Results 1 to 4 of 4

Thread: Infected with TR/Crypt.XPACK.Gen2 Trojan

  1. #1
    Junior Member
    Join Date
    Apr 2011

    Default Infected with TR/Crypt.XPACK.Gen2 Trojan

    Yesterday, I went on a site accidentally that looked like a fake anti-virus. After, Avira detected malware,TR/Crypt.XPACK.Gen2 Trojan. I tried to remove it, but it did not work. Today, I turned on my computer and Avira cannot be started. Please help!

    My DDS Log: .
    DDS (Ver_11-03-05.01) - NTFSx86
    Run by Lee ^^ ~ !! at 20:37:45.65 on 08/04/2011
    Internet Explorer: 8.0.6001.17184
    Microsoft Windows XP Professional 5.1.2600.2.950.886.1033.18.1015.496 [GMT -4:00]
    AV: AntiVir Desktop *Disabled/Outdated* {AD166499-45F9-482A-A743-FDD3350758C7}
    ============== Running Processes ===============
    C:\WINDOWS\system32\svchost -k DcomLaunch
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    C:\Program Files\Ahead\InCD\InCDsrv.exe
    C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
    C:\Program Files\Avira\AntiVir Desktop\sched.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    C:\Program Files\Microsoft IntelliPoint\point32.exe
    C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
    C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Free Desktop Clock\DesktopClock.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\3web\3web.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Documents and Settings\Lee ^^ ~ !!\Desktop\dds.scr
    ============== Pseudo HJT Report ===============
    uSearch Page = hxxp://*
    uSearch Bar = hxxp://*
    uStart Page = about:blank
    uSearchMigratedDefaultURL = hxxp://{searchTerms}&ei=utf-8&fr=b1ie7
    uInternet Settings,ProxyOverride = *.local
    mWinlogon: SfcDisable=-99 (0xffffff9d)
    BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~1\office12\GRA8E1~1.DLL
    BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
    BHO: : {933e7167-f302-48c8-a4e9-19c4d4c15b3b} - c:\progra~1\3web\AFE.dll
    EB: Groove Folder Synchronization: {2a541ae1-5bf6-4665-a8a3-cfa9672e4291} - c:\progra~1\micros~1\office12\GRA8E1~1.DLL
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    uRun: [EPSON Stylus CX7400 Series] c:\windows\system32\spool\drivers\w32x86\3\e_faticda.exe /fu "c:\windows\temp\E_SC6.tmp" /EF "HKCU"
    uRun: [SkinClock] c:\program files\free desktop clock\DesktopClock.exe
    mRun: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    mRun: [igfxtray] c:\windows\system32\igfxtray.exe
    mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe
    mRun: [IntelliPoint] "c:\program files\microsoft intellipoint\point32.exe"
    mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
    mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
    mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
    mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~1\office12\EXCEL.EXE/3000
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~1\office12\ONBttnIE.dll
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~1\office12\REFIEBAR.DLL
    LSP: c:\program files\speedbit video accelerator\SBLSP.dll
    Trusted Zone:\kb2
    DPF: {556DDE35-E955-11D0-A707-000000521957} - hxxp://
    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://
    TCP: {F7F22C5E-D5CE-4C5C-AFFD-770308D09B72} =
    Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
    Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\progra~1\micros~1\office12\GR99D3~1.DLL
    Notify: igfxcui - igfxdev.dll
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
    SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~1\office12\GRA8E1~1.DLL
    ================= FIREFOX ===================
    FF - ProfilePath -
    ============= SERVICES / DRIVERS ===============
    R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2010-11-25 11608]
    R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2010-11-25 135336]
    R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2010-11-25 61960]
    R2 VideoAcceleratorService;VideoAcceleratorService;c:\progra~1\speedb~1\videoacceleratorservice.exe -start -scm --> c:\progra~1\speedb~1\VideoAcceleratorService.exe -start -scm [?]
    S2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2010-11-25 269480]
    =============== Created Last 30 ================
    2011-04-09 00:23:19 -------- d-----w- c:\windows\system32\wbem\repository\FS
    2011-04-09 00:23:19 -------- d-----w- c:\windows\system32\wbem\Repository
    2011-03-12 17:28:40 103864 ----a-w- c:\program files\mozilla firefox\plugins\nppdf32.dll
    2011-03-12 17:28:40 103864 ----a-w- c:\program files\internet explorer\plugins\nppdf32.dll
    ==================== Find3M ====================
    2011-01-22 05:29:02 172032 ----a-w- c:\windows\system32\AniGIF.ocx
    2004-03-11 18:27:22 40960 ----a-w- c:\program files\Uninstall_CDS.exe
    ============= FINISH: 20:38:35.06 ===============

  2. #2
    Join Date
    Aug 2007


    Hello and welcome to Safer Networking.

    My name is km2357 and I will be helping you to remove any infection(s) that you may have.

    I will be giving you a series of instructions that need to be followed in the order in which I give them to you.

    If for any reason you do not understand an instruction or are just unsure then please do not guess, simply post back with your questions/concerns and we will go through it again.

    Please do not start another thread or topic, I will assist you at this thread until we solve your problems.

    Lastly the fix may take several attempts and my replies may take some time but I will stick with it if you do the same.

    Sorry for the delay in replying, the forum is very busy. If you still need help, please do the following:

    Step # 1 Download and run DDS

    Download DDS and save it to your desktop from here or here or here
    Disable any script blocker, and then double click dds.scr to run the tool.
    • When done, DDS will open two (2) logs:
      1. DDS.txt
      2. Attach.txt
    • Save both reports to your desktop. Post them back to your topic.

    Step # 2: Download and Run Gmer

    Please download from Gmer and save it to your desktop.

    ***Please close any open programs ***

    Double-click gmer.exe. The program will begin to run.

    These types of scans can produce false positives. Do NOT take any action on any "<--- ROOTKIT" entries unless advised by a trained Security Analyst

    If possible rootkit activity is found, you will be asked if you would like to perform a full scan. Click No.

    If you do not receive notice about possible rootkit activity remain on the Rootkit/Malware tab & make sure that the 'Sections' button is ticked and the 'Show All' button is unticked.
    • Click the Scan button and let the program do its work. GMER will produce a log.
    • Once the scan is complete, you may receive another notice about rootkit activity.
    • Click OK.
    • GMER will produce a log. Click on the Save button, and save the log as gmer.txt somewhere you can easily find it, such as your desktop.

    DO NOT touch the PC at ALL for Whatever reason/s until it has 100% completed its scan, or attempted scan in case of some error etc !

    Please post the results from the GMER scan in your reply.

    In your next post/reply, I need to see the following:

    1. The two DDS Logs (DDS and Attach.txt)
    2. The GMER Log

    Use multiple posts if you can't fit everything into one post
    Malware Removal University Master
    Member of ASAP & UNITE

  3. #3
    Join Date
    Aug 2007


    lele890? Do you still need help?
    Malware Removal University Master
    Member of ASAP & UNITE

  4. #4
    Join Date
    Aug 2007


    This topic has been archived due to inactivity.

    If it has been three days or more since your last post, and the helper assisting you
    posted a response to that post to which you did not reply, your topic will not be
    reopened. At that point, if you still require help, please start a new topic and include
    a new DDS log with a link to your previous thread. Please do not add any logs that
    might have been requested in the closed topic, you would be starting fresh.

    Applies only to the original poster, anyone else with similar problems please start a new
    Malware Removal University Master
    Member of ASAP & UNITE

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts