner\locals~1\temp\ntdll64.dll
O10 - Unknown file in Winsock LSP: c:\docume~1\owner\locals~1\temp\ntdll64.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo2.walgreens.com/WalgreensActivia.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1234822378296
O16 - DPF: {80B626D6-BC34-4BCF-B5A1-7149E4FD9CFA} (UnoCtrl Class) - http://zone.msn.com/bingame/zpagames/GAME_UNO1.cab60096.cab
O16 - DPF: {8C279F4E-917E-4CD2-8DF0-D9C73C0CE763} (ZPA_WheelOfFortune Object) - http://zone.msn.com/bingame/zpagames/zpa_wof.cab55579.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZPAFramework.cab56649.cab
O22 - SharedTaskScheduler: kjm6t5rinmhp8o87t7r6gh - {C2BA40A2-74F3-42BD-F434-2604812C8954} - C:\WINDOWS\system32\nhser43uhjnefr.dll
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Background Intelligent Transfer Service (BITS) - Unknown owner - C:\WINDOWS\
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Automatic Updates (wuauserv) - Unknown owner - C:\WINDOWS\

--
End of file - 4104 bytes

and here is the SDF log:

b]SDFix: Version 1.240 [/b]
Run by Owner on Sat 04/11/2009 at 11:32 PM

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix

Checking Services :

Name :
ICF
restore

Path :
C:\WINDOWS\system32\svchost.exe:ext.exe
\??\C:\WINDOWS\system32\drivers\restore.sys

ICF - Deleted
restore - Deleted

Restoring Default Security Values
Restoring Default Hosts File

Rebooting

Service restore - Deleted after Reboot

Checking Files :

Trojan Files Found:

C:\-20112~1 - Deleted

Removing Temp Files

ADS Check :

Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-11 23:41:56
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

Remaining Services :

My images appeared to be working again on the internet, but I have a big blinking Warning Box on my desktop stating the following:

Dangerous spyware Following viruses were found on your computer: Trojan horse, PassCaputre and etc. Your private information might be transferred to third parties. Please check your computer using advanced software.

Also, the "Notepad" tab disappeared from the Accessories tab.

Thank you!

Re: Infected by Win32/cryptor12th April 2009, 2:54 pm

Hello.
Not saying this is your fault, but I need you to stay with me on this, you can't leave this an entire week, because the longer you leave it, the more malware gets downloaded.

Open HijackThis
Choose "Do a system scan only"
Check the boxes in front of these lines:

O2 - BHO: C:\WINDOWS\system32\nhser43uhjnefr.dll - {C2BA40A2-74F3-42BD-F434-2604812C8954} - C:\WINDOWS\system32\nhser43uhjnefr.dll
O4 - HKLM\..\Run: [Eqicesu] rundll32.exe "C:\WINDOWS\okolokahubo.dll",e
O4 - HKLM\..\Run: [Framework Windows] frmwrk32.exe
O4 - HKCU\..\Run: [Diagnostic Manager] C:\DOCUME~1\Owner\LOCALS~1\Temp\2758371036.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O22 - SharedTaskScheduler: kjm6t5rinmhp8o87t7r6gh - {C2BA40A2-74F3-42BD-F434-2604812C8954} - C:\WINDOWS\system32\nhser43uhjnefr.dll
Press "Fix Checked"
Close Hijack This.

Please download and run this tool.

Download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.

Re: Infected by Win32/cryptor13th April 2009, 1:53 am

Malwarebytes' Anti-Malware 1.36
Database version: 1945
Windows 5.1.2600 Service Pack 2

4/12/2009 1:58:52 PM
mbam-log-2009-04-12 (13-58-52).txt

Scan type: Quick Scan
Objects scanned: 156053
Time elapsed: 55 minute(s), 56 second(s)

Memory Processes Infected: 1
Memory Modules Infected: 2
Registry Keys Infected: 5
Registry Values Infected: 3
Registry Data Items Infected: 10
Folders Infected: 0
Files Infected: 21

Memory Processes Infected:
C:\WINDOWS\system32\frmwrk32.exe (Trojan.FakeAlert) -> Unloaded process successfully.

Memory Modules Infected:
C:\WINDOWS\indsa6.dll (Trojan.Hiloti) -> Delete on reboot.
C:\WINDOWS\system32\nhser43uhjnefr.dll (Trojan.FakeAlert) -> Delete on reboot.

Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{c2ba40a2-74f3-42bd-f434-2604812c8954} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c2ba40a2-74f3-42bd-f434-2604812c8954} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c2ba40a2-74f3-42bd-f434-2604812c8954} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\UAC (Rootkit.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\AGprotect (Malware.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{c2ba40a2-74f3-42bd-f434-2604812c8954} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\eqicesu (Trojan.Agent) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diagnostic manager (Trojan.Downloader) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: c:\windows\system32\userinit.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools (Hijack.Regedit) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions (Hijack.FolderOptions) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallpaper (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\activedesktop\NoChangingWallpaper (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\indsa6.dll (Trojan.Hiloti) -> Delete on reboot.
C:\WINDOWS\system32\nhser43uhjnefr.dll (Trojan.FakeAlert) -> Delete on reboot.
C:\WINDOWS\system32\UAChrfoulys.dll (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\UACxpmlyqod.dll (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\igkrrk.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\liymwuq.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Marsellus\Local Settings\Temp\UAC923.tmp (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\okolokahubo.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\uacinit.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ntdll64.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\warning.gif (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ahtn.htm (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\frmwrk32.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\ntdll64.dll (Trojan.FakeAlert) -> Delete on reboot.
C:\WINDOWS\system32\win32hlp.cnf (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\684784578.exe (Trojan.Downloader) -> Delete on reboot.
C:\WINDOWS\system32\UACaowpvaqj.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\UAChwinkxqv.dat (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\UAClrktsmxr.log (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\UACtkuxhxra.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\UACymhqfdxv.dll (Trojan.Agent) -> Quarantined and deleted successfully.

Re: Infected by Win32/cryptor13th April 2009, 12:51 pm

Please download DDS by sUBs to your Desktop (Important!!) from one of these locations:
Link 1
Link 2
Double click DDS.scr to run
When complete, DDS.txt will open.
Save the report to your Desktop.
Copy and paste DDS.txt back here, I don't need to see attach.txt.

Re: Infected by Win32/cryptor14th April 2009, 12:14 am

DDS (Ver_09-03-16.01) - NTFSx86
Run by Owner at 19:12:18.54 on Mon 04/13/2009
Internet Explorer: 6.0.2900.2180
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.502.252 [GMT -5:00]

AV: AntiVir Desktop *On-access scanning enabled* (Updated)

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\SFQVEIS8\dds[1].scr

============== Pseudo HJT Report ===============

uSearch Bar = hxxp://www.google.com/ie
uSearch Page = hxxp://www.google.com
uStart Page = hxxp://www.comcast.net/
mDefault_Search_URL = hxxp://www.google.com/ie
uInternet Connection Wizard,ShellNext = iexplore
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
TB: &Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll
TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File
uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} - hxxp://photo2.walgreens.com/WalgreensActivia.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1234822378296
DPF: {80B626D6-BC34-4BCF-B5A1-7149E4FD9CFA} - hxxp://zone.msn.com/bingame/zpagames/GAME_UNO1.cab60096.cab
DPF: {8C279F4E-917E-4CD2-8DF0-D9C73C0CE763} - hxxp://zone.msn.com/bingame/zpagames/zpa_wof.cab55579.cab
DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - hxxp://cdn2.zone.msn.com/binFramework/v10/ZPAFramework.cab56649.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Notify: igfxcui - igfxdev.dll
LSA: Notification Packages = scecli indsa6.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\owner\applic~1\mozilla\firefox\profiles\ehnhyhr4.default\
FF - plugin: c:\program files\unity\webplayer\loader\npUnity3D32.dll
FF - HiddenExtension: XUL Cache: {F71B281D-B4CF-4B81-B195-7534E13DA217} - c:\documents and settings\owner\local settings\application data\{F71B281D-B4CF-4B81-B195-7534E13DA217}

============= SERVICES / DRIVERS ===============

R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2009-4-5 11608]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2009-4-5 108289]
R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2009-4-5 185089]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-4-5 55640]
R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]
S1 46c73941;46c73941;c:\windows\system32\drivers\46c73941.sys --> c:\windows\system32\drivers\46c73941.sys [?]
S3 botdrv;botdrv;\??\c:\windows\system32\driver.sys --> c:\windows\system32\driver.sys [?]

