Trojan.generic.kdv.530980

Hello,

I have BitDefender 2010 and after a scan last night discovered that my computer is infected with trojan.generic.KDV.530980. When asked to quarantime or remove this trojan, the screen simply flashes and returns to the same question, ie the removal does not work and BitDefender tells me the quarantine has failed. Another screen also pops up asking me to send a log of the problem. I have already done this twice without response. Please advise what to do to get rid of the trojan.

Thanks you,

Maja

Find more posts tagged with

Comments

rootkit

In order to be able to assist you please run a Deep System Scan task with Bitdefender and send us the resulting scan report.

[how to GENERATE A DEEP SYSTEM SCAN LOG]

- Before running the scan please make sure that you have the latest virus definitions downloaded via the Update module: open Bitdefender and click the "Settings" button in the upper right side of the interface; Switch UI to "Novice Mode"; Click "OK"; Choose the "Update Now" task;

- After the update process completes successfully you can proceed to running the scan task: select the "Scan Now" task;

- When the scan ends, click the "View Log" button at the bottom right of the scan window; A browser window will open displaying the scan report; Save this file on a location of your choice and then attach it in your next reply here.

NOTE! If you already ran a scan task you can send us your latest report instead.

[how to RETRIEVE THE LATEST DEEP SYSTEM SCAN LOG]

- Open Bitdefender and click the "View Logs" link on the lower right; Click the "Antivirus" tab on the left;

- In the "On-demand tasks" list (the one on the bottom) look for the latest (closest to the top) entry that reads "Deep System Scan" under the "Task Name" column and "Scan Finished" under the "Action name"; Double-click this entry and click the "View Scan Log" button at the bottom of the window that just popped up; A browser window will open displaying the scan report; Save this file on a location of your choice and then attach it in your next reply here.

We recommend using the new Bitdefender QUICKSCAN for an extra layer of protection;

[how to USE THE BITDEFENDER QUICKSCAN]

Bitdefender QuickScan is an online scanning tool that uses a new technology to combine intelligent local scanning and in-the-cloud scanning which detects e-threats in memory quickly.

- Using your favorite web browser visit: http://quickscan.bitdefender.com/ and install the required ActiveX/Plugin when prompted;

NOTE! A detailed installation and compatibility guide can always be found at:

http://forum.malwarecity.com/index.php?showtopic=23

- click on "Start" and read the END USER SOFTWARE LICENSE AGREEMENT carefully; Select the "Accept" button to use the QuickScan tool or "Exit" if you do not agree with the terms and conditions;

- Allow the scanning process a few moments to complete;

- When the scan is over click on "Report" in order to open the log in the default text editor; Save the log to a location of your choice (e.g. Desktop) and attach it in your next reply here.

Take care.

majad

Hi Christian,

Thank you for your comprehensive reply. I noted that the infected file related to a programme I am no longer using and had, in fact, aleady deleted. So, I sent the file to the recycle bin and then deleted it. I then ran the Bitdefender Quickscan which said my computer was clear (see attached report) and then updated my virus definitions and ran a deep system scan to be sure. The deep system scan found the Trojan again and was able to delete it successfully this time (see attached report Deep_System_Scan). To be certain, I ran the deep system scan again and this confirmed my system is now clear (see Deep_System_Scan02). Thank you very much for your assistance with this problem My question is, how can I prevent this occurring again? I am very diligent about keeping BitDefender updated and running regular scans, so I'm not sure what else I can do? Should I update to BitDefender 2012? I currently have a subscription for BitDefender 2010 version 13.0.21 which expires in 271 days.

Thank you and best wishes,

Maja

/applications/core/interface/file/attachment.php?id=9223" data-fileid="9223" rel="">BitDefenderQuickscan2012_03_02_23.10.55.txt

/applications/core/interface/file/attachment.php?id=9224" data-fileid="9224" rel="">Deep_System_Scan.xml

/applications/core/interface/file/attachment.php?id=9225" data-fileid="9225" rel="">Deep_System_Scan02.xml

BitDefenderQuickscan2012_03_02_23.10.55.txt

Deep_System_Scan.xml

Deep_System_Scan02.xml

rootkit

Hello

You have a malware in System Volume Information.

Please follow the steps from here to remove it:

http://www.bitdefender.com/support/How-To-...mation-682.html

After that, you can upgrade for free to Bitdefender 2012:

http://forum.bitdefender.com/index.php?act...f=196&id=42

Thank you.

majad

Hi Christian,

Thank you once again for your reply. I'm really glad I attached all those logs because it really looked like the malware had been removed! I followed the steps outlined in your link and checked 'turn off system restore on all drives' and initiated the restore point deletion. To re-enable this feature, I had no option for 'restore systems settings and previous versions of files', all I could do was uncheck the 'turn off system restore on all drives' and apply. I have Windows XP, so I hope this was the correct thing to do? Anyway I rescanned using the on line virus scanner and also did another deep system scan. Both of the logs are attached here. Please let me know if things are now ok?

Thank you and best wishes,

Maja

/applications/core/interface/file/attachment.php?id=9249" data-fileid="9249" rel="">Report_2012_03_04_18.39.00.txt

/applications/core/interface/file/attachment.php?id=9250" data-fileid="9250" rel="">Deep_System_Scan.xml

Report_2012_03_04_18.39.00.txt

Deep_System_Scan.xml

rootkit

Hello Maja

The logs are clean. You can now upgrade to Bitdefender 2012.

Take care.

majad

Hi Christian,

I tried updating to BitDefender 2012 and during the installation, I got an error message saying that C:\WINDOWS\system32\grpconv.exe the specifified path file does not exist, check the path then try again. This window popped up about three times, but the installation appeared to proceed normally and I was able to perform a scan after that. When I turned the computer on today however, the BitDefender icon was missing from the system tray and when I tried to open it from the desk top icon, I got an error message saying C:\program files\BitDefender\Bitdefender2012\seccenter.exe does not exist, check the path etc. I checked the BitDefender folder and there were a whole lot of files in there, but the programme did not appear to function anymore. I tried reinstalling with the same results- ie same error messages and the programme appears to run from the system tray, but not from the desk top icon and I'm guessing if I turn the computer off, it will be non-functional when I turn it on again... Please help me...

Thank you and best wishes,

Maja

majad

Oh, I forgot to mention that I am working with Windows XP Professional and Windows version 5.1, Service pack 3. Unfortunately I don't have the Windows installation disk anymore, so I hope this isn't a problem.

Thank you and best wishes,

Maja

rootkit

Hello Maja

In the current case please use System File Checker to check for missing files and folders from Windows:

http://mintywhite.com/windows-7/7security/...nnow-quick-tip/

Reboot.

After this, please try to reinstall the product. You have all the details over here:

http://forum.bitdefender.com/index.php?act...f=241&id=44

Thank you.

majad

Hi Christian,

I tried your suggestion using the System File Checker and it asked for the Windows installation CD, which I no longer have. Furthermore, my CD-ROM has stopped working (unrelated to this issue), so even if I had my original Windows CD, I couldn't use it anyway. Is there something else I can do to check for missing files and folders and replace them please?

Thank you and best wishes,

Maja

majad

Hi Christian,

After a bit of digging around I believe you can tell tell "sfc /scannow" to look at the files in C:\I386, but I'm not sure of the command that will do this. Do I need to contact my computer manufacturer for help with this? I'm working with a Dell Precision M90.

Thank you and best wishes,

Maja

rootkit

Hi Maja

Welcome back.

You can do that without CD by using that folder.

Please checkout these instructions:

http://forum.kitz.co.uk/index.php?topic=3103.0

Thank you.