Various Trojan Alert Accessed By Wareg51.exe?

Hi,

I've done a lot of search for this, but I haven't found anything. I have been getting these alerts from my Bitdefender antivirus:

Bitdefender has blocked a virus!

Virus name: Gen:Variant.TDss.38 (The name changes every time.... sometimes, it has Trojan in its name, but the name keeps changing).

Accessed by: wareg51.exe

Location: gate33.info/Jtx3/pls22.exe

Oddly enough, when I run full deep scan, Bitdefender doesn't find any virus.... I've also run Norton's online/web scan, which didn't find anything. I've also run a couple of antimalware softwares, and they both didn't find anything... I'm clueless why this alert keeps popping up...

Has anyone had this before? Please share any info you may have on this. Thank you.

I have Windows 7 64 bit Ultimate.

Find more posts tagged with

Comments

coolcool1227

Check that the file "gate33.info/Jtx3/pls22.exe" physically present at the location or not, it may be hidden. If you find that file, scan it with Bitdefender and also from "www.virustotal.com" and then post the result here.

Also mention settings of Real Time Protection and Deep/Full System Scan whatever you ran.

I also have experience that the Real Time Protection detects an infection but Contextual Scan didn't. When I post this issue on forum, the detection was declared false positive.

Cristi Raducu

Hello goldentequila,

Please send me by PM a BDSI and GMER log,full instructions are available here:

http://kb.bitdefender.com/KB490-en--The-sy...s-infected.html

@ONT

In this case the detection is not a false positive.

goldentequila

Hi, Cristi.

Thank you for offering to help, but I have a few questions. The BDSI result came out as a password protected zip file. When you say send them to you via PM, am I supposed to upload them somewhere like rapidshare and send you the link? I don't see any options to attach anything on the control panel here. Please let me know.

Cristi Raducu

You can easily upload them on rapidshare or on any upload site of your choice and send me by PM the links.

The BDSI report file (bd_sys_log.zip) is indeed a password protected archive.

Cristi Raducu

Based on the sent logs the following file c:\users\tony\appdata\local\temp\wareg51.exe has been signed as Trojan.Downloader.JNII

Run a BitDefender deep scan in about 2 hours from now and post here the results.

Also make sure that your BitDefender is up to date prior to starting this scan.

goldentequila

Hi, Cristi.

I tried what you said, and here's what happened.

1. I ran deep scan after waiting and updating the virus definition like you said.

2. This time, BD was able to detected c:\users\tony\appdata\local\temp\wareg51.exe

3. It asked for action, so I chose "delete."

4. The next page said "One item failed to be cleaned. This happened because no cleaning routine was available for this type of threat. You can find more about this here: www.bitdefender.com

5. So, I booted into safe mode and ran manual deep scan this time (thinking that maybe it could be cleaned in safe mode).

6. The result didn't detected anything.

7. I booted back into normal mode and ran the deep scan again.

8. This time, BD did not detect the virus.

That's where I'm at. I'm not sure if the virus is gone or not because it said it couldn't clean it, but a new scan doesn't detect it. I hope you can help me understand this. Thank you.

goldentequila

An update.... The exact same warning just came back:

Bitdefender has blocked a virus!

Virus name: Gen:Variant.TDss.38

Accessed by: wareg51.exe

Location: gate33.info/Jtx3/pls22.exe