My sister's computer is infected with the Win32/Cryptor virus, and I'm helping her get rid of it. She's on Windows XP SP3.

AVG 8.5 continually detects it, but can't get rid of it.

Are there any free anti-malware tools that can get rid of this one?

Alternatively, are there some step-by-step instructions that actually work?



The best guaranteed way to get rid of a virus is a full format and OS reinstall.

Sorry, it's probably not what you wanted to hear, but a lot of virus pave the way for other viruses. You'll find that you might get rid of it, but you'll have more problems shortly after. Bite the bullet and do a full format reinstall.

(Obviously, backup important data to something first, and be very careful that you don't carry the virus with you in the backup).

If you really don't want to do that, check out HijackThis. It might help you figure out where the virus is attaching to the system.

[Disclaimer: HijackThis is an advanced tool that lists potential attachment points, not detected viruses. do not just blindly clean everything that HijackThis detected. HijackThis should be used to analyse the state of your computer, it is not an automatic clean up tool. If you are at all unsure, post your HijackThis log report to a security/spyware/virus forum (Not here, there are dedicated forums for this) and get an experts advice before taking any action)]

  • HijackThis is dangerous in that almost everything it shows is legal and is dangerous to "fix". It's mostly only used for sending reports to anti-virus specialists. DON'T USE IT. I've seen people totally destroy their Windows installation with it.
    – harrymc
    Oct 13 '09 at 19:27
  • @harrymc: Good point. I've added some warnings. Oct 14 '09 at 9:45
  • Thumbs up for HijackThis, but full format and reinstall? That's IMHO a bit... Exaggerated, if this is the right word. Anyway, as for the HijackThis, I believe there gotta be a some kind of forum, where you can send HT log and they'll tell you what to delete. At least there is such forum in Czech.
    – sYnfo
    Oct 14 '09 at 10:32
  • +1 Reinstall is the only way to be certain an infected computer is not owned by someone else than the intended user. Seriously. Oct 16 '09 at 12:50
  • i tend to agree with Oskar & Simon, on the "nuke it from orbit / only way to be sure" principle. but it is enough of a pain that you are probably "safe enough" attempting to remove it. Oct 16 '09 at 15:01

Malwarebytes' Anti-Malware is excellent for removing viruses.

If required, manual removal instructions are here.

However, if you're not computer-savvy, you can also use an antivirus online scan such as Trend Micro House Call and Kaspersky Labs Free Virus Scan. Please note that they might require you to use Internet Explorer as your browser and that each scan may take several hours.

  • Those manual instructions don't make a lot of sense. First it says delete the files (which I can't find anyway), then later is says I should unregister the dlls. It just seems like a bunch of random instructions designed to confuse people and get them to buy the product that that page is touting. Thanks for the other hints though.
    – codeulike
    Oct 13 '09 at 22:15
  • These instructions may be a compilation of advice by different people. If you don't have the right files for this virus, this might be a false positive by AVG. Try scanning with Malwarebytes (remember to update the signatures), then scan with Kaspersky online scan. If nothing is found, then you're most probably not infected.
    – harrymc
    Oct 14 '09 at 7:58

Have you tried some other antivirus products?


I'd recomend MWAV. It's one on the best on-demand AV out there, as far as I know. It's very slow, but detects (and is able to remove) almost everything.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.