Trouble With Generic Trojans

Bitdefender 2011 keeps blocking Trojan.Generic.6668174 and 6675002 accessed by svchost.exe, located in the C:\Windows\assmebly folder.

I run a scan and it some times finds and kills viruses in that folder but it's probably just a red herring. Basically, I keep getting pop-ups from Bitdefender that it is blocking these two viruses on a frequent and periodic basis.

I've also found that under the Advanced settings, Active Virus control is off, and when I check it on, it never turns on. I don't know if this is a program bug (cause the active scanner does seem to be working since it says it is blocking viruses) or what.

Here's my scan results from a scan last night:

BitDefender Log File

Product: BitDefender Antivirus Pro 2011

Scanning task: Full System Scan

Log date: Wednesday, September 28, 2011 10:15:55 PM

Log path: C:\ProgramData\BitDefender\Desktop\Profiles\Logs\6f349eda-6759-4378-b3c9-9174905515f7\1317266100_3_01.xml

Scan paths:

Path : C:\

Path : \

[-]Detailed Scan Summary

[-]Basic

Scanned items: 65338

Infected items: 0 (no infected items have been detected)

Suspect items: 0 (no suspected items have been detected)

Resolved items: 0 (no threats have been detected during this scan)

Unresolved items: 0 (no issues remained unresolved)

[-]Advanced

Scan time: 0: 0: 53

Files per second: 1232

Skipped items: 18462

Password-protected items: 0

Over-compressed items: 0

Scanned archives: 42

Input-output errors: 4

Scanned boot sectors: 0

Scanned processes: 3513

Infected processes: 0

Scanned registry keys: 188

Infected registry keys: 0

Scanned cookies: 0

Infected cookies: 0

[-]Scan Options

[-]Target Threat Types:

Scan for viruses: Yes

Scan for adware: Yes

Scan for spyware: Yes

Scan for applications: Yes

Scan for dialers: Yes

Scan for rootkits: No

Scan for keyloggers: Yes

[-]Virus Scanning Options:

Scan registry keys: Yes

Scan cookies: Yes

Scan boot sectors: Yes

Scan memory processes: Yes

Scan archives: Yes

Scan runtime packers: Yes

Scan e-mails: Yes

Scan all files: Yes

Heuristic Scan: Yes

Scanned extensions: not configured

Excluded extensions: not configured

[-]Target Processing:

Default first action for infected objects: Disinfect

Default second action for infected objects: Move files to quarantine

Default first action for suspect objects : Move files to quarantine

Default second action for suspicious objects: None

Default action for hidden objects: None

Default action for password-protected objects: Log only

[-]Scan Engines Summary

Virus signatures: 9232897

Find more posts tagged with

Comments

skwint

I am having this same problem. Multiple quarantine deletes have done nothing to remove the issue and stop the pop ups.

Bitdefender 2011 keeps blocking Trojan.Generic.6668174 and 6675002 accessed by svchost.exe, located in the C:\Windows\assmebly folder.

I run a scan and it some times finds and kills viruses in that folder but it's probably just a red herring. Basically, I keep getting pop-ups from Bitdefender that it is blocking these two viruses on a frequent and periodic basis.

I've also found that under the Advanced settings, Active Virus control is off, and when I check it on, it never turns on. I don't know if this is a program bug (cause the active scanner does seem to be working since it says it is blocking viruses) or what.

Here's my scan results from a scan last night:

BitDefender Log File

Product: BitDefender Antivirus Pro 2011

Scanning task: Full System Scan

Log date: Wednesday, September 28, 2011 10:15:55 PM

Log path: C:\ProgramData\BitDefender\Desktop\Profiles\Logs\6f349eda-6759-4378-b3c9-9174905515f7\1317266100_3_01.xml

Scan paths:

Path : C:\

Path : \

[-]Detailed Scan Summary

[-]Basic

Scanned items: 65338

Infected items: 0 (no infected items have been detected)

Suspect items: 0 (no suspected items have been detected)

Resolved items: 0 (no threats have been detected during this scan)

Unresolved items: 0 (no issues remained unresolved)

[-]Advanced

Scan time: 0: 0: 53

Files per second: 1232

Skipped items: 18462

Password-protected items: 0

Over-compressed items: 0

Scanned archives: 42

Input-output errors: 4

Scanned boot sectors: 0

Scanned processes: 3513

Infected processes: 0

Scanned registry keys: 188

Infected registry keys: 0

Scanned cookies: 0

Infected cookies: 0

[-]Scan Options

[-]Target Threat Types:

Scan for viruses: Yes

Scan for adware: Yes

Scan for spyware: Yes

Scan for applications: Yes

Scan for dialers: Yes

Scan for rootkits: No

Scan for keyloggers: Yes

[-]Virus Scanning Options:

Scan registry keys: Yes

Scan cookies: Yes

Scan boot sectors: Yes

Scan memory processes: Yes

Scan archives: Yes

Scan runtime packers: Yes

Scan e-mails: Yes

Scan all files: Yes

Heuristic Scan: Yes

Scanned extensions: not configured

Excluded extensions: not configured

[-]Target Processing:

Default first action for infected objects: Disinfect

Default second action for infected objects: Move files to quarantine

Default first action for suspect objects : Move files to quarantine

Default second action for suspicious objects: None

Default action for hidden objects: None

Default action for password-protected objects: Log only

[-]Scan Engines Summary

Virus signatures: 9232897

Sabitsuki

I'm having the same exact problem. Aren't we going to get any help?

Cristi Raducu

Hello all,

We are investigating this.

The scan you ran shows a number of 65338 files in 38 seconds.

Did you let the scan to finish?

skwint

Yes the scan finishes and only those 2viruses are found and placed in quarantine. Doing another scan though right after will find the same virus.

Also doing a scan with malwarebytes and adaware come up clean.

Hello all,

We are investigating this.

The scan you ran shows a number of 65338 files in 38 seconds.

Did you let the scan to finish?

Cristi Raducu

I see.In this case please specify the exact location of those files.

Also it would be very very helpful if you could submit those 2 files for analysis.

For this you need to upload them on www.sendspace.com and just post here the download links.

Note that during this process the real time protection in Bitdefender (antivirus) must be turned off.

Sabitsuki

Is there anything I can do to help speed this process up? It kind of seems like a bunch of people are having this issue all at once (posting on other forums, too), so I would like to do whatever I can to make sure people are protected.

Cristi Raducu

If you're having the same problem then you can also try to locate the files and submit them.

Sabitsuki

If you're having the same problem then you can also try to locate the files and submit them.

Come to think of it, the last time I tried to look for the files (which are in the C:\Windows\assembly), I wasn't able to see any files in the folder (I assume that's normal?). I happen to remember the name of the seemingly infected file located there: kwrd.dll.

I guess I'll wait for this current scan to finish and post again with more information, but what exactly should I do? Should I press the 'submit for analysis' button in BitDefender 2011, or is there a way to see the files that I can't seem to view?

(I also seem to be having the Firefox redirect problems that people have been mentioning on this site, and both my Windows firewall and BitDefender one seem to be permanently down as a side effect of the trojan.)

Cristi Raducu

One more note,take a look in Task Manager under Processes and let me know if you have a process that has only numbers,like 2032121:545454.exe

Sabitsuki

One more note,take a look in Task Manager under Processes and let me know if you have a process that has only numbers,like 2032121:545454.exe

That honestly seemed to be the most odd thing about my computer's infection; there weren't many of the tell-tale signs (such as XUL Cache for my Firefox redirects) that could have lead me to an answer about what it was and how to fix it.

After running BitDefender one more time and it not being able to locate the problematic files yet again, I ran ComboFix, which seems to have completely taken care of my multiple issues. It was simple enough that a girl who has only a moderate understanding of computers could work it on a severe lack of sleep, so I strongly suggest that anyone who is having these problems looks into ComboFix.

I hope this helps anyone who reads this!

Cristi Raducu

Please note that Combofix is third-party tool and you should run it on your own risk as in certain cases it can crash the system.

By default Combofix stores a copy of the deleted items in C:\Qoobox

Can you send a copy of that folder to see what it detected?

You need to archive the folder first and then upload the results to www.sendspace.com

Thanks !

@skwint

Please send me by PM a BDSYS log.

http://www.bitdefender.com/support/The-sys...fected-490.html

Sabitsuki

Can you send a copy of that folder to see what it detected?

You need to archive the folder first and then upload the results to www.sendspace.co

I'm actually being told that I don't have permission to archive the folder, even when trying as an administrator.

EDIT: Here we go, got it.

http://www.sendspace.com/file/2j55mb

Cristi Raducu

The Qoobox folder shows that it has removed all your shortcut files from Start ->All Programs and all the .ink files that are shortcut files.

I don't see a reason why it removed them.

The rest of the archive is under analysis but from a first look everything is clean there so I don't know exactly what virus it has removed.

Sabitsuki

The Qoobox folder shows that it has removed all your shortcut files from Start ->All Programs and all the .ink files that are shortcut files.

I don't see a reason why it removed them.

The rest of the archive is under analysis but from a first look everything is clean there so I don't know exactly what virus it has removed.

That's what I meant before, it seemed like the things that were happening on my machine had no cause. I'll leave it to you guys to figure out why that was the case, but I'll just be glad if we can figure out a solution to help people out with this.

EDIT: Yeah, I totally noticed that it had removed some of the shortcuts on my toolbar and such. I was a little worried for a second that I somehow messed up due to my lack of sleep.

skwint

This is happening on my parents computer, so I will not be able to upload the logs or anything for a couple of days till I see them next. I have hit the submit button on the quarantine page to send it to you guys several times this weekend after doing numerous scans.

The virus is located like others mention in the C:\Windows\Assembly folder. It looks like it creates a temp folder in there with the files in it. When actually trying to navigate to the folder its empty upon inspection.

There are no odd processes running while this is happening. I've run BitDefender scan and malwarebytes scans in safemode also with no permanent removal luck.

I guess I will try combofix next time I am over at their place, but hopefully you guys will have an updated definitions by then.

Cristi Raducu

The file analysis has been finished.

Nothing that Combofix has removed is infected and if you run this tool then you will run it on your own risk.

If the problem persists with those files in C:\Windows\Assembly then I am waiting for the BDSYS log.

http://www.bitdefender.com/support/The-sys...fected-490.html

taifeng2

Any progress on this issue? This is relentlessly popping up on my computer.

Here's my screenshot with trojan.generic.6675002

http://i196.photobucket.com/albums/aa256/f...screenprint.jpg

Cristi Raducu

Any progress on this issue? This is relentlessly popping up on my computer.

Here's my screenshot with trojan.generic.6675002

http://i196.photobucket.com/albums/aa256/f...screenprint.jpg

Please send me by PM a BDSYS log.

http://www.bitdefender.com/support/The-sys...fected-490.html

Cristi Raducu

Thank you for the info.

I will get back here with the results ASAP.

Cristi Raducu

The log is clean.

The virus is not getting removed because you're not running a deep scan which scans for rootkits.

Please run a deep scan and post here the results.

taifeng2

The log is clean.

The virus is not getting removed because you're not running a deep scan which scans for rootkits.

Please run a deep scan and post here the results.

Not sure how else to run a deep scan. Please see the photobucket link here, this is what I did:

Cristi Raducu

I can see that all the viruses were removed.

Do you receive any other warnings after reboot?