How To Solve These Infected Files!

Hello judee,

Let me assure you that you are safe.

This just happened to me too - but one thing I don't understand. I ran several deep scans before now and this problem didn't come up. I do have a number of password protected zip files on one of my drives, but they were never caught like this before. However, my scan today showed 3600 "problems" - listing not only the zips but each and every item within them - the same for some exe programs - the exe programs are not password protected, but do require a serial number once installed.

You are right. These password protected files were not detected until the last Product Upgrade (listed here). That update contained a new version of uiscan.exe (the application which is responsible for manual scans) which, apparently, lists the password-protected files as suspected.

Still, if it can look into these password protected zip folders and identify each small item therin, why cannot it say if there is a virus or not?

ANY application can browse the password protected archives, without needing a password. That's because, most of the times, the password offers encryption only for the content of the files, not for the archive itself. An archive can also contain both password-protected files AND non-protected files.

BitDefender CAN browse the archives and finds those files as password-protected, but it can't actually scan them because it doesn't have the password to de-crypt them (and BD is NOT a password cracker).

There are some cases when the password is used to encrypt also the filenames of the files included in an archive, in which case the archive cannot be browsed without a password. But this behavior is rare.

It told me these files were infected, but no indication of what exactly is infecting them, just the "password protected item" and "no action possible".

It didn't say that the files were infected. If you look closer, you'll notice that the category of password-protected files is marked with a red star. At the bottom of the window, that start has an explanation: the password-protected files cannot be scanned, and therefore they are considered possible threats. It also gives you an advice: get the files out of the archive and scan them.

How can I be absolutely sure of these files? Should I "unzip" them, using the password, and then run a scan on the unzipped folder?

In normal condition, YES, you should take the files out and scan them.

But if you know those files, and you know that they were clean when they were archived, there is no need to scan them again. Because the archive is password-protected, malware cannot access the files from within that archive, therefore, the files cannot be infected.

And if this is normal behavior, why didn't it do this on previous scans? It scanned these same files 4 days ago and found nothing unusual.

As I said, they were not detected because this is a new feature.

However, it is pretty annoying to view hundreds of suspicious files, mainly because about most of them you cannot do anything, for instance:

- files in Quarantine of different applications (like Antispyware programs)

- different files used by different applications, and which are stored in password protectd archives to prevent changes outside the program

- installation kits, also protected against changes

- and a lot more cases

I think that, in spite of your assurance, I'm still needing to be talked into feeling safe, lol!

All I've said above should be enough to assure you that you're as safe as you were 4 days ago.

I will talk to TechSupport and suggest them that either they take out this detection, either they make it optional.

Cris.

allwaysjudee

Thank you Cris, yes that does make me feel better. BTW, I'm using the french version of Bit Defender, purchased in the box at a store, then registered here (It was a 3-pc version and my daughter uses it too, and just today had the same thing come up in hers).

I think what scared me is that in the french version at one point they did use the term "infectéé" for these files, and made it sound like they were infections and not just unsolved problems. Even now in the historic this particular scan is marked with a red X and says that the "menace" is still present and unresolved. I imagine it's just a difference in language and how the language responses were programmed, it just gave me a scare. Oh, and there was no suggestion for unlocking the files and scanning them as there seems to be in the English Version.

Your explanation, however is clear, and as I know most of the files are safe, I'm pretty sure there is no problem.

But I do have one more question - is there any tool, file, whatever, to turn my French version into English? Since I do own the license, can it not be somehow substituted one language for the other? I can follow the French version, been speaking and reading French for the past 20 years, but English is my mother tongue and still the more comfortable for me. Just wondering.

Thanks for your help, and thanks for these forums! They have helped in a couple more things I was unsure of.

Oh and Happy Holidays!

judee

I think what scared me is that in the french version at one point they did use the term "infectéé" for these files, and made it sound like they were infections and not just unsolved problems. Even now in the historic this particular scan is marked with a red X and says that the "menace" is still present and unresolved. I imagine it's just a difference in language and how the language responses were programmed, it just gave me a scare. Oh, and there was no suggestion for unlocking the files and scanning them as there seems to be in the English Version.

Yes, they are marked as infected, not as suspected. But at the end, when the list of problems is showed, the password-protected files (as I said) are marked with a star. At the bottom of the window, where the star is explained, it says that those items are not infected and they are only considered possible threats, because they couldn't be scanned.

Also, I don't use the English version. I'm using the Romanian version and the translation of the explanation is approximate. Also, I kinda find it hard to believe that the star and the explanation are missing in the French version (maybe you just didn't notice them).

Also, I talked to TechSupport a few days ago about this, and they told me that it should have already been fixed in the previous update. Obviously, it wasn't fixed, so they'll have to double-check it. Since right now it's Christmas, I believe there will be a few days until the update is released.

But I do have one more question - is there any tool, file, whatever, to turn my French version into English? Since I do own the license, can it not be somehow substituted one language for the other? I can follow the French version, been speaking and reading French for the past 20 years, but English is my mother tongue and still the more comfortable for me. Just wondering.

Such tool doesn't exist, mainly because it's not needed. All you have to do is to download the English version, uninstall the current version (I recommend using the BD Uninstall Tool) and installing the English version. As far as I know, license keys are language-independent.

If you have problems registering with the same license key, please contact LiveAssistance (Customer support) and explain the problem.

Thanks for your help, and thanks for these forums! They have helped in a couple more things I was unsure of.

Oh and Happy Holidays!

judee

You're very welcome, judee. And Happy Holidays to you too

Cris.

topknot

This just started happening to me too. I don't use a password that I know of for any files. Hopefully the update will fix this problem. I'm glad to know that it's not a big deal. I was worried that my computer was really infected , and had no idea how to get rid of the files that were protected and a possible threat !!

I was having the problem where BitDefender AntiVirus 2008 was reporting the quarantined files of SuperAntiSpyware as being password protected and therefore a potential threat. BD AV 2008 would stop scanning at that point. This afternoon I ran a full system scan and had no problem. I did delete all the quarantined files in SuperAntiSpyware before this scan, but doing the same before previous scans still gave a password protection warning. I certainly hope this problem is fixed. I'll try to remember to run a full system scan again tomorrow to verify that the problem is corrected.

Ken :wacko:

Sownman

I'm having the same problem. I am about 2 months in to my 1 year license on Internet Security. I run XP home. When I installed BD I got a clean scan except for adware which I quarentined. Now when I run scans on two computers one has 15 password protected "threats" One has 416 password protected "threats". The BD display is such that I can't even read the full path to these threats but my primary question is....

WHAT AM I PAYING FOR HERE THAT ALLOWS PASSWORD PROTECTED FILES OUT OF MY CONTROL TO RESIDE ON MY COMPUTER ???? THESE FILES ALL HAVING APPEARED WHILE I THOUGHT I WAS BEING "PROTECTED' BY BD.

AND YES I AM SHOUTING

WHAT AM I PAYING FOR HERE THAT ALLOWS PASSWORD PROTECTED FILES OUT OF MY CONTROL TO RESIDE ON MY COMPUTER ???? THESE FILES ALL HAVING APPEARED WHILE I THOUGHT I WAS BEING "PROTECTED' BY BD.

AND YES I AM SHOUTING

Well... YOU SHOULDN'T BE SHOUTING!

First of all, because I explained very well in post#4 what is with these files. They didn't infect your computer while you were using BitDefender, because these files are NOT infections! These files have existed on your computer since forever!

Because I see that you really didn't understand what I said before, I'm going to repeat: password protection is a method used to protect different files against unauthorized changes (and even against unauthorized accessing). And these passwords aren't only used by users themselves (so YOU, Sownman, are NOT the only one that creates password-protected files on your computer).

Also, other applications use passwords on their own to protect their own files against changes and/or accessing. As I said, such applications are:

- security applications that use Quarantine folders (they store the infected files, encrypted with a password, so that the infections cannot spread)

- different backup tools (even Windows System Restore points are sometimes encrypted with a passwords that YOU DON'T KNOW)

- different applications which use databases (like even a Phone Book...or the e-mail contacts list).

- ANY application that wants to be sure that it's own files are not modified outside the application itself, can use this method to protect the files.

Again, I repeat: THESE FILES DO NOT REPRESENT ANY RISK! BitDefender only reports these files as possible threats, because they couldn't be scanned. But this doesn't mean that they are infections (and, most of the cases, they really aren't infections).

I reported this before and I will report it again in a few days (after the New Year). This issue, as I already said, should already have been solved in the last update, but it wasn't. I'm sure that the next Product Update (not Signature Update) will solve this.

And secondly, Sownman, please stop shouting on this forum, because everyone here only tries to help. Instead of shouting, I suggest you calm down, because shouthing won't solve ANYTHING!

Cris.

Sownman

Well... YOU SHOULDN'T BE SHOUTING!

First of all, because I explained very well in post#4 what is with these files. They didn't infect your computer while you were using BitDefender, because these files are NOT infections! These files have existed on your computer since forever!

