Random Number Exe

I have this problem- random numbered exe files (eg. 32.exe , 45.exe ) Bitdefender is blocking some , but is not detecting them once I run scan. BTW Malwarebytes and SuperAntispyware are detecting these exe files, but they keep appearing! I'm attaching some pictures of BD IS 2010 alerts. This is also happening on one my friend's pc who have the same ISP. I'm running Win Xp sp2.

Find more posts tagged with

Comments

pozzo

New Trojan detected:

alexcrist

Hello Pozzo,

Please read this article: http://kb.bitdefender.com/KB490

Use the 2 tools presented there, as described in that article. Archive the 2 logs and upload the archive on a file sharing server of your choice (such as www.sendspace.com), then send me the download link by PM.

Cris.

pozzo

Did as you asked Cris

alexcrist

The 2 logs appear to show somehow inconsistent data. Were they taken at the same time? Not simultaneously, but within the same Windows session, without any system restarts or log offs?

Also, the BDSI log shows extremely few processes. Have you closed or killed any processes before taking the scan? It's important to leave the processes running, because it appears that you have a malware that injects itself into legit, running processes. Killing those processes deactivates (but only temporarily) the malware, making it not show on the gmer and/or BDSI scans.

If any of the above cases apply, please restart your system, use it normally until you get another virus alert from BitDefender, then immediately repeat bot scans (preferably starting with BDSI).

Cris.

pozzo

No, the scans were made one after the other ... about the restart question-yes, maybe I had restarted the pc once after the alert. i'm not absolutely positive though!! I'll try and post the next scans immediately after an alert. It seems the virus(s) are downloaded from/accessed by an ip address?

alexcrist

OK. Please repeat the scans when/if the BitDefender alerts show up again. In the meantime, I will look again on the logs you already sent me. Maybe I missed something the first time.

Cris.

pozzo

I have pm ed the logs immediately after an alert

pozzo

hello:huh: Echooooo!

Cristi Raducu

Please send me the logs as well.

Thank you.

Cristi Raducu

I've received the logs and they are under analysis.

Please send me a copy of C:\Windows\System32\36.exe along with all files in shape of numbers from that folder (C:\Windows\System32)

pozzo

Pm-ed you Cristi the exe(s).

pozzo

I sincerely hope you release an update that recognises this virus before it attacks, because many,many,many users in India (and maybe the whole world for all I know) is having this very same problem! And I hope something will be done aout the ip range that is contacted by the virus/trojan.

alexcrist

Pozzo, the files you submitted to Cristi did not include the 36.exe file that appears in one of the screenshots you first posted. Can you search for that file to see if it exists?

As for the files your submitted, they are mostly clean. They are not actually exe files, but HTML files with another extension. Most of them just contain the BitDefender message that states that a malicious file was blocked during download. The virus alerts that you posted (not the one about Active Virus Control, but the other 2) mean that the malicious file was detected and blocked before it reached your hard drive. This is the reason why, on successive scans, BitDefender does not detect them: because they are not there to begin with.

I talked to Cristi about your situation, and also with a member of BitDefender Labs. We are still looking into your situation, but at the moment, it seems that the cause of infection is outside your system. We are not sure at the moment, but these alerts might mean that your computer is under attack from another (possibly infected) computer within your network. Since not threats were detected during BitDefender scans, it means that the infections were successfully blocked before reaching your system.

I will be back shortly with a few advices that you could take. But in the meantime, please tell me this: do you have any router for your home network, or are you directly connected to your ISP's network? Do you and your friend have IPs in the same class (similar IPs)?

Also, please go to Start -> Run, type cmd and press enter. After the Command Prompt opens, type this command:

ipconfig /all

and press Enter. make a screenshot of the result (resize CMD if needed) and post it here.

Cris.

pozzo

Thank you Cris, for the sincere attempts to solve this problem That's why I'm such a BD fan ! I have had to format & update, in fear of imp. programs and documents being infected, I'm now using Win 7 (x86)... I noticed these virus/malware is specifically attacking xp pcs.

In answer to your questions:

1) I do not have a router, I'm directly connected to my ISP's network

2)My friends all have the same class of ips

Hope that helps.

pozzo

BTW I had searched for the file 36.exe, but it was not be found...sorry!

alexcrist

So I take it that you don't receive those alerts anymore, right? Take care, that if the attack is indeed from within the network, then the alerts might appear again. I don't know if Windows 7 is vulnerable to it. I'm not sure how the attack was made, because the logs your provided do not offer such information (they only show what's happening inside your system, not outside of it, on the network). If the alerts show up again, please don't hesitate to post back here.

Also, as a note: when a virus alert shows up, and the virus location is shown as an Internet address (like the screenshots your posted), not as a local file, then it means that the malicious file was blocked during download, so it wasn't saved on your system (not even as a temporary or cached file). So in this case, there is nothing else you can or need to do. That message is purely informative.

However, this type of protection is only available if you keep HTTP scanner enabled. This is done from Antivirus -> Custom level -> Scan HTTP traffic. You had it enabled since now, and make sure you keep it enabled.

Also, just for the sake of analysis, could you please ask one of your friends, who still have this problem, to run the above command (from my previous post)? I'm interested in the result. Thank you.

Cris.

pozzo

No problem, I'll ask them provide the screen shot. If anything somilar happens again, I'll let you know. Thanks.