win32.cryptor (i think) either way its a nasty bugger that wont leave

ok so i was browsing the interwebs when suddenly i noticed a windows message by the taskbar saying that "windows needs to restart to disable user account control" i told it to shoo and carried on browsing, then blam it reboots all on its own... i think... wierd, nvm must have decided to restart for updates or whatever. when it came back on however each time i tried to click on a link in IE8 i was redirected to search engines (7search the most common)

after a small fight and the help of a blackberry with internet i managed to get spybot S&D on the machine which (so i thought) cleared everything out, it said it was opachki.ru

i then remembered that my f-secure trial had expired and realised that must be how it got in, so i downloaded vipre from sunbelt software (antivir and antispyware together) on a trial (as the firewall isnt win7 compat yet) with aim to upgrade to full in the new year.

it detected many viruses, win32.cryptor being the most common, it removed most, i ran (probably a botched) assault on these virii with root repeal, GMER, combofix, win32diag and exehelper.

all my programs were now calling no longer present virii files calc.dll being the most common, so i went into safemode and ran a few more scans and finally got rid (so i thought) of everything

something is still there, though vipre is locking it down, it keeps trying to run programs by activating xyz123.tmp or xyz123.dll or xyz123.exe (random filenames) all being called by svchost.dll or other system processes.

it is at this point that i turn to you oh fountains of knowledge as i need help. dds logs attached and i await your (hopefully prompt) response.

root repeal gives the following error on launch

"FOPS - DeviceIoControl Error! Error Code = 0xc0000024
Extended info (0x00000ec)"
same error on clicking scan

dds log as follows attach log is zipped and ... attached.


DDS (Ver_09-12-01.01) - NTFSx86
Run by dave at 21:10:31.43 on 10/12/2009
Internet Explorer: 8.0.7600.16385
Microsoft Windows 7 Ultimate 6.1.7600.0.1252.44.1033.18.1015.324 [GMT 0:00]

SP: Antispyware *disabled* (Updated) {888B6F93-C965-465D-B71D-70030A09481F}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\TVersity\Media Server\MediaServer.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\explorer.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Sunbelt Software\VIPRE\SBAMTray.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\Sunbelt Software\VIPRE\SBAMSvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\wuauclt.exe
C:\Users\dave\Desktop\dds.scr
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uSearch Page = hxxp://www.google.com
uStart Page = hxxp://www.google.co.uk/
uSearch Bar = hxxp://www.google.com/ie
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mWinlogon: Shell=Explorer.exe rundll32.exe pnde.beo ajhcua
BHO: c:\windows\system32\yhe7o3qx.dll: {c5b24b16-23f2-41ad-f4e4-00abc39c0004} - c:\windows\system32\yhe7o3qx.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll
uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\DTLite.exe" -autorun
uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [notepad] rundll32.exe c:\windows\system32\config\system~1\ntload.dll,_IWMPEvents@0
uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [SBAMTray] c:\program files\sunbelt software\vipre\SBAMTray.exe
mRun: [notepad] rundll32.exe c:\windows\system32\notepad.dll,_IWMPEvents@0
mRun: [SBRegRebootCleaner] c:\program files\sunbelt software\vipre\SBRC.exe
StartupFolder: c:\users\dave\appdata\roaming\micros~1\windows\startm~1\programs\startup\openof~1.lnk - c:\program files\openoffice.org 3\program\quickstart.exe
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll
Notify: igfxcui - igfxdev.dll
STS: c:\windows\system32\yhe7o3qx.dll: {c5b24b16-23f2-41ad-f4e4-00abc39c0004} - c:\windows\system32\yhe7o3qx.dll
Hosts: 127.0.0.1 www.spywareinfo.com

================= FIREFOX ===================

FF - ProfilePath - c:\users\dave\appdata\roaming\mozilla\firefox\profiles\7mu47eyl.default\

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

============= SERVICES / DRIVERS ===============

R1 SBRE;SBRE;c:\windows\system32\drivers\SBREDrv.sys [2009-10-13 95024]
R1 sbtis;sbtis;c:\windows\system32\drivers\sbtis.sys [2009-12-8 203056]
R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-7-13 48128]
R2 SBAMSvc;VIPRE Antivirus + Antispyware;c:\program files\sunbelt software\vipre\SBAMSvc.exe [2009-10-27 1012080]
R2 sbapifs;sbapifs;c:\windows\system32\drivers\sbapifs.sys [2009-8-10 69936]
S3 {6178CBD2-8F3D-465F-9C9D8B75082E22B9};{6178CBD2-8F3D-465F-9C9D8B75082E22B9};c:\windows\system32\svchost.exe -k netsvcs [2009-7-13 20992]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]

