Relentless Win32:AuCrypt [Cryp]

[Quackamolian]

I know its from the [Cryp] side and all, but this thing is becoming a major pain. I've tried every action in avast on it and its still here + now its spread to my external HD. Does anybody have any advice for getting rid of it? So far what I've found is that it places a file (C:\i8.com) and then locks me out of directly accessing my C:\ drive (though I can access it by going to, for example, C:\program files\world of warcraft\ and then pressing the 'up one level' button.

Any help would be greatly appreciated.

(Ps: I know its not really from the [Cryp] side, lulz  )

[psw]

There is a kind of solution preventing autorunf.inf spreading but in your case the main problem is that this solution is for healthy PC only. It's prevents autorun and restore some Explorer registry keys.
This registry modification doesn't cure any active malware, probably avmo in your case.

Code: [Select]

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer]
"NoDriveTypeAutoRun"=dword:000000ff
"NoDriveAutoRun"=dword:000000ff
"NoFolderOptions"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
"CheckedValue"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf]
@="@SYS:DoesNotExist"

Trick with @SYS:DoesNotExist was taken from http://nick.brown.free.fr/blog/2007/10/memory-stick-worms.html

[polonus]

Hi Quackamolian

Please download FindAWF to your Desktop from: http://noahdfear.geekstogo.com/FindAWF.exe
Double-click FindAWF.exe to start the tool.
Select "option #1 - Scan for bak folders" by typing 1 and press Enter
When the tool has completed, a report will open up in notepad. Please post the results of the awf.txt as an attachment.
Please post the result of this scan before proceeding.

Download CureIt from here: ftp://ftp.drweb.com/pub/drweb/cureit/cureit.exe
and do a full scan.

[Lisandro]

Maybe, after the suggestion of Polonus, you could try the general cleaning procedure:

1. Disable System Restore and reenable it after step 3.
2. Clean your temporary files.
3. Schedule a boot time scanning with avast with archive scanning turned on.
4. Use SUPERantispyware and/or Spyware Terminator to scan for spywares and trojans. If any infection is detected, better and safer is send the file to Quarantine than to simple delete than.
5. Test your machine with anti-rootkit applications. I suggest Trend Micro RootkitBuster.
6. Make a HijackThis log to post here or, better, submit the RunScanner log to to on-line analysis.
7. Immunize your system with SpywareBlaster or Windows Advanced Care.
8. Check if you have insecure applications with Secunia Software Inspector.

[edek004]

Same problem.
Log from FindAWF is empty.

Fast scan in Dr.Web found nothing

[polonus]

Howdy edek004,

If you have amvo.exe on your comp, consider this:
http://www.prevx.com/filenames/1360796256778365074-X1/AMVO.EXE.html

polonus

[edek004]

Wait for while. Dr.Web working on full scan and found lots of infected files.
10 % left

P.S. Pozdro rodaku ?!

[polonus]

Witam, witam.
Proszę zamelduj co DrWeb znalazł,

polonus

[Ania007]

Wait for while. Dr.Web working on full scan and found lots of infected files.
10 % left

P.S. Pozdro rodaku ?!

Hello edek004,

We've have the same problem. If you find the solution, please let us know.

P.S. Ciesze sie ze nie tylko ja mam problem z AuCrypt. W internecie prawie nie ma informacji. Nowe swinstwo, dzis je zlapalam.
Prosze, prosze. Kółko polonijne się tu na forum zebrało....

[edek004]

Dr.Web rulez! Log in attachment. Same problem was on all partitions.

Program sobie poradził tylko muszę jeszcze rozwiązać problem z wejściem do dysków. Mam ten sam kłopot z terzema kompami w domowej sieci 

[polonus]

Hi edek004,

Well I continue in English as we are an English speaking forum here. DrWeb has three scan modules: Quick Scan, Full Scan and then comes the Third Scan Mode (I do not know how that is called in the Polish version of DrWeb's CureIt), choose that one and then do the specific disk scans. In the mean time we will have a look at the log and set out a strategy to tackle this malware. Nie martw się, wszystko będzie dobrze!

Damian

[michals]

Hello guys.

I'm writing just to tell that I have the same problem (probably caught today and I have no idea where from :/). So I will be also very grateful for any idea how we could fix it !
What I noticed is that although I can't enter my drives from 'My Computer' , there is no problem to do this using Total Commander.

Greetings for people from Poland - mam nadzieje ze rozwiązemy ten problem.

michał

[polonus]

Cześć,

Consider this cleansing routine:
http://www.geekstogo.com/forum/amvo-exe-Win32-nsanti-help1-exe-malware-Please-help-t183392.html

Download this program, Flash Drive Disinfector by sUBs from

http://www.techsupportforum.com/sectools/sUBs/Flash_Disinfector.exe

Plug in your usb hd, pen drive etc.

Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear.
The utility may ask you to insert your flash drive and/or other removable drives including your mobile phone. Please do so and allow the utility to clean up those drives as well (D: and external Disk)
Wait until it has finished scanning and then exit the program.
Reboot your computer when done.

Then we have to perform an extra scan with DDS to be downloaded here:
http://www.techsupportforum.com/sectools/Deckard/dss.exe

The first thing I want you to do is download Deckard's System Scanner.

   1. Close all applications and windows.
   2. Double-click on dss.exe to run it, and follow the prompts.
   3. When the scan is complete, a text file will open - Main.txt
   4. Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of Main.txt in your thread in the HijackThis Log Help Forum.
   5. A folder, C:\Deckard, will also open. In it will be another text file, Extra.txt.
   6. Attach Extra.txt to your post.

Note: some firewalls may warn that sigcheck.exe is trying to access the internet - please ensure that you allow sigcheck.exe permission to do so.

What Deckard's System Scanner will do:

    * create a new System Restore point in Windows XP and Vista.
    * clean your Temporary Files, Downloaded Program Files, and Internet Cache Files, and also empty the Recycle Bin on all drives.
    * check some important areas of your system and produce a report for your analyst to review. Deckard's System Scanner automatically runs HijackThis for you, but it will also install and place a shortcut to HijackThis on your desktop if you do not already have HijackThis installed.

When you get the two notepad documents, attach them to your next reply Main.txt & Extra.txt,
After you have run both flashdrive disinfector and DSS, also attach a fresh HJT log.txt,

pozdrawiam,

polonus

[edek004]

I think Dr.Web is enough. After that scan & fix I used MKS online and Avast. Nothing more was found.
Any USB device was connected last two days.
I will see tomorrow - infected computers are in my neighbours house. Now I'm going to my house for enjoy Tyskie 

I just still don't now how to fix problem with opening disks.

P.S. In attachment is log from other computer.

[polonus]

Cześć, edek004,

"Małe piwko, potem kosteczkę czekolady," I asked around for a solution for you to be able to enter your drives, I'll post it when it gets to me. And for later: "karaluchy pod poduchy", do jutra,

polonus