Urgent Help Needed

Dear Bitdefender manager,

I am a registered user of bitdefender antivirus 2009.

I am using it for more than 50 days.

Suddenly in recent past some bug or trojan has entered. Inspite of bit defender working Somebody tries to send money when I tried to login into my alertpay account through Internet explorer. But it did not happen while I tried to login through firefox browser.

I am regulary updating to bitdefender website.

Also the bug is trying to put mozilla firefox to a content box. There is a major malware. Sometimes it shows different username cookies which I never used it one such username is gasgag which I never used. Many times bitdefender vserv.exe becomes inactive when I tried to login into my alertpay or paypal account.

I feel bitdefender had failed to find the malware. Kindly help me in this regard.

This is the last deepsystem log file.

BitDefender Log File

Product : BitDefender Antivirus 2009

Version : BitDefender UIScanner v.12

Scanning task : Deep System Scan

Log date : 2/15/2010 8:52:44 PM

Log path : C:\Documents and Settings\All Users\Application Data\BitDefender\Desktop\Profiles\Logs\deep_scan\1266247364_1_00.xml

Scan Paths:Path 0000: C:\

Path 0001: \

Path 0002: E:\

Path 0003: F:\

Path 0004: G:\

Scan Options:Scan for viruses : Yes

Scan for adware : Yes

Scan for spyware : Yes

Scan for applications : Yes

Scan for dialers : Yes

Scan for rootkits : Yes

Target Selection Options:Scan registry keys : Yes

Scan cookies : Yes

Scan boot sectors : Yes

Scan memory processes : Yes

Scan archives : Yes

Scan runtime packers : Yes

Scan emails : No

Scan all files : Yes

Heuristic Scan : Yes

Scanned extensions :

Excluded extensions :

Target Processing:Default action for infected objects : Disinfect

Default action for suspicious objects : None

Default action for hidden objects : None

Default action for encrypted infected objects : None

Default action for encrypted suspicious objects : None

Default action for password-protected objects : Log as not scanned

Scan engines summaryNumber of virus signatures : 5075738

Archive plugins : 44

Email plugins : 6

Scan plugins : 13

System plugins : 5

Unpack plugins : 8

Overall scan summaryScanned items : 286755

Infected items : 0

Suspicious items : 0

Resolved items : 0

Unresolved items : 0

Password-protected items : 0

Overcompressed items : 0

Individual viruses found : 0

Scanned directories : 8694

Scanned boot sectors : 6

Scanned archives : 2765

Input-output errors : 1

Scan time : 00:42:30

Files per second : 111

Scanned processes summaryScanned : 37

Infected : 0

Scanned registry keys summaryScanned : 886

Infected : 0

Scanned cookies summaryScanned : 494

Infected : 0

Yours truly,

C.K. Prasanna

Find more posts tagged with

Comments

prasannack

Dear webmaster,

Regarding fire fox problem said in the previous post this is what I see everytime. Someone is trying to drop my browser it into a box.

Kindly help me how to detect this malware.

I never touched my mouse. This happens when I tried to login into some website through firefox. Firefox becomes unresponding for few seconds and I get the screen message.

Kindly help me in this regard. I have posted the deepsystem log file in the previous post.

Yours truly,

C.K. Prasanna

alexcrist

Hello C.K. Prasanna,

Please read this article: http://kb.bitdefender.com/KB490

Generate the 2 logs, upload them on a file sharing server of your choice (like www.sendspace.com) and send me a PM with the download link.

Cris.

prasannack

Dear Cris,

Thanks for responding me.

I have uploaded the gmer.log file and bd_sys_log.xml file as per your instructions.

Kindly help me to find the malware in my system.

I am afraid someone could steal my money so I have not logged on to those sites from yesterday.

Waiting for your earliest reply.

Yours truly,

C.K. Prasanna.

/applications/core/interface/file/attachment.php?id=6095" data-fileid="6095" rel="">gmer.log

gmer.log

prasannack

Dear Cris,

Thanks for responding me.

I have uploaded the gmer.log file and bd_sys_log.xml file as per your instructions.

Kindly help me to find the malware in my system.

I am afraid someone could steal my money so I have not logged on to those sites from yesterday.

Waiting for your earliest reply.

Yours truly,

C.K. Prasanna.

Dear Cris,

I could not upload bd_sys_log.xml file directly into the forum.

Below is the link of bd_sys_log.xml file for my system through www.sendspace.com

http://www.sendspace.com/file/2yxui0

Kindly review and help me find and rectify the malware.

Yours truly,

C.K. Prasanna

alexcrist

Follow these steps:

open gmer.exe
after the initial quickscan, press on the > > > button. Multiple tabs will appear
click on the Files tab
search for the following files:
```
c:\windows\system32\sdra64.exe
c:\documents and settings\all users\application data\01759325\01759325.exe
```
If you find any of these files, select it, click on Copy and save the file in a new folder. At the end, put the file(s) in a password-protected archive (with the password infected), upload it on a file sharing server of your choice (such as www.sendspace.com) and send me a PM with the download link.

Cris.

prasannack

Dear Cris,

I have done the things you have instructed.

But I do not find the sdra64.exe file and the other file.

I have posted the image for proof.

As you could see from the image there is no such files you have mentioned.

Kindly tell me what to do next.

Yours truly,

C.K. Prasanna

prasannack

Dear Cris,

Today I did this thing. First I browsed in firefox for sometime. Then I closed the browser and reopened it.

I then tried to clear the cookies for the last two hours. When I tried this I got a message a ****** has been running and you have to stop the ******. The image is given below.

Also When I perform full scan initially I did not find any trojan but when I performed the above action and perform the scan I found trojans. The trojan list collected from history of log file

C:\Program Files\Mozilla Firefox\a.exe Trojan.Generic.3046854 Deleted

C:\System Volume Information\_restore{906CE9F5-911E-4807-BF0E-26A07011A8F5}\RP71\A0174868.exe Trojan.Generic.3046854 Deleted

C:\WINDOWS\Temp\~TM8A0.tmp Trojan.Generic.3145453 Deleted

Kindly help me to fight the malware in my computer.

Yours truly,

C.K. Prasanna