Trojan.heur

after update the program still catch

Gen:Trojan.Heur.GZ.rq7

Gen:Trojan.Heur.GZ.mq

so it's not a false alarm for me and i try to search for answers and i found what i need :

Trojan Remover very small program and do perfect job to clear this Trojans now i'm happy after this small program my PC is clear like a new and the BitDefender no more detect this two Trojan

if you still have the same problem like me and don't know what to do try this and say if helps you

here is the download link : Trojan Remover

Regards,

Mihail Kyosev

Find more posts tagged with

Comments

Cristi Raducu

Can you post the scan log from Trojan Remover showing the viruses found?

Sophian_g2009

Can you post the scan log from Trojan Remover showing the viruses found?

I search with that programme >>> it tell my my pc is Clean LOL :wacko: :huh: :blink:

Sophian_g2009

I found this maybe Help >>>

I cant read it Cozz my language is arabic :

http://www.ehow.com/way_5762738_heur-trojan-removal.html

vechnost

***** THE SYSTEM HAS BEEN RESTARTED *****

09/08/2011 02:44:25: Trojan Remover has been restarted

The wscsvc service has been reset

09/08/2011 02:44:25: Trojan Remover closed

************************************************************

***** NORMAL SCAN FOR ACTIVE MALWARE *****

Trojan Remover Ver 6.8.2.2599. For information, email support@simplysup.com

[unregistered version]

Scan started at: 02:39:09 09 Aug 2011

Using Database v7740

Operating System: Windows 7 Professional (SP1) [build: 6.1.7601]

File System: NTFS

User Account Control is DISABLED

[secure Desktop Prompt is DISABLED]

UserData directory: C:\Users\SCUBA_DIVER\AppData\Roaming\Simply Super Software\Trojan Remover\

Database directory: C:\ProgramData\Simply Super Software\Trojan Remover\Data\

Logfile directory: C:\Users\SCUBA_DIVER\Documents\Simply Super Software\Trojan Remover Logfiles\

Program directory: C:\Program Files\Trojan Remover\

Running with Administrator privileges

************************************************************

02:39:09: ----- SCANNING FOR ROOTKIT SERVICES -----

No hidden Services were detected.

************************************************************

02:39:10: Scanning -----WINDOWS REGISTRY-----

--------------------

Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon

--------------------

Checking HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon

This key's "Shell" value calls the following program(s):

Key value: [explorer.exe]

File: explorer.exe

C:\Windows\explorer.exe

2616320 bytes

Created: 01/06/2011 01:30

Modified: 25/02/2011 08:30

Company: Microsoft Corporation

----------

This key's "Userinit" value calls the following program(s):

Key value: [c:\windows\system32\userinit.exe,]

File: c:\windows\system32\userinit.exe

c:\windows\system32\userinit.exe

26624 bytes

Created: 01/06/2011 02:13

Modified: 20/11/2010 15:17

Company: Microsoft Corporation

----------

This key's "System" value appears to be blank

----------

This key's "System" value appears to be blank

----------

--------------------

Checking HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows

--------------------

Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows

Value Name: run

The Data Value for this entry appears to be blank

--------------------

Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Value Name: BDAgent

Value Data: "C:\Program Files\Bitdefender\Bitdefender 2012\bdagent.exe"

C:\Program Files\Bitdefender\Bitdefender 2012\bdagent.exe

1188248 bytes

Created: 08/08/2011 20:03

Modified: 08/08/2011 20:03

Company: Bitdefender

--------------------

Value Name: TrojanScanner

Value Data: C:\Program Files\Trojan Remover\Trjscan.exe /boot

C:\Program Files\Trojan Remover\Trjscan.exe

1233856 bytes

Created: 09/08/2011 02:38

Modified: 18/05/2011 18:32

Company: Simply Super Software

--------------------

Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

This Registry Key appears to be empty

--------------------

Checking HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Value Name: RocketDock

Value Data: "C:\Program Files\RocketDock\RocketDock.exe"

C:\Program Files\RocketDock\RocketDock.exe

495616 bytes

Created: 13/06/2011 04:47

Modified: 02/09/2007 13:58

Company: [no info]

--------------------

Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce

This Registry Key appears to be empty

************************************************************

02:39:11: Scanning -----SHELLEXECUTEHOOKS-----

ShellExecuteHooks key is empty

************************************************************

02:39:12: Scanning -----HIDDEN REGISTRY ENTRIES-----

Taskdir check completed

----------

No Hidden File-loading Registry Entries found

----------

************************************************************

02:39:12: Scanning -----ACTIVE SCREENSAVER-----

No active ScreenSaver found to scan.

************************************************************

02:39:12: Scanning ----- REGISTRY ACTIVE SETUP KEYS -----

************************************************************

02:39:12: Scanning ----- SERVICEDLL REGISTRY KEYS -----

Key: StorSvc

Path: %SystemRoot%\system32\storsvc.dll

C:\Windows\system32\storsvc.dll

16384 bytes

Created: 14/07/2009 02:45

Modified: 14/07/2009 04:16

Company: Microsoft Corporation

--------------------

************************************************************

02:39:16: Scanning ----- SERVICES REGISTRY KEYS -----

Key: AdobeARMservice

ImagePath: "C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe"

C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

64952 bytes

Created: 06/06/2011 12:55

Modified: 06/06/2011 12:55

Company: Adobe Systems Incorporated

----------

Key: amdsata

ImagePath: \SystemRoot\system32\drivers\amdsata.sys

C:\Windows\system32\drivers\amdsata.sys

80256 bytes

Created: 14/07/2011 14:48

Modified: 11/03/2011 08:38

Company: Advanced Micro Devices

----------

Key: amdxata

ImagePath: system32\drivers\amdxata.sys

C:\Windows\system32\drivers\amdxata.sys

22400 bytes

Created: 14/07/2011 14:48

Modified: 11/03/2011 08:38

Company: Advanced Micro Devices

----------

Key: ASO3DiskOptimizer

ImagePath: C:\Program Files\Advanced System Optimizer 3\ASO3DefragSrv.exe

C:\Program Files\Advanced System Optimizer 3\ASO3DefragSrv.exe

238824 bytes

Created: 06/08/2011 12:48

Modified: 19/04/2010 17:15

Company: Systweak Inc., (www.systweak.com)

----------

Key: atapi

ImagePath: system32\drivers\atapi.sys

C:\Windows\system32\drivers\atapi.sys

21584 bytes

Created: 14/07/2009 02:11

Modified: 14/07/2009 04:26

Company: Microsoft Corporation

----------

Key: avc3

ImagePath: system32\DRIVERS\avc3.sys

C:\Windows\system32\DRIVERS\avc3.sys

596600 bytes

Created: 15/07/2011 16:11

Modified: 15/07/2011 16:11

Company: BitDefender

----------

Key: avchv

ImagePath: system32\DRIVERS\avchv.sys

C:\Windows\system32\DRIVERS\avchv.sys

240184 bytes

Created: 15/07/2011 16:11

Modified: 15/07/2011 16:11

Company: BitDefender

----------

Key: avckf

ImagePath: system32\DRIVERS\avckf.sys

C:\Windows\system32\DRIVERS\avckf.sys

451864 bytes

Created: 15/07/2011 16:11

Modified: 15/07/2011 16:11

Company: BitDefender

----------

Key: avisfltr

ImagePath: system32\DRIVERS\avisfltr.sys

C:\Windows\system32\DRIVERS\avisfltr.sys

327368 bytes

Created: 03/08/2011 14:55

Modified: 03/08/2011 14:55

Company: BitDefender

----------

Key: bdfsfltr

ImagePath: system32\DRIVERS\bdfsfltr.sys

C:\Windows\system32\DRIVERS\bdfsfltr.sys

353096 bytes

Created: 05/08/2011 20:49

Modified: 24/03/2011 15:36

Company: BitDefender

----------

Key: bdfwfpf

ImagePath: \??\C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys

C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys

90704 bytes

Created: 01/03/2011 17:45

Modified: 01/03/2011 17:45

Company: BitDefender LLC

----------

Key: bdsandbox

ImagePath: \??\C:\Windows\system32\drivers\bdsandbox.sys

C:\Windows\system32\drivers\bdsandbox.sys

62544 bytes

Created: 08/08/2011 20:03

Modified: 08/08/2011 20:03

Company: BitDefender SRL

----------

Key: bdselfpr

ImagePath: \??\C:\Program Files\Bitdefender\Bitdefender 2012\bdselfpr.sys

C:\Program Files\Bitdefender\Bitdefender 2012\bdselfpr.sys

127056 bytes

Created: 19/07/2011 16:20

Modified: 19/07/2011 16:20

Company: BitDefender LLC

----------

Key: BDVEDISK

ImagePath: system32\DRIVERS\bdvedisk.sys

C:\Windows\system32\DRIVERS\bdvedisk.sys

85128 bytes

Created: 19/01/2010 19:32

Modified: 19/01/2010 19:32

Company: BitDefender

----------

Key: clr_optimization_v4.0.30319_32

ImagePath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

130384 bytes

Created: 18/03/2010 13:16

Modified: 18/03/2010 13:16

Company: Microsoft Corporation

----------

Key: CompositeBus

ImagePath: \SystemRoot\system32\drivers\CompositeBus.sys

C:\Windows\system32\drivers\CompositeBus.sys

31232 bytes

Created: 01/06/2011 02:13

Modified: 20/11/2010 12:50

Company: Microsoft Corporation

----------

Key: Creative Audio Engine Licensing Service

ImagePath: "C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe"

C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe

79360 bytes

Created: 01/06/2011 00:40

Modified: 01/06/2011 00:40

Company: Creative Labs

----------

Key: CT20XUT

ImagePath: system32\drivers\CT20XUT.SYS

C:\Windows\system32\drivers\CT20XUT.SYS

171096 bytes

Created: 05/05/2010 21:23

Modified: 05/05/2010 21:23

Company: Creative Technology Ltd.

----------

Key: CT20XUT.SYS

ImagePath: \SystemRoot\System32\drivers\CT20XUT.SYS

C:\Windows\System32\drivers\CT20XUT.SYS

171096 bytes

Created: 05/05/2010 21:23

Modified: 05/05/2010 21:23

Company: Creative Technology Ltd.

----------

Key: ctac32k

ImagePath: system32\drivers\ctac32k.sys

C:\Windows\system32\drivers\ctac32k.sys

511064 bytes

Created: 05/05/2010 21:24

Modified: 05/05/2010 21:24

Company: Creative Technology Ltd

----------

Key: ctaud2k

ImagePath: system32\drivers\ctaud2k.sys

C:\Windows\system32\drivers\ctaud2k.sys

526296 bytes

Created: 05/05/2010 21:24

Modified: 05/05/2010 21:24

Company: Creative Technology Ltd

----------

Key: CTAudSvcService

ImagePath: C:\Program Files\Creative\Shared Files\CTAudSvc.exe

C:\Program Files\Creative\Shared Files\CTAudSvc.exe

307200 bytes

Created: 01/06/2011 00:39

Modified: 23/02/2009 11:43

Company: Creative Technology Ltd

----------

Key: ctdvda2k

ImagePath: system32\drivers\ctdvda2k.sys

C:\Windows\system32\drivers\ctdvda2k.sys

347144 bytes

Created: 05/05/2010 21:24

Modified: 05/05/2010 21:24

Company: Creative Technology Ltd

----------

Key: CTEXFIFX

ImagePath: system32\drivers\CTEXFIFX.SYS

C:\Windows\system32\drivers\CTEXFIFX.SYS

1324120 bytes

Created: 05/05/2010 21:24

Modified: 05/05/2010 21:24

Company: Creative Technology Ltd.

----------

Key: CTEXFIFX.SYS

ImagePath: \SystemRoot\System32\drivers\CTEXFIFX.SYS

C:\Windows\System32\drivers\CTEXFIFX.SYS

1324120 bytes

Created: 05/05/2010 21:24

Modified: 05/05/2010 21:24

Company: Creative Technology Ltd.

----------

Key: CTHWIUT

ImagePath: system32\drivers\CTHWIUT.SYS

C:\Windows\system32\drivers\CTHWIUT.SYS

72792 bytes

Created: 05/05/2010 21:23

Modified: 05/05/2010 21:23

Company: Creative Technology Ltd.

----------

Key: CTHWIUT.SYS

ImagePath: \SystemRoot\System32\drivers\CTHWIUT.SYS

C:\Windows\System32\drivers\CTHWIUT.SYS

72792 bytes

Created: 05/05/2010 21:23

Modified: 05/05/2010 21:23

Company: Creative Technology Ltd.

----------

Key: ctprxy2k

ImagePath: system32\drivers\ctprxy2k.sys

C:\Windows\system32\drivers\ctprxy2k.sys

14424 bytes

Created: 05/05/2010 21:28

Modified: 05/05/2010 21:28

Company: Creative Technology Ltd

----------

Key: ctsfm2k

ImagePath: system32\drivers\ctsfm2k.sys

C:\Windows\system32\drivers\ctsfm2k.sys

158808 bytes

Created: 05/05/2010 21:29

Modified: 05/05/2010 21:29

Company: Creative Technology Ltd

----------

Key: EagleXNt

ImagePath: \??\C:\Windows\system32\drivers\EagleXNt.sys

C:\Windows\system32\drivers\EagleXNt.sys - [file not found to scan]

----------

Key: emupia

ImagePath: system32\drivers\emupia2k.sys

C:\Windows\system32\drivers\emupia2k.sys

95832 bytes

Created: 05/05/2010 21:29

Modified: 05/05/2010 21:29

Company: Creative Technology Ltd

----------

Key: GGSAFERDriver

ImagePath: \??\C:\Program Files\Garena Messenger\Room\safedrv.sys

C:\Program Files\Garena Messenger\Room\safedrv.sys - [file not found to scan]

----------

Key: ha20x2k

ImagePath: system32\drivers\ha20x2k.sys

C:\Windows\system32\drivers\ha20x2k.sys

1178200 bytes

Created: 05/05/2010 21:29

Modified: 05/05/2010 21:29

Company: Creative Technology Ltd

----------

Key: HdAudAddService

ImagePath: \SystemRoot\system32\drivers\HdAudio.sys

C:\Windows\system32\drivers\HdAudio.sys

304128 bytes

Created: 01/06/2011 02:13

Modified: 20/11/2010 13:00

Company: Microsoft Corporation

----------

Key: HTCAND32

ImagePath: System32\Drivers\ANDROIDUSB.sys

C:\Windows\System32\Drivers\ANDROIDUSB.sys

25088 bytes

Created: 26/10/2009 08:54

Modified: 26/10/2009 08:54

Company: HTC, Corporation

----------

Key: iaStorV

ImagePath: \SystemRoot\system32\drivers\iaStorV.sys

C:\Windows\system32\drivers\iaStorV.sys

332160 bytes

Created: 14/07/2011 14:48

Modified: 11/03/2011 08:38

Company: Intel Corporation

----------

Key: L1E

ImagePath: system32\DRIVERS\L1E62x86.sys

C:\Windows\system32\DRIVERS\L1E62x86.sys

48640 bytes

Created: 23/08/2009 13:06

Modified: 23/08/2009 13:06

Company: Atheros Communications, Inc.

