Virus TR/Crypt.XPACK.Gen

[canard66]

Bonjour,

 

Sur les postes d'une entreprise d'un ami ce matin en allumant les PC les trois ont indiqué la présence du virus TR/Crypt.XPACK.Gen .

 

Voici le rapport hijackthis :

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 19:18:25, on 05/10/2009

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v8.00 (8.00.6001.18813)

Boot mode: Normal

 

Running processes:

C:\Windows\system32\Dwm.exe

C:\Windows\system32\taskeng.exe

C:\Windows\Explorer.EXE

C:\Program Files\Windows Defender\MSASCui.exe

C:\hp\support\hpsysdrv.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

C:\Windows\RtHDVCpl.exe

C:\Windows\system32\schtasks.exe

C:\Program Files\Common Files\logishrd\LComMgr\Communications_Helper.exe

C:\Program Files\Logitech\QuickCam\Quickcam.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files\Lexmark 6500 Series\lxdfmon.exe

C:\Program Files\Lexmark 6500 Series\lxdfamon.exe

C:\Windows\WindowsMobile\wmdc.exe

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\Windows\ehome\ehtray.exe

C:\Windows\system32\igfxsrvc.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Program Files\Ciel\Serveur\WSRV.exe

C:\Program Files\NETGEAR\WG111v3\WG111v3.exe

C:\Windows\system32\jusched.exe

C:\Windows\ehome\ehmsas.exe

C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

C:\Windows\System32\mobsync.exe

C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe

C:\Windows\system32\wuauclt.exe

C:\program files\avira\antivir desktop\avcenter.exe

C:\Program Files\Avira\AntiVir Desktop\GUARDGUI.EXE

C:\Program Files\Avira\AntiVir Desktop\avnotify.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Avira\AntiVir Desktop\GUARDGUI.EXE

C:\Windows\system32\SearchFilterHost.exe

C:\Users\313 pieces auto\AppData\Local\Temp\Temp1_HiJackThis.zip\HijackThis.exe

C:\Users\313 pieces auto\HijackThis.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O1 - Hosts: ::1 localhost

O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe

O4 - HKLM\..\Run: [iAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"

O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe

O4 - HKLM\..\Run: [HP Health Check Scheduler] [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe

O4 - HKLM\..\Run: [sunJavaUpdateReg] "C:\Windows\system32\jureg.exe"

O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"

O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [igfxTray] C:\Windows\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe

O4 - HKLM\..\Run: [lxdfmon.exe] "C:\Program Files\Lexmark 6500 Series\lxdfmon.exe"

O4 - HKLM\..\Run: [lxdfamon] "C:\Program Files\Lexmark 6500 Series\lxdfamon.exe"

O4 - HKLM\..\Run: [Lexmark 6500 Series Fax Server] "C:\Program Files\Lexmark 6500 Series\fm3032.exe" /s

O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon

O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe

O4 - HKCU\..\Run: [MsgCenterExe] "C:\Program Files\Common Files\Real\Update_OB\RealOneMessageCenter.exe" -osboot

O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')

O4 - Startup: Ciel serveur.lnk = C:\Program Files\Ciel\Serveur\WSRV.exe

O4 - Global Startup: Ciel Serveur.lnk = C:\Program Files\Ciel\Serveur\WSRV.exe

O4 - Global Startup: NETGEAR WG111v3 Smart Wizard.lnk = C:\Program Files\NETGEAR\WG111v3\WG111v3.exe

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll

O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll

O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll

O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL

O13 - Gopher Prefix:

O16 - DPF: {14F94215-CA07-4CA0-B451-E5D78B68CC58} (PDLicenseHelper Object) - https://www.protectdisc.com/download/PDLicHelperSetup2.exe

O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe

O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

O23 - Service: EPSON V3 Service4(01) (EPSON_PM_RPCV4_01) - SEIKO EPSON CORPORATION - C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE

O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe

O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe

O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe

O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe

O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe

O23 - Service: lxdf_device - - C:\Windows\system32\lxdfcoms.exe

O23 - Service: Transbase TECDOC CD 3_2009 Service - Transaction Software, D 81829 Munich - C:\TECDOC_CD\3_2009\db\tbmux32.exe

 

--

End of file - 8998 bytes

 

 

Et voici ce qu'a trouvé le site Virustotal en analysant ce fichier :

 

