I´VE THIS ISSUE WITH THESE 2 FILES, THAT ARE IN A FOLDER CALLED “CRYPTO”
1- RSA64.DLL (MY ESET AND MBAM FIND IT EVERYTIME I RESTART MI COMPUTER, THEY CLEAN IT , BUT IT APPEARS AGAIN AND AGAIN)
THIS IS WHAT ESET SHOWS ON THE LOG : C:\ProgramData\Microsoft\Crypto\RSA64\rsa64.dll - una variante de Win64/Sathurbot.A troyano - desinfectado por eliminación (tras el próximo reinicio) - puesto en cuarentena
2-CryptoProvider.DLL (THIS ONE I CANT GET RID OF EITHER; THE DIFERENCE? WELL, IT SAYS TO ME THAT IS BEING USED BY MICTOSOFT, SO, THERE`S NO CHANCE FOR THE ANTIVIRUS-SPYWARE TO OPEN IT, AS WELL AS FOR ME TRYING TO ERASE IT MANUALLY.
NOW, I`VE READ THAT YOU CAN SOLVE IT USING THIS PROGRAM: COMBOFIX ; BUT I ALSO KNOW THAT SOMEONE HAS TO HELP ME WITH THE LOGS …HOPE SOMEONE HERE CAN.
Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
[*]Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
[*]Select additions at the bottom
[*]Press Scan button.
WARNING:Java is the #1 exploited program at this time. The Department of Homeland Security recommends that computer users disable Java
See this article
I would recommend that you completely uninstall Java unless you need it to run an important software.
In that instance I would recommend that you disableJava in your browsers until you need it for that software and then enable it. (See How to diasble Java in your web browser and How to unplug Java from the browser)
Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:
CryptoPrevent install this programme to lock down and prevent crypto ransome ware
If I can make a suggestion, Winpatrol is another product that informs you of changes
being made to your system. Winpatrol also monitors quite a few of the registry entries often attacked
by malware.
last issue: when i try to install CryptoPrevent it cames i¿out with the following text:
“unable to execute file in the temporary directory. setup aborted. Error 5: acces denied” ( i´m sure it´s 64-bit version and i moved it to desktop, but still appears)
The problem is with the security permissions on your profile temp folder. To fix it navigate to %temp% or C:\Users\[Username]\AppData\Local and right click on the Temp folder and choose properties, then click the security tab and click advanced.
On the permissions tab you should see the permissions that are there. There should 3 which are:
‘SYSTEM’ with Full control which applies to ‘This folder, subfolders and files’
‘Administrators’ with Full control which applies to ‘This folder, subfolders and files’
‘Your Username’ with Full control which applies to ‘This folder, subfolders and files’
and all 3 should be inherited from the C:\Users[Username]\ folder.
If you don’t have the ‘Include inheritable permissions from this object’s parent’ option ticked, then tick it and click continue if there are any problems, then remove the permissions that aren’t inherited.
Once you click ‘Apply’ and click ‘OK’ you should have the permissions to write to the directory and you won’t get those error messages any more.
Download Windows All In One Repair from Tweaking.com to your desktop
Install the programme and run
Select Step 5 : Back up your registry and create a system restore point