=============== Created Last 30 ================

2009-12-10 20:53:56 0 d-----w- c:\program files\Trend Micro
2009-12-10 20:49:55 104 ----a-w- c:\windows\system32\SBRC.dat
2009-12-10 20:39:31 46 ----a-w- C:\p2hhr.bat
2009-12-10 20:39:14 25601 ----a-w- c:\windows\system32\pnde.beo
2009-12-10 20:39:14 15000 ------w- c:\windows\system32\yhe7o3qx.dll
2009-12-09 03:00:51 0 d-----w- c:\program files\MSXML 4.0
2009-12-08 20:43:20 0 d-----w- c:\programdata\Google
2009-12-08 03:42:33 0 d-----w- c:\users\dave\Tracing
2009-12-08 03:41:52 0 d-----w- c:\program files\Microsoft
2009-12-08 03:41:31 0 d-----w- c:\program files\Windows Live SkyDrive
2009-12-08 03:40:38 0 d-----w- c:\windows\PCHEALTH
2009-12-08 03:38:10 0 d-----w- c:\program files\common files\Windows Live
2009-12-08 00:34:28 0 d-----w- c:\programdata\Sunbelt
2009-12-08 00:34:27 0 d-----w- c:\users\dave\appdata\roaming\Sunbelt
2009-12-08 00:33:43 203056 ----a-w- c:\windows\system32\drivers\sbtis.sys
2009-12-08 00:33:25 0 d-----w- c:\program files\Sunbelt Software
2009-12-07 23:39:04 2146304 ----a-w- c:\windows\system32\GPhotos.scr
2009-12-07 23:00:44 1060864 ----a-w- c:\windows\system32\MFC71.dll
2009-12-07 02:56:15 0 d-----w- c:\program files\F-Secure
2009-12-07 02:55:34 0 d-----w- c:\programdata\fssg
2009-12-07 02:54:15 0 d-----w- c:\programdata\f-secure
2009-12-07 02:37:35 0 d-sh--w- C:\$RECYCLE.BIN
2009-12-07 02:24:56 98816 ----a-w- c:\windows\sed.exe
2009-12-07 02:24:56 77312 ----a-w- c:\windows\MBR.exe
2009-12-07 02:24:56 260608 ----a-w- c:\windows\PEV.exe
2009-12-07 02:24:56 161792 ----a-w- c:\windows\SWREG.exe
2009-12-07 02:15:57 91904 ----a-w- C:\kwlyipow.sys
2009-12-07 01:26:48 0 d-sh--w- c:\windows\system32\%APPDATA%
2009-12-06 01:39:04 215 ----a-w- c:\windows\wininit.ini
2009-12-06 01:06:05 0 d-----w- c:\programdata\Spybot - Search & Destroy
2009-12-06 01:06:05 0 d-----w- c:\program files\Spybot - Search & Destroy
2009-12-06 00:30:18 0 d-----w- c:\windows\system32\appmgmt
2009-12-01 01:57:40 0 d-----w- c:\programdata\Adobe
2009-11-29 22:56:00 0 d-----w- c:\program files\mackoy
2009-11-27 16:43:17 17408 ---ha-w- c:\windows\BIT8735.tmp
2009-11-27 05:01:03 0 d-----w- c:\program files\GoldWave
2009-11-25 20:03:25 17408 ---ha-w- c:\windows\BITF260.tmp
2009-11-25 20:03:25 17408 ---ha-w- c:\windows\BITEFD6.tmp
2009-11-25 20:03:25 17408 ---ha-w- c:\windows\BITAB64.tmp
2009-11-25 20:03:25 17408 ---ha-w- c:\windows\BIT95B5.tmp
2009-11-25 20:03:25 17408 ---ha-w- c:\windows\BIT69F.tmp
2009-11-25 20:03:25 17408 ---ha-w- c:\windows\BIT5640.tmp
2009-11-25 20:03:25 17408 ---ha-w- c:\windows\BIT4D1E.tmp
2009-11-25 03:00:46 2048 ----a-w- c:\windows\system32\tzres.dll
2009-11-23 19:41:03 65536 --sha-w- c:\users\dave\NTUSER.DAT{155a6f1f-d868-11de-95c1-00235471122e}.TM.blf
2009-11-23 19:41:03 524288 --sha-w- c:\users\dave\NTUSER.DAT{155a6f1f-d868-11de-95c1-00235471122e}.TMContainer00000000000000000002.regtrans-ms
2009-11-23 19:41:03 524288 --sha-w- c:\users\dave\NTUSER.DAT{155a6f1f-d868-11de-95c1-00235471122e}.TMContainer00000000000000000001.regtrans-ms
2009-11-22 22:29:38 547 ----a-w- c:\windows\system32\ff_vfw.dll.manifest
2009-11-22 22:29:37 60273 ----a-w- c:\windows\system32\pthreadGC2.dll
2009-11-22 22:29:37 499712 ----a-w- c:\windows\system32\msvcp71.dll
2009-11-22 22:29:37 348160 ----a-w- c:\windows\system32\msvcr71.dll
2009-11-22 22:29:14 0 d-----w- c:\program files\TVersity Codec Pack
2009-11-22 22:28:56 0 d-----w- c:\program files\TVersity
2009-11-22 22:27:47 6144 ----a-w- c:\windows\system32\ff_acm.acm
2009-11-22 22:27:46 7680 ----a-w- c:\windows\system32\ff_vfw.dll
2009-11-22 22:27:43 0 d-----w- c:\program files\ffdshow
2009-11-20 16:29:37 0 d-----w- c:\program files\LucasArts
2009-11-20 14:51:57 47616 ----a-w- c:\windows\wupd.dll
2009-11-18 18:54:24 0 d-----w- c:\users\dave\appdata\roaming\OpenOffice.org
2009-11-18 18:44:58 0 d-----w- c:\program files\OpenOffice.org 3
2009-11-11 19:44:33 0 d-----w- c:\users\dave\appdata\roaming\Spotify
2009-11-11 19:44:26 0 d-----w- c:\program files\Spotify

