Relentless Win32:AuCrypt [Cryp]

[Lisandro]

IS THIS BAD...SHOULD I BE WORRIED (because of the corrupted files and fact that I can't see my hidden files) OR AM I VIRUS FREE AND SAFE TO MIX WITH THE REST OF THE PC WORLD?

Disable System Restore on Windows ME, XP or Vista. System Restore cannot be disabled on Windows 9x and it's not available in Windows 2k. After boot you can enable System Restore again. This will delete corrupted (or infected) restore points. After that, it would be good that you create a new, clean, restore point.

[pcnaive]

Ok...but could you tell me step by step how to do that? Sorry to be such a bother, but I really don't know much about the secret workings of my computer. This whole virus thing has been a HUGE learning experience for me, accompanied by much foul language and despair until I found this forum.

Thanks

[Lisandro]

Ok...but could you tell me step by step how to do that?

It's written on the Microsoft pages... I mean, if you're not sure how to do a specific step, then you can ask for help, but first you may need to read a little.

In most detail, if a virus is replicant (coming and coming again), you could follow the general cleaning procedure:

1. As posted before, disable System Restore on Windows ME, XP or Vista. System Restore cannot be disabled on Windows 9x and it's not available in Windows 2k. After boot you can enable System Restore again after step 3.

2. Clean your temporary files. You can use CleanUp or the Windows Advanced Care features for that.

3. Schedule a boot time scanning with avast. Start avast! > Right click the skin > Schedule a boot-time scanning. Select for scanning archives. Boot. Other option is scanning in SafeMode (repeatedly press F8 while booting).

4. It will be good if you download, install, update and run SUPERantispyware or Spyware Terminator.
If any infection is detected, better and safer is send the file to Quarantine than to simple delete than.
About legit antispyware applications or the bad ones: http://www.spywarewarrior.com/rogue_anti-spyware.htm#sites

5. If you still detecting any strange behavior or even you're sure you're not clean, maybe it will be good to test your machine with anti-rootkit applications. I suggest avast! antirootkit or Trend Micro RootkitBuster for XP/Vista. For XP only: Panda.

6. Also, if you still detecting strange behaviors or you want to be sure you're clean, maybe making a HijackThis log to post here and, specially, scan and submit to on-line analysis the RunScanner log would help to identify the problem and the solution.

7. After you're clean, use the immunization of SpywareBlaster or, which is better, the Windows Advanced Care features of spyware/adware cleaning and removal.

8. Finally, when you're clean, check for insecure applications with Secunia Software Inspector to update insecure applications and avoid reinfection.

[pcnaive]

Wow!!! Thanks for the swift reply and all the info...doing all this will keep me busy for a while. Once it is done I'll let you know how things stand.

Thanks

PS: At this point in time would it be faster to wipe the drive (repartition it or whatever that is that completely destroys everything on it), reinstall everything, download a usb cleaner and scan my backup external hd? I'm attached to some of the data and would rather not loose it, but also would like to get back to "normal" asap.

[Lisandro]

At this point in time would it be faster to wipe the drive (repartition it or whatever that is that completely destroys everything on it), reinstall everything, download a usb cleaner and scan my backup external hd?

Well... format is 'lose' the battle... the last solution... generally, we don't like it as it is too dramatic. Of course, backup your data is a must do.

[pcnaive]

THANK YOU ALL!!!!!!!!!!!!!

I did just about everything you told me. Set new restore points, ran a boot time scan, downloaded and ran Windows Advnaced Care, downloaded and ran SUPERantispyware and then also got Tweak UI turned off autorun, and downloaded and ran Flash Disinfector. I finally plugged in my external hard drive, ran the disenfector on it and it said it was finished, but I scanned it with Avast just to be safe and it found a trojan so I deleted that and now everything seems ok. The bootscan says I am virus and corrupted file free, Windows Advanced Care fixed oodles of stuff (32398 files to be precise), and Superantispyware got rid of 29 cookies, and then I redownloaded and ran Dr. Cureit just for fun and it said I was virus free so I'm feeling pretty confident.

I can see all my hidden files and folders, and I can access my c drive properly, so all seems well in PC World. I want to thank you and let you know how much I appreciate this. I would have been lost without all your advice and help. Also, thank you for explaining things so clearly for a pc novice like myself. Thank you, thank you, thank you.....think i'll go change my name to pc-elated.   