----------

Key: MBAMSwissArmy

ImagePath: \??\C:\Windows\system32\drivers\mbamswissarmy.sys

C:\Windows\system32\drivers\mbamswissarmy.sys - [file not found to scan]

----------

Key: mouclass

ImagePath: \SystemRoot\system32\drivers\mouclass.sys

C:\Windows\system32\drivers\mouclass.sys

41552 bytes

Created: 14/07/2009 02:11

Modified: 14/07/2009 04:20

Company: Microsoft Corporation

----------

Key: MpKsl14a41b1a

ImagePath: \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{1369E902-5367-4BFC-8B50-597A421519A8}\MpKsl14a41b1a.sys

c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{1369E902-5367-4BFC-8B50-597A421519A8}\MpKsl14a41b1a.sys - [file not found to scan]

----------

Key: MpKsl3f612208

ImagePath: \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{6CE5EA4E-056E-44B3-A40E-A5933894D699}\MpKsl3f612208.sys

c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{6CE5EA4E-056E-44B3-A40E-A5933894D699}\MpKsl3f612208.sys - [file not found to scan]

----------

Key: MpKsl45e5098e

ImagePath: \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{CCC77B6D-4EE7-44CA-BB27-E8CA1E987C89}\MpKsl45e5098e.sys

c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{CCC77B6D-4EE7-44CA-BB27-E8CA1E987C89}\MpKsl45e5098e.sys - [file not found to scan]

----------

Key: MpKsl6a5d6fd3

ImagePath: \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{35525B22-5A36-47F5-95F5-43AFF6BBADA9}\MpKsl6a5d6fd3.sys

c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{35525B22-5A36-47F5-95F5-43AFF6BBADA9}\MpKsl6a5d6fd3.sys - [file not found to scan]

----------

Key: MpKsl8bfa7900

ImagePath: \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{87C391A5-1079-4F89-BFCA-23D5224DD967}\MpKsl8bfa7900.sys

c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{87C391A5-1079-4F89-BFCA-23D5224DD967}\MpKsl8bfa7900.sys - [file not found to scan]

----------

Key: MpKsl8ebc65a3

ImagePath: \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{E4D76752-BBF4-4CDF-99C7-2454F54DC5D3}\MpKsl8ebc65a3.sys

c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{E4D76752-BBF4-4CDF-99C7-2454F54DC5D3}\MpKsl8ebc65a3.sys - [file not found to scan]

----------

Key: MpKsl9a9a83f7

ImagePath: \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{1369E902-5367-4BFC-8B50-597A421519A8}\MpKsl9a9a83f7.sys

c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{1369E902-5367-4BFC-8B50-597A421519A8}\MpKsl9a9a83f7.sys - [file not found to scan]

----------

Key: MpKsl9adcc644

ImagePath: \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{99DE2387-0E8E-46B2-85E9-2A92E4466BC3}\MpKsl9adcc644.sys

c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{99DE2387-0E8E-46B2-85E9-2A92E4466BC3}\MpKsl9adcc644.sys - [file not found to scan]

----------

Key: MpKslb5a4fbb1

ImagePath: \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{1FE1B4FF-D883-470A-8AD8-889A68B5049D}\MpKslb5a4fbb1.sys

c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{1FE1B4FF-D883-470A-8AD8-889A68B5049D}\MpKslb5a4fbb1.sys - [file not found to scan]

----------

Key: MpKslc88f59e6

ImagePath: \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{9C1FC196-9EDA-4281-AF53-90F3CF5FD0BB}\MpKslc88f59e6.sys

c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{9C1FC196-9EDA-4281-AF53-90F3CF5FD0BB}\MpKslc88f59e6.sys - [file not found to scan]

----------

Key: MpKslf55d5280

ImagePath: \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{1E08BEF2-3868-4349-9DFD-059DE694A650}\MpKslf55d5280.sys

c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{1E08BEF2-3868-4349-9DFD-059DE694A650}\MpKslf55d5280.sys - [file not found to scan]

----------

Key: mssmbios

ImagePath: \SystemRoot\system32\drivers\mssmbios.sys

C:\Windows\system32\drivers\mssmbios.sys

28240 bytes

Created: 14/07/2009 02:19

Modified: 14/07/2009 04:20

Company: Microsoft Corporation

----------

Key: npggsvc

ImagePath: C:\Windows\system32\GameMon.des -service

C:\Windows\system32\GameMon.des

4066168 bytes

Created: 04/06/2011 14:55

Modified: 24/04/2011 23:55

Company: INCA Internet Co., Ltd.

