Possible Infection

Hello,

QuickScan indicates that my system is infected with Trojan.Generic.4104085 . No other products on my laptop indicate a problem, but I have run QuickScan repeatedly over the past couple of weeks and it always shows a Trojan.Generic infection. I have searched online but find no solutions for this specific infection.

Product: BitDefender QuickScan 0.9.9.142 add-on for FireFox

OS: Windows 7 SP1

Thanks in advance!

Find more posts tagged with

Comments

csalgau

You might try removing the detected file manually. QuickScan does not attempt remediation (but it does suggest you install a full product that would).

On supported version of Windows you should be able to find QuickScan logs under %APPDATA%\QuickScan

Detection, or lack thereof, by another security products is their decision alone.

neishai

Thank you very much for your reply! I checked the QuickScan log and this is what it found:

Found 1 infected file!

----------------------

C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe --> Trojan.Generic.4104085

--> HKLM\System\ControlSet001\services\Bluetooth Media Service\"ImagePath"

This seems like a legitimate file. If it's infected, how would I re-install it properly?

TanLorik

Hello,

I have checked the detection and Trojan.Generic.4104085 should only detect one file, namely

https://www.virustotal.com/en/file/a12759a5...6fcc8/analysis/

if you think this is a false positive please send us the file (archive it with password (preferred password: infected), and uploaded to a fileshare site and give us the link, or send it directly here but I cannot guarantee I will see it if you use the form) and I will check to make sure there are no problems.

Sorry for any inconvenience this may have caused.

PS: QuickScan does not offer the full range of protection a normal antivirus solution has. It is possible that some malware may slip past QuickScan. Please do a full system scan with a regular anti-virus. I recommend testing with our free product http://www.bitdefender.com/solutions/free.html , but you are free to choose whatever you like best.

neishai

Hello, and thank you for the reply. The link you provided to Virus Total is interesting. It says that Malwarebytes would not detect this but that McAfee should have. Neither program on my machine detected it. So I have sent the file mediasrv.exe via the form with attachment. If there is any problem with that please let me know and I will upload it somewhere.

TanLorik

Hi, the files sent through the form take a while to be processed, I could help you right now if you upload the file to a fileshare website (dropbox, google drive, sendspace, etc) and post the link in this thread. Just remember to archive it with a password (preferred: infected) .

Have a nice day!

neishai

Hi, the files sent through the form take a while to be processed, I could help you right now if you upload the file to a fileshare website (dropbox, google drive, sendspace, etc) and post the link in this thread. Just remember to archive it with a password (preferred: infected) .

Have a nice day!

I see. In that case I have uploaded it to Google Drive. It should be as you instructed, zip file with password (infected). Here's the link:

https://drive.google.com/folderview?id=0BwQ...amp;usp=sharing

TanLorik

Ok, so the file you have sent me is clean and is not detected by the scanners. If you still have the quickscan log, could you provide me with the md5 of the file as seen in the log( %APPDATA%\QuickScan ), the line should look like this :

MD5: b59e9810f8a416b9e5354834f26969d4 C:\Windows\SysWOW64\msvcrt.dll

only for C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe

There seems to be a discrepancy in what exists on disk and what was recivied by quickscan.

Anyway, the file is a false positive and should be ignored for the time being. Any request from now on is if you are kind enough to help us investigate the problem further to see why this has happened.

Thank you and have a nice day!

neishai

Thank you! I'm glad it's a false positive. It's a relief.

I'm also happy to help investigate. Here is what the log file says:

MD5: 5e5edcceea4fa3fdf3a907ac204b5828 C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe