win32 cryptor wsaifrz.dll

View previous topic View next topic Go down

win32 cryptor wsaifrz.dll

Post by monuvasu on 7th April 2009, 2:01 am

I have this wsaifrz.dll as infected file when i scan thru avg. and virus identified as win32.cyrptor.
I looked thru intrenet and found only geek police can help me. Please let me know what to do

monuvasu
Beginner
Beginner

Posts Posts : 2
Joined Joined : 2009-04-07
OS OS : XP
Points Points : 28044
# Likes # Likes : 0

View user profile

Back to top Go down

Re: win32 cryptor wsaifrz.dll

Post by Belahzur on 7th April 2009, 2:16 am


  • Please download DDS by sUBs to your Desktop (Important!!) from one of these locations:
    [You must be registered and logged in to see this link.]
    [You must be registered and logged in to see this link.]
  • Double click DDS.scr to run
  • When complete, DDS.txt will open.
  • Save the report to your Desktop.
  • Copy and paste DDS.txt back here, I don't need to see attach.txt.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245111
# Likes # Likes : 1

View user profile

Back to top Go down

Re: win32 cryptor wsaifrz.dll

Post by monuvasu on 7th April 2009, 2:29 am

DDS (Ver_09-03-16.01) - NTFSx86
Run by risadm at 22:24:55.81 on Mon 04/06/2009
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.375.41 [GMT -4:00]

AV: ISS Proventia 9.0.226.2075 *On-access scanning enabled* (Outdated)
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated)
FW: ISS Proventia 9.0.226.0 *enabled*

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Altiris\Altiris Agent\AeXNSAgent.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\ISS\BlackICE\blackd.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Citadel\Hercules\Client\HercClient.exe
C:\Program Files\Citadel\Hercules\Client\HercValidator.exe
C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Wireless-G Notebook Adapter\NICServ.exe
C:\WINDOWS\system32\PNUpdate.exe
C:\Program Files\ISS\BlackICE\RapApp.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\ISS\BlackICE\vpatch.exe
C:\Program Files\ISS\BlackICE\RapUISvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\tp4mon.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\Citadel\Hercules\Client\HercUserAgent.exe
C:\Program Files\Brother\ControlCenter2\brctrcen.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Citrix\ICA Client\pnagent.exe
C:\Program Files\Wireless-G Notebook Adapter\Gcc.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\Wireless-G Notebook Adapter\OdHost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Java\jre1.5.0_09\bin\jucheck.exe
C:\Documents and Settings\risadm\Desktop\dds.scr
C:\Documents and Settings\risadm\Desktop\dds.scr
C:\Program Files\Apple Software Update\SoftwareUpdate.exe

