TR/Crypt.XPACK.Gen Trojan infection

I've been struggling with this trojan for a few days now and have run all required programs to the best of my ability. Here are some of my log file attachments.

I hope I've done everything correctly. The only thing I saw that happened was that when I installed Superantispyware I didn't catch where to turn on off the automatic run and so when my computer restarted my Malwarebytes and my Superantispyware started at the same time which I quickly switched one off. I know not to run these two together with realtime on.

Thank you so very much in advance!

Here are some of my attachments:

 

Hi, Welcome to MajorGeeks!

I'm currently reviewing your logs, please be patient as there is a lot of information to review

 

Let's use ComboFix again to remove some malware files

* Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
If it is not on your Desktop, the below will not work.
* Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
* If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
* Open Notepad and copy/paste the text in the below code box into it (make sure you scroll all the way down in the code box to get all lines selected ):

Code:

KILLALL::
 
DirLook::
C:\Users\cpbunch\AppData\Local\{3E5EE1B9-B7BB-451A-B735-1B60282312A9}
C:\Users\cpbunch\AppData\Local\{52B6BEF5-45FB-46B8-8D66-C44BA35FA63A}
C:\Users\cpbunch\AppData\Local\{626382EB-64AD-4345-8850-3AF0683066E2}
C:\Users\cpbunch\AppData\Local\{72638510-3A8E-4D2F-8B4D-DE4B318FC23B}
C:\Users\cpbunch\AppData\Local\{80E89053-3449-4E83-A590-71873D88B59E}
C:\Users\cpbunch\AppData\Local\{8C77C9DE-17BB-4C87-86E4-7259700B33FF}
C:\Users\cpbunch\AppData\Local\{A788EE9E-5E43-4309-8274-4BEE3A0A7648}
C:\Users\cpbunch\AppData\Local\{A7BF3BEF-F9A2-4A14-9F62-3969DA13D8FD}
C:\Users\cpbunch\AppData\Local\{BD40AC51-2F30-49A0-A347-BE1B348D152D}
C:\Users\cpbunch\AppData\Local\{BE728C60-78C6-4B8B-8A86-7EBA9CCDD838}
C:\Users\cpbunch\AppData\Local\{D449F7C5-2EBD-4B01-97FC-CAEB35FA82EF}
C:\Users\cpbunch\AppData\Local\{E7687519-B073-4479-94BB-223D002D639C}
C:\Users\cpbunch\AppData\Local\{EA05D506-B431-4B82-864A-69D8AA02C7DA}
C:\Users\cpbunch\AppData\Local\{EBC521DF-C41A-4EEC-8812-FCABF5E75105}
C:\Users\cpbunch\AppData\Local\{FF0C4C31-C5E5-4411-AE3D-40A7F97D05DD}
C:\ProgramData\{E91883C8-8CDC-46A4-A45F-CB40EB82ED60}
 
Registry::
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{D18C0FF9-9181-47DC-A88C-525D20C236D0}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{D18C0FF9-9181-47DC-A88C-525D20C236D0}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\NoExplorer]

* Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
* At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
* You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
If it asks you to overide the previous file with the same name, click YES.
* Now use your mouse to drag CFscript.txt on top of ComboFix.exe
http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
* Follow the prompts.
* When it finishes, a log will be produced named c:\combofix.txt
* I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

Note: If after running Combofix you discover none of your programs will open up, and you receive the following error: "Illegal operation attempted on a registry key that has been marked for deletion". Then the answer is to REBOOT the machine, and all will be corrected.


I want you to run TDSSKiller so refer to the below for how to do so.

TDSSkiller - How to run

After you have finished with TDSSKiller..


Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).


Then attach the below logs:

• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

Thank you so much helping me do this.

I did upload that file to the site that you had on here but it didn't do anything and nothing came up in the results.

As I'm attaching these logs I believe I did do something wrong. I ran the mgtools.exe instead of the bat file you wanted me to. I hope that didn't mess things up too badly. I'm really trying to follow your instructions to the T. I can't thank you enough for helping me.

The computer is running faster now and I'm not getting any wireless assistance errors or diagnostics errors any longer.

I've attached the log files for you here:

 

Glad to hear that things are running better now.

Now let's use ComboFix again for some more testing.

* Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
If it is not on your Desktop, the below will not work.
* Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
* If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
* Open Notepad and copy/paste the text in the below code box into it (make sure you scroll all the way down in the code box to get all lines selected ):

Code:

KILLALL::

File::
C:\Users\cpbunch\AppData\Local\BITFD53.tmp
FileLook::
C:\Users\cpbunch\Local Settings\TEMP\~DFA650E881064FCA51.TMP
C:\Users\cpbunch\Local Settings\TEMP\~DF639F5B9E9555028A.TMP
DirLook::
C:\Users\cpbunch\AppData\Local\{284F270E-A059-4B51-A3DE-6ED2A5040906}

* Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
* At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
* You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
If it asks you to overide the previous file with the same name, click YES.
* Now use your mouse to drag CFscript.txt on top of ComboFix.exe
http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
* Follow the prompts.
* When it finishes, a log will be produced named c:\combofix.txt
* I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

Note: If after running Combofix you discover none of your programs will open up, and you recieve the following error: "Illegal operation attempted on a registry key that has been marked for deletion". Then the answer is to REBOOT the machine, and all will be corrected.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

• C:\MGlogs.zip

Also, a friendly reminder, please do not install anymore software until we are completely done

 

Hi thanks again! I promise I won't install anything else. I did put in Comodo Firewall and a Windows Update that I couldn't get installed before. Sorry I guess I wasn't thinking.

Something good too that happened. I had lost the function of my left click about a month ago and I have it back again. I had originally switched to right click and it was a pain but I went in to the mouse control and tested it and now it is working great. Could that be where one of the viruses originated?

I do have a couple of questions:

1. Can you give me some pointers when I get the all clear of how to use the Comodo firewall. It has told me that computers are trying to connect to mine via Yahoo, Skype, and a 'System' program. It says the programs are safe but if you don't know what it is to block it so I've been blocking it. I've been turning the programs off when I run the scans though.

2. I have these two icons on my desktop called desktop.ini - these are new. Can these be deleted?

Thanks again!!! Let me know if there is anything else that needs done. Computer is running great but I want to be sure I have the nasties all out.

Here are the reports from my scans today:

 

Hi

Just wanted to let you know that when logging in just a few minutes ago, I got this error again:

Device stopped working: C:\Windows\system32\GfxUI.exe

This is the same error I received the other day and then my wireless connection assistant stopped working and finally the internet.

Just wanted to let you know.

Thanks so much again!

 

Most likely yes

I personally have no experience with Comodo firewall, however, it sounds like Comodo is asking you if you want to allow certain programs access to the Internet. I use Zone Alarm, and it does the same thing to me at first with new programs. This may be something to ask about in the Software forum.

These are system files, they will go away once we finish our final steps, which we are about to do

But, if you want to delete an empty folder, you can manually remove this one through explorer.

Code:

c:\users\cpbunch\AppData\Local\{284F270E-A059-4B51-A3DE-6ED2A5040906}

This actually isn't malware related. This is something that can be looked into at the Software forum.

These latest logs are completely clean


If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real time protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.We recommend them for doing backup scans when you suspect a malware infection.
2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\combofix" /uninstall
     • Notes: The space between the combofix" and the /uninstall, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
3. Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
7. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
8. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
   • Refer to the cleaning procedures pointed to by step 7 of the READ ME
     for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
9. After doing the above, you should work thru the below link:
   • How to Protect yourself from malware!

Malware removal from a National Chain = $149
Malware removal from MajorGeeks = $0

Help Support MajorGeeks
Buy Discounted Software @ Majorgeeks Store. Giveaways Too!

Majorgeeks Geek Wear. Hats, T-Shirts, Hoodies

MajorGeeks on FaceBook

 

Thanks so much for reply! One thing I've noticed is that mouse is starting to "act" up again with having to click more than once for it to take. It's not all the time but this is how it started before. Should I run anything else or go ahead and do these cleanup steps?

I'll be keeping the malwarebyes, superantispyware, and comodo firefall and antivir after the cleanup.

Thanks!

 

Mmm well your logs are clean, might be a hardware problem or another type of Windows problem. I would proceed with the cleanup steps.