TR/Crypt.ZPACK.Gen

Hi Dr. Chowbox,

ESET detected some files we have quarantined and what may be a couple of false positives. We'll check out the 2 files and see what other scanners have to say.

We need some file informantion

• Make sure to use Internet Explorer for this
• Please go to VirSCAN.org FREE on-line scan service
• Copy and paste the following file path, one at a time if more than file is listed, into the "Suspicious files to scan" box on the top of the page:
  
  C:\burn4free_setup.exe
  C:\WINNT\NDNuninstall4_80.exe
  
  
• Click on the Upload button
• Please ensure the scan is complete and the results saved before submitting the next.
• If a pop-up appears saying the file has been scanned already, please select the ReScan button.
• Once the Scan is completed, click on the "Copy to Clipboard" button. This will copy the link of the report into the Clipboard.
• Paste the contents of the Clipboard in your next reply.

Thanks

I'm not sure if I did it right, not sure if I can do it wrong. I scanned each of the files, so here the links.

Thanks.

VirSCAN.org Scanned Report :
Scanned time : 2011/01/13 08:56:17 (EST)
Scanner results: 3% Scanner(s) (1/36) found malware!
File Name : burn4free_setup.exe
File Size : 1833719 byte
File Type : PE32 executable for MS Windows (GUI) Intel 80386 32-bit
MD5 : 1c0762840f8389259b7c50f23c2dace2
SHA1 : 3ae47572693304371bfc41d7a5ef873157faffa9
Online report : http://virscan.org/report/e957c3d3c0ea95bb…b300b1efe8.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 5.1.0.2 20110113031635 2011-01-13 0.18 -
AhnLab V3 2011.01.11.00 2011.01.11 2011-01-11 0.09 -
AntiVir 8.2.4.134 7.11.0.248 2010-12-31 0.50 -
Antiy 2.0.18 20101228.6954489 2010-12-28 0.02 -
Arcavir 2010 201101131934 2011-01-13 0.02 -
Authentium 5.1.1 201101130228 2011-01-13 3.51 -
AVAST! 4.7.4 110113-0 2011-01-13 0.94 -
AVG 8.5.850 271.1.1/3376 2011-01-13 2.02 -
BitDefender 7.90123.6641957 7.35685 2011-01-13 8.81 -
ClamAV 0.96.5 12512 2011-01-13 0.20 -
Comodo 4.0 7379 2011-01-13 0.21 -
CP Secure 1.3.0.5 2011.01.13 2011-01-13 0.48 -
Dr.Web 5.0.2.3300 2011.01.13 2011-01-13 14.50 Adware.NavHelper
F-Prot 4.4.4.56 20110112 2011-01-12 1.89 -
F-Secure 7.02.73807 2011.01.13.05 2011-01-13 7.79 -
Fortinet 4.2.254 12.788 2011-01-12 0.13 -
GData 21.1545/21.612 20110113 2011-01-13 0.08 -
ViRobot 20110113 2011.01.13 2011-01-13 0.08 -
Ikarus T3.1.32.15.0 2011.01.13.77524 2011-01-13 5.22 -
JiangMin 13.0.900 2011.01.13 2011-01-13 0.08 -
Kaspersky 5.5.10 2011.01.13 2011-01-13 0.10 -
KingSoft 2009.2.5.15 2011.1.13.18 2011-01-13 0.08 -
McAfee 5400.1158 6224 2011-01-12 19.88 -
Microsoft 1.6402 2011.01.12 2011-01-12 0.09 -
Norman 6.06.12 6.06.00 2011-01-12 18.03 -
Panda 9.05.01 2011.01.12 2011-01-12 0.08 -
Trend Micro 9.200-1012 7.766.10 2011-01-13 0.03 -
Quick Heal 11.00 2011.01.13 2011-01-13 0.08 -
Rising 20.0 22.82.03.04 2011-01-13 0.08 -
Sophos 3.15.0 4.61 2011-01-13 3.42 -
Sunbelt 3.9.2464.2 8059 2011-01-13 0.08 -
Symantec 1.3.0.24 20110112.002 2011-01-12 0.07 -
nProtect 20110112.01 9585955 2011-01-12 0.08 -
The Hacker 6.7.0.1 v00114 2011-01-13 0.09 -
VBA32 3.12.14.2 20110112.1255 2011-01-12 5.49 -
VirusBuster 4.5.11.10 10.130.61/1989694 2011-01-03 3.56 -



