Gen Variant Kazy 154650

Hi.

I have BitDefender Total Security 2013 installed. I just finished running a complete anti-virus scan and it came up with this: Gen Variant Kazy 154650 with two file numbers saying appended exe located in my G drive/dox/possible word dox. This folder was created in January 2010 and BitDefender has never found this possible worm before despite numerous scans with the TS 2013 installed. I typed the file numbers into my search box and it came up blank. I actually do not know what this folder is for but it contains a lot of numerical files. For example the two possibly infected- 604AE0B7 AND 704AE0B7. They are all numerically named like this. When I opened one up at random on notepad, it was simply a string of programming language.

Because I don't know what this folder is or does and because I've never seen this on any scan before, I really do not want to take any action such as deleting it before I hear anything from other people on this forum as to what it is or might be. A web search for this variant also came up blank.

Thank you for any help or information.

Find more posts tagged with

Comments

Georgia

We need a sample of that file for the lab analysis.

Please protect the archive with the password "infected" and upload it on a file server such as http://www.sendspace.com or http://www.mediafire.com. Then post back the download link.

Thank you.

aardvaark

We need a sample of that file for the lab analysis.

Please protect the archive with the password "infected" and upload it on a file server such as http://www.sendspace.com or http://www.mediafire.com. Then post back the download link.

Thank you.

Thank you.

I have just started another scan. I should also tell you that something is turning off my Auto-Scan function intermittently and so I get a warning saying my computer is at risk. As soon as I turn it back on again, I get the green "your computer is protected" again. No idea why this would be happening.

Scan is complete. The two objects are still there and disinfection has failed.

Is there no way to send these files directly for analysis through my Bitdefender TS 2013 ? As I said, a search comes up blank when the file numbers are entered in my computer search boxes. Same thing when I did a manual search. I'll try and find them again but I'm not optimistic.

aardvaark

Hi again.

I just set up an account with sendspace and uploaded the two files. I've never used this service before and am unsure what to do next. How can I send them to you in a protected format?

aardvaark

Hi again

I just moved the infected files into quarantine and I see the "submit suspicious quarantined files for further analysis" tab is set to On but nothing has been sent yet. Why would that be?

Georgia

Hi again

I just moved the infected files into quarantine and I see the "submit suspicious quarantined files for further analysis" tab is set to On but nothing has been sent yet. Why would that be?

Hello,

Thank you for providing additional information.

I will need a couple of logs from that computer to be able to help you with these issues.

1. Bring up the Bitdefender interface

- locate the Update panel and hit 'Update Now'. Wait until the progress bar get to the end

- next, on the Antivirus panel click 'Scan Now'

- from the drop-down menu choose the option 'System scan' and allow the scan process to complete

2. After the scan completes, follow these steps:

http://forum.bitdefender.com/index.php?showtopic=29927

You may not be able to upload the files here as they are too big so you can put them on http://www.sendspace.com or http://www.mediafire.com and post the download links.

3. Save and extract the BDSYS tool to a location of your choice:

http://www.bitdefender.com/files/Knowledge.../BDSysLog_i.exe

- make sure you close all active applications and then run "BDSysLog_i.exe"; If you receive a firewall alert,select to Allow the application to connect;

- click the "Create log" button to start generating the log; A progress bar is indicating that the tool is creating the report;

- when the small window appears with the message "Log saved" then the report is complete and a new file named "bdsyslog.zip" has appeared on your Desktop;

- upload the results to one of the online file hosting servers mentioned below or use one of your own and post here the download link.

http://www.sendspace.com

http://www.mediafire.com

I will get back to you as soon as the analysis is done.

Thank you!

aardvaark

Hello,

Thank you for providing additional information.

I will need a couple of logs from that computer to be able to help you with these issues.

1. Bring up the Bitdefender interface

- locate the Update panel and hit 'Update Now'. Wait until the progress bar get to the end

- next, on the Antivirus panel click 'Scan Now'

- from the drop-down menu choose the option 'System scan' and allow the scan process to complete

2. After the scan completes, follow these steps:

http://forum.bitdefender.com/index.php?showtopic=29927

You may not be able to upload the files here as they are too big so you can put them on http://www.sendspace.com or http://www.mediafire.com and post the download links.

3. Save and extract the BDSYS tool to a location of your choice:

http://www.bitdefender.com/files/Knowledge.../BDSysLog_i.exe

- make sure you close all active applications and then run "BDSysLog_i.exe"; If you receive a firewall alert,select to Allow the application to connect;

- click the "Create log" button to start generating the log; A progress bar is indicating that the tool is creating the report;

- when the small window appears with the message "Log saved" then the report is complete and a new file named "bdsyslog.zip" has appeared on your Desktop;

- upload the results to one of the online file hosting servers mentioned below or use one of your own and post here the download link.

http://www.sendspace.com

http://www.mediafire.com

I will get back to you as soon as the analysis is done.

Thank you!

Hi and thanks for the further info. Here are the links to the sendspace files. Could you tell me why my Bitdefender is not sending the files directly to the lab for further analysis? I have that option selected but its telling me they have not been sent.

http://www.sendspace.com/file/mz51uc

http://www.sendspace.com/file/33knx4

rootkit

Hello,

Proper actions were taken for those files.

In the future, if you want to report a file or a website, please use out Submit form:

http://www.bitdefender.com/submit

Have a great week ahead!