Because I see that you really didn't understand what I said before, I'm going to repeat: password protection is a method used to protect different files against unauthorized changes (and even against unauthorized accessing). And these passwords aren't only used by users themselves (so YOU, Sownman, are NOT the only one that creates password-protected files on your computer).

Also, other applications use passwords on their own to protect their own files against changes and/or accessing. As I said, such applications are:

- security applications that use Quarantine folders (they store the infected files, encrypted with a password, so that the infections cannot spread)

- different backup tools (even Windows System Restore points are sometimes encrypted with a passwords that YOU DON'T KNOW)

- different applications which use databases (like even a Phone Book...or the e-mail contacts list).

- ANY application that wants to be sure that it's own files are not modified outside the application itself, can use this method to protect the files.

Again, I repeat: THESE FILES DO NOT REPRESENT ANY RISK! BitDefender only reports these files as possible threats, because they couldn't be scanned. But this doesn't mean that they are infections (and, most of the cases, they really aren't infections).

I reported this before and I will report it again in a few days (after the New Year). This issue, as I already said, should already have been solved in the last update, but it wasn't. I'm sure that the next Product Update (not Signature Update) will solve this.

And secondly, Sownman, please stop shouting on this forum, because everyone here only tries to help. Instead of shouting, I suggest you calm down, because shouthing won't solve ANYTHING!

Cris.

Well you apparantly didn't read my post well either. When I installed and scanned using BD I had two files that were issues. One trojan (deleted) and one adware (quarantined). I WAS a happy camper. Now after using BD for a couple months I have 416 "security issues"

rather than two. I have not loaded any new software. I have no other defense programs. I have not password protected anything. I don't archive anything. Yet my files that are a potential security risk have grown from 2 to 416. Lets pretend shall we that there is no security risk at all. How did BD go from 0 files it couldn't scan to 416 files it couldn't scan ? I also am not the one with the highest number of files nor am I the only one with this problem.

What good does it do me to be alerted to 15 threats or 150 or 1500 where "no action can be taken" ? and then get a message that my computer is not virus free ?

Steve

I was having the problem where BitDefender AntiVirus 2008 was reporting the quarantined files of SuperAntiSpyware as being password protected and therefore a potential threat. BD AV 2008 would stop scanning at that point. This afternoon I ran a full system scan and had no problem. I did delete all the quarantined files in SuperAntiSpyware before this scan, but doing the same before previous scans still gave a password protection warning. I certainly hope this problem is fixed. I'll try to remember to run a full system scan again tomorrow to verify that the problem is corrected.

Ken

I ran a full system scan this morning without deleting the quarantined files I created in SUPERAntiSpyware first. I wanted to see how BD would treat the normal archived files that SUPERAntiSpyware creates. Unfortunately BD stopped when it got to the archived files and indicated that there was "no action taken on 8 issues". Yesterday I got a clean scan after removing all the files from SUPERAntiSpyware quarantine. Now I am back to the original problem. I then removed all the quarantined files from SUPERAntiSpyware and re-scanned my HD with BD. That gave me 1 remaining issue that BD could take no action on. So there has not been any resolution to the problem.

I know that the moderators on this board are unpaid volunteers, and should not have to take the heat for the developer's mistakes. I know that in my case, the files BD can't scan are just Tracking Cookies that SUPERAntiSpyware packs into an archive. The problem for me is that BitDefender stops the scan of my hard drive, and there is nothing I can do to run a full scan of my hard drive until I unpack the archived files that SUPERAntiSpyware creates. I have no way to unpack those files. Only the developers of SUPERAntiSpyware know how to unpack those files. The net result is that I cannot do a full scan of my H/D with BitDefender, so right now, BD is only partially useable. It is, in effect, a defective product, and I have no way of knowing when it will be returned to a fully funtioning state. We consumers have a right to know what is being done, and to have an estimated time of completion for the repairs. Right now the free antivirus my son uses is looking very good to me. I think it is called avast! and he doesn't have these kind of problems. He is very happy with it.

Sincerely,

Ken

I read your post very carefully and I completely understood your problem. However, it seems that you simply refuse to understand. What I am going to do next is only copy quotes from my previous posts, because all your questions have been answered in this thread. TWICE!

Question:

Well you apparantly didn't read my post well either. When I installed and scanned using BD I had two files that were issues. One trojan (deleted) and one adware (quarantined). I WAS a happy camper. Now after using BD for a couple months I have 416 "security issues" rather than two.