VirSCAN.org Scanned Report :
Scanned time : 2011/01/13 09:09:26 (EST)
Scanner results: 33% Scanner(s) (12/36) found malware!
File Name : NDNuninstall4_80.exe
File Size : 52224 byte
File Type : PE32 executable for MS Windows (GUI) Intel 80386 32-bit
MD5 : 504b4fb4973b272b431c52bdafb1c238
SHA1 : 68be09e6486a05de5531f7041694140f453f9fdc
Online report : http://virscan.org/report/b43e492f5898ba35…20640f8eef.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 5.1.0.2 20110113031635 2011-01-13 0.08 -
AhnLab V3 2011.01.11.00 2011.01.11 2011-01-11 0.08 -
AntiVir 8.2.4.134 7.11.0.248 2010-12-31 0.27 -
Antiy 2.0.18 20101228.6954489 2010-12-28 0.02 -
Arcavir 2010 201101131934 2011-01-13 0.05 -
Authentium 5.1.1 201101130228 2011-01-13 1.43 W32/Adware.NHY (Exact)
AVAST! 4.7.4 110113-0 2011-01-13 0.01 Win32:Spyware-gen [Spy]
AVG 8.5.850 271.1.1/3376 2011-01-13 0.27 Generic.DPY
BitDefender 7.90123.6641957 7.35685 2011-01-13 6.05 Adware.Generic.64480
ClamAV 0.96.5 12512 2011-01-13 0.02 Adware.NewDotNet.B-3
Comodo 4.0 7379 2011-01-13 0.08 -
CP Secure 1.3.0.5 2011.01.13 2011-01-13 0.06 Malware.W32.NewDotNet
Dr.Web 5.0.2.3300 2011.01.13 2011-01-13 10.27 Adware.NewDotNet
F-Prot 4.4.4.56 20110112 2011-01-12 1.43 W32/Adware.NHY (exact)
F-Secure 7.02.73807 2011.01.13.05 2011-01-13 11.85 -
Fortinet 4.2.254 12.788 2011-01-12 0.08 -
GData 21.1545/21.612 20110113 2011-01-13 0.08 -
ViRobot 20110113 2011.01.13 2011-01-13 0.08 -
Ikarus T3.1.32.15.0 2011.01.13.77524 2011-01-13 5.12 not-a-virus:RiskTool.Win32.PsExec.131
JiangMin 13.0.900 2011.01.13 2011-01-13 0.08 -
Kaspersky 5.5.10 2011.01.13 2011-01-13 0.15 not-a-virus:AdWare.Win32.NewDotNet
KingSoft 2009.2.5.15 2011.1.13.18 2011-01-13 0.08 -
McAfee 5400.1158 6224 2011-01-12 18.69 -
Microsoft 1.6402 2011.01.12 2011-01-12 0.08 -
Norman 6.06.12 6.06.00 2011-01-12 12.01 W32/NewDotNet.A
Panda 9.05.01 2011.01.12 2011-01-12 0.08 -
Trend Micro 9.200-1012 7.766.10 2011-01-13 0.05 -
Quick Heal 11.00 2011.01.13 2011-01-13 0.08 -
Rising 20.0 22.82.03.04 2011-01-13 0.08 -
Sophos 3.15.0 4.61 2011-01-13 3.02 -
Sunbelt 3.9.2464.2 8059 2011-01-13 0.08 -
Symantec 1.3.0.24 20110112.002 2011-01-12 0.05 -
nProtect 20110112.01 9585955 2011-01-12 0.08 -
The Hacker 6.7.0.1 v00114 2011-01-13 0.08 -
VBA32 3.12.14.2 20110112.1255 2011-01-12 3.34 AdWare.Win32.NewDotNet
VirusBuster 4.5.11.10 10.130.61/1989694 2011-01-03 2.60 -

Hi Dr. Chowbox,

We'll remove the one file with OTL then clean up the tools. The quarantined files will be removed when we clean up the tools.

