Trojan.patched.bd

It seems to becoming a common problem: http://forum.bitdefender.com/index.php?showtopic=4665

I have the same file / Virus in system32/sens.dll , it appeared yeasterday

hello there , well I have the same problem Trojan.Patched. BD in windows\system32\sens.dll, well what next ? I mean did anyone find a solution?

Hoops, i posted in the wrong thread - same as before.

/applications/core/interface/file/attachment.php?id=1612" data-fileid="1612" rel="">sens.zip

Attached is the latest scan log. The registry key doesn't show up here, since I manually deleted it. But now it found the file in my System32 folder again, even after disinfection on the first scan. Is this virus reproducing itself?

The attachments could be downloaded only by virus researchers and mods. They seem to be attending the problem.

I recommend not to delete anything until there is more clearance about sens.dll, as sens.dll is legit MS file.

OK so what should we do now? We have trojans on our PC's, and the techs keep quiet.....

It seems we just have to sit and wait to see who will be the first to make the big step, the Trojan or the techs there!! I'm having the same problem as you, I really understand what you are going through.

10.19% of systems are infected with Trojan.Patched.BD according to Real-time Virus Reporting - Last 24 hours.

Only Bitdefender and Counter Spy detected it yesterday. Just wait until they research it more, because it's likely to be a false positive.

But for now locate:

C:\WINDOWS\SYSTEM32\SENS.DLL

Right click on it, and click properties. If the date of creation is new, then the file is most likely infected.

Dear Greatbigmouth,

The legit sens.dll should have a description when you hold mouse cursor on it System Event Notification Service. But in this case yoru sens.dll could be modified. Go to start,run,type regedit press enter now expand this registry key hkey_local_machine,system,currentcontrolset,services,sens,Parameters now take a look at the right side and double click on "ServiceDll" and see what the path is it should be %SystemRoot%\system32\sens.dll check also the default key that should be empty. That should be the only registry keys that should be located. Reboot your pc into safe mode by pressing several times on the F8 button before the windows loading screen select safe mode press enter. Log in with your account. Go to start,right click on my computer choose properties,system restore check the option disable system restore on all stations confirm the message wait till systemrestore is disabled. After that uncheck the option to disable system restore and press on apply and ok. Reboot your pc perform an update with BitDefender and let BitDefender scan it. It would also be nice if you upload your sens.dll so the virus researchers can check it.

Best regards

Niels

It went so fast and I could not add anything to my reply:

Any good programs that you can recommend?

1. I recomend AVG atispyware (not antivirus), after 30 days trial it becomes automatically a free version without real time protection which you can update and scan your system from time to time.

   
   Spybot search & destroy can also be an addition, it handles many old adware/spyware stuff.

   
   Many people use also the free version of Super AntiSpyware.

2. It is though weired if the creation and the modification date is the same. What is the version and the size?
3. You asked in the other post if it is safe to use Internet banking. To be on the safe side avoid that until you replace the dll and you scan your system with those programs I mentioned.
4. Using Internet explorer empty your Internet cache, cookies and history. Using disk cleanup empty all temp folders.
5. The BD real time protection has blocked access to the dll. That is why you can't replace it. So you can make a copy of the dll from i386 folder on your install CD and save it somewhere on your computer. Then turn of the real time protection and remove the infected dll. Then without rebooting copy the original one to its folder (C:\WINDOWS\SYSTEM32).

   
   If the file is in use you should try it in safe mode.

6. I am not sure if it works but you may try it if everything failed: click start - type sfc \scannow in the run box, and press Enter. It checks the integrity of windows system files and if needed replaces them. You need your windows install CD. It may take about 20 minutes. The real time protection should be turned off. After that you have to scan the dll with BD.
7. Then empty your system volume information to get rid of recreation of infection by windows recovery. To do that: go to start-right click My Computer-select properties- under system restore tab- check turn off system restore on all drives. Click apply. By doing this you loose all your restore points. Reboot and don't forget to uncheck "turn off system restore on all drives" to create a clean restore point.

Since I'm having exacty the same proplem as Greatbigmouth, I'll answer for these questions also.

1. Date of creation: Dec. 2004

Date Modified : Aug. 2004

So strange it was modified before it was created!!

Its size is 38 KB and the by version I didn't understand what you meant but for type it has as: Application extension. My operating system is WinXP SP 2.

2. BD was updated everal time and when I scanned this file always the same result: Trojan.Patched.BD

I hope you can help us solve this issue.

It happens sometimes that the dat of creation and modification get reversed. The date of modification is not recent and that really strange.

About the version: when you right click the dll and select properties under general tab you read the size and under version tab you can read the version.

The sens.dll with the size of 38 KB (38.912 bytes) should be 5.1.2600.2180.

I would like to say thank you to Farbar and Niels for helping me in this sticky situation. After disabling BD Real Time Protection, I was able to replace the infected file using my Windows XP Installation disc.

My system now appears virus-free. Thank you once again.

EDIT: It seems to have created a sens.dll.tmp file which is still infected. While the original sens.dll file is now clean. I can't delete that tmp file. Tried turning RT protection off. It didn't work.

I am glad we could help you and you are most welcome.

Could you please specify the path to sens.dll.tmp?

No need to. After a system reboot, the file was gone. I did a full scan with BD, and my system came up clean. Thanks again. It's much appreciated.

You are welcome.

I'm so glad you solved the issue for our friend but I just got mixed up. Can you please tell me what to do in order to finish with this thing? By the way I don't have a windows installation CD bec it was preinstalled I have the recovery tool. I would be grateful if you can help me since I'm not that expert in computer.

This is what you should do:

1. You need a clean sens.dll anyway. It can be copied from a windows install CD, or another computer.
2. If you can find a CD you just put the CD into CD/DVD-ROM. Click start - My Computer - open the CD/DVD-ROM drive. Navigate to i386 Folder and find sens.dll then right click and select copy from the context menu (or select and Ctrl+C), go to a folder like My Documents set the cursor there - right click and select paste from the context menu.
3. If you copy the sens.dll from another computer:right click start - select explorer from the context menu - Go to C:\Windows\system32 in that folder copy the sens.dll and paste it to a flash driver or send it as attachment with email to your email. Then download from your flash driver or email to My Documents.
4. Turn off the BD real time protection (double click BD icon on the system tray -click settings - antivirus -under Shield tab: uncheck enable real-time protection
   
5. Navigate to C:\Windows\system32\sens.dll and dete it. Don't reboot. Copy the clean sens.dll from My Documents and paste it to system32 folder.
6. Turn on BD real-time protection a gain.
7. Follow other instructions in the earlier post to clean the IE and Temp folder.
8. Follow also the instruction to create a new restore point.

Hello, recently I've troubled with this "sens.dll" as well in my WINDOWS\system32. My Bitdefender found it a day before or the day of when this thread is created. It was pretty much normal, I choose to wait for further updates from Bitdefender, but until now, everytime the message pops up with the "Trojan.Patched.BD" detected in "sens.dll", my internet disconnected and reconnected. I'm an online gamer, it's quiet annoying when you play in the middle of some games and have to quit which will cause bad reputations to my game account for quitting. I don't want to enable to "Game Mode" because the "sens.dll" would do something while it's not protected.

I've read this entire thread, I checked the sens.dll and here's the informations:

Created date: Wednesday, August 04 2004, 6:00:00 PM

Modified: Wednesday, August 04 2004, 6:00:00 PM

Size: 38,912

Size on disk: 40,960

When my mouse are place over the .dll, the message shows "The date it was created and size". The passed days, it was something else, such as "System Event Notification Service" which was supposed to be with its version. "Properties" of the ".dll" should have some sections or tabs on top of the interface with the version name, but it doesn't have it in my "sens.dll"

Any recommended methods that I used? (any of the method mentioned up there I should try)I only have Bitdefender Total Security 2008 as my security. I'm using a HP Laptop, which means I don't have the installation CD of the Window.

Any recommended antispyware that is strong and effective?

In my mind, I can get:

- SUPERAntispyware professionals

- Webroot Spyweeper

- AVG Antispyware

Those are the famous one, anymore which can helps me on this problem?

I do not want to delete the sens.dll since it's part of Microsoft legitimate windows applications.

Thank you for further helps~

@ farbar: Well, I found out that when I selected the properties of the "sens.dll", I don't find a section that talks about version, and "Summary".

However, I reformated sometimes before, and I still have backups of my "WINDOWS", I checked the "sens.dll" in the old backups WINDOWS files. I found that there's a section of versions and summary...I scanned it too, and doesn't found anything.

Tell me if this could work...I replaced my old sens.dll with the one I'm using now. I just wondering if it would affect the WINDOWS in anyway, because different version uses?

No it should not effect the working of windows, and it is your own (original) version. In case the windows needs to update it to another version you will know it when you update windows.

Is there anyway to replace it using Copy and Paste? Because it won't let me access it and you'll know why. It's a message keep poping up saying it's already being used.

I'm pretty sure this can help, since I used another version of it on the same PC.

Well thanks alot for the help Farbar, everything is ok now. " />

You are most welcome Fida.

Did you followed the instruction?

Ok...

After I turned the off the real time scanner, I go to properties of the sens.dll of the infected, I select "OK", which means it was modified. Then after that, it doesn't get detect anymore after I turn on the real time scanner of BD. However, I just want to make the system clean, I replaced with the old ones...now BD doesn't detect anymore, I've found that it was a legitimate file, everything is normal now.

Thanks for your help...because I do not want to reformat windows for a simple .dll nor installing more softwares to fight against problems can make it worse.

Once last question from my side. (Even though my problem is resolved).

Why do we still have trojans/viruses/worms, etc on our PC's if BitDefender supposedly "Blocks" them. Why do they still get through?

This question is asked many times on this forum. As I understand: The perfect antivirus which can catch or prevent all the infections is a wonderful illusion. The virus makers could be intelligent, innovative, skillful and more often consciousless people who invent new techniques and exploit the unknown vulnerabilities in the OS, softwares, programs and even AV we are using. You may also ask with the same analogy the question: why the police force (from any county) can't catch all the bad guys and prevent all the crimes?