Win32/cryptor Possible explorer.exe issue [RESOLVED]

Hello

Disable resident protections (Antivirus...); you'll re-enable them after the scan

Download Lop S&D < here

Double-click Lop S&D.exe
Choose the language, then choose Option 1 (Search)
Wait till the end of the scan
Post the log which is created: (%SystemDrive%\lopR.txt)

Below I have pasted the results of the scan you suggested. I could not figure out how to turn off AVG. It did not seem to interfere with the scan, but I really know nothing about these things. I also am going to list the results of the virus scan and the infections that were removed just before my missing desktop problem started.


6 infections found
6 infected objects removed or healed
5 spyware found
5 spyware removed
306 warnings


Infections were
C:\WINDOWS\system32\A9ins_880808.exe Trojan horse FakeAlert.CJ
The next 4 were located in

C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\3RWQUADT\ag[1].exe Trojan horse SHeur2.CXM

C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\40V5WRXX\ag[1].exe Trojan horse SHeur2.CXM

C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\40V5WRXX\load2[1].exe
TrojanhorsePSW.Generic6.AQNP

C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\CNQZXSFZ\b[1].exe
Trojanhorse Downloader.Generic3.VSL



Just as I was posting this an alert and vault message appeared for the following virus

C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\SAQWC4UT\av_2009[1].exe

Trojan horse Agent.AMHL

I am just about to remove it.



Now spyware was also detected
3 that were this

C:\WINDOWS\BBSTORE\DSS\DSSAGENT.EXE

1 like this - that had an orange exclamation point beside it
also said that reboot was required to finish this action for it (removal i assume)
C:\WINDOWS\BBSTORE\DSS\DSSAGENT.EXE(1332)

And finally, this, which i believe might be relevant to my issue

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\DSS

Infect note says :
Found registry key with reference to infected file C:\WINDOWS\BBSTORE\DSS\DSSAGENT.EXE


Now below is the result of the scan


--------------------\\ Lop S&D 4.2.4-9c XP/Vista

Microsoft Windows XP Home Edition ( v5.1.2600 ) Service Pack 2
X86-based PC ( Uniprocessor Free : Intel® Celeron® M processor 1400MHz )
BIOS : Phoenix NoteBIOS 4.0 Release 6.0
USER : Kim ( Administrator )
BOOT : Normal boot
Antivirus : AVG Anti-Virus Free 8.0 (Activated)
C:\ (Local Disk) - NTFS - Total:37 Go (Free:23 Go)
D:\ (CD or DVD)

"C:\Lop SD" ( MAJ : 01-11-2008|16:30 )
Option : [1] ( Sat 11/22/2008|10:25 )

--------------------\\ Listing folders in APPLIC~1

[09/16/2006|06:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Adobe
[10/21/2007|03:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Apple
[10/26/2006|10:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Apple Computer
[11/21/2008|06:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> avg8
[01/03/2007|01:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> BVRP Software
[09/21/2007|08:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> CanonBJ
[01/09/2008|02:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Google
[11/21/2008|07:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Google Updater
[03/15/2008|12:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Microsoft
[07/29/2008|10:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> MSScanAppDataDir
[04/06/2008|11:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> PopCap
[09/16/2006|06:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> QuickTime
[08/20/2007|12:39] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> River Past G5
[09/30/2008|04:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Symantec
[12/12/2006|09:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> TEMP
[02/09/2008|11:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Windows Genuine Advantage

[09/16/2006|09:30] C:\DOCUME~1\DEFAUL~1\APPLIC~1\<DIR> Microsoft

[07/12/2008|04:43] C:\DOCUME~1\Kim\APPLIC~1\<DIR> Adobe
[07/31/2008|01:48] C:\DOCUME~1\Kim\APPLIC~1\<DIR> AdobeUM
[02/26/2008|08:57] C:\DOCUME~1\Kim\APPLIC~1\<DIR> Apple Computer
[11/21/2008|06:53] C:\DOCUME~1\Kim\APPLIC~1\<DIR> AVGTOOLBAR
[02/16/2008|08:41] C:\DOCUME~1\Kim\APPLIC~1\<DIR> Canon
[11/27/2007|08:39] C:\DOCUME~1\Kim\APPLIC~1\<DIR> ClassRoom GradeBook
[10/27/2008|04:29] C:\DOCUME~1\Kim\APPLIC~1\<DIR> Google
[01/17/2007|11:56] C:\DOCUME~1\Kim\APPLIC~1\<DIR> Help
[09/16/2006|05:08] C:\DOCUME~1\Kim\APPLIC~1\<DIR> Identities
[11/04/2006|04:46] C:\DOCUME~1\Kim\APPLIC~1\<DIR> InterVideo
[09/21/2006|12:25] C:\DOCUME~1\Kim\APPLIC~1\<DIR> Macromedia
[07/03/2008|04:44] C:\DOCUME~1\Kim\APPLIC~1\<DIR> Microsoft
[02/20/2008|09:32] C:\DOCUME~1\Kim\APPLIC~1\<DIR> Real
[08/20/2007|12:34] C:\DOCUME~1\Kim\APPLIC~1\<DIR> River Past G5
[06/30/2008|07:57] C:\DOCUME~1\Kim\APPLIC~1\<DIR> Snapfish
[07/26/2007|03:58] C:\DOCUME~1\Kim\APPLIC~1\<DIR> Sonic
[09/16/2006|07:01] C:\DOCUME~1\Kim\APPLIC~1\<DIR> Sun
[09/16/2006|06:55] C:\DOCUME~1\Kim\APPLIC~1\<DIR> Symantec

[11/21/2008|06:32] C:\DOCUME~1\LOCALS~1\APPLIC~1\<DIR> Microsoft
[11/18/2008|04:48] C:\DOCUME~1\LOCALS~1\APPLIC~1\<DIR> twain_32

[12/03/2007|08:09] C:\DOCUME~1\NETWOR~1\APPLIC~1\<DIR> Microsoft
[11/18/2008|04:48] C:\DOCUME~1\NETWOR~1\APPLIC~1\<DIR> twain_32

--------------------\\ Scheduled Tasks located in C:\WINDOWS\Tasks

[09/16/2008 08:37 PM][--a------] C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[11/21/2008 11:49 PM][--ah-----] C:\WINDOWS\tasks\SA.DAT
[08/04/2004 07:00 AM][-r-h-----] C:\WINDOWS\tasks\desktop.ini
[08/20/2007 12:40 AM][--a------] C:\WINDOWS\tasks\Symantec NetDetect.job