============== Pseudo HJT Report ===============

uStart Page = about:blank
uSearch Bar = [You must be registered and logged in to see this link.]
uSearch Page = [You must be registered and logged in to see this link.]
uSearchMigratedDefaultURL = [You must be registered and logged in to see this link.]
uDefault_Search_URL = [You must be registered and logged in to see this link.]
mDefault_Page_URL = [You must be registered and logged in to see this link.]
uSearchAssistant = [You must be registered and logged in to see this link.]
uSearchURL,(Default) = [You must be registered and logged in to see this link.]
mSearchAssistant = [You must be registered and logged in to see this link.]
uURLSearchHooks: N/A: {0579b4b6-0293-4d73-b02d-5ebb0ba0f0a2} - c:\program files\asksbar\srchastt\1.bin\A2SRCHAS.DLL
mWinlogon: Userinit=c:\windows\system32\userinit.exe,c:\windows\system32\sdra64.exe,
BHO: Ask Search Assistant BHO: {0579b4b1-0293-4d73-b02d-5ebb0ba0f0a2} - c:\program files\asksbar\srchastt\1.bin\A2SRCHAS.DLL
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: {29404cab-f4a9-fcc0-a008-ded864dfdecd} - c:\windows\aloxaxedakoko.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.5.0_09\bin\ssv.dll
BHO: : {a0223b9c-d020-486b-aba0-5a157f5855de} - c:\windows\system32\wsaifrz.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar1.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\3.1.807.1746\swg.dll
BHO: Ask Toolbar BHO: {f0d4b231-da4b-4daf-81e4-dfee4931a4aa} - c:\program files\asksbar\bar\1.bin\ASKSBAR.DLL
TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar1.dll
TB: Ask Toolbar: {f0d4b239-da4b-4daf-81e4-dfee4931a4aa} - c:\program files\asksbar\bar\1.bin\ASKSBAR.DLL
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
mRun: [TrackPointSrv] tp4mon.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre1.5.0_09\bin\jusched.exe"
mRun: [pnuprdp] c:\windows\system32\rundll32 c:\windows\system32\pnuprdp.dll,RegisterVirtualChannel
mRun: [pnupica] c:\windows\system32\rundll32 c:\windows\system32\pnupica6.dll,RegisterVirtualChannel
mRun: [HerculesClientAgentHelper] c:\program files\citadel\hercules\client\HercUserAgent.exe
mRun: [ControlCenter2.0] c:\program files\brother\controlcenter2\brctrcen.exe /autorun
mRun: [AeXAgentLogon] c:\program files\altiris\altiris agent\AeXAgentActivate.exe /logon
mRun: [Ebamixusumoc] rundll32.exe "c:\windows\aloxaxedakoko.dll",e
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
dRunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs"
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\progra~1.lnk - c:\program files\citrix\ica client\pnagent.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\vpncli~1.lnk - c:\windows\installer\{14fcfe7c-ab86-428a-9d2e-bfb6f5a7aa6e}\Icon3E5562ED7.ico
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\wirele~1.lnk - c:\program files\wireless-g notebook adapter\Gcc.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBC} - c:\program files\java\jre1.5.0_09\bin\ssv.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - [You must be registered and logged in to see this link.]
DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} - [You must be registered and logged in to see this link.]
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - [You must be registered and logged in to see this link.]
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - [You must be registered and logged in to see this link.]
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - [You must be registered and logged in to see this link.]
DPF: {A903E5AB-C67E-40FB-94F1-E1305982F6E0} - [You must be registered and logged in to see this link.]
DPF: {CAFEEFAC-0014-0002-001-ABCDEFFEDCBA} - [You must be registered and logged in to see this link.]
DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} - [You must be registered and logged in to see this link.]
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - [You must be registered and logged in to see this link.]
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - [You must be registered and logged in to see this link.]
DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} - [You must be registered and logged in to see this link.]
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Notify: avgrsstarter - avgrsstx.dll
Notify: nsyqyfnw - wsaifrz.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
LSA: Notification Packages = scecli lwcmsk.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\risadm\applic~1\mozilla\firefox\profiles\sd2f7ydy.default\
FF - component: c:\program files\avg\avg8\firefox\components\avgssff.dll
FF - plugin: c:\program files\java\jre1.5.0_09\bin\NPJava11.dll
FF - plugin: c:\program files\java\jre1.5.0_09\bin\NPJava12.dll
FF - plugin: c:\program files\java\jre1.5.0_09\bin\NPJava13.dll
FF - plugin: c:\program files\java\jre1.5.0_09\bin\NPJava14.dll
FF - plugin: c:\program files\java\jre1.5.0_09\bin\NPJava32.dll
FF - plugin: c:\program files\java\jre1.5.0_09\bin\NPJPI150_09.dll
FF - plugin: c:\program files\java\jre1.5.0_09\bin\NPOJI610.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPAskSBr.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npatgpc.dll
FF - HiddenExtension: XUL Cache: {A9A2C4A1-FFBB-43E7-A01C-D4FE8CF0AE53} - c:\documents and settings\risadm\local settings\application data\{A9A2C4A1-FFBB-43E7-A01C-D4FE8CF0AE53}

============= SERVICES / DRIVERS ===============

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-4-6 325640]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-4-6 27656]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-4-6 108552]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-4-6 298264]
R2 BlackICE;BlackICE;c:\program files\iss\blackice\blackd.exe [2008-10-20 2081034]
R2 EAPPkt;Realtek EAPPkt Protocol;c:\windows\system32\drivers\EAPPkt.sys [2008-5-28 38144]
R2 hClient;Hercules Client;c:\program files\citadel\hercules\client\HercClient.exe [2006-1-16 684032]
R2 hValidator;Hercules Validator;c:\program files\citadel\hercules\client\HercValidator.exe [2006-1-16 192512]
R2 IntuitUpdateService;Intuit Update Service;c:\program files\common files\intuit\update service\IntuitUpdateService.exe [2009-2-16 13088]
R2 lrxkgjrm;Direct Parallel Link Monitor;c:\windows\system32\svchost.exe -k netsvcs [2007-7-27 14336]
R2 PNUpdate;Provision Networks Update Service;c:\windows\system32\pnupdate.exe -run --> c:\windows\system32\PNUpdate.exe -RUN [?]
R2 VPatch;ISS Buffer Overflow Exploit Prevention;c:\program files\iss\blackice\vpatch.exe [2008-10-20 405770]
R3 LucentSoftModem;Lucent Technologies Soft Modem;c:\windows\system32\drivers\LTSM.sys [2007-9-13 802683]
R3 MakoNT;MakoNT;c:\windows\system32\drivers\isskboep.sys [2008-10-20 80512]
R3 rap;rap;c:\windows\system32\drivers\RapDrv.sys [2008-3-24 50163]
R4 BLACK;black;c:\windows\system32\drivers\Blackcat.sys [2008-10-20 205938]
S2 vvdsvc;VJVodServices;c:\windows\system32\svchost.exe -k vvdsvc [2007-7-27 14336]
S3 BigBrotherClient;Big Brother SNM Client 1.08b;c:\program files\bb\bbnt\1.08b\bin\bbnt.exe [2001-10-27 122880]
S3 OracleOraHome81ClientCache;OracleOraHome81ClientCache;c:\oracle\ora81\bin\ONRSD.EXE [2000-10-19 411244]
S3 RapFile;RapFile;c:\windows\system32\drivers\RapFile.sys [2008-3-24 36676]
S3 RapNet;RapNet;c:\windows\system32\drivers\RapNet.sys [2008-3-24 24344]
S3 RTL8187B;Realtek RTL8187B Wireless 802.11g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\drivers\rtl8187B.sys [2008-5-28 223616]
S3 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2005-1-26 280344]

=============== Created Last 30 ================

2009-04-06 21:05 --d-h--- C:\$AVG8.VAULT$
2009-04-06 21:04 10,520 a------- c:\windows\system32\avgrsstx.dll
2009-04-06 21:04 108,552 a------- c:\windows\system32\drivers\avgtdix.sys
2009-04-06 21:03 325,640 a------- c:\windows\system32\drivers\avgldx86.sys
2009-04-06 21:03 --d----- c:\windows\system32\drivers\Avg
2009-04-06 21:02 --d----- c:\program files\AVG
2009-04-06 21:02 --d----- c:\docume~1\alluse~1\applic~1\avg8
2009-04-06 13:58 54,156 a---h--- c:\windows\QTFont.qfn
2009-04-06 13:58 1,409 a------- c:\windows\QTFont.for
2009-04-06 00:06 23,576 a------- c:\windows\system32\wuapi.dll.mui
2009-04-04 13:57 17,992 a------- c:\windows\system32\drivers\bcm42rly.sys
2009-04-04 13:57 17,992 a------- c:\windows\system32\bcm42rly.sys
2009-04-04 13:57 --d----- c:\program files\Wireless-G Notebook Adapter
2009-04-01 11:40 25,856 ac------ c:\windows\system32\dllcache\usbprint.sys
2009-04-01 11:40 25,856 a------- c:\windows\system32\drivers\usbprint.sys
2009-04-01 11:40 31,616 ac------ c:\windows\system32\dllcache\usbccgp.sys
2009-04-01 11:40 31,616 a------- c:\windows\system32\drivers\usbccgp.sys
2009-03-31 13:02 --dsh--- c:\windows\system32\lowsec
2009-03-29 12:30 --d----- C:\VJVod_Cache
2009-03-28 19:34 --d----- c:\windows\system32\Nagasoft
2009-03-20 13:42 --d----- c:\docume~1\risadm\applic~1\JGoodies
2009-03-20 13:40 --d----- c:\program files\JGoodies
2009-03-18 22:20 --d----- c:\windows\pss

==================== Find3M ====================

2009-02-19 10:02 6 a------- c:\windows\fonts\wfonts.key
2008-04-30 14:15 34,488 a------- c:\docume~1\risadm\applic~1\GDIPFONTCACHEV1.DAT

============= FINISH: 22:27:42.91 ===============

monuvasu
Beginner
Beginner

Posts Posts : 2
Joined Joined : 2009-04-07
OS OS : XP
Points Points : 28044
# Likes # Likes : 0

View user profile

Back to top Go down

Re: win32 cryptor wsaifrz.dll

Post by Belahzur on 7th April 2009, 1:15 pm

1. Please download The Avenger by Swandog46 to your Desktop
Link: [You must be registered and logged in to see this link.] or [You must be registered and logged in to see this link.].

  • Click on Avenger.zip to open the file
  • Extract avenger.exe to your desktop

2. Now, start The Avenger program by clicking on its icon on your desktop.

  • Leave the script box empty.
  • Leave the ticked box "Scan for rootkit" ticked.
  • Then tick "Disable any rootkits found"
  • Now click on the Execute to begin execution of the script.
  • Answer "Yes" twice when prompted.

    The Avenger will automatically do the following:

  • It will Restart your computer.
  • On reboot, it will briefly open a black command window on your desktop, this is normal.
  • After the restart, it creates a log file that should open with the results of Avengerís actions. This log file will be located at C:\avenger.txt
  • The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
3. Please copy/paste the content of c:\avenger.txt into your reply.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245111
# Likes # Likes : 1

View user profile

Back to top Go down

View previous topic View next topic Back to top

- Similar topics

 
Permissions in this forum:
You cannot reply to topics in this forum