=============== Created Last 30 ================

2009-04-11 23:25 --d----- c:\windows\ERUNT
2009-04-11 23:19 --d----- C:\SDFix
2009-04-10 13:33 1 a------- c:\windows\system32\uniq.tll
2009-04-10 13:33 23,040 a------- c:\documents and settings\owner\S87ekhV.exe
2009-04-05 16:59 259 a------- C:\avexport.bat
2009-04-05 16:43 --d----- c:\docume~1\owner\applic~1\Malwarebytes
2009-04-05 16:22 362 a------- C:\Shortcut to Avenger.lnk
2009-04-05 15:39 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-04-05 15:39 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-05 15:39 --d----- c:\program files\Malwarebytes' Anti-Malware
2009-04-05 15:39 --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-04-05 13:36 --d----- c:\program files\Trend Micro
2009-04-05 09:28 55,640 a------- c:\windows\system32\drivers\avgntflt.sys
2009-04-05 09:27 --d----- c:\program files\Avira
2009-04-05 09:27 --d----- c:\docume~1\alluse~1\applic~1\Avira
2009-04-04 21:52 --d----- c:\program files\AVG
2009-04-04 06:40 16 a------- c:\windows\Dnubuwocucafu.bin
2009-04-04 06:40 1,420 a------- c:\windows\Bjapaguheye.dat
2009-03-30 18:17 --d-h--- C:\$AVG8.VAULT$
2009-03-29 13:12 --d----- c:\docume~1\alluse~1\applic~1\avg8
2009-03-21 13:36 --d----- c:\docume~1\owner\applic~1\Unity
2009-03-21 13:10 --d----- c:\program files\Unity
2009-03-20 22:24 --d----- c:\program files\Club Penguin Money Maker
2009-03-19 09:13 499,712 a------- c:\windows\system32\msvcp71.dll
2009-03-19 09:13 348,160 a------- c:\windows\system32\msvcr71.dll
2009-03-19 09:13 --d----- c:\windows\system32\Adobe
2009-03-16 14:54 69 a------- c:\windows\NeroDigital.ini
2009-03-15 16:09 --d----- c:\program files\CASIO
2009-03-15 16:09 413,696 a------- c:\windows\system32\PICSDK.dll
2009-03-15 16:09 114,688 a------- c:\windows\system32\EpPicPrt.dll
2009-03-15 16:09 91,923 a------- c:\windows\system32\EPPICPrinterDB.dat
2009-03-15 16:09 76,956 a------- c:\windows\system32\EPPICPattern2.dat
2009-03-15 16:09 65,536 a------- c:\windows\system32\EPPicMgr.dll
2009-03-15 16:09 39,121 a------- c:\windows\system32\EPPICPattern1.dat
2009-03-15 16:09 27,965 a------- c:\windows\system32\EPPICPresetData_JP.dat
2009-03-15 16:09 15,822 a------- c:\windows\system32\EPPICLocal_JP.cfg
2009-03-15 16:09 14,482 a------- c:\windows\system32\EPPICLocal_EN.cfg
2009-03-15 16:08 --d----- c:\program files\HOTALBUMMyBOX

==================== Find3M ====================

2009-04-10 13:33 235,008 a------- c:\windows\system32\userinit.exe
2009-03-29 17:31 182,912 a------- c:\windows\system32\drivers\ndis.sys
2009-03-29 17:31 14,336 a------- c:\windows\system32\svchost.exe
2009-02-23 16:36 87,747 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat
2009-02-16 14:20 21,640 a------- c:\windows\system32\emptyregdb.dat

============= FINISH: 19:12:43.18 ===============

Re: Infected by Win32/cryptor14th April 2009, 12:24 am

Hello.
Bad news here. You've left this malware more than a week without fighting and now it's downloaded another infection, and we can't fix it, the malware has downloaded Virut.

It's a file infector, infects all your legit files (.exe and .scr)

See here for more information:
http://miekiemoes.blogspot.com/2009/02/virut-and-other-file-infectors-throwing.html

Your computer has multiple infections, including a backdoor. A backdoor gives intruders complete control of your computer, logs your keystrokes, steal personal information, etc.

You are strongly advised to do the following:

Disconnect the computer from the Internet and from any networked computers until it is cleaned.
Back up all your important data except programs. The programs can be reinstalled back from the original disc or from the Net.
Call all your banks, financial institutions, credit card companies and inform them that you may be a victim of identity theft and put a watch on your accounts. If you don't mind the hassle, change all your account numbers.
From a clean computer, change all your passwords (ISP login password, your email address(es) passwords, financial accounts, PayPal, eBay, Amazon, online groups and forums and any other online activities you carry out which require a username and password).