--------------------\\ Listing Folders in C:\Program Files

[01/03/2007|01:16] C:\Program Files\<DIR> ABBYY FineReader 5.0 Sprint
[01/03/2007|01:15] C:\Program Files\<DIR> ABBYY FineReader 6.0
[09/16/2006|06:57] C:\Program Files\<DIR> Adobe
[11/18/2008|05:36] C:\Program Files\<DIR> Antivirus 2009
[10/02/2008|03:05] C:\Program Files\<DIR> AO Reminder
[04/26/2008|12:06] C:\Program Files\<DIR> Apple Software Update
[04/26/2007|11:21] C:\Program Files\<DIR> Applied Vision
[08/20/2007|12:15] C:\Program Files\<DIR> Audacity
[11/21/2008|06:33] C:\Program Files\<DIR> AVG
[09/21/2007|08:49] C:\Program Files\<DIR> Canon
[09/21/2007|08:48] C:\Program Files\<DIR> CanonBJ
[11/27/2007|08:38] C:\Program Files\<DIR> ClassRoom GradeBook
[09/30/2008|04:12] C:\Program Files\<DIR> Common Files
[09/16/2006|05:48] C:\Program Files\<DIR> ComPlus Applications
[09/16/2006|06:25] C:\Program Files\<DIR> CONEXANT
[01/03/2007|01:15] C:\Program Files\<DIR> FaxTools
[10/27/2008|04:28] C:\Program Files\<DIR> Google
[09/16/2006|06:02] C:\Program Files\<DIR> Hewlett-Packard
[09/16/2006|07:00] C:\Program Files\<DIR> HPQ
[01/03/2007|01:15] C:\Program Files\<DIR> InstallShield Installation Information
[09/16/2006|07:03] C:\Program Files\<DIR> Intel
[11/04/2008|07:52] C:\Program Files\<DIR> InterActual
[10/16/2008|03:41] C:\Program Files\<DIR> Internet Explorer
[09/16/2006|06:28] C:\Program Files\<DIR> InterVideo
[04/26/2008|12:17] C:\Program Files\<DIR> iPod
[04/26/2008|12:18] C:\Program Files\<DIR> iTunes
[01/09/2008|02:21] C:\Program Files\<DIR> Java
[09/11/2007|05:02] C:\Program Files\<DIR> Lexmark X1100 Series
[09/16/2006|09:00] C:\Program Files\<DIR> Microsoft ActiveSync
[11/21/2008|06:56] C:\Program Files\<DIR> Microsoft Common
[09/16/2006|09:30] C:\Program Files\<DIR> microsoft frontpage
[09/16/2006|08:59] C:\Program Files\<DIR> Microsoft Office
[09/16/2006|08:58] C:\Program Files\<DIR> Microsoft.NET
[09/16/2006|09:28] C:\Program Files\<DIR> Movie Maker
[12/13/2006|12:36] C:\Program Files\<DIR> MSN Games
[09/16/2006|09:30] C:\Program Files\<DIR> msn gaming zone
[04/26/2007|10:47] C:\Program Files\<DIR> MSXML 4.0
[11/25/2007|10:29] C:\Program Files\<DIR> Netflix
[09/16/2006|09:28] C:\Program Files\<DIR> NetMeeting
[09/16/2006|09:28] C:\Program Files\<DIR> Online Services
[06/13/2007|05:31] C:\Program Files\<DIR> Outlook Express
[11/21/2008|11:56] C:\Program Files\<DIR> Panda Security
[11/22/2008|09:11] C:\Program Files\<DIR> PC Doc Pro
[08/25/2008|08:11] C:\Program Files\<DIR> Power Soft
[12/11/2006|09:16] C:\Program Files\<DIR> Quicken
[04/26/2008|12:15] C:\Program Files\<DIR> QuickTime
[07/13/2007|10:59] C:\Program Files\<DIR> Real
[09/16/2006|07:00] C:\Program Files\<DIR> RecordNow!
[08/20/2007|01:57] C:\Program Files\<DIR> Shuangs WAV to MP3 Converter
[09/16/2006|07:00] C:\Program Files\<DIR> Sonic
[04/26/2007|11:23] C:\Program Files\<DIR> STMicroelectronics
[09/30/2008|04:14] C:\Program Files\<DIR> Symantec
[09/16/2006|06:26] C:\Program Files\<DIR> Synaptics
[05/10/2007|12:49] C:\Program Files\<DIR> TeacherWorks
[04/21/2007|01:04] C:\Program Files\<DIR> The Learning Company
[09/01/2008|02:14] C:\Program Files\<DIR> Traysoft
[11/22/2008|12:58] C:\Program Files\<DIR> Trend Micro
[09/16/2006|05:08] C:\Program Files\<DIR> Uninstall Information
[11/22/2008|09:26] C:\Program Files\<DIR> Windows Live Safety Center
[02/09/2008|11:28] C:\Program Files\<DIR> Windows Media Connect 2
[02/09/2008|11:28] C:\Program Files\<DIR> Windows Media Player
[05/08/2007|07:44] C:\Program Files\<DIR> windows nt
[09/16/2006|09:29] C:\Program Files\<DIR> WindowsUpdate
[09/16/2006|09:30] C:\Program Files\<DIR> xerox