Answer:

You are right. These password protected files were not detected until the last Product Upgrade (listed here). That update contained a new version of uiscan.exe (the application which is responsible for manual scans) which, apparently, lists the password-protected files as suspected.

[...]They were not detected because this is a new feature

Question:

I have not loaded any new software. I have no other defense programs. I have not password protected anything. I don't archive anything.

Answer:

These files have existed on your computer since forever!

[...] password protection is a method used to protect different files against unauthorized changes (and even against unauthorized accessing). And these passwords aren't only used by users themselves [...]

Also, other applications use passwords on their own to protect their own files against changes and/or accessing. As I said, such applications are:

- security applications that use Quarantine folders (they store the infected files, encrypted with a password, so that the infections cannot spread)

- different backup tools (even Windows System Restore points are sometimes encrypted with a passwords that YOU DON'T KNOW)

- different applications which use databases (like even a Phone Book...or the e-mail contacts list).

- ANY application that wants to be sure that it's own files are not modified outside the application itself, can use this method to protect the files.

Question:

Yet my files that are a potential security risk have grown from 2 to 416. Lets pretend shall we that there is no security risk at all. How did BD go from 0 files it couldn't scan to 416 files it couldn't scan ? I also am not the one with the highest number of files nor am I the only one with this problem.

Answer:

They were not detected because this is a new feature

Question:

What good does it do me to be alerted to 15 threats or 150 or 1500 where "no action can be taken" ? and then get a message that my computer is not virus free ?

Answer:

The situation is know and:

I reported this before and I will report it again in a few days (after the New Year). This issue, as I already said, should already have been solved in the last update, but it wasn't. I'm sure that the next Product Update (not Signature Update) will solve this.

================================================================================

If you repeat any of the above questions AGAIN (since you already asked them twice AND they were answered 3 times... twice for you and once for judee, which understood perfectly the situation from my first reply), I invite anyone that read this thread and understood it to answer you, because you won't get any answer from me.

KTaggart: No, the situation hasn't been fixed yet.

However, BitDefender doesn't stop the scan when it reaches a password-protected archive. It first scans all files and folders it has to scan and, only after it scans all files, the results are shown. It doesn't matter if it finds infected/suspected/password-protected files...the scan won't be stopped, unless you press Stop scan. This is how it works on my computer, and this is how it should behave.

If the behavior is different on your computer, then it must be some other problem. Are you sure the scan stops?

Cris.

Sownman

If you repeat any of the above questions AGAIN (since you already asked them twice AND they were answered 3 times... twice for you and once for judee, which understood perfectly the situation from my first reply), I invite anyone that read this thread and understood it to answer you, because you won't get any answer from me.

Cris.

Actually Chris I don't understand why you are so pissy about this. I was shouting because my "infected items" as reported by the BD

product I paid for was rapidly growing. Would that make you happy ? I was shouting at a company, not an individual. I didn't address my post to you. I wasn't shouting at you nor was I even rude to you, I don't know you at all yet you have been rude back.

So lets try a new question.....

Whats the nature of the "fix" ? Will it continue to not scan the same files but no longer report them as infected ?

Will it scan them like it should scan any file and see no threat there and report them as fine ?

I certainly hope the fix is not the former because then all one would have to do is password protect the spywares and trojans

and keyloggers to completely defeat BD

Steve

KTaggart: No, the situation hasn't been fixed yet.

However, BitDefender doesn't stop the scan when it reaches a password-protected archive. It first scans all files and folders it has to scan and, only after it scans all files, the results are shown. It doesn't matter if it finds infected/suspected/password-protected files...the scan won't be stopped, unless you press Stop scan. This is how it works on my computer, and this is how it should behave.

If the behavior is different on your computer, then it must be some other problem. Are you sure the scan stops?

Cris.

Chris,

This morning, just for the heck of it, I ran a scan of my h/d with BD, and everything was normal...no problems, no passworded files. I can't explain the difference. The reason I thought that BD was stopping after it found the password protected files, and not continuing through to the end of the scan, is illustrated by the attached screen shot. You will note that at the top of the page are the words "Antivirus Scan - Step 2 of 3". To me, that meant that BD had completed "Step 2 of 3" or stopped during "Step 2 of 3". Step 3 was not completed. This is my interpretation. How would you interpret this?

Sincerely,

Ken

Chris,

This morning, just for the heck of it, I ran a scan of my h/d with BD, and everything was normal...no problems, no passworded files. I can't explain the difference. The reason I thought that BD was stopping after it found the password protected files, and not continuing through to the end of the scan, is illustrated by the attached screen shot. You will note that at the top of the page are the words "Antivirus Scan - Step 2 of 3". To me, that meant that BD had completed "Step 2 of 3" or stopped during "Step 2 of 3". Step 3 was not completed. This is my interpretation. How would you interpret this?

Sincerely,

Ken

Chris,

Is my attachment blocked to anyone but moderators after it is sent to the forum? I could view it quite well in 'preview post" mode, but once I sent it up to the forum, I can't view it anymore.

Ken

Whats the nature of the "fix" ? Will it continue to not scan the same files but no longer report them as infected ?

Will it scan them like it should scan any file and see no threat there and report them as fine ?

I certainly hope the fix is not the former because then all one would have to do is password protect the spywares and trojans

and keyloggers to completely defeat BD

I have no idea how exactly this issue will be fixed, because I don't work for BitDefender and I don't have any inside info about such things.

But there are only 2 possible solutions:

1) the scans will be reverted to the way they were before (the password-protected items will just be ignored)

2) the detection of password-protected items could be made optional (an option could be added, so that the user can choose if he wants to be notified about such items or not).

However, none of these two solutions imply a real scanning of the password-protected files. To explain why I say this:

First of all, password-protected means encrypted. Passwords, as I said (and as you already know), are a method to prevent unauthorized access to certain files. Therefore, an Antivirus solution cannot, under ANY circumstances, access the protected files. If the AV cannot access them, it means it can't scan them, therefore it cannot say if they are infected or not.

This happens with ALL Antivirus solutions, because Antiviruses are not password crackers, so the best thing that it can do is to notify you about the existence of these files.

However: if a file is password-protected, it means it is encrypted. If it is encrypted, it cannot be ran unless it is decrypted.

So, even if, let's say, someone uses a password to protect a virus, that virus won't be detected by BitDefender (nor by any other AV solution). But still, your computer is safe, because the virus cannot run while it is protected by the password.

In the moment when the virus is decrypted (and launched), BitDefender can scan it without any problems and WILL catch it (if it has a signature for it, or if the virus triggers the heuristic detection).

To make it short: A password-protected file cannot be scanned by an AV solution, and also it doesn't represent a threat to your PC (at least while it stays password-protected).

I hope it's clear what I wanted to say (It's about 2:30 in the morning, and after a glass of champaign and more glasses of wine, I don't know how accurate I am in explaining things ).

You will note that at the top of the page are the words "Antivirus Scan - Step 2 of 3". To me, that meant that BD had completed "Step 2 of 3" or stopped during "Step 2 of 3". Step 3 was not completed. This is my interpretation. How would you interpret this?

This is normal, Ken.

The Manual Scan process has 3 steps:

1) the actual scan

2) show the results and ask for action

3) final results (in which only a very short report is shown)

The list of events takes place like this:

1) all selected files and folders are scanned.

2) when something is found, the primary action is taken (the primary action is set in the scanning options)

3) if the primary action fails (or is not defined) for one or more files, then the Step 2 window is shown, allowing you to choose what to do with each threat.

4) If, again, the selected actions fail, Step 2 is shown again, and again...until no action is possible anymore, or until the user doesn't select any action.

5) Step 3 window is shown, with a short report (with the total number of solved/unsolved/ignored/failed alerts). All taken actions are logged in a scan report (which can be viewed by clicking View Report in Step 3, or by browsing the Manual Scan History).

Conclusion, as I said before: the scan doesn't stop when it finds something, unless YOU stop it (by clicking Stop Scan).

Cris.

I keep looking for a Product Update to solve the problem being discussed in this topic, but so far, according to the BitDefender Update Status Topic, the last Product Update was on Dec. 21, 2007. I feel like I have been getting my information from US of A politicians.

Ken T (A US of A citizen)

s.jahns@comcast.net

I've had the same problem that everyone else has had re: Password Protected Files. I've had 2 responses from BD Tech Support, both confirming that these are NOT infected files, etc., etc. This confirms the latest info seen in this forum. They originally said this would be taken care of with an update, but as of now, two weeks later, its still doing the same thing. Just yesterday, one of the Tech Support Spets @ BD suggested that I could remove the Password Protected Files (He didn't mention anything about an upgrade or "fix" for this problem). Basically, all 1437 listed files were in 2 folders. One folder was an old Spyware Program (SpyBot) that I thought I had removed long ago with Add/Remove. I've managed to manually remove all those files (took some work). The other folder has this name:

C:\found.000\dir0000.chk0494896.cfg

I've done some research and the only thing I know is that this is some kind of configuration file, probably being, or having been used, by one of my existing programs. Some of the file extensions of these files are .EXE. I'm a little leary of deleting this folder, for fear of getting rid of something that my computer needs to operate normally. Can anyone give me any advice?

Also: I recently downloaded BD onto my daughter's notebook computer. Her scans show no password protected files. Does this mean that BD has upgraded to fix the problem? If so, why haven't I seen a change on my recent scans?

Hello steveo,

First of all, I understand that you read this topic. If you didn't, please read it.

About your questions:

1) No, the problem hasn't been fixed yet.

2) the file C:\found.000\dir0000.chk0494896.cfg is a backup of CheckDisk (the Windows tool that is used to scan the drives for errors, in case of improper shutdown). You can safely delete it (if you worry about breaking something, first move it to another location, see if you have any problems and, if you don't, delete it).

3) Not on all computers are present password-protected files. But there might be files that are protected by the applications that use them (read above, in previous posts).

When I have the chance, I'll report this (again) to TechSupport.

Cris.

Does the Product Update dated January 16, 2008 solve the problem detailed in this topic? How do I know if my copy of BitDefender AntiVirus 2008 has been updated with this Product Update? I know I still had the problem last night when I ran a scan.

Ken T

Well, it depends on what you think fixed means...

The detection remained, but something was definitely changed: the password-protected items are not shown as infected in the first and last scanning steps (Step 1 and Step 3). Instead, they are shown in their own category, (Unscanned) Password protected items, and at the end, there's only a yellow exclamation point, instead of a red one (also, the advice to un-pack those files and scan them again, is written with big letters in the last step, so you can't miss it).

In my opinion, it is a step forward, but still...this detection should be made optional (and disabled, by default).

You can check the Update History like this:

- open Security Center

- click History (lower-right corner of the window)

- click on the Update section

- check the last entry called Updated files (or something like that... I have the Romanian version). The last update is shown on the top of the list. Double-clicking a line shows details about that entry (in this case, you'll see the updated files list).

Cris.

Devereaux

What if the password protected files exist on a different drive than your harddrive. My log file came up with files like these:

\i386\Apps\App30921\mpf\mpfins.ui=]setcss.vbs Password-Protected Items No action was possible

\i386\Apps\App30921\mpf\mpfins.ui=]utils.vbs Password-Protected Items No action was possible

\i386\Apps\App30921\msk\agentins.ui=]agentins.ini Password-Protected Items No action was possible

\i386\Apps\App30921\msk\agentins.ui=]agntcons.vbs Password-Protected Items No action was possible

\i386\Apps\App30921\msk\agentins.ui=]agntinst.htm

I've never had this drive before (that I've noticed). When I go to my computer and open up the drive an Internet Explorer window pops up with a "PC Angel" logo and says that it is a recovery partition and to leave it alone. Also, IE blocks a ****** from running when the window opens. Could this be a non-benign? I don't recall ever downloading PC Angel, and when I search for it online I dont really find any info on it.

Thanks for the info and help!

Hello Devereaux,

Did you buy your computer with a pre-installed Operating System?

If yes, then that hidden partition might be the Recovery Partition. Some system vendors, which sell computers with pre-installed OS, ship the computer with an OS installation disc, so you can reinstall the OS, if needed.

But other vendors just put the backup kit on your HDD, on a hidden partition. Practically, that partition cannot be accessed from Windows and contains the OS installation kit, some diagnostic tools and other similar applications, needed to revert your computer to it's initial state, in case it gets so damaged that it won't start.

To clarify this situation, please read your computer's manual, or contact the vendor.

Cris.

Well, it depends on what you think fixed means...

The detection remained, but something was definitely changed: the password-protected items are not shown as infected in the first and last scanning steps (Step 1 and Step 3). Instead, they are shown in their own category, (Unscanned) Password protected items, and at the end, there's only a yellow exclamation point, instead of a red one (also, the advice to un-pack those files and scan them again, is written with big letters in the last step, so you can't miss it).

In my opinion, it is a step forward, but still...this detection should be made optional (and disabled, by default).

You can check the Update History like this:

- open Security Center

- click History (lower-right corner of the window)

- click on the Update section

- check the last entry called Updated files (or something like that... I have the Romanian version). The last update is shown on the top of the list. Double-clicking a line shows details about that entry (in this case, you'll see the updated files list).

Cris.