[Lisandro]

You're welcome. Feel free to come back any time you need help or just to change experiences

[vnscnc86]

Hi Polonus,

I have the same problem, i cant open my c driver, i have read your advises, and
I have dowloded FindAWF and run it, the report is:
 Find AWF report by noahdfear ©2006
               Version 1.40
 bak folders found
  ~~~~~~~~~~~
Duplicate files of bak directory contents
  ~~~~~~~~~~~~~~~~~~~~~~~
end of report

than dowloaded DrWeb CureIt and run, but it could not have found any infected file.
And my problem goes on, i still can not open my c driver, can you help me in this point?
Is there a missing in my steps? or is there another solution for it?

[iChigoMado]

Hi pcnaive,

1) Delete the Autorun.inf file of your C: drive, for it :
Open the command prompt, and type :
cd \
attrib -s -h -r autorun.inf
del autorun.inf

Now download DrWeb's CureIt from here: ftp://ftp.drweb.com/pub/drweb/cureit/cureit.exe
and do a full scan,

polonus

Hi... I seem to have the same problem of the virus Win32:AuCrypt [Cryp]... I downloaded the CureIt and ran it... I deleted loads of viruses for me, but still the virus re-infect my com after avast deleted it... How do I do the command prompt thing? After I run command prompt via the Run function through the Start button and keyed in 'cd\" and "attrib -s -h -r autorun.inf" and I press enter to get to the next line, it says that "attrib is not recognised as an internal or external command, operable program or batch file."

What do I do?

[vnscnc86]

Hi Polonus,

I have the same problem, i cant open my c driver, i have read your advises, and
I have dowloded FindAWF and run it, the report is:
 Find AWF report by noahdfear ©2006
               Version 1.40
 bak folders found
  ~~~~~~~~~~~
Duplicate files of bak directory contents
  ~~~~~~~~~~~~~~~~~~~~~~~
end of report

than dowloaded DrWeb CureIt and run, but it could not have found any infected file.
And my problem goes on, i still can not open my c driver, can you help me in this point?
Is there a missing in my steps? or is there another solution for it?

I repeated CureIt with full scan and ok it has found many infected files and deleted them. But my c still cannot be opened, please someone help me, I will appreciate very much!

[Lisandro]

Did you follow the steps I've posted before on reply #32?

[probwitpc]

Hi, I'm having the same issue trying to open my drives when I do the following:

click My Computer
double click either of my hard drives c: or d:

the Open With window always pops up

How do I fix this? I went through the whole procedure in reply #32 and it seems like my viruses are gone.

I also still cannot view my hidden files.

Please help! Thanks!

[seening]

Hi,
i seem like having the same problem here.
i can't open my C & D drive through My Computer.
i've ran FindAWF, nothing was found.
then i ran Cureit, lots of infected files were deleted.
n i ran the boot scheduled scan with avast, n no infected files was found.
but still i can't open my C & D drive through My Computer.
Anyone can help me, pls...
thanks.

[siberian sue]

 I too had the Win:32AuCrpyt [Cryp]. Thank you so much Polonus and others, for your postings here. Thanks to your postings and one elsewhere on the web, I seem to have my computer back to normal. I want to share the suggestion I found elsewhere, in case it may be of help to any of you as it was to me.

Avast boot scan and Dr Web CureIt! seemed to get rid of the infective agent, but I still had the C drive and hidden file problems. After I finally figured out the command prompt thing to delete Autorun.inf, then I could open my C drive. But hidden files still couldn’t be seen. I downloaded Advanced WindowsCare Personal but got scared by a posting of disaster hitting with the one button approach so I only deleted junk files.

Finally, at
http://www.askvg.com/frequently-asked-problems-with-solutions-part-3/
 I found directions on how to make one simple change in the registry, using regedit, to reenable the option to see hidden files (solution number 23). After also reading all the cautions and instructions in Windows help & support about registry changes, I tried it, and it worked! I can now see my hidden files, as well as access my C drive, and test clean of viruses. Of course I’ve cleaned out old restore points and created a new one.

I’m no expert to be able to evaluate it, but maybe this idea may be of help to someone else dealing with Win:32AuCrpyt. Thank you all for your help!