--------------------\\ Listing Folders in C:\Program Files\Common Files

[09/17/2006|07:32] C:\Program Files\Common Files\<DIR> Adobe
[10/21/2007|03:35] C:\Program Files\Common Files\<DIR> Apple
[09/16/2006|09:00] C:\Program Files\Common Files\<DIR> DESIGNER
[09/16/2006|06:54] C:\Program Files\Common Files\<DIR> InstallShield
[09/16/2006|06:59] C:\Program Files\Common Files\<DIR> Intuit
[09/16/2006|07:01] C:\Program Files\Common Files\<DIR> Java
[11/21/2008|06:33] C:\Program Files\Common Files\<DIR> Microsoft Shared
[09/16/2006|09:28] C:\Program Files\Common Files\<DIR> MSSoap
[09/16/2006|09:21] C:\Program Files\Common Files\<DIR> ODBC
[09/16/2006|06:59] C:\Program Files\Common Files\<DIR> Palo Alto Software
[07/13/2007|11:00] C:\Program Files\Common Files\<DIR> Real
[09/16/2006|09:28] C:\Program Files\Common Files\<DIR> Services
[09/16/2006|07:00] C:\Program Files\Common Files\<DIR> Sonic
[09/16/2006|09:21] C:\Program Files\Common Files\<DIR> SpeechEngines
[09/16/2006|07:00] C:\Program Files\Common Files\<DIR> SureThing Shared
[09/30/2008|04:14] C:\Program Files\Common Files\<DIR> Symantec Shared
[06/13/2007|05:31] C:\Program Files\Common Files\<DIR> System
[07/13/2007|11:00] C:\Program Files\Common Files\<DIR> xing shared

--------------------\\ Process

( 32 Processes )

IEXPLORE.EXE ~ [PID:1392]
IEXPLORE.EXE ~ [PID:4080]

--------------------\\ Searching with S_Lop

No Lop folder found !

--------------------\\ Searching for Lop Files - Folders

C:\DOCUME~1\Kim\Cookies\kim@advertising[2].txt
C:\DOCUME~1\Kim\Cookies\[email protected][1].txt

--------------------\\ Searching within the Registry

..... OK !

--------------------\\ Checking the Hosts file

Hosts file CLEAN


--------------------\\ Searching for hidden files with Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-22 10:26:49
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 0

--------------------\\ Searching for other infections

--------------------\\ ROGUES ..

C:\PROGRA~1\Antivirus 2009



[F:11880][D:47]-> C:\DOCUME~1\Kim\LOCALS~1\Temp
[F:246][D:0]-> C:\DOCUME~1\Kim\Cookies
[F:15398][D:165]-> C:\DOCUME~1\Kim\LOCALS~1\TEMPOR~1\content.IE5

1 - "C:\Lop SD\LopR_1.txt" - Sat 11/22/2008|10:38 - Option : [1]

--------------------\\ Scan completed at 10:38:57




NOTE: After the above Lop scan, I used the online windows live one care tool and 5 things were detected

The 3 that it listed specifically are

Trojan:Win/32/AgentBypass.gen!
Trojan:Win32/Vundo.gen!V
TrojanSpy:Win32/zbot.gen!C

I then ran another scan with AVG with no results. I guess AVG doesnt pick these up? or possibly the Windows Live one care could have been mistaken?

Edited by sandrak, 22 November 2008 - 11:46 AM.

Hello

Please download the OTMoveIt3 by OldTimer or from here.

• Save it to your desktop.
• Please double-click OTMoveIt3.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
• Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  

  :Processes
  explorer.exe
  
  :Services
  
  :Reg
  
  :Files
  C:\PROGRA~1\Antivirus 2009
  C:\WINDOWS\system32\A9ins_880808.exe
  
  :Commands
  [purity]
  [emptytemp]
  [start explorer]
  [Reboot]

• Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
  
• Click the red Moveit! button.
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
• Close OTMoveIt3

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

• Download random's system information tool (RSIT) by random/random from here and save it to your desktop.
• Double click on RSIT.exe to run RSIT.
• Click Continue at the disclaimer screen.
• Once it has finished, two logs will open. Please post the contents of both log.txt (<<will be maximized) and info.txt (<<will be minimized)

I just wanted to thank you for your help. After a while, I ran sfc/scannow and i guess the exlorer.exe was replaced. I was able to run explorer and my desktop appeared. The errors that said windows had to shut down continued, so i decided to save all my files and then restore the whole system.

I am grateful for your help.

Thanks!

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.