Curious About Warning On Windows.exe

Hello

I think something is injected in that file.

In order to be able to further investigate the reported situation we need a bit more information from your computer as follows:

. A BDSYS log;

[how to GENERATE A BDSYS LOG]

. Save and extract the BDSYS tool to a location of your choice:

http://www.bitdefender.com/files/Knowledge.../BDSysLog_i.exe

. Make sure you close all active applications and then run "BDSysLog_i.exe"; If you receive a firewall

alert,select to Allow the application to connect;

. Click the "Create log" button to start generating the

log; A progress bar is indicating that the tool is creating the report;

. When the small window appears with the message "Log

saved" then the report is complete and a new file named "bdsyslog.zip" has appeared on your Desktop;

. Send me via PM the generated log file.

. If the file is to big for send it over PM, upload the results to one of the online file hosting servers mentioned below or use one of your own and send via PM the download link.

http://www.sendspace.com

http://www.mediafire.com

IMPORTANT:

.During this process the Real Time Protection in Bitdefender must be temporarily disabled;

.If you receive a Bitdefender Firewall alert to inform you that BDSysLog_i.exe tries to connect to the internet,then you need to select Allow;

[how to DISABLE THE ANTIVIRUS PROTECTION in Bitdefender 2013]

In order to disable the antivirus protection, please open Bitdefender and click the "Settings" button in the upper side part of the interface"; In the new window go to "Antivirus" > "Shield" tab and click on "ON" under On-access scanning. Select the time interval that suites your troubleshooting needs and click "OK". The On-access scanning should be enabled back after finishing the troubleshooting procedure.

We will get back to you as soon as the analysis is complete.

Have a nice day.

Hello

Please run the tool - password "tool" without quotes from this link:

http://www.mediafire.com/file/b93lut4jh8eilct/tool.rar

1 unpack the archive

2 inside the folder tool, run "tool.bat"

3 wait for it to finish ( can take a few minutes )

4 send us all the files it creates ( also with subfolders )

Pack them in an archive with the password infected and upload it on

http://www.sendspace.com

or

http://www.mediafire.com

and send me a PM with the download link.

We will analyze the information you sent and then reply with a possible solution in the shortest time.

Have a nice day.

Hello

Please save the file first, on your desktop and extract both files in the same location.

Right click on tool.bat and choose Run as administrator. Let it run for several minutes, the tool will dump all explorer.exe injections. It will create several files and folders in the same location. Pack those files in an archive and send me a PM with it.

Thank you!

Hello

I will talk to my colleagues from the Labs and get back to you on this ASAP.

Also I will need one more thing:

Navigate to this key

HKEY_LOCAL_MACHINE\SOFTWARE\AVC3\UserID

and export the value.

How to:

http://www.pc1news.com/videos/export-registry-key-15.html

Send me a PM with it.

Thank you!

Hello

I have replied to your PM, I need the exported key, not the text from the file.

Thank you!

Hi

Please make sure that you have the latest product update installed:

http://forum.bitdefender.com/index.php?sho...st&p=164968

Detection was removed from Active Virus Control, the injected element is legit.

Thank you!

Hello

Yes, it was a False Positive from the Active Virus Control module, my colleagues removed detection from the product. Your system is not infected.

Please let me know if you have other questions.

Thank you!