Win32:Malob-T (cryp)

Viruses and worms
1

Hi there! I’m a new member and of course found the site when searching for answers.

I’m not the most computer literate gal and really need some expertise to evict this virus.

I’m running XP and Avast 4.8. I’ve scanned a few times with Avast and it looks like it gone, when logging in as another user the virus starts again. Win32:Malob-T (cryp) is an ugly one, with many names, as I get rid of one a new one pops up.

Many thanks.

2

hey and welcome to the forum LadyK.

i suggest you try a scan with MBAB or/and SAS and see if they can remove the malware for you.

http://filehippo.com/download_malwarebytes_anti_malware/
http://filehippo.com/download_superantispyware/

don’t forget to update before you scan.

good luck and write back if you get any problems

3

Which one do I want?

Download DriverScanner from Uniblue - |USA|
Download DriverScanner from Uniblue - |USA 2|

Also, do I want the “update all PC drivers”?

Thanks for responding. I’ve been reading through the forum and this looks alot like the one Lynn had. If so I’m in way above my experience level. Yikes

4

Hi.Please try this link
http://filehippo.com/download_malwarebytes_anti_malware/download/9eb2b706355f67bd36f95991900b5165/

And it seems suspicious to me as DriverScanner is not suppose to show up on a link to download malwarebytes so don’t download the DriverScanner application.

5

I ran the PC tools and the scan results say there are 7threats and 110 infections. Do I want to clean them? Should I check the "create restore point before removal? Isn’t this one you have to purchase?

6

I think you have downloaded the wrong programs. I am pretty sure that if you are trying to let PCtools Spyware doctor fix this there will be a pop up saying you have to pay for removal. I guess you are in the same situation as this lady was

http://forum.avast.com/index.php?topic=49011.0

If you are using the links mikaelrask and matboyx215 gave you, you sohuld get some programs with the name “MalwareBytes Antimalware” and “SUPERAntiSpyware” if not there is something wrong

7

Yes Pondus, it had downloaded the wrong one. Thanks for catching that!

I think I’ve got the right one now. We’ll see.

8

I was off to a rough start, but believe I’m doing GREAT.

I ran the below recommended software and the cccleaner.

http://filehippo.com/download_malwarebytes_anti_malware/
http://filehippo.com/download_superantispyware/

Should I run them again? Avast came with a multitude( .jpg, mpa, VOB )of unscanable files, is that okay? What else should I be doing? How often should I be running the malware and sas?

Many thanks for your time and computer braun.

9

the files that was not scan are noting you have to worry about those are files that avast could get aces to scan. a recommendation is to scan with malwarebytes and superantispyware one a week i think should be good. you can run a scan with avast again if you like to but i think MBAB and SAS have cleaned your computer from the malware that hit you.

glad we could help you.

10

I recommend posting the scan logs here, then the malware killers here can see if everything is okay or you need more help

11

Are you talking about the logs that were cleaned/quarantined, or the logs that were unscannable? I tried to copy the unscannable logs, but can’t right click to copy and don’t know how to copy any other way. I’ll definately post the logs for the malware killers once I figure out how.

Many thanks.

12

This came up clean earlier and now these popped up.

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 11/08/2009 at 02:47 PM

Application Version : 4.29.1004

Core Rules Database Version : 4246
Trace Rules Database Version: 2138

Scan type : Complete Scan
Total Scan Time : 01:08:28

Memory items scanned : 523
Memory threats detected : 0
Registry items scanned : 5913
Registry threats detected : 0
File items scanned : 26135
File threats detected : 4

Adware.Tracking Cookie
C:\Documents and Settings\Bill n Will\Cookies\bill n will@cgi-bin[1].txt
C:\Documents and Settings\Bill n Will\Cookies\bill n will@doubleclick[1].txt
C:\Documents and Settings\Bill n Will\Cookies\bill n will@accounts[2].txt

Unclassified.Unknown Origin/System
C:\SYSTEM VOLUME INFORMATION_RESTORE{03F9DD48-E384-4440-A8AB-4D1FC4A57693}\RP857\A0148882.EXE

Malwarebytes’ Anti-Malware 1.41
Database version: 3119
Windows 5.1.2600 Service Pack 3

11/8/2009 1:37:43 PM
mbam-log-2009-11-08 (13-37-43).txt

Scan type: Full Scan (C:|D:|E:|)
Objects scanned: 331033
Time elapsed: 2 hour(s), 7 minute(s), 47 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

13
Adware.Tracking Cookie C:\Documents and Settings\Bill n Will\Cookies\bill n will@cgi-bin[1].txt C:\Documents and Settings\Bill n Will\Cookies\bill n will@doubleclick[1].txt C:\Documents and Settings\Bill n Will\Cookies\bill n will@accounts[2].txt
Are cookies really spyware and are they dangerous? http://www.superantispyware.com/supportfaqdisplay.html?faq=26
14

I’m new to the forums too. I have almost the same problem. Win32:MalOb-V [Cryp] instead of Win32:MalOb-T [Cryp]

I Had Avast do a full scan of my system and It found a virus.

This is what it showed:

File Name: C:\Users\Steven\AppData\Local\Temp\xcmwoesnra.exe

Maleware name: Win32:MalOb-V [Cryp]

Malware type: Virus/Worm

VPS version: 091108-1, 11/08/2009

When i tried to move to chest. It could not find the file. When I tried to delete it. It would say Access Denied. I also tried to schedule a boot scan. Also said Access Denied.

Now when I try to open my avast it won’t open. It will open to the point where it will Test memory and Startup items. After it finishes the test. It just disappears like i never opened it.

I was reading on some other posts. And I seen recommendations for installing Malwarebytes’ & Hijack this. I have installed both.

Malwarebytes’ is in the process of scanning and has found 5 objects infected so far.

I also have the results of Hijack this.