Cris,

Something definitely has changed, but since I don't know how to access the first and last scanning steps, I see it on the BitDefender Log File. In the log file, under "Overall scan summary", it says "Infected items: 0, Suspicious items: 0, and Individual viruses found: 0". Then at the bottom of the Log file, under "Remaining issues", each password protected item is listed separately under "Object Name", under "Threat Name" it says "Password Protected Items", and under "Final Status", it says "No action was possible". So I guess to summarize the Log File, it is saying "We can't find any threatening items, but some of the items we couldn't check". Is that a fair description?

As far as detecting the Product Update of Jan. 16, 2008, I have never seen it say "Product Update" in the Update Events display of the BitDefender History & Events module. Under "Action Taken" it will say "Engine & Signatures" or "Update files". Those have been all I have seen displayed. On Jan. 15, 2008, in an "Update files", I saw listed "ENU/uiscan.ui" and "uiscan.exe". Farther back in this topic, it is said that a new version of "uiscan.exe" caused the password protected files to be listed as "suspected". I thought this new attention to the uiscan files was an attempt to correct this situation that has brought about this topic. I'm really not sure of anything now. :wacko: I would think that if it was OK previously with a specific uiscan.exe, then why not just return to the original file that made everybody happy? Or like you said "this detection should be made optional (and disabled, by default)." That would be great!

Sincerely,

Ken T

Something definitely has changed, but since I don't know how to access the first and last scanning steps, I see it on the BitDefender Log File.

What do you mean you don't know? You don't have to do anything to access those steps.

As I already told you a few posts back (on page 1 of this thread), the scanning has 3 steps:

1) Step 1: The actual scanning: the step where you can see the progress of the scanning

current scanned file
a few statistics: elapsed time, scanning speed, number of files scanned, etc...

2) Step 2: when BD shows you the list of infected/suspected files and asks for action

3) Step 3: When final results are shown

In the first and last steps, you can see a different category (as I said in my previous post).

So I guess to summarize the Log File, it is saying "We can't find any threatening items, but some of the items we couldn't check". Is that a fair description?

That's exactly the description.

As far as detecting the Product Update of Jan. 16, 2008, I have never seen it say "Product Update"

The History module doesn't make any difference between updates. That's why I made the topic in the General Talk about Product Updates, so that users can find easily that information.

In that module, all updates are put together, in two sections:

1) Engine & Signatures, in which is shown latest engine version and the latest number of signatures

2) Updated files, which stores the list of the downloaded files, from the last update.

You have to look in those logs ("Updated files") and search for the files that you need. I know it's a little hard to find them, but that's the way it is.

"ENU/uiscan.ui" and "uiscan.exe"

uiscan.ui is the file that represents the actual interface.

uiscan.exe is the code behind the interface.

I would think that if it was OK previously with a specific uiscan.exe, then why not just return to the original file that made everybody happy?

It's not a matter of making everyone happy. Some users like to be alerted about such things.

Come to think of it, in some cases, it might come handy such detection.

Or like you said "this detection should be made optional (and disabled, by default)." That would be great!

Yes, this would be the best option. But I cannot do anything about it. I suggested this before, I could do it again (next time when I can talk to TechSupport), but I cannot promise anything.

Anyway, at least now they are not listed as infected, which should calm most of the users down.

Cris.

ykcirn

The topic discussed in this thread isn't urgent, but it does make BitDefender look sloppy and user-unfriendly. So I guess they *should* consider it urgent from a marketing and reputation perspective.

Yes, it's been pointed out that the post-scan message has been changed to say that the password-protected files were potential threats, not infections. But when I go the history-section log for the full system scan that produced the alerts, I see a big X in a red circle next to the listing. When I click on the entry, I get an even bigger X and the following alarmist message at the top: Some of the threats found during the scan are still active! It doesn't even say "potential threats," it says simply "threats." Being presented with a screen like this would certainly be concerning to the casual user, even if it doesn't use the word "infection." This should be changed, and soon.

Now let's turn to some details of the the scan that produced those poorly-worded and poorly illustrated history entries, as well as the scan I did prior to that. My first full system scan after upgrading from BitDefender Antivirus 9.5 to BitDefender AntiVirus 2008 was a week ago. I received 38 of the password-protected/potential threat messages. It turns out they were all files contained within the setup exe for an old version of AdAware. I no longer needed that setup file, so I deleted it.

Then last night I did my second full-system scan, and got 76 of the password-protected/potential threat messages. Upon examination, I saw that these were two apiece of each of the same files detected in that recently-deleted AdAware setup file. But now they were detected somewhere in the XP System Restore folder (e.g., C:\System Volume Information\_restore{45362FB7-1475-4810-96F1-7AC543002A71}\RP1002\A0244038.exe=]wise0021=]Ad-Aware SE Default.skn).

