TR/Crypt.XPACK.Gen2Fermé

Question

Bonjour, 
Je viens de remettre en route un vieux PC qui est infecté par ce virus (TR/Crypt.XPACK.Gen2)
UC à 100%, mon antivirus (Avira) a mit plus de 12h à scanner la bestiole...
Quelles sont les solutions?
Par ailleurs, je n'arrive pas à me débarrasser de PnkbstrA qui s'était installé à l'époque quand je jouais à BF2.
Merci de vos réponses


Configuration: Windows 7 / Firefox 49.0

Malekal_morte- · Answer

Salut,

Donne le rapport Antivir.
Pour voir la détection.

JSIrie · Answer

Le voici, je viens aussi de lancer un scan ZHPCleaner je le fais suivre dès que c'est terminé. Avira Free Antivirus Report file date: dimanche 25 septembre 2016 13:07 The program is running as an unrestricted full version. Online services are no longer available since s. Licensee : Avira Free Antivirus Serial number : 0000149996-ADJIE-0000001 Platform : Microsoft Windows XP Windows version : (Service Pack 3) [5.1.2600] Boot mode : Normally booted Username : SYSTEM Computer name : PCCYRIL Version information: BUILD.DAT : 13.0.0.4052 55009 Bytes 29/08/2013 18:03:00 AVSCAN.EXE : 13.6.20.2100 639032 Bytes 20/08/2013 08:44:56 AVSCANRC.DLL : 13.6.20.2174 52280 Bytes 20/08/2013 08:44:56 LUKE.DLL : 13.6.20.2174 65080 Bytes 20/08/2013 08:46:42 AVSCPLR.DLL : 13.6.20.2174 92216 Bytes 20/08/2013 08:45:00 AVREG.DLL : 13.6.20.2174 250424 Bytes 20/08/2013 08:44:54 avlode.dll : 13.6.20.2174 497720 Bytes 20/08/2013 08:44:52 avlode.rdf : 13.0.1.42 26846 Bytes 28/08/2013 13:50:17 VBASE000.VDF : 7.11.70.0 66736640 Bytes 04/04/2013 14:21:03 VBASE001.VDF : 7.11.74.226 2201600 Bytes 30/04/2013 13:54:50 VBASE002.VDF : 7.11.80.60 2751488 Bytes 28/05/2013 14:16:59 VBASE003.VDF : 7.11.85.214 2162688 Bytes 21/06/2013 12:13:34 VBASE004.VDF : 7.11.91.176 3903488 Bytes 23/07/2013 12:40:18 VBASE005.VDF : 7.11.98.186 6822912 Bytes 29/08/2013 13:51:16 VBASE006.VDF : 7.11.98.187 2048 Bytes 29/08/2013 13:51:17 VBASE007.VDF : 7.11.98.188 2048 Bytes 29/08/2013 13:51:17 VBASE008.VDF : 7.11.98.189 2048 Bytes 29/08/2013 13:51:17 VBASE009.VDF : 7.11.98.190 2048 Bytes 29/08/2013 13:51:17 VBASE010.VDF : 7.11.98.191 2048 Bytes 29/08/2013 13:51:17 VBASE011.VDF : 7.11.98.192 2048 Bytes 29/08/2013 13:51:17 VBASE012.VDF : 7.11.98.193 2048 Bytes 29/08/2013 13:51:17 VBASE013.VDF : 7.11.99.52 270848 Bytes 30/08/2013 13:51:17 VBASE014.VDF : 7.11.99.167 210944 Bytes 02/09/2013 13:51:31 VBASE015.VDF : 7.11.100.3 265216 Bytes 03/09/2013 13:51:55 VBASE016.VDF : 7.11.100.95 220160 Bytes 04/09/2013 12:23:54 VBASE017.VDF : 7.11.100.197 143872 Bytes 05/09/2013 12:20:06 VBASE018.VDF : 7.11.101.11 227840 Bytes 06/09/2013 12:20:55 VBASE019.VDF : 7.11.101.79 148480 Bytes 07/09/2013 12:20:58 VBASE020.VDF : 7.11.101.169 305664 Bytes 10/09/2013 12:22:28 VBASE021.VDF : 7.11.102.9 253440 Bytes 12/09/2013 07:11:01 VBASE022.VDF : 7.11.102.10 2048 Bytes 12/09/2013 07:11:01 VBASE023.VDF : 7.11.102.11 2048 Bytes 12/09/2013 07:11:01 VBASE024.VDF : 7.11.102.12 2048 Bytes 12/09/2013 07:11:01 VBASE025.VDF : 7.11.102.13 2048 Bytes 12/09/2013 07:11:01 VBASE026.VDF : 7.11.102.14 2048 Bytes 12/09/2013 07:11:01 VBASE027.VDF : 7.11.102.15 2048 Bytes 12/09/2013 07:11:01 VBASE028.VDF : 7.11.102.16 2048 Bytes 12/09/2013 07:11:01 VBASE029.VDF : 7.11.102.17 2048 Bytes 12/09/2013 07:11:01 VBASE030.VDF : 7.11.102.18 2048 Bytes 12/09/2013 07:11:02 VBASE031.VDF : 7.11.102.146 282624 Bytes 15/09/2013 13:40:43 Engine version : 8.2.12.120 AEVDF.DLL : 8.1.3.4 102774 Bytes 13/06/2013 18:07:10 AESCRIPT.DLL : 8.1.4.148 516478 Bytes 06/09/2013 12:21:02 AESCN.DLL : 8.1.10.4 131446 Bytes 26/03/2013 13:36:02 AESBX.DLL : 8.2.16.26 1245560 Bytes 23/08/2013 21:16:14 AERDL.DLL : 8.2.0.128 688504 Bytes 13/06/2013 18:07:08 AEPACK.DLL : 8.3.2.28 749945 Bytes 13/09/2013 13:11:48 AEOFFICE.DLL : 8.1.2.76 205181 Bytes 08/08/2013 12:50:03 AEHEUR.DLL : 8.1.4.630 6164858 Bytes 13/09/2013 13:11:47 