----------

Key: nvUpdatusService

ImagePath: C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe

C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe

2214504 bytes

Created: 01/06/2011 00:27

Modified: 21/05/2011 06:01

Company: NVIDIA Corporation

----------

Key: ossrv

ImagePath: system32\drivers\ctoss2k.sys

C:\Windows\system32\drivers\ctoss2k.sys

130136 bytes

Created: 05/05/2010 21:24

Modified: 05/05/2010 21:24

Company: Creative Technology Ltd.

----------

Key: Stereo Service

ImagePath: C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

378472 bytes

Created: 07/04/2011 21:54

Modified: 07/04/2011 21:54

Company: NVIDIA Corporation

----------

Key: swenum

ImagePath: \SystemRoot\system32\drivers\swenum.sys

C:\Windows\system32\drivers\swenum.sys

12240 bytes

Created: 14/07/2009 02:45

Modified: 14/07/2009 04:19

Company: Microsoft Corporation

----------

Key: TermDD

ImagePath: \SystemRoot\system32\drivers\termdd.sys

C:\Windows\system32\drivers\termdd.sys

53120 bytes

Created: 01/06/2011 02:14

Modified: 20/11/2010 15:30

Company: Microsoft Corporation

----------

Key: trufos

ImagePath: system32\DRIVERS\trufos.sys

C:\Windows\system32\DRIVERS\trufos.sys

311248 bytes

Created: 05/08/2011 20:49

Modified: 22/07/2011 20:20

Company: BitDefender S.R.L.

----------

Key: TsUsbFlt

ImagePath: System32\drivers\tsusbflt.sys

C:\Windows\System32\drivers\tsusbflt.sys

52224 bytes

Created: 01/06/2011 02:15

Modified: 20/11/2010 13:24

Company: Microsoft Corporation

----------

Key: Update Server

ImagePath: C:\Program Files\Common Files\Bitdefender\Bitdefender Arrakis Server\bin\arrakis3.exe

C:\Program Files\Common Files\Bitdefender\Bitdefender Arrakis Server\bin\arrakis3.exe

307544 bytes

Created: 22/07/2011 12:22

Modified: 22/07/2011 12:22

Company: BitDefender

----------

Key: UPDATESRV

ImagePath: "C:\Program Files\Bitdefender\Bitdefender 2012\updatesrv.exe" /service

C:\Program Files\Bitdefender\Bitdefender 2012\updatesrv.exe

50128 bytes

Created: 22/07/2011 12:47

Modified: 22/07/2011 12:47

Company: Bitdefender

----------

Key: VID

ImagePath: C:\Users\SCUBA_~1\AppData\Local\Temp\VID.exe

C:\Users\SCUBA_~1\AppData\Local\Temp\VID.exe

502656 bytes

Created: 06/08/2011 21:26

Modified: 06/08/2011 21:26

Company: Sysinternals - www.sysinternals.com

----------

Key: vmbus

ImagePath: system32\drivers\vmbus.sys

C:\Windows\system32\drivers\vmbus.sys

175360 bytes

Created: 01/06/2011 02:14

Modified: 20/11/2010 15:30

Company: Microsoft Corporation

----------

Key: VMnetAdapter

ImagePath: system32\DRIVERS\vmnetadapter.sys

C:\Windows\system32\DRIVERS\vmnetadapter.sys - [file not found to scan]

----------

Key: VSSERV

ImagePath: C:\Program Files\Bitdefender\Bitdefender 2012\vsserv.exe /service

C:\Program Files\Bitdefender\Bitdefender 2012\vsserv.exe

1506536 bytes

Created: 08/08/2011 20:03

Modified: 08/08/2011 20:03

Company: Bitdefender

----------

Key: WatAdminSvc

ImagePath: %SystemRoot%\system32\Wat\WatAdminSvc.exe

C:\Windows\system32\Wat\WatAdminSvc.exe

1343400 bytes

Created: 01/06/2011 02:17

Modified: 01/06/2011 02:17

Company: Microsoft Corporation

----------

************************************************************

02:39:40: Scanning -----VXD ENTRIES-----

************************************************************

02:39:40: Scanning ----- WINLOGON\NOTIFY DLLS -----

No WINLOGON\NOTIFY DLLs found to scan

Rootkit scan of Winlogon\Notify key not possible [key may not exist]

************************************************************

02:39:40: Scanning ----- CONTEXTMENUHANDLERS -----

Key: AIMP

CLSID: {1F77B17B-F531-44DB-ACA4-76ABB5010A28}

Path: C:\Program Files\AIMP3\Modules\aimp_menu32.dll

C:\Program Files\AIMP3\Modules\aimp_menu32.dll

318464 bytes

Created: 07/08/2011 22:44

Modified: 07/08/2011 22:44

Company: AIMP DevTeam

----------

Key: SecureExt

CLSID: {D23C3BA7-6DC3-4DDF-9BDF-12599E852A40}

Path: C:\Program Files\Advanced System Optimizer 3\SecureShell.dll

C:\Program Files\Advanced System Optimizer 3\SecureShell.dll

313064 bytes

Created: 06/08/2011 12:48

Modified: 19/04/2010 17:15

Company: Systweak Inc., (www.systweak.com)

----------

Key: VirtualCloneDrive

CLSID: {B7056B8E-4F99-44f8-8CBD-282390FE5428}

Path: C:\Program Files\Elaborate Bytes\VirtualCloneDrive\ElbyVCDShell.dll

C:\Program Files\Elaborate Bytes\VirtualCloneDrive\ElbyVCDShell.dll

101544 bytes

Created: 01/06/2011 19:14

Modified: 14/12/2009 20:31

Company: Elaborate Bytes AG

----------

Key: {D653647D-D607-4df6-A5B8-48D2BA195F7B}

Path: C:\Program Files\Bitdefender\Bitdefender 2012\bdshellext.dll

C:\Program Files\Bitdefender\Bitdefender 2012\bdshellext.dll

73824 bytes

Created: 22/07/2011 14:03

Modified: 22/07/2011 14:03

Company: Bitdefender

----------

************************************************************

02:39:41: Scanning ----- FOLDER\COLUMNHANDLERS -----

************************************************************

02:39:41: Scanning ----- BROWSER HELPER OBJECTS -----

************************************************************

02:39:41: Scanning ----- SHELLSERVICEOBJECTS -----

************************************************************

02:39:41: Scanning ----- SHAREDTASKSCHEDULER ENTRIES -----

No SharedTaskScheduler entries found to scan

************************************************************

02:39:41: Scanning ----- IMAGEFILE DEBUGGERS -----

No "Debugger" entries found.

************************************************************

02:39:41: Scanning ----- APPINIT_DLLS -----

The AppInit_DLLs value is blank or does not exist

************************************************************

02:39:42: Scanning ----- SECURITY PROVIDER DLLS -----

************************************************************

02:39:42: Scanning ------ COMMON STARTUP GROUP ------

[C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup]

The Common Startup Group attempts to load the following file(s) at boot time:

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-HS- 174 bytes

Created: 14/07/2009 07:41

Modified: 14/07/2009 07:41

Company: [no info]

--------------------

************************************************************

02:39:42: Scanning ----- USER STARTUP GROUPS -----

Checking Startup Group for: SCUBA_DIVER

[C:\Users\SCUBA_DIVER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup]

C:\Users\SCUBA_DIVER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-HS- 174 bytes

Created: 31/05/2011 20:53

Modified: 01/06/2011 02:46

Company: [no info]

----------

--------------------

************************************************************

02:39:43: Scanning ----- SCHEDULED TASKS -----

Taskname: Adobe online update program

File: C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

937920 bytes

Created: 06/06/2011 12:55

Modified: 06/06/2011 12:55

Company: Adobe Systems Incorporated

Schedule: At 10:00:00 every Monday of every week, starting 01/01/2009

Next Run Time: 15/08/2011 10:00:00

Status: Ready

Creator: TuneUp

Comments: tuident:597942F8

----------

Taskname: Java Update Scheduler

File: C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

254696 bytes

Created: 08/04/2011 12:59

Modified: 08/04/2011 12:59

Company: Sun Microsystems, Inc.

Schedule: At 10:00:00 every Monday of every week, starting 01/01/2009

Next Run Time: 15/08/2011 10:00:00

Status: Ready

Creator: TuneUp

Comments: tuident:3BDB2E3B

----------

Taskname: kvxmpz

File: C:\Windows\system32\d3dx10_435.dll

C:\Windows\system32\d3dx10_435.dll

-RHS- 64000 bytes

Created: 26/07/2011 11:06

Modified: 26/07/2011 11:06

Company: [no info]

Parameters: "C:\Windows\system32\d3dx10_435.dll",Epizkdrfky

Schedule: On system startup

Next Run Time:

Status: Running

Creator: SCUBA_DIVER

Comments:

C:\Windows\system32\d3dx10_435.dll - access denied

C:\Windows\system32\d3dx10_435.dll - Ownership taken

kvxmpz - this Scheduled Task has been deleted

C:\Windows\system32\d3dx10_435.dll - READ-ONLY, HIDDEN and SYSTEM file attributes removed

C:\Windows\system32\d3dx10_435.dll - file renamed to: C:\Windows\system32\d3dx10_435.dll.vir

----------

Taskname: Launch HTC Sync Loader

File: C:\Program Files\HTC\HTC Sync 3.0\htcUPCTLoader.exe

Parameters: -startup

Schedule: At 20:50:21 on 23/06/2011

Next Run Time:

Status: Ready

Creator: InstallShield

Comments: Launch HTC Sync Loader

C:\Program Files\HTC\HTC Sync 3.0\htcUPCTLoader.exe - [file not found to scan]