It's bad enough that BitDefender tells me these are potential threats. But what's worse is the program's advice to unpack the files so they can be scanned. It is just plain ridiculous to blindly suggest something that people -- especially the average user -- should not even THINK of doing. I can just see the average user thinking, OMG, I have tons of viruses (or even the milder, "I might have tons of viruses"), and then trying to unpack an exe, or -- worse yet -- trying to diddle around with the System Restore folder! It's goofy. The last thing they need, if they want to retain business, is to scare unsuspecting buyers into unnecessarily screwing up their systems.

This has certainly lowered my own opinion of BitDefender a few notches. It's still high, but not as high as it used to be. More thought should have gone into this. It needs to be fixed.

Today is February 5 and I just received an update from BitDefender. The problem still isn't fixed. I was forwarded to this topic because I had the same problem you all have had. Hey, I'm a just a "user" . . . trying to learn as much as possible. But "unpacking" (what the heck is that? And I don't think I want to know!) and running searches to find these files, figuring out whether to delete them . . . is just a big time-consuming project. I don't want to delete something important either! And last of all, I just don't believe we should have to do any of those things!

So guys, what's my option? Continue to get this reading after each and every full scan? I'm going to look around the menus and see if I can somehow select something to omit this step. Any ideas? I'd like to ignore it as Cris suggests, but I have to find out what to select to do this in the menus.

Hey Cris! We're not picking on you. We're just big-time frustrated with the people at BitDefender. Not you. Thanks for the time you spent answering all our questions. However I agree with Ardmore. BitDefender had better fix this problem quickly or they're going to lose their reputation. I'm already pretty disappointed with my new download after running it, getting scared out of my wits by their choice of words and then reading all these posts.

Unless it gets fixed, I might not renew. Anyhow. . . What's my options about a work-around for this headache?

Hello popcorn,

By ignoring I mean that you just should overlook those alerts. There is no way to make them disappear.

I will try to contact someone (AGAIN) about this, but (again) I cannot promise anything.

So: those archives are NOT malware. There is an extremely LOW chance that they really are malware and, as I already explained, even if they are malware, they are harmless while they are encrypted. And once they are decrypted, they will be detected and blocked by BitDefender.

In other words, as long as the sections Infected items and Suspected Items show a big 0 (zero), there's absolutely nothing to worry about.

I'm sorry, but there nothing else that you can do about this, for the time being.

Cris.

Hello popcorn,

By ignoring I mean that you just should overlook those alerts. There is no way to make them disappear.

I will try to contact someone (AGAIN) about this, but (again) I cannot promise anything.

So: those archives are NOT malware. There is an extremely LOW chance that they really are malware and, as I already explained, even if they are malware, they are harmless while they are encrypted. And once they are decrypted, they will be detected and blocked by BitDefender.

In other words, as long as the sections Infected items and Suspected Items show a big 0 (zero), there's absolutely nothing to worry about.

I'm sorry, but there nothing else that you can do about this, for the time being.

Cris.

Hey Cris! I decided to Google the C:\RECYCLER file names I had been getting in the scan log. I located a forum and read a thread with the simple explanation that "C:RECYCLER" is a hidden folder used by the Recycle Bin. They suggested just "empty your trash!" I did that and the next scan did not pick up any of the 174 items that were entitled "C:\RECYCLER:". Hooray!

By the way, another Google search turned up some useful information about Recycler and the System Volume Information folder in XP. You can get it if you start a search at Google and ask for information "About Recycler and System Volume Information Folder in XP and Vista". This should get you there. Maybe this will help others.

chrisderoover

My up to date version of BD Internet Security 2008 considers also all items in non password protect archives as infections. This includes e.g. all individual mails in an Outlook pst file, all files that are contained in zips... (in total about 75.000 password-protected items). Also, in step 3 they are still listed as infections (no sign of another category).

BTW, this computer should be clean (I just reinstalled it from scratch and did a restore of data I first thoroughly checked with Kaspersky, F-Secure and Panda).

Chris5,

The odds are in your favor that these files are NOT infected. And like everyone else posting here, you're dealing with the same problem. We'll just to keep our cools and wait! Wait until BD's software people DEAL WITH this problem. Users are losing their patience. I don't blame them. Who wants to spend valuable time (HOURS sometimes!) chasing down the answers to so-called threats that aren't threats!! Like everyone else, I have better things to do. <_<

BTW have you ever tried Firefox as a browser and gmail? I switched and it's made life easier. :rolleyes: