What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

How to remove Crypt.XPACK.Gen3... and seems to be more trojans

3 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hello guys
First of all, thanks for your great work that you do here and thanks for sharing your knowledge with us. In my case, I would never know what to do in a situation like this (even read all this information that I send to you). So, this started after I ignored for a long time the finding of Avira of the trojan Crypt.XPACK.Gen3 in an certain e-mail that I couldn't found. Yesterday I realised that Avira found more than this trojan Crypt.XPACK.Gen3, after my internet navigation started drastically to slow down, even to a point of stop.
Hope you give me an help on this one. Below goes the log from HiJackThis
Thank you VERY MUCH!!!
Ricardo

PS: I've already posted this topic… its a pity that you dont send an e-mail-notification when a reply arrives.
I have downloaded GIMP, disabled "IAT/EAT" and others… and after GIMP started scaning the computed rebooted automatically without finishing scan. Don't know what it means :-/
Thanks (I'll keep a closer look at this Topic for any reply)


Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:30:31, on 12-10-2011
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\SCardSvr.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Programas\Avira\AntiVir Desktop\sched.exe
C:\Programas\Avira\AntiVir Desktop\avguard.exe
C:\Programas\Conceptronic\Bluetooth Software\bin\btwdins.exe
C:\WINNT\System32\svchost.exe
C:\Programas\Java\jre6\bin\jqs.exe
C:\Programas\CDBurnerXP\NMSAccessU.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\RUNDLL32.EXE
C:\WINNT\RTHDCPL.EXE
C:\Programas\Ficheiros comuns\InstallShield\UpdateService\issch.exe
C:\Programas\Avira\AntiVir Desktop\avgnt.exe
C:\Programas\Ficheiros comuns\Java\Java Update\jusched.exe
C:\Programas\QuickTime\qttask.exe
C:\Programas\iTunes\iTunesHelper.exe
C:\Programas\Ficheiros comuns\Adobe\ARM\1.0\AdobeARM.exe
C:\Programas\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Programas\Conceptronic\Bluetooth Software\BTTray.exe
C:\Documents and Settings\Ricardo\Application Data\Dropbox\bin\Dropbox.exe
C:\Programas\iPod\bin\iPodService.exe
C:\WINNT\System32\svchost.exe
C:\Programas\OpenOffice.org 3\program\soffice.exe
C:\Programas\OpenOffice.org 3\program\soffice.bin
c:\programas\ficheiros comuns\installshield\updateservice\isuspm.exe
C:\Programas\Ficheiros comuns\InstallShield\UpdateService\agent.exe
C:\Programas\Ficheiros comuns\Java\Java Update\jucheck.exe
C:\Programas\Mozilla Thunderbird\thunderbird.exe
C:\Programas\Mozilla Firefox\firefox.exe
C:\WINNT\system32\msiexec.exe
C:\Programas\HijackThis\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pt/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 10.0.0.1:3128
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hiperligações
O2 - BHO: Facilitador de Leitor de Link Adobe PDF - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programas\Ficheiros comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programas\Ficheiros comuns\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programas\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programas\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programas\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] "c:\Programas\Ficheiros comuns\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Programas\Ficheiros comuns\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [avgnt] "C:\Programas\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programas\Ficheiros comuns\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programas\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programas\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programas\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Programas\Ficheiros comuns\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\WINNT\system32\Macromed\Flash\FlashUtil10l_Plugin.exe -update plugin
O4 - HKUS\.DEFAULT\..\Run: [internat.exe] internat.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Programas\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Startup: Dropbox.lnk = C:\Documents and Settings\Ricardo\Application Data\Dropbox\bin\Dropbox.exe
O4 - Startup: OpenOffice.org 3.2.lnk = C:\Programas\OpenOffice.org 3\program\quickstart.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programas\Ficheiros comuns\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Assistente do Acrobat.lnk = C:\Programas\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: BTTray.lnk = C:\Programas\Conceptronic\Bluetooth Software\BTTray.exe
O8 - Extra context menu item: Send To &Bluetooth - C:\Programas\Conceptronic\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programas\Conceptronic\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programas\Conceptronic\Bluetooth Software\btsendto_ie.htm
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1275672190296
O22 - SharedTaskScheduler: Pré-carregador Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINNT\system32\browseui.dll
O22 - SharedTaskScheduler: Daemon da cache de categorias dos componentes - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINNT\system32\browseui.dll
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Programas\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programas\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Programas\Conceptronic\Bluetooth Software\bin\btwdins.exe
O23 - Service: Serviço administrativo de gestão de discos lógicos (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: iPod Service - Apple Inc. - C:\Programas\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programas\Java\jre6\bin\jqs.exe
O23 - Service: NMSAccess - Unknown owner - C:\Programas\CDBurnerXP\NMSAccessU.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe

–
End of file - 7212 bytes

Attachments:

Post #2
Hi and Welcome!! :) My name is Jeff. I would be more than happy to take a look at your malware results logs and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.
  • Be sure to subscribe to the topic so that you will receive notifications when there are new responses.
IMPORTANT NOTE : Please do not delete, download or install anything unless instructed to do so.
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision. Doing so could make your system inoperable and could require a full reinstall of your Operating System and losing all your programs and data.

Having said that….Let's get going!! :thumbup:
———-

While I am reviewing the logs that you provided please do the following:

Please download aswMBR to your desktop.

  • Double click the aswMBR icon to run it.
  • Click the Scan button to start scan.
  • When it finishes, press the save log button, save the logfile to your desktop and post its contents in your next reply.

[external image: Posted Image]
Click the image to enlarge it
———-
Post #3
Hello, Jeff And many thanks for your kind work! So, here is the result of the aswMBR. I attach the TXT and as for the DAT file that was produced, don't know if it is important. Many thanks. Ricardo

Attachments:

Post #5
Hello Yes, I believe so. This is my work station… and its weird geting this Avira result on an e-mail dated before I started working here…
Post #7
Hello, Jeff Well, this is my work station, but I'm using my computer here. It became as a free-use part of my contract. I use my computer everyday but, during my work hours, I was authorised to use my computer as with all the others of the company, in order to easy as I feel the need to do so (because I am more used to it). So, every now and then, I use it at work. For example, they had problems in recovering an e-mail in Thunderbird. I had Thunderbird in my computer, so, I "gave them a hand" and tryed to import the dayam previously exported e-mails. After that, my computer became slow and Avira detected the trojan in a e-mail file :-? I guess this was it, Jeff (sorry for my bad english)
Post #8
Hi pinkfloydian,

(sorry for my bad english)

Your English is just fine. :)

Does the company that you work for have an IT department? If so, I would advise that you take it to them for assistance with this problem.

We generally only help with home computers.

Working on a corporate computer can sometimes change settings (which I have seen in the logs that you have provided) and potentially harm your system which your company might not be too pleased about and could leave us liable for a lawsuit.
Post #9
Good morning, Jeff Well, it's a small company with no IT department AND… near to be closed. Since the computer is mine, so, of course that I'll keep it when it closed, there will be no lawsuits. They don't even know I'm consulting you. As for the "change of settings" that you mentioned, well, this machine as been here for some years :-/. Server and stuff, don't know if thats what makes that change occur :-/ but if this causes you trouble, no problem. Sorry if I haven't said this information before. Thanks anyway for your work, Jeff

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI