TR/Crypt.ZPACK.Gen

Blodfinger · Oct 19, 2009

Hi!

On Tuesday 13th Oct I was searching for a music-dvd. I unfortunatly/stupidly downloaded a zipped file, unzipped and opened it. I immediatly got a warning from Avira (free version) that I was infected with TR/Crypt.ZPACK.Gen.

I tried to delete it and put it in quarantine, but no matter what it kept popping up. I located the file in the system32 folder and tried to delete it manually. Everytime I did it came back with a new name. It seems that it takes the name of an existing .dll file and adds 32 to the filename, moving through the alphabet.

I also ran Spybot S&D, but it came up with nada.

It seems that everything runs perfectly on my computer, but to be honest I haven't initiated anything other than virus-scanners and Google Chrome.

I've just gone through the entire malware-removal guide, and completed every step on the list. After I finished I ran a complete system-scan in Avira, and TR/Crypt.ZPACK.Gen still showed up.

I really hope you are able to help me, since I don't know what this worm is doing to my computer, and it's freaking me out! I am afraid to log on to my bank, and I have nightmares of TR/Crypt.ZPACK.Gen. :banghead

I've attached the 5 logs you've asked for.

Looking forward to your response!

-Blodfinger

Blodfinger · Oct 19, 2009

The last log...

Kestrel13! · Oct 22, 2009

Hi and welcome. I am currently reviewing your logs and will get back to you with a set of instructions as soon as possible. Thanks for your patience during this time.

Kes13!

Kestrel13! · Oct 23, 2009

I tried to delete it and put it in quarantine, but no matter what it kept popping up. I located the file in the system32 folder and tried to delete it manually. Everytime I did it came back with a new name. It seems that it takes the name of an existing .dll file and adds 32 to the filename, moving through the alphabet.
Click to expand...

You need to give me the exact file path of where Avira is reporting it's finding malware. Your logs reveal nothing untowards, so I am leaning towards suspecting this being a false positive.

You can delete the below left over directory from limewire and then let me know about where exactly avira is finding the threat(s) and also please let me know if it's just something being detected in System Volume Information.

C:\Documents and Settings\Rhymes\Programdata\LimeWire

Blodfinger · Oct 23, 2009

Hi again!

I did like you told me and deleted the left over LimeWire directory, and I performed an Avira scan. To my delight/surprise it came up with nothing! It reacted on MGTools, but I ignored that one, and there was 7 warnings. I'll attach the log if it is of any interest to you.

Does this mean I'm clean? And if I am, is there anything else I should do to be perfectly sure the worm isn't hiding anywhere?

-B

Kestrel13! · Oct 26, 2009

You need to update to the current version of Avira which is version 9.

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we used Pocket Killbox during your cleanup, do the below

Run Pocket Killbox and select File, Cleanup, Delete All Backups

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /u

Notes: The space between the combofix" and the /u, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.

If you are running Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures in step 3 the READ ME for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Blodfinger · Oct 26, 2009

Thanks alot for the help!

All instructions and help on majorgeeks are easy to comprehend, and they resorted my problems. On top of that I learned something! Very useful!

Sincerly
-Blodfinger

Kestrel13! · Oct 26, 2009

You're welcome.

Log in or Sign up

TR/Crypt.ZPACK.Gen

Blodfinger Private E-2

Attached Files:

SASlog.txt

mbam-log-2009-10-19 (20-05-32).txt

COMBOFIXlog.txt

RRlog.txt

Blodfinger Private E-2

Attached Files:

MGlogs.zip

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Blodfinger Private E-2

Attached Files:

AVlog.txt

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Blodfinger Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member