Do NOT change your passwords from this computer as the attacker will be able to get all the new passwords and transaction records.

Due to its backdoor functionality, your computer is very likely to have been compromised and there is no way that it can be trusted again. Many experts in the security community believe that once infected with this type of Trojan, the best course of action would be to do a reformat and reinstallation of the operating system (OS).

To help you understand more, please take some time to read the following articles:

What are Remote Access Trojans and why are they dangerous
How do I respond to a possible identity theft and how do I prevent it
When should I do a reformat and reinstallation of my OS
Where to backup your files
How to backup your files in Windows XP
Restoring your backups

Re: Infected by Win32/cryptor14th April 2009, 12:34 am

How would I go about reformating and reinstallation of the operating system (OS)?

I really don't have anything on this computer right now (pictures or files) and I never used any online banking tool or anthing like that.

The only thing I could think of would be my e-mail, but I am accessing this also thru the web, so nothing downloaded to the computer.

Re: Infected by Win32/cryptor14th April 2009, 12:37 am

You might not have downloaded anything, but what was left of the malware before you disappeared for a week was still active and now has caused serious damage that can't be fixed.

You'll need a XP disc to format.

Re: Infected by Win32/cryptor14th April 2009, 12:40 am

I don't think that I have the XP disc to format.

What would it take for you to attemt to clean it?

Re: Infected by Win32/cryptor14th April 2009, 12:44 am

Can't clean it. The malware has infected your Windows files. So even if we do clean it of the bad files, the good (now infected) files regenerate it, or we clean the good files too and trash the machine.

Either way, we can't win. Sad tearing

You need to buy an XP disc then.

Re: Infected by Win32/cryptor14th April 2009, 12:49 am

Okay, thank you very much for your help and the information.

Infected by Win32/cryptor

descriptionInfected by Win32/cryptor5th April 2009, 6:13 pm

descriptionRe: Infected by Win32/cryptor5th April 2009, 6:20 pm

descriptionRe: Infected by Win32/cryptor5th April 2009, 7:13 pm

descriptionRe: Infected by Win32/cryptor5th April 2009, 7:15 pm

descriptionRe: Infected by Win32/cryptor5th April 2009, 7:26 pm

descriptionRe: Infected by Win32/cryptor5th April 2009, 7:27 pm

descriptionRe: Infected by Win32/cryptor5th April 2009, 7:49 pm

descriptionRe: Infected by Win32/cryptor5th April 2009, 7:52 pm

descriptionRe: Infected by Win32/cryptor5th April 2009, 8:14 pm

descriptionRe: Infected by Win32/cryptor5th April 2009, 8:17 pm

descriptionRe: Infected by Win32/cryptor5th April 2009, 8:24 pm

descriptionRe: Infected by Win32/cryptor5th April 2009, 8:39 pm

descriptionRe: Infected by Win32/cryptor5th April 2009, 8:42 pm

descriptionRe: Infected by Win32/cryptor5th April 2009, 8:48 pm

descriptionRe: Infected by Win32/cryptor5th April 2009, 9:14 pm

descriptionRe: Infected by Win32/cryptor5th April 2009, 9:15 pm

descriptionRe: Infected by Win32/cryptor12th April 2009, 1:34 pm

descriptionRe: Infected by Win32/cryptor12th April 2009, 2:54 pm

descriptionRe: Infected by Win32/cryptor13th April 2009, 1:53 am

descriptionRe: Infected by Win32/cryptor13th April 2009, 12:51 pm

descriptionRe: Infected by Win32/cryptor14th April 2009, 12:14 am

descriptionRe: Infected by Win32/cryptor14th April 2009, 12:24 am

descriptionRe: Infected by Win32/cryptor14th April 2009, 12:34 am

descriptionRe: Infected by Win32/cryptor14th April 2009, 12:37 am

descriptionRe: Infected by Win32/cryptor14th April 2009, 12:40 am

descriptionRe: Infected by Win32/cryptor14th April 2009, 12:44 am

descriptionRe: Infected by Win32/cryptor14th April 2009, 12:49 am

descriptionRe: Infected by Win32/cryptor