Gen:heur.vb.krypt.7 Won't Go Away......

Hello support, my Bitdefender internet security 2010's real time protection first detected "Gen:Heur.VB.Krypt.7" a few hours ago when start using my IE browser. It was not able to disinfect it, thus it moved it to the quarantine section. I chose to deleted the infected files which is my mother board Giagabyte Gui.exe and ETC5 PRO files...

I ran a Deep system scan after that, as i aspect-ed, the virus is pretty much alive and this time, it infected 2 of my system restore files. And once again, Bitdefender internet security 2010 was not able to disinfect the files, i had manually deleted the infected files again.

I haven't run another scan yet as the last scan took me about 3 hours and i am pretty sure the darn virus is still residing in my computer somewhere.., and infected another 2 files..

Below is my deep system scan log:

Product: BitDefender Internet Security 2010

Version: BitDefender Antivirus Scanner

Scanning task: Deep System Scan

Log date: 2/27/2010 11:47:25 PM

Log path: \Documents and Settings\All Users\Application Data\BitDefender\Desktop\Profiles\Logs\deep_scan\1267285645_3_01.xml

Scan paths:

Path 0000: C:\

Path 0001: \

Path 0002: E:\

Path 0003: F:\

Scan Level:

Scan for viruses: Yes

Scan for adware: Yes

Scan for spyware: Yes

Scan for applications: Yes

Scan for dialers: Yes

Scan for rootkits: Yes

Scan for keyloggers: Yes

Virus Scanning Options:

Scan registry keys: Yes

Scan cookies: Yes

Scan boot sectors: Yes

Scan memory processes: Yes

Scan archives: Yes

Scan runtime packers: Yes

Scan e-mails: Yes

Scan all files: Yes

Heuristic Scan: Yes

Scanned extensions: not configured

Excluded extensions: not configured

Target Processing:

Default first action for infected objects: Disinfect

Default second action for infected objects: None

Default first action for suspect objects : None

Default second action for suspicious objects: None

Default action for hidden objects: None

Default first action for encrypted infected objects: Disinfect

Default second action for encrypted infected objects: None

Default first action for encrypted suspicious objects: None

Default second action for encrypted suspicious objects: None

Default action for password-protected objects: Log only

Scan Engines Summary

Virus signatures: 5334826

Archive plugins: 44

E-mail plugins: 6

Scan plugins: 13

System plugins: 5

Unpack plugins: 8

Basic

Scanned items: 278635

Infected items: 2

Suspect items: 0 (no suspected items have been detected)

Hidden items: 0 (no hidden items have been detected during this scan)

Resolved items: 2

Unresolved items: 0 (no issues remained unresolved)

Advanced

Scan time: 01:58:07

Files per second: 39

Skipped items: 66850

Password-protected items: 5101

Over-compressed items: 0

Individual viruses found: 1

Scanned folders: 9402

Scanned boot sectors: 6

Scanned archives: 2509

Input-output errors: 30

Scanned processes: 0

Infected processes: 0

Scanned registry keys: 0

Infected registry keys: 0

Scanned cookies: 0

Infected cookies: 0

Resolved issues:Object Path Threat Name Final Status

\System Volume Information\_restore{72853F02-CE7F-482F-A8A8-0C83E95BF941}\RP84\A0040248.exe Gen:Heur.VB.Krypt.7 Deleted

\System Volume Information\_restore{72853F02-CE7F-482F-A8A8-0C83E95BF941}\RP84\A0040249.exe Gen:Heur.VB.Krypt.7 Deleted

Here are the BDS SYS LOG LINK as requested:

http://www.filefactory.com/file/b062326/n/bd_sys_log.xml.zip

And this is the GMER LOG files link:

http://www.filefactory.com/file/b062327/n/gmer.log

I hope this issue can be resolved without formatting my computer, i don't have time and mood to reinstall my OS and programs, and files..

I hope this issue will resolves asap, 1st, motherboard files got infected, next system restore files got infected, i don't know which is the next one.. Thank you very much.

Find more posts tagged with

Comments

Cristi Raducu

Hello Ian LimYY,

Please follow the steps from this KB article and run a new scan:

http://www.bitdefender.com/KB2-en--Cleanin...em-Restore.html

If the problem persists,send me by PM a sample of the infected files (upload them to www.sendspace.com and send the download link).

Looking forward to your reply.

ianlimyy

Hello Ian LimYY,

Please follow the steps from this KB article and run a new scan:

http://www.bitdefender.com/KB2-en--Cleanin...em-Restore.html

If the problem persists,send me by PM a sample of the infected files (upload them to www.sendspace.com and send the download link).

Looking forward to your reply.

Hi Cristi, thanks for the reply. But maybe you should read my post more detail, as the virus Gen:Heur.VB.Krypt.7 was first found infected on my motherboard program's file, ETC5SC and GUI.exe -GIGABYTE by the Bitdefender real time scanning.

It then quarantine the two gigabyte files, and i manually deleted them.

Then i ran a deeep scan on the system, the very same Gen:Heur.VB.Krypt.7 has "hop on" to my system restore files, i chose to delete the 2 infected files.

After a few hours, i ran another deep scan, another virus "Trojan.Generic.3055035" appears in my other logical partition, and 2 of my games CAB were infected. The archive was manually deleted by myself after it moved to Quarantine section. Strange is, "Gen.Heur.VB.Krypt.7" is nowhere to be seen.

Then this noon, i ran another deep scan, it detected the same "Trojan.Generic.3055035" appears in my other logical partition , but this time, it carries a system restore file with it.

System Volume Information\_restore{72853F02-CE7F-482F-A8A8-0C83E95BF941}\RP85\A0040391.msi=>(Embedded CAB)=>DeathOnTheNile.exe.BAK

And again, Gen:Heur.VB.Krypt.7 was nowhere to be found.., so i am wondering whether "Gen:Heur.VB.Krypt.7" and "Trojan.Generic.3055035" are the same one?

I just ran another deep scan, this time, i clone all the deep scan task, and runs on different logical drives and partitions, one partition at a time. And guess what, no virus were detected for all the partitions scanned separately.

Note that, when i running all these deep system scans, i was offline, but now i am online again, the virus might become active again. I will post another reply after a default deep system scan all drives together by tomorrow.

Anyhow, i did applied what you had suggested, i had turn on and off the system restore points, and it has only the most current restore point.

We will see what will comes out later. Hopefully, nothing then..

Thanks very much for the help again, and sorry for this long post, i didn't sleep well seems my computer got infected by virus.

briantk1974

This is interesting, because Bitdefender just found this same virus in my Gigabyte software - the ETC5SC.exe file and in a restore file, as well. The timing and files infected seem more than a coincidence, especially since it was never found before. What is the best course of action for this virus - quarantine, delete, ignore? This is especially interesting, since this thread is the only mention anywhere on the Internet (at least doing a Google search with this virus in quotes) of this virus. Is Bitdefender just that far ahead of the game, or is this a false positive for this virus?

Hi Cristi, thanks for the reply. But maybe you should read my post more detail, as the virus Gen:Heur.VB.Krypt.7 was first found infected on my motherboard program's file, ETC5SC and GUI.exe -GIGABYTE by the Bitdefender real time scanning.

...

Cristi Raducu

Please send me by PM a copy of ETC5SC.exe and GUI.exe (upload them on a server).

ianlimyy

Please send me by PM a copy of ETC5SC.exe and GUI.exe (upload them on a server).

Hello, Cristi, i'm afraid i would not able to do that as i told in previous post, i had deleted the file after it moved to quarantine..

But i did chose to send the sample files to Bitdefender's server before i deleted the Gigabyte's files.., so, maybe you can check your server side log to see the file.

But then again, today afternoon, i ran a full paths of deep system scan, and my system is clean.

Product: BitDefender Internet Security 2010

Version: BitDefender Antivirus Scanner

Scanning task: Deep System Scan

Log date: 3/2/2010 3:12:50 PM

Log path: \Documents and Settings\All Users\Application Data\BitDefender\Desktop\Profiles\Logs\deep_scan\1267513970_1_00.xml

Scan paths:

Path 0000: C:\

Path 0001: \

Path 0002: E:\

Path 0003: F:\

Scan Level:

Scan for viruses: Yes

Scan for adware: Yes

Scan for spyware: Yes

Scan for applications: Yes

Scan for dialers: Yes

Scan for rootkits: Yes

Scan for keyloggers: Yes

Virus Scanning Options:

Scan registry keys: Yes

Scan cookies: Yes

Scan boot sectors: Yes

Scan memory processes: Yes

Scan archives: Yes

Scan runtime packers: Yes

Scan e-mails: Yes

Scan all files: Yes

Heuristic Scan: Yes

Scanned extensions: not configured

Excluded extensions: not configured

Target Processing:

Default first action for infected objects: Disinfect

Default second action for infected objects: None

Default first action for suspect objects : None

Default second action for suspicious objects: None

Default action for hidden objects: None

Default first action for encrypted infected objects: Disinfect

Default second action for encrypted infected objects: None

Default first action for encrypted suspicious objects: None

Default second action for encrypted suspicious objects: None

Default action for password-protected objects: Log only

Scan Engines Summary

Virus signatures: 5356018

Archive plugins: 44

E-mail plugins: 6

Scan plugins: 13

System plugins: 5

Unpack plugins: 8

Basic

Scanned items: 774377

Infected items: 0 (no infected items have been detected)

Suspect items: 0 (no suspected items have been detected)

Hidden items: 0 (no hidden items have been detected during this scan)

Resolved items: 0 (no threats have been detected during this scan)

Unresolved items: 0 (no issues remained unresolved)

Advanced

Scan time: 02:54:26

Files per second: 73

Skipped items: 50419

Password-protected items: 5101

Over-compressed items: 0

Individual viruses found: 0

Scanned folders: 9662

Scanned boot sectors: 6

Scanned archives: 6193

Input-output errors: 26

Scanned processes: 65

Infected processes: 0

Scanned registry keys: 841

Infected registry keys: 0

Scanned cookies: 492

Infected cookies: 0

So, congrats to me and Bitdefender, but i still want to know how can a virus or trojan just disappear like that?

Or the delete option from Bitdefender had already removed the virus or trojan, both "Gen:Heur.VB.Krypt.7" and "Trojan.Generic.3055035".. ???

Thanks again for any answer.

Cristi Raducu

My colleagues from the lab were able to analyze Trojan.Generic.3055035 which turned out to be a false detection and the file is no longer detected.

I cannot tell you the same for Gen:Heur.VB.Krypt.7 without a sample file but at this point you should try to reinstall your motherboard driver.

Cristi.

ianlimyy

My colleagues from the lab were able to analyze Trojan.Generic.3055035 which turned out to be a false detection and the file is no longer detected.

I cannot tell you the same for Gen:Heur.VB.Krypt.7 without a sample file but at this point you should try to reinstall your motherboard driver.

Cristi.

Thanks for the reply, Cristi.

Great to know that 3055035 was just a false positive.

About the Gui.exe and ETC5PRO which was infected by Gen:Heur.VB.Krypt.7, i don't think i will reinstall seems it's not really important, it's just some mobo softwares to tweak motherboard if i am not wrong.

But i did select to send the sample files from the quarantine section to Bitdefender server, if you chekc the log, it should be there at 27th March, GUI.exe and ETC5PRO.exe something..

Thanks for any reply again.