Removing Gen:variant.adware.zwangi.2

I am having trouble removing a virus. Even after hours of browsing the internet and the BD forum for an answer I still cannot remove it so I am requesting help here.

What I have:

Windows XP 32 bit

BitDefender 2010 (Not the pro version)

Problem:

BitDefender has found one virus but when I attempt to remove or quarantine the infected file(s) BD says "One item failed to be cleaned. This happened because no cleaning routine was available for this type of threat. You can find out more about this here." And then it has a link to the BD site. Unfortunately the FAQ was not very useful to me as I had already done the steps BD suggested and they still didn't seem to fix the problem. BD continues to block the file access of the virus/malware multiple times a day but it seems it cannot remove it.

BD refers to the malware as:

Gen:Variant.Adware.Zwangi.2

Accessed by:

svchost

Final status after scan(s):

Move archive to Quarantine failed (archive could not be repacked.)

Additional info:

Possibly unrelated but in scans for as long as I have had BD (a year or two?) it has detected 15 Password protected items in:

C:\WINDOWS\system32\config\systemprofile\Local Settings/Temporary internet files\......

Even after I had made hidden files visible when I followed the file path the files simply weren't there. I tried deleting all of the Temporary Internet Files but to no avail. A few weeks ago BD discovered the virus, since that time I have been able to delete those files; unfortunately I cannot remember how I finally succeeded after over a year of searching for them... Yet even after deleting these files in the system32 file path and using a drive cleaner to delete all Temporary Internet Files in all internet browsers it still finds an infected file here (I do realize they are a different file path than the password protected items aforementioned.) :

C:\Documents and Settings\Local Service\Local Settings\Temporary Internet Files\Content.IE5\RME6BZ46\upgrade[1].cab=>upgrade.exe=>(NSIS o)=>lzma_solid_nsis0003

I can put up a scan log if it is requested.

Thank you in advance for any help!

Find more posts tagged with

Comments

Cristi Raducu

Hello BlackKnight10,

Please post the entire scan log file to see exactly what happened.

BlackKnight10

BitDefender Log File

Product: BitDefender Antivirus 2010

Version: BitDefender Antivirus Scanner

Scanning task: System Scan

Log date: 2/20/2011 1:00:04 AM

Log path: C:\Documents and Settings\All Users\Application Data\BitDefender\Desktop\Profiles\Logs\full_scan\1298181604_1_02.xml

Scan paths:

Path 0000: C:\

Path 0001: \

Path 0002: I:\

Path 0003: H:\

Scan Level:

Scan for viruses: Yes

Scan for adware: Yes

Scan for spyware: Yes

Scan for applications: Yes

Scan for dialers: Yes

Scan for rootkits: No

Scan for keyloggers: Yes

Virus Scanning Options:

Scan registry keys: Yes

Scan cookies: Yes

Scan boot sectors: Yes

Scan memory processes: Yes

Scan archives: Yes

Scan runtime packers: Yes

Scan e-mails: Yes

Scan all files: Yes

Heuristic Scan: Yes

Scanned extensions: not configured

Excluded extensions: not configured

Target Processing:

Default first action for infected objects: Disinfect

Default second action for infected objects: None

Default first action for suspect objects : None

Default second action for suspicious objects: None

Default action for hidden objects: None

Default first action for encrypted infected objects: Disinfect

Default second action for encrypted infected objects: None

Default first action for encrypted suspicious objects: None

Default second action for encrypted suspicious objects: None

Default action for password-protected objects: Log only

Scan Engines Summary

Virus signatures: 6668742

Archive plugins: 44

E-mail plugins: 6

Scan plugins: 14

System plugins: 5

Unpack plugins: 10

Basic

Scanned items: 441966

Infected items: 1

Suspect items: 0 (no suspected items have been detected)

Hidden items: 0 (the scan options do not include scanning for rootkits)

Resolved items: 0 (infected or suspect items have been found and were ignored or could not be fixed)

Unresolved items: 1

Advanced

Scan time: 01:45:02

Files per second: 70

Skipped items: 0

Password-protected items: 0

Over-compressed items: 0

Individual viruses found: 1

Scanned folders: 11583

Scanned boot sectors: 6

Scanned archives: 4959

Input-output errors: 0

Scanned processes: 18

Infected processes: 0

Scanned registry keys: 2757

Infected registry keys: 0

Scanned cookies: 8

Infected cookies: 0

Remaining issues:Object Path Threat Name Final Status

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\RME6BZ46\upgrade[1].cab=>upgrade.exe=>(NSIS o)=>lzma_solid_nsis0003 Gen:Variant.Adware.Zwangi.2 Move archive to Quarantine failed (archive could not be repacked)

Thanks for the fast response!

BlackKnight10

Oh and like I said earlier BD blocks the access of the malware multiple times a day and when it pops up that it has blocked the virus that's when it says that it was accessed by svchost.exe

Cristi Raducu

I have sent you an email with instructions on how to further investigate this situation.

Please reply back to my email with the necessary logs.

BlackKnight10

I have sent you an email with instructions on how to further investigate this situation.

Please reply back to my email with the necessary logs.

OK, I have sent an email with the logs as requested

BlackKnight10

Thank you very much! Problem has been resolved with the BD update! Thank you for your time; impressive customer service!

Bhanuka

I have a problem with BD. I scanned my system ( Full Scan) and it says that there is a trojan that cannot be removed. can you please help?