----------

************************************************************

02:40:05: Scanning ----- SHELLICONOVERLAYIDENTIFIERS -----

Key: SharingPrivate

CLSID: {08244EE6-92F0-47f2-9FC9-929BAA2E7235}

File: %SystemRoot%\system32\ntshrui.dll

C:\Windows\system32\ntshrui.dll

442880 bytes

Created: 01/06/2011 02:14

Modified: 20/11/2010 15:20

Company: Microsoft Corporation

----------

************************************************************

02:40:05: Scanning ----- DEVICE DRIVER ENTRIES -----

************************************************************

02:40:06: ----- ADDITIONAL CHECKS -----

Winlogon registry rootkit checks completed

----------

Heuristic checks for hidden files/drivers completed

----------

Layered Service Provider entries checks completed

----------

Windows Explorer Policies checks completed

----------

Desktop Wallpaper entry is blank

----------

Web Desktop Wallpaper entry is blank

----------

DNS Server information:

Interface:

NameServers: 212.50.10.50 212.50.10.51

Checks for rogue DNS NameServers completed

----------

The Security Center service is disabled

[service set to DISABLED]

The Security Center service has been reset

Additional checks completed

************************************************************

02:40:17: Scanning ----- RUNNING PROCESSES -----

C:\Windows\System32\smss.exe

69632 bytes

Created: 14/07/2009 02:11

Modified: 14/07/2009 04:14

Company: Microsoft Corporation

[1 loaded module]

--------------------

C:\Windows\system32\csrss.exe

6144 bytes

Created: 14/07/2009 02:11

Modified: 14/07/2009 04:14

Company: Microsoft Corporation

[17 loaded modules in total]

--------------------

C:\Windows\system32\wininit.exe

96256 bytes

Created: 14/07/2009 02:36

Modified: 14/07/2009 04:14

Company: Microsoft Corporation

[25 loaded modules in total]

--------------------

[17 loaded modules in total]

C:\Windows\system32\services.exe

259072 bytes

Created: 14/07/2009 02:11

Modified: 14/07/2009 04:14

Company: Microsoft Corporation

[32 loaded modules in total]

--------------------

C:\Windows\system32\lsass.exe

22528 bytes

Created: 14/07/2009 02:11

Modified: 14/07/2009 04:14

Company: Microsoft Corporation

[63 loaded modules in total]

--------------------

C:\Windows\system32\lsm.exe

267776 bytes

Created: 01/06/2011 02:14

Modified: 20/11/2010 15:17

Company: Microsoft Corporation

[15 loaded modules in total]

--------------------

C:\Windows\system32\winlogon.exe

286720 bytes

Created: 01/06/2011 02:14

Modified: 20/11/2010 15:17

Company: Microsoft Corporation

[30 loaded modules in total]

--------------------

C:\Windows\system32\svchost.exe

20992 bytes

Created: 14/07/2009 02:19

Modified: 14/07/2009 04:14

Company: Microsoft Corporation

[51 loaded modules in total]

--------------------

C:\Program Files\Bitdefender\Bitdefender 2012\vsserv.exe

1506536 bytes

Created: 08/08/2011 20:03

Modified: 08/08/2011 20:03

Company: Bitdefender

[231 loaded modules in total]

--------------------

C:\Windows\system32\nvvsvc.exe

615528 bytes

Created: 07/04/2011 22:43

Modified: 21/05/2011 06:01

Company: NVIDIA Corporation

[34 loaded modules in total]

--------------------

[33 loaded modules in total]

--------------------

[60 loaded modules in total]

--------------------

[91 loaded modules in total]

--------------------

[151 loaded modules in total]

--------------------

[28 loaded modules in total]

[61 loaded modules in total]

[83 loaded modules in total]

C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

839272 bytes

Created: 07/04/2011 22:43

Modified: 21/05/2011 06:01

Company: NVIDIA Corporation

[43 loaded modules in total]

--------------------

[45 loaded modules in total]

C:\Windows\System32\spoolsv.exe

317440 bytes

Created: 01/06/2011 02:14

Modified: 20/11/2010 15:17

Company: Microsoft Corporation

C:\Windows\system32\spool\PRTPROCS\W32X86\winprint.dll appears to contain: TROJAN.SPY.GOLDUN

C:\Windows\system32\spool\PRTPROCS\W32X86\winprint.dll - file renamed to: C:\Windows\system32\spool\PRTPROCS\W32X86\winprint.dll.vir

[74 loaded modules in total]

--------------------

[60 loaded modules in total]

--------------------

C:\Windows\system32\taskeng.exe

192000 bytes

Created: 01/06/2011 02:14

Modified: 20/11/2010 15:17

Company: Microsoft Corporation

[25 loaded modules in total]

--------------------

C:\Windows\system32\taskhost.exe

49152 bytes

Created: 01/06/2011 02:13

Modified: 20/11/2010 15:17

Company: Microsoft Corporation

[53 loaded modules in total]

--------------------

C:\Windows\system32\rundll32.exe

44544 bytes

Created: 14/07/2009 02:41

Modified: 14/07/2009 04:14

Company: Microsoft Corporation

[43 loaded modules in total]

