"security Tool" Virus

Hi folks :rolleyes:

Been recommending Bitdefender to my customers here in Sweden for some time....Have a customer who is testing the Internet Security version and has been getting a rogue popup "security tool" virus which Bitdefender didn't detect or remove and now the customer isn't best pleased with me....?!!

Am I missing something here...thought that "security tool" virus had been around for a long time now...Why didn't Bitdefender do something about it?

bookie56

Find more posts tagged with

Comments

Cristi Raducu

Hi bookie56,

This threat is already detected by our engines:

http://www.bitdefender.com/VIRUS-1000600-e...ealert.CAW.html

The Security Tool virus is a polymorphic virus and almost everyday a new version is released and everyday we add a new detection.

In this cases there is a time gap between when the virus was created and we added detection.

If the system is still infected please send me by PM a BDSI to help in disinfection.

http://kb.bitdefender.com/site/article/490/

C__ProgramData_BitDefender_Desktop_Profiles_Logs_deep_sc_TWO.pdf

C__ProgramData_BitDefender_Desktop_Profiles_Logs_deep_sc_One.pdf

margotdorn

Hi bookie56,

This threat is already detected by our engines:

http://www.bitdefender.com/VIRUS-1000600-e...ealert.CAW.html

The Security Tool virus is a polymorphic virus and almost everyday a new version is released and everyday we add a new detection.

In this cases there is a time gap between when the virus was created and we added detection.

If the system is still infected please send me by PM a BDSI to help in disinfection.

http://kb.bitdefender.com/site/article/490/

[/quote

Today I got an almost identical virus, on my brandnew HP PC (not this old one), called "System Tool" instead of security tool. Spent 3 hours trying all recommended actions from posts on the internet and MS Malicious Software removal tool. I had uninstalled the preinstalled Norton and installed BitDefender. I thought all was well but BitDefender did not detect this virus. I tried to start a scan, but the scan was the scan was interrupted and computer shut down. I started in SafeMode and was finally able to move the "SystemTool" file into the recycle bin. Then I did a system restore but it said the system restore was not successful. However, the virus seems to be gone. I did a system scan with BidDefender and it showed no infection. I am doing a deep scan now and will send results, if any, but I wonder how this happened?

C__ProgramData_BitDefender_Desktop_Profiles_Logs_deep_sc_TWO.pdf

C__ProgramData_BitDefender_Desktop_Profiles_Logs_deep_sc_One.pdf

margotdorn

Today I got an almost identical virus, on my brandnew HP PC (not this old one), called "System Tool" instead of security tool. Spent 3 hours trying all recommended actions from posts on the internet and MS Malicious Software removal tool. I had uninstalled the preinstalled Norton and installed BitDefender. I thought all was well but BitDefender did not detect this virus. I tried to start a scan, but the scan was the scan was interrupted and computer shut down. I started in SafeMode and was finally able to move the "SystemTool" file into the recycle bin. Then I did a system restore but it said the system restore was not successful. However, the virus seems to be gone. I did a system scan with BidDefender and it showed no infection. I am doing a deep scan now and will send results, if any, but I wonder how this happened?

Here are the two deep scan log files after the infection. Can you let me know what the password protected items might be as this is a new computer and I do not have more than a couple of password protected files. I do have Roboform which collects log-in information with a master password. Thank you for your help.

/applications/core/interface/file/attachment.php?id=7240" data-fileid="7240" rel="">C__ProgramData_BitDefender_Desktop_Profiles_Logs_deep_sc_TWO.pdf

/applications/core/interface/file/attachment.php?id=7241" data-fileid="7241" rel="">C__ProgramData_BitDefender_Desktop_Profiles_Logs_deep_sc_One.pdf

C__ProgramData_BitDefender_Desktop_Profiles_Logs_deep_sc_TWO.pdf

C__ProgramData_BitDefender_Desktop_Profiles_Logs_deep_sc_One.pdf

Cristi Raducu

All those files belong to HP setup,drivers etc.

http://h30434.www3.hp.com/t5/Other-Noteboo...-it/td-p/393331

C__ProgramData_BitDefender_Desktop_Profiles_Logs_deep_sc_TWO.pdf

C__ProgramData_BitDefender_Desktop_Profiles_Logs_deep_sc_One.pdf

wade D

Yesterday morning my laptop was infected with the "System Tool 2011" virus. I spent all day researching the typical fix for this virus. None of the info that I could find on fixes to this problem seemed accurate with how my machine was acting. I searched for the files and through the registry for the "normal" files created by the files. I do have Bitdefender 2010 antivirus loaded but the virus blocks all functions with bitdefender and it also has done something to block my ability to load new software which could fix the problem.

When trying to run new software that could fix the problem such as "Microsoft Security Essentials" or "windows defender" the virus apparently blocks the software from running. I get a Warning that says "Application cannot be executed. The file bdagent.exe is infected. Please activate your antivirus software." Which I cannot do because bit defender is also blocked from running. I also get an error that says "Windows cannot access the specified device, path or file. You may not have the appropriate permissions to access the item."

When trying to run Bitdefender I get the bdagent error also and nothing else.

Any advise is greatly appreaciated. Isn't this the sort of thing that BD is supposed to prevent? Very frustrating.

C__ProgramData_BitDefender_Desktop_Profiles_Logs_deep_sc_TWO.pdf

C__ProgramData_BitDefender_Desktop_Profiles_Logs_deep_sc_One.pdf

Cristi Raducu

@Wade D

What you can try is to boot the system in safe mode using the F8 key and run a scan using BitDefender.

If the problem persists then send me back a BDSI log.

http://kb.bitdefender.com/site/article/490/

C__ProgramData_BitDefender_Desktop_Profiles_Logs_deep_sc_TWO.pdf

C__ProgramData_BitDefender_Desktop_Profiles_Logs_deep_sc_One.pdf

Capt. Mike

@Wade D

What you can try is to boot the system in safe mode using the F8 key and run a scan using BitDefender.

If the problem persists then send me back a BDSI log.

http://kb.bitdefender.com/site/article/490/

Hi,

Yesterday afternoon I was infected by something that called itself "Spyware Protection". I think it may have gotten in via MSIExplorer V7. I am on Win XP SP3.

Bitdefender did not stop it or notify me.

The virus creates popups saying you are at risk. Also popups and notifies you of risk with regard to firewall accesses.

I did not click on anything it was asking me to click on.

I was able to run run Defender 2010. However, I had to select the run scan buttons seveal times before it would run.

I was not able to run any other applications. For example I would try to run task manager and it would start but was immediatley closed. I could open Windows folders but could not start any applications.

As soon as I realized I was infected I disconnected my Internet connection/router. I ran all the Bitdefender scans available.

I shutdown. I turned the router back on, I started up in safe mode with networking. I tried to run Bitdefender from safe mode but it would not run.

I restarted, and choose the system restore. Restore went successfully. I ran all Bitdefender scans available. It found nothing.

I created a new restore point and did a Windows update. Rebooted. Things went ok.

Let the computer sit on for awhile. Got warning from Bitdefeder that it had just stopped and deleted Trojan.Generic.KDV.91335 in System Volume Information\_restore{26A69FCE-98C5-468D-8A4D-593F4703C615}\RP1112\A0116464.exe

I am doing all the scans again.

Please advise of any tips or suggestions.

Kind regards, Capt. Mike

C__ProgramData_BitDefender_Desktop_Profiles_Logs_deep_sc_TWO.pdf

C__ProgramData_BitDefender_Desktop_Profiles_Logs_deep_sc_One.pdf

Capt. Mike

I should note that after Bitdefender found the bug Trojan.Generic.KDV.91335 in System Volume Information\_restore{26A69FCE-98C5-468D-8A4D-593F4703C615}\RP1112\A0116464.exe

I removed all my System restore points by disabling system restore then re-enabling it.

C__ProgramData_BitDefender_Desktop_Profiles_Logs_deep_sc_TWO.pdf

C__ProgramData_BitDefender_Desktop_Profiles_Logs_deep_sc_One.pdf

Cristi Raducu

You did the right thing by disabling all system restore points to remove this type of infection.

Please post if you encounter any other problems.

C__ProgramData_BitDefender_Desktop_Profiles_Logs_deep_sc_TWO.pdf

C__ProgramData_BitDefender_Desktop_Profiles_Logs_deep_sc_One.pdf

denggenmei8372

I scanned in safe mode, in normal mode, upgraded to version 2011, but no trojan found.

C__ProgramData_BitDefender_Desktop_Profiles_Logs_deep_sc_TWO.pdf

C__ProgramData_BitDefender_Desktop_Profiles_Logs_deep_sc_One.pdf

Cristi Raducu

@yiyi

Please post a BDSI log to further investigate this situation.

http://kb.bitdefender.com/site/article/490/

C__ProgramData_BitDefender_Desktop_Profiles_Logs_deep_sc_TWO.pdf

C__ProgramData_BitDefender_Desktop_Profiles_Logs_deep_sc_One.pdf

nanaka777us

I seem to be having a problem similar to Capt. Mike except that the malware in my case has the 'name' defender. Bitdefender did not stop nor is it detecting the exe, even when I specifically scan it. It keeps opening popups stating that I'm infected and attempting to get me to click it. It is blocking programs and saying they are infected by W32 Blaster.worm.

I'm going to try rebooting in safe mode and manually deleting it. Will post again later. Any advice is welcome.

P.S. Posting via my ps3 right now so it'll take some time for me to respond.

C__ProgramData_BitDefender_Desktop_Profiles_Logs_deep_sc_TWO.pdf

C__ProgramData_BitDefender_Desktop_Profiles_Logs_deep_sc_One.pdf

coolcool1227

Try different settings of AVC and IDS for blocking it.

C__ProgramData_BitDefender_Desktop_Profiles_Logs_deep_sc_TWO.pdf

C__ProgramData_BitDefender_Desktop_Profiles_Logs_deep_sc_One.pdf

coolcool1227

What are your Real Time Protection settings? Also post deep system scan log.

C__ProgramData_BitDefender_Desktop_Profiles_Logs_deep_sc_TWO.pdf

C__ProgramData_BitDefender_Desktop_Profiles_Logs_deep_sc_One.pdf

nanaka777us

My Real Time Protection setting was at default, now it's at aggressive. A deep system scan log probably won't show anything now. Poking around in the advanced settings revealed that my IDS on BD was disabled (for some odd reason) though it is now enabled.

I was able to reboot in safe mode and manually delete the offending file, though in hindsight I probably should have gotten an ID on it or sent it in. I've also run Ccleaner and gotten rid of oh about 505 MB worth of junk and corrected my registry.

C__ProgramData_BitDefender_Desktop_Profiles_Logs_deep_sc_TWO.pdf

C__ProgramData_BitDefender_Desktop_Profiles_Logs_deep_sc_One.pdf