AEHELP.DLL : 8.1.27.6 266617 Bytes 28/08/2013 01:50:22 AEGEN.DLL : 8.1.7.14 446839 Bytes 06/09/2013 12:20:57 AEEXP.DLL : 8.4.1.62 328055 Bytes 13/09/2013 13:11:48 AEEMU.DLL : 8.1.3.2 393587 Bytes 19/09/2012 13:42:55 AECORE.DLL : 8.1.32.0 201081 Bytes 23/08/2013 21:16:02 AEBB.DLL : 8.1.1.4 53619 Bytes 05/11/2012 14:00:38 AVWINLL.DLL : 13.6.20.2174 23608 Bytes 20/08/2013 08:44:09 AVPREF.DLL : 13.6.20.2174 48184 Bytes 20/08/2013 08:44:54 AVREP.DLL : 13.6.20.2174 175672 Bytes 20/08/2013 08:44:55 AVARKT.DLL : 13.6.20.2174 258104 Bytes 20/08/2013 08:44:13 AVEVTLOG.DLL : 13.6.20.2174 165432 Bytes 20/08/2013 08:44:41 SQLITE3.DLL : 3.7.0.1 397088 Bytes 19/09/2012 17:17:40 AVSMTP.DLL : 13.6.20.2174 60472 Bytes 20/08/2013 08:45:27 NETNT.DLL : 13.6.20.2174 13368 Bytes 20/08/2013 08:46:43 RCIMAGE.DLL : 13.6.20.2174 4788792 Bytes 20/08/2013 08:44:10 RCTEXT.DLL : 13.6.20.2175 66616 Bytes 04/09/2013 12:23:11 Configuration settings for the scan: Jobname.............................: Complete system scan Configuration file..................: c:\program files\avira\antivir desktop\sysscan.avp Reporting...........................: default Primary action......................: Interactive Secondary action....................: Ignore Scan master boot sector.............: on Scan boot sector....................: on Boot sectors........................: C:, D:, Process scan........................: on Extended process scan...............: on Scan registry.......................: on Search for rootkits.................: on Integrity checking of system files..: off Scan all files......................: All files Scan archives.......................: on Limit recursion depth...............: 20 Smart extensions....................: on Macrovirus heuristic................: on File heuristic......................: extended Skipped files.......................: C:\Documents and Settings\Compaq_Propriétaire\Mes documents\Downloads\Call_of_Duty_Black_Ops_French, C:\Documents and Settings\Usurpateur\Mes documents\Téléchargements\BFME2\BFME2\game.dat, C:\Documents and Settings\Usurpateur\Mes documents\Téléchargements\From Dust Skidrow\ubiorbitapi_r2.dll, C:\Documents and Settings\Virginie\Mes documents\Downloads\Chronicles of Mystery L' arbre de vie[FR]\Chronicles of Mystery L' arbre de vie\Chronicles of Mystery L' arbre de vie\ChoM2.exe, C:\Documents and Settings\Virginie\Mes documents\Downloads\Secrets of the Dark La Montagne du Demon Edition Collector[FR]\Secrets of the Dark La Montagne du Demon Edition Collector\SecretsOfTheDark.exe, C:\Program Files\GlobalSCAPE\CuteFTP 8 Professional\patch.exe, C:\Program Files\SFR\Mediacenter Evolution\MediaCenter.exe, F:\Jeux\[FR]Le seigneur des Anneaux la bataille pour la terre du milieu II\keygen.exe, F:\Jeux\Allora et le Portal Detruit\Allora_Broken_Portal.exe, F:\Jeux\Allora et le Portal Detruit\Allora_Broken_Portal.exe.exe, F:\Jeux\Allora et le Portal Detruit\data_fr.img, F:\Jeux\Allora et le Portal Detruit\thwchln.exe, F:\Jeux\Eufloria 2.06, F:\LOGICIELS\Globalscape.Cuteftp.Professional.8.3.3.054.Cracked-REVENGE\cuteftppro.exe, F:\LOGICIELS\Globalscape.Cuteftp.Professional.8.3.3.054.Cracked-REVENGE\Patch\file_id.diz, F:\LOGICIELS\Globalscape.Cuteftp.Professional.8.3.3.054.Cracked-REVENGE\Patch\patch.exe, F:\LOGICIELS\Xilisoft Video Converter 3.1.52.0124 + keygen\Keygen\Video Converter.exe, F:\LOGICIELS\Xilisoft Video Converter 3.1.52.0124 + keygen\x-video-converter 3.1.52.0124.exe, K:\Crack\NFSHP_Activator.exe, K:\Crack\rld-tw2k.exe, L:\Crack\generals.exe, L:\Crack\NFSHP_Activator.exe, L:\Keygen\CC generals keygen.exe, N:\Downloads\Eufloria 2.06\Eufloria.exe, N:\Downloads\ksp-win-0-19-1\KSP_win\KSP.exe, N:\Downloads\ReflexiveGame.English.Pack1, N:\Downloads\ReflexiveGame.English.Pack1\Reflexive Unlockers\Cracker\FFF-ReflexV2.exe, N:\Downloads\ReflexiveGame.English.Pack1\Reflexive Unlockers\Keygen, N:\Downloads\ReflexiveGame.English.Pack1\Reflexive Unlockers\Keygen\ZWT Reflexive Keygen.exe, Start of the scan: dimanche 25 septembre 2016 13:07 Starting master boot sector scan: Master boot sector HD0 [INFO] No virus was found! Start scanning boot sectors: Boot sector 'C:\' [INFO] No virus was found! Boot sector 'D:\' [INFO] No virus was found! Starting search for hidden objects. The scan of running processes will be started: Scan process 'rsmsink.exe' - '29' Module(s) have been scanned Scan process 'msdtc.exe' - '40' Module(s) have been scanned Scan process 'dllhost.exe' - '61' Module(s) have been scanned Scan process 'dllhost.exe' - '45' Module(s) have been scanned Scan process 'vssvc.exe' - '48' Module(s) have been scanned Scan process 'avscan.exe' - '93' Module(s) have been scanned Scan process 'avcenter.exe' - '74' Module(s) have been scanned Scan process 'explorer.exe' - '143' Module(s) have been scanned Scan process 'alg.exe' - '33' Module(s) have been scanned Scan process 'wscntfy.exe' - '18' Module(s) have been scanned Scan process 'wmiapsrv.exe' - '45' Module(s) have been scanned Scan process 'avshadow.exe' - '26' Module(s) have been scanned Scan process 'ctfmon.exe' - '25' Module(s) have been scanned Scan process 'nvtmru.exe' - '25' Module(s) have been scanned Scan process 'avgnt.exe' - '65' Module(s) have been scanned Scan process 'svchost.exe' - '39' Module(s) have been scanned Scan process 'jqs.exe' - '81' Module(s) have been scanned Scan process 'PresentationFontCache.exe' - '30' Module(s) have been scanned Scan process 'avguard.exe' - '81' Module(s) have been scanned Scan process 'sched.exe' - '40' Module(s) have been scanned Scan process 'spoolsv.exe' - '65' Module(s) have been scanned Scan process 'svchost.exe' - '37' Module(s) have been scanned Scan process 'svchost.exe' - '28' Module(s) have been scanned Scan process 'Ati2evxx.exe' - '40' Module(s) have been scanned Scan process 'svchost.exe' - '31' Module(s) have been scanned Scan process 'btwdins.exe' - '21' Module(s) have been scanned Scan process 'svchost.exe' - '173' Module(s) have been scanned Scan process 'svchost.exe' - '39' Module(s) have been scanned Scan process 'svchost.exe' - '53' Module(s) have been scanned Scan process 'Ati2evxx.exe' - '28' Module(s) have been scanned Scan process 'lsass.exe' - '58' Module(s) have been scanned Scan process 'services.exe' - '27' Module(s) have been scanned Scan process 'winlogon.exe' - '69' Module(s) have been scanned Scan process 'csrss.exe' - '14' Module(s) have been scanned Scan process 'smss.exe' - '2' Module(s) have been scanned Starting to scan executable files (registry): The registry was scanned ( '2315' files ). Starting the file scan: Begin scan in 'C:\' C:\Documents and Settings\Administrateur\Local Settings\Temp\libeay32.dll [DETECTION] Is the TR/Crypt.XPACK.Gen2 Trojan C:\Documents and Settings\Administrateur\Local Settings\Temp\sqlite3.dll [DETECTION] Is the TR/Crypt.XPACK.Gen2 Trojan Begin scan in 'D:\' Beginning disinfection: C:\Documents and Settings\Administrateur\Local Settings\Temp\sqlite3.dll [DETECTION] Is the TR/Crypt.XPACK.Gen2 Trojan [WARNING] The file was ignored. C:\Documents and Settings\Administrateur\Local Settings\Temp\libeay32.dll [DETECTION] Is the TR/Crypt.XPACK.Gen2 Trojan [WARNING] The file was ignored. End of the scan: lundi 26 septembre 2016 10:11 Used time: 13:53:27 Hour(s) The scan has been done completely. 22753 Scanned directories 954904 Files were scanned 2 Viruses and/or unwanted programs were found 0 Files were classified as suspicious 0 Files were deleted 0 Viruses and unwanted programs were repaired 0 Files were moved to quarantine 0 Files were renamed 0 Files cannot be scanned 954902 Files not concerned 20243 Archives were scanned 2 Warnings 0 Notes 755227 Objects were scanned with rootkit scan 0 Hidden objects were found

JSIrie · Answer

A noter que après le scan de mon antivirus, j'ai un peu fait le bourrin, j'ai été directement supprimer les fichier nommés, ce qui, bien entendu, n'a absolument servi à rien...

Malekal_morte- · Answer

Alors déjà ce ne sont pas des fichiers malicieux mais des DLL dans ton dossier temporairement, notamment une qui permet de lire des bases sqlite.

Donc ça été mis après l’utilisation d'un programme, il est aussi possible que ces fichiers revienne si ton relance ce programme.

Ensuite je vois que tu as beaucoup de programmes crackés...

Je pense que le mieux c'est de désactiver Antivir.
Touche Windows + R
tape cleanmgr.exe
nettoye les fichiers temporaires.

Si les fichiers reviennent et les détections Antivir avec... tu mets en exception pour qu'il arrête.

Veux-tu qu'on vérifie l'ordinateur ?

JSIrie · Answer

A noter aussi qu'entre temps, j'ai complètement nettoyé mon ordinateur, désinstallé tous les logiciels et supprimé pas mal de dossiers inutiles.

Je veux bien qu'on vérifie l'ordinateur oui s'il te plait. J'attends le rapport ZHP et je te l'envoie?

Malekal_morte- · Answer

Je n'utilise pas ZPHDiag mais un équivalent.

Suis le tutoriel FRST. ( prends le temps de lire attentivement - tout y est bien expliqué ).

Télécharge et lance le scan FRST, 3 rapports FRST seront générés :

 FRST.txt
 Shortcut.txt
 Additionnal.txt

Envoie ces 3 rapports sur le site http://pjjoint.malekal.com/ et en retour donne les 3 liens pjjoint qui mènent aux rapports ici dans une nouvelle réponse afin que l'on puisse les consulter.

 
 
Veuillez appuyer sur une touche pour continuer la désinfection...

JSIrie · Answer

Bonsoir,
Voici les rapports demandés :
https://pjjoint.malekal.com/files.php?id=FRST_20160929_t10g9y12v11x12
https://pjjoint.malekal.com/files.php?id=20160929_c8h11k7l11l5
https://pjjoint.malekal.com/files.php?id=20160929_f7x5y15e15i7

Merci Malekal_Morte pour ton implication

Malekal_morte- · Answer

Ca me semble correct :)

JSIrie · Answer

Parfait mais j'ai toujours mon UC à 100% notamment lorsque je lance le gestionnaire des tâches... taskmgr...si ce n'est logiciel c'est donc matériel je vais gratter de ce côté là. En tout cas grand merci à toi.
Sujet résolu?

TR/Crypt.XPACK.Gen2

9 réponses

Discussions similaires

Newsletters