Antivirus Version Dernière mise à jour Résultat

a-squared 4.5.0.24 2009.10.05 -

AhnLab-V3 5.0.0.2 2009.10.05 -

AntiVir 7.9.1.33 2009.10.05 -

Antiy-AVL 2.0.3.7 2009.10.05 -

Authentium 5.1.2.4 2009.10.05 -

Avast 4.8.1351.0 2009.10.04 -

AVG 8.5.0.420 2009.10.04 -

BitDefender 7.2 2009.10.05 -

CAT-QuickHeal 10.00 2009.10.05 -

ClamAV 0.94.1 2009.10.05 -

Comodo 2518 2009.10.05 -

DrWeb 5.0.0.12182 2009.10.05 -

eSafe 7.0.17.0 2009.10.05 -

eTrust-Vet 31.6.6777 2009.10.05 -

F-Prot 4.5.1.85 2009.10.05 -

F-Secure 8.0.14470.0 2009.10.05 -

Fortinet 3.120.0.0 2009.10.05 -

GData 19 2009.10.05 -

Ikarus T3.1.1.72.0 2009.10.05 -

Jiangmin 11.0.800 2009.10.05 -

K7AntiVirus 7.10.862 2009.10.05 -

Kaspersky 7.0.0.125 2009.10.05 -

McAfee 5762 2009.10.05 -

McAfee+Artemis 5762 2009.10.05 -

McAfee-GW-Edition 6.8.5 2009.10.05 Trojan.Crypt.XPACK.Gen

Microsoft 1.5101 2009.10.05 -

NOD32 4482 2009.10.05 -

Norman 6.01.09 2009.10.05 -

nProtect 2009.1.8.0 2009.10.05 -

Panda 10.0.2.2 2009.10.05 -

PCTools 4.4.2.0 2009.10.05 -

Prevx 3.0 2009.10.05 -

Rising 21.49.22.00 2009.09.30 -

Sophos 4.45.0 2009.10.05 -

Sunbelt 3.2.1858.2 2009.10.05 -

Symantec 1.4.4.12 2009.10.05 -

TheHacker 6.5.0.2.029 2009.10.05 -

TrendMicro 8.950.0.1094 2009.10.05 -

VBA32 3.12.10.11 2009.10.05 -

ViRobot 2009.10.5.1970 2009.10.05 -

VirusBuster 4.6.5.0 2009.10.05 -

Information additionnelle

File size: 9581810 bytes

MD5...: c7ad8f7d38ec11bbe192b10fd7f61f1f

SHA1..: e56dba8946f81d9980960aecd176d434ac06983f

SHA256: 63fcca10ca8bdee93789408b6b9d2294dea1db647ad3640db798ec683841f9d3

ssdeep: 196608:QetKn2eNKcI5RpHmWI312F8A78avXu2nQ0yH:Q/2wKcAOn4XufH

PEiD..: -

PEInfo: PE Structure information

 

( base data )

entrypointaddress.: 0xb000

timedatestamp.....: 0x4a1fd5ae (Fri May 29 12:31:42 2009)

machinetype.......: 0x14c (I386)

 

( 6 sections )

name viradd virsiz rawdsiz ntrpy md5

ribfexzp 0x1000 0x3cc8 0x4000 0.28 3581d8ed78fce35b3a4c0cf06600856f

gfujvzqw 0x5000 0x11b6 0x2000 4.54 4a1bde5040ef6d3bfd8b37182d06ecd9

wpyfxvpj 0x7000 0x1000 0x400 0.00 0f343b0931126a20f133d67c2b018a3b

.rsrc 0x8000 0x1398 0x2000 4.12 3199c8a1c69d3dd72594c690cba3c8a7

vrpmzybx 0xa000 0x1000 0x400 2.60 88507b5f803d9533cfeaba25d77131db

uwygucue 0xb000 0x506000 0x505c70 7.77 563003f5fae134a340f0de1f6c483217

 

( 3 imports )

> kernel32.dll: CloseHandle, CreateDirectoryA, CreateFileA, ExitProcess, GetLastError, GetProcAddress, GetSystemTime, GetVersion, LoadLibraryA, ReadFile, SetFileAttributesA, Sleep, WriteFile

> shlwapi.dll: PathAppendA

> shfolder.dll: SHGetFolderPathA

 

( 0 exports )

RDS...: NSRL Reference Data Set

-

pdfid.: -

trid..: Generic Win/DOS Executable (49.9%)

DOS Executable Generic (49.8%)

Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%)

sigcheck:

publisher....: Sybase, Inc.

copyright....: Contains licensed copyright material by Sybase Inc. and others. Use and distribution of Sybase copyright material and licensed material is governed by Sybase End-user License Agreement.

product......: PowerBuilder Enterprise Series

description..: Sybase Inc. Product File

original name: n/a

internal name: PB 10.5

file version.: 1,0,0,1

comments.....: n/a

signers......: -

signing date.: -

verified.....: Unsigned

 

Merci par avance pour votre aide