--------------------

C:\Windows\system32\Dwm.exe

92672 bytes

Created: 14/07/2009 02:24

Modified: 14/07/2009 04:14

Company: Microsoft Corporation

[27 loaded modules in total]

--------------------

[166 loaded modules in total]

[23 loaded modules in total]

[21 loaded modules in total]

[97 loaded modules in total]

[43 loaded modules in total]

[28 loaded modules in total]

C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

373864 bytes

Created: 07/04/2011 22:43

Modified: 21/05/2011 06:01

Company: NVIDIA Corporation

[45 loaded modules in total]

--------------------

[48 loaded modules in total]

[50 loaded modules in total]

[37 loaded modules in total]

C:\Program Files\Skype\Phone\Skype.exe

-R- 15141768 bytes

Created: 15/06/2011 15:02

Modified: 15/06/2011 15:02

Company: Skype Technologies S.A.

[152 loaded modules in total]

--------------------

[38 loaded modules in total]

C:\Program Files\uTorrent\uTorrent.exe

639864 bytes

Created: 01/06/2011 00:10

Modified: 19/07/2011 12:14

Company: BitTorrent, Inc.

[70 loaded modules in total]

--------------------

C:\Program Files\Bitdefender\Bitdefender 2012\seccenter.exe

1059480 bytes

Created: 08/08/2011 20:03

Modified: 08/08/2011 20:03

Company: Bitdefender

[134 loaded modules in total]

--------------------

C:\Program Files\Mozilla Firefox\firefox.exe

924632 bytes

Created: 01/06/2011 00:08

Modified: 23/06/2011 20:19

Company: Mozilla Corporation

[168 loaded modules in total]

--------------------

C:\Program Files\Trojan Remover\Rmvtrjan.exe

FileSize: 4678576

[This is a Trojan Remover component]

[78 loaded modules in total]

--------------------

************************************************************

02:41:51: Checking HOSTS file

No malicious entries were found in the HOSTS file

************************************************************

02:41:52: Scanning ------ %TEMP% DIRECTORY ------

************************************************************

02:41:55: Scanning ------ C:\Windows\Temp DIRECTORY ------

************************************************************

02:41:55: Scanning ------ ROOT DIRECTORY ------

************************************************************

02:41:56: ------ Scan for other files to remove ------

No malware-related files found to remove

************************************************************

------ INTERNET EXPLORER HOME/START/SEARCH SETTINGS ------

HKLM\Software\Microsoft\Internet Explorer\Main\"Start Page":

about:blank

HKLM\Software\Microsoft\Internet Explorer\Main\"Local Page":

C:\Windows\System32\blank.htm

HKLM\Software\Microsoft\Internet Explorer\Main\"Search Page":

http://go.microsoft.com/fwlink/?LinkId=54896

HKCU\Software\Microsoft\Internet Explorer\Main\"Start Page":

about:blank

HKCU\Software\Microsoft\Internet Explorer\Main\"Local Page":

C:\Windows\system32\blank.htm

HKCU\Software\Microsoft\Internet Explorer\Main\"Search Page":

http://go.microsoft.com/fwlink/?LinkId=54896

************************************************************

=== CHANGES WERE MADE TO THE WINDOWS REGISTRY ===

=== ONE OR MORE FILES WERE RENAMED OR REMOVED ===

Scan completed at: 02:41:56 09 Aug 2011

Total Scan time: 00:02:47

-------------------------------------------------------------------------

Trojan Remover needs to restart the system to complete operations

09/08/2011 02:42:23: restart commenced

************************************************************

Cristi Raducu

Please upload on http://www.sendspace.com the following file and post here the download link.

C:\Windows\system32\spool\PRTPROCS\W32X86\winprint.dll.vir

This was renamed by Trojan Remover and tagged as a threat.

preguntonontrack

Please upload on http://www.sendspace.com the following file and post here the download link.

C:\Windows\system32\spool\PRTPROCS\W32X86\winprint.dll.vir

This was renamed by Trojan Remover and tagged as a threat.

Can an admin/mod post the official trojan remover site?

Cristi Raducu

Can an admin/mod post the official trojan remover site?

That tool is not made by BitDefender and if you run it you will do it on your own risk.

The file deleted by that tool seems to be clean file,that's why I'm asking for a sample.

vechnost

http://www.sendspace.com/file/xsutyf

here is the file

vechnost

btw see this too the program alse rename this file:

C:\Windows\system32\d3dx10_435.dll - READ-ONLY, HIDDEN and SYSTEM file attributes removed

C:\Windows\system32\d3dx10_435.dll - file renamed to: C:\Windows\system32\d3dx10_435.dll.vir

http://www.sendspace.com/file/i0vpjb

online scaners see it like a virus

NOD32 6367 2011.08.11 a variant of Win32/Kryptik.RLE

AntiVir 7.11.13.12 2011.08.10 TR/Crypt.XPACK.Gen

Cristi Raducu

winprint.dll is clean and you should rename it back.

d3dx10_435.dll is infected and has been signed as Trojan.Agent.ASCL