Bdts 2011 Fail To Install

I tried to install Bitdefender Total Security 2011 on my Laptop from Bitdefender Backup CD, but when I click the "install" button on the interface, the Bitdefender starts unpacking the installation files and then disappear atonce. I tried several times and from different installation kist but all in vain. Then I scan the Laptop from Bitdefender Security Scan Tool, the scan log of which is attached. Kindly note that I don't want to install Bitdefender 2012. I also generated the log from Standalone version of Supporttool. May I upload it here?

OS: Windows XP Professional SP3, 32bit

Processor: Core 2 Duo 2.33 GHz

Memory: 3 GB.

/applications/core/interface/file/attachment.php?id=8816" data-fileid="8816" rel="">last_bdss_log_report.xml

Find more posts tagged with

Comments

rootkit

Hi ONT

Your machine is infected with Sality.

Sality is well known for trying to stop AV products or block access to their websites.

C:\PROGRA~1\Yahoo!\Messenger\Ymsgr_tray.exe" threatName="Win32.Sality.3"

"C:\Documents and Settings\ALI\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe" threatName="Win32.Sality.3"

"E:\adxsnn.exe" threatName="Win32.Sality.3"

"C:\Documents and Settings\ALI\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" threatName="Win32.Sality.3"

"G:\dmnn.exe" threatName="Win32.Sality.3"

"C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" threatName="Win32.Sality.3"

"C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe" threatName="Win32.Sality.3"

"C:\DOCUME~1\ALI\LOCALS~1\Temp\ygagas.exe" threatName="Generic.Malware.FYdld.7E9ECF03"

Run a scan with this utility and tell me if you are able to install the product after the restart.

http://forum.bitdefender.com/index.php?showtopic=27622

Thank you.

coolcool1227

Finally managed to install Bitdefender, but the above said tool didn't help also. I use another portable malware removal tool which help me in installing the Bitdefender. I would like to suggest to improve the Self Defense of Bitdefender against such threats. The Self Defense should be active before the installation kit starts unpacking the files.

The Deep System Scan log is also attached.

/applications/core/interface/file/attachment.php?id=8825" data-fileid="8825" rel="">1323235004_1_02.xml

1323235004_1_02.xml

rootkit

Welcome back Omer

Self Defense protects the installation, but Sality is a polymorphic malware that kills the installer of any AV product before the protection can start(during the unpack stage).

I am glad that you managed to install Bitdefender on that machine.

Anyway, I recommend you to use Bitdefender USB immunizer to protect that machine. I guess those threats reach that machine via USB sticks or memory cards.

http://labs.bitdefender.com/?page_id=108

Thank you.

coolcool1227

Welcome back Omer

Self Defense protects the installation, but Sality is a polymorphic malware that kills the installer of any AV product before the protection can start(during the unpack stage).

I am glad that you managed to install Bitdefender on that machine.

Anyway, I recommend you to use Bitdefender USB immunizer to protect that machine. I guess those threats reach that machine via USB sticks or memory cards.

http://labs.bitdefender.com/?page_id=108

Thank you.

I already try Bitdefender USB Immunizer on USB sticks, but it has bugs, and some malware overwrites the autorun.inf file created by USB Imunizer. If you are interested, I will send you some more bugs.

Just for curiosity, how does Bitdefender deals with such Polymorphic malwares, if they kill the installer of AV? I would like to recommend the Portable Version of Bitdefender.

Also send PM for detail.

rootkit

Hi ONT

Could you please provide me a malware sample to test out if autorun.inf is overwritten?

Regarding that portable version, I will talk to our Developers.

Thank you.

coolcool1227

Could you please provide me a malware sample to test out if autorun.inf is overwritten?

Not yet unfortunately, as I change my office PC and not able to retrieve the logs.

coolcool1227

Hi Chris

The Deep System Scan Log of the same system is attached. After the scan, the Bitdefender Summary window shows 5 Resolved Items while the Scan Log shows 3 Resolved Items, why? Kindly see the attachments.

/applications/core/interface/file/attachment.php?id=8858" data-fileid="8858" rel="">1323255456_1_02.xml

1323255456_1_02.xml

rootkit

Hello ONT

The .exe filese were trojans infected by a file infector.

They were first detected as infected, then disinfected, then subsequently detected as Trojans and then deleted.

So two of the files were both disinfected and deleted, and were counted in both situations.

Have a great weekend.

coolcool1227

Hello ONT

The .exe filese were trojans infected by a file infector.

They were first detected as infected, then disinfected, then subsequently detected as Trojans and then deleted.

So two of the files were both disinfected and deleted, and were counted in both situations.

Have a great weekend.

I understand that but my concern is why the disinfected items are not shown in Resolved Items in the Log file?

Could you please provide me a malware sample to test out if autorun.inf is overwritten?

It was the Ver 1.2 of the tool, the current Ver 1.5 may not have such bug.

Regarding that portable version, I will talk to our Developers.

Kindly update me in this regard.

Thanks.

rootkit

Hi ONT

Those actions were note saved in the log because the infection was not revolved when those files were disinfected.

It like an malware was infected by another malware(a Trojan .exe file infected by a file infector).

When the initial file was correctly disinfected, the same file was detected by Bitdefender as infected(the Trojan part).

We can not log the action is the infection is still present(is a small difference between objects and files(in the screenshot there are 2 disinfected objects).

I'll keep you updated with that tool.

Thank you.

coolcool1227

Hi ONT

Those actions were note saved in the log because the infection was not revolved when those files were disinfected.

It like an malware was infected by another malware(a Trojan .exe file infected by a file infector).

When the initial file was correctly disinfected, the same file was detected by Bitdefender as infected(the Trojan part).

We can not log the action is the infection is still present(is a small difference between objects and files(in the screenshot there are 2 disinfected objects).

I'll keep you updated with that tool.

Thank you.

Hmmm.....Interesting. You want to say that Bitdefender performed disinfection routine first and then deletion routine on the same file (the infected file with infected virus.....loop infection). e.g in this case the files "adxsnn.exe" and "ywdv.exe" were first disinfected as mentioned in Summary Window and then deleted as shown in the Log. If I'm not off-topic, why does Bitdefender behave like that, is it not time consuming, when the system is infected with large no. of such infected files or more precisely infected virus, I think?

Also I suggest update option in the said portable tool.

rootkit

Welcome back Omer

I can tell you for sure that is not time consuming this action. The original file infected with the trojan was altered buy the file infector. Bitdefender detected the file using the sality routine. In the engine there are some priorities and I can tell you for sure that a polymorphic malware is much more dangerous than a trojan.

That's why those files were disinfected and after that deleted.

Thank you for that suggestion. I will talk with the developers. Take care.

coolcool1227

Can I use Bitdefender Rescue CD in such situation next time?

rootkit

Hi Omer.

You can use the Rescue CD. Don't forget to update the definition before running the scan.

Thank you.