Anyone know how I can remove the virus win32:crypt-ny?

system · 2008-01-05T12:26:42.000Z

I do not know how but I have somewhere a virus called win32 crypt-ny
Always found a file named nc2.exe
How can I delete it? ?

disable system restore???
how?

Lisandro · 2008-01-05T12:32:59.000Z

I suggest:

Disable System Restore and reenable it after step 3.
Clean your temporary files.
Schedule a boot time scanning with avast with archive scanning turned on.
Use AVG Antispyware; SUPERantispyware and/or Spyware Terminator to scan for spywares and trojans. If any infection is detected, better and safer is send the file to Quarantine than to simple delete than.
Test your machine with anti-rootkit applications. I suggest AVG or Trend Micro RootkitBuster.
Make a HijackThis log to post here or, better, submit the RunScanner log to to on-line analysis.
Immunize your system with SpywareBlaster or Windows Advanced Care.
Check if you have insecure applications with Secunia Software Inspector.

polonus · 2008-01-05T15:34:11.000Z

Hi steuku,

The trojan’s file is a DLL that is designed to be loaded at Windows startup using the ‘Winlogon\Notify’ Registry key. As a result the trojan is loaded as the component of one of Windows’s system processes and its removal or modification is impossible when Windows is active. Moreover, the trojan blocks access to its own file, monitors changes to its Registry keys and restores them if they are modified or deleted.

Disinfection

So far we found the only reliable way to delete this intrusive adware: to boot from Windows installation CD to Recovery Console and to delete the malicious DLL file from a hard disk.

Alternatively you can use ERD commander or a bootable Linux CD to access your NTFS partition and to delete the DLL file.

Or try the “delete at next system startup, if necessary” option in Avast.

polonus

Announcements