Next, Double click on OTL.exe

• Under the Custom Scans/Fixes box at the bottom, paste in the following
• Do Not copy the word CODE
• please note the fix starts with the :

:Services

:Files
C:\WINNT\NDNuninstall4_80.exe

Then click the Run Fix button at the top

• Let the program run unhindered

No need to post the log.

We'll clean up the tools.

From your desktop, please delete, if present

• any notepads/logs that we created
• Norton_Removal_Tool.exe
• GooredFix.exe
• GooredFix Backups
  
  Next
  
  * Create a new restore point
  
  You must be logged on to an administrator account
  • Go to Start - All Programs - Accessories - System Tools - System Restore.
  • Click Create a restore point, and then click Next.
  • In the text box labeled Restore Point Description, type a name for this restore point
  • click create
  * Remove old restore points
  
  
  • Go to Start - All Programs - Accessories - system tools.
  • Launch the Disk Cleanup tool and let it run.
  • When it finishes a box with tabs will appear, select the more options tab.
  • On this tab you will find a section for System Restore.
  • If you press the Clean Up button for that section, Windows will delete all restore points except for the most recent one.
  
  Open OTL then click the Clean Up button. You may get prompted by your firewall that OTL wants to contact the internet - allow this. A cleanup.txt will be downloaded, a message dialog will ask you if you want to proceed with the cleanup process, click Yes. This will do some clean up tasks and delete some of the tools you have downloaded plus itself.
  
  I suggest you keep MBAM. Keep MBAM updated and use it regularly.
  
  ESET can be uninstalled via add/remove programs.
  
  Some Recommendations and prevention tips
  
  Basic security consists of 1 antivirus program, 1 resident antispyware program, 1 on demand antispyware program and a firewall. Add a firewall to the 3 security programs you have and you are on your way to building a secure system.
  
  * If you are behind a router Windows firewall should be fine. Otherwise a 3rd party firewall with outbound monitoring is recommended.
  
  Click FIREWALL for tips, reviews and links to good, free and paid for firewalls. (Note: Zone Alarm is becoming bloatware,IMO)
  
  -Secure your Internet Explorer
  
  From within Internet Explorer click on the Tools menu and then click on Options.
  • Click once on the Security tab
  • Click once on the Internet icon so it becomes highlighted.
  • Click once on the Custom Level button.
  • Change the Download signed ActiveX controls to Prompt
  • Change the Download unsigned ActiveX controls to Disable
  • Change the Initialize and script ActiveX controls not marked as safe to Disable
  • Change the Installation of desktop items to Prompt
  • Change the Launching programs and files in an IFRAME to Prompt
  • Change the Navigate sub-frames across different domains to Prompt
  • When all these settings have been made, click on the OK button.
  • If it prompts you as to whether or not you want to save the settings, press the Yes button.
  Next press the Apply button and then the OK to exit the Internet Properties page.
  
  - Keeping your Windows up-to-date is crucial to your computer's security. Please go to the Windows Update Site (using Internet Explorer) and download and install all critical updates on a regular basis
  
  - Ensure that Automatic Update is turned on so you get all the latest patches.
  Click start, control panel, click Security Center.
  
  - Keep your antivirus program updated, as well as any other security programs you have.
  
  -More tips and programs can be found HERE
  
  - You may also want to read this article By Tony Klein
  http://www.freedomlist.com/forum/viewtopic.php?t=22879
  
  We will keep this thread open for a couple of days. Please post back if you have any problems or questions. Please post back when you have finished so this thread can be marked "Resolved".
  
  Take care

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.