==================== Find3M ====================

2009-11-10 14:21:45 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_09_00.Wdf
2009-11-05 04:55:17 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-11-04 17:00:56 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-11-02 20:42:06 195456 ------w- c:\windows\system32\MpSigStub.exe
2009-10-27 14:31:16 27984 ----a-w- c:\windows\system32\sbbd.exe
2009-10-13 09:22:50 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2009-07-14 04:56:42 31548 ----a-w- c:\windows\inf\perflib\0409\perfd.dat
2009-07-14 04:56:42 31548 ----a-w- c:\windows\inf\perflib\0409\perfc.dat
2009-07-14 04:56:42 291294 ----a-w- c:\windows\inf\perflib\0409\perfi.dat
2009-07-14 04:56:42 291294 ----a-w- c:\windows\inf\perflib\0409\perfh.dat
2009-07-14 04:41:57 174 --sha-w- c:\program files\desktop.ini
2009-07-14 00:34:40 291294 ----a-w- c:\windows\inf\perflib\0000\perfi.dat
2009-07-14 00:34:40 291294 ----a-w- c:\windows\inf\perflib\0000\perfh.dat
2009-07-14 00:34:38 31548 ----a-w- c:\windows\inf\perflib\0000\perfd.dat
2009-07-14 00:34:38 31548 ----a-w- c:\windows\inf\perflib\0000\perfc.dat
2009-06-10 21:26:35 9633792 --sha-r- c:\windows\fonts\StaticCache.dat
2009-07-14 01:15:35 28160 --sha-w- c:\windows\system32\notepad.dll
2009-07-14 01:15:35 28160 --sha-w- c:\windows\system32\config\systemprofile\ntload.dll
2009-07-14 01:14:45 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe

============= FINISH: 21:11:33.57 ===============

Hello and welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.

If you have already posted a DDS log, please do so again, as your situation may have changed.
Use the 'Add Reply' and add the new log to this thread.


Thanks and again sorry for the delay.

We need to see some information about what is happening in your machine. Please perform the following scan:

• Download DDS by sUBs from one of the following links. Save it to your desktop.
  • DDS.scr
  • DDS.pif
• Double click on the DDS icon, allow it to run.
• A small box will open, with an explaination about the tool. No input is needed, the scan is running.
• Notepad will open with the results.
• Follow the instructions that pop up for posting the results.
• Close the program window, and delete the program from your desktop.

Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE

Due to the lack of feedback, this topic is now closed.
If you need this topic reopened, please PM a staff member and we will reopen it for you (include the address of this thread in your request). This applies to the original topic starter only. Everyone else with similar problems, please start a new topic.