Kindly be advised we cannot cancel subscriptions or issue refunds on the forum.
You may cancel your Bitdefender subscription from Bitdefender Central or by contacting Customer Support at: https://www.bitdefender.com/consumer/support/help/

Thank you for your understanding.

need help plz!!!

Options
eugeneang
edited June 2007 in Malware talk

hey people im new here. when i do a full virus scan DB detected 3 virus but it can't disinfect them :unsure: ... i really need help anyway heres my log hope anyone could help me plzzz!


o yea btw im using DB plus 10 OEM.


Summary:


F:\WINDOWS\Temp\tmp000022a2\tmp0000e93b=>lzma_solid_nsis0005 Detected: Adware.VB


F:\WINDOWS\Temp\tmp000022a2\tmp0000e93b=>lzma_solid_nsis0005 Disinfection failed


F:\WINDOWS\Temp\tmp000022a2\tmp0000e93b=>lzma_solid_nsis0005 Move failed


F:\WINDOWS\Temp\tmp000022a2\tmp0000e93b=>lzma_solid_nsis0006 Detected: Adware.BHO


F:\WINDOWS\Temp\tmp000022a2\tmp0000e93b=>lzma_solid_nsis0006 Disinfection failed


F:\WINDOWS\Temp\tmp000022a2\tmp0000e93b=>lzma_solid_nsis0006 Move failed


F:\WINDOWS\Temp\tmp000022a2\tmp0000e93b=>lzma_solid_nsis0010 Detected: Application.Adware.Savenow.G


F:\WINDOWS\Temp\tmp000022a2\tmp0000e93b=>lzma_solid_nsis0010 Disinfection failed


F:\WINDOWS\Temp\tmp000022a2\tmp0000e93b=>lzma_solid_nsis0010 Move failed


F:\WINDOWS\Temp\tmp000040ac\tmp000ad076=>lzma_solid_nsis0005 Detected: Adware.VB


F:\WINDOWS\Temp\tmp000040ac\tmp000ad076=>lzma_solid_nsis0005 Disinfection failed


F:\WINDOWS\Temp\tmp000040ac\tmp000ad076=>lzma_solid_nsis0005 Move failed


F:\WINDOWS\Temp\tmp000040ac\tmp000ad076=>lzma_solid_nsis0006 Detected: Adware.BHO


F:\WINDOWS\Temp\tmp000040ac\tmp000ad076=>lzma_solid_nsis0006 Disinfection failed


F:\WINDOWS\Temp\tmp000040ac\tmp000ad076=>lzma_solid_nsis0006 Move failed


F:\WINDOWS\Temp\tmp000040ac\tmp000ad076=>lzma_solid_nsis0010 Detected: Application.Adware.Savenow.G


F:\WINDOWS\Temp\tmp000040ac\tmp000ad076=>lzma_solid_nsis0010 Disinfection failed


F:\WINDOWS\Temp\tmp000040ac\tmp000ad076=>lzma_solid_nsis0010 Move failed


F:\WINDOWS\Temp\tmp00006ec9\tmp000a690a=>lzma_solid_nsis0005 Detected: Adware.VB


F:\WINDOWS\Temp\tmp00006ec9\tmp000a690a=>lzma_solid_nsis0005 Disinfection failed


F:\WINDOWS\Temp\tmp00006ec9\tmp000a690a=>lzma_solid_nsis0005 Move failed


F:\WINDOWS\Temp\tmp00006ec9\tmp000a690a=>lzma_solid_nsis0006 Detected: Adware.BHO


F:\WINDOWS\Temp\tmp00006ec9\tmp000a690a=>lzma_solid_nsis0006 Disinfection failed


F:\WINDOWS\Temp\tmp00006ec9\tmp000a690a=>lzma_solid_nsis0006 Move failed


F:\WINDOWS\Temp\tmp00006ec9\tmp000a690a=>lzma_solid_nsis0010 Detected: Application.Adware.Savenow.G


F:\WINDOWS\Temp\tmp00006ec9\tmp000a690a=>lzma_solid_nsis0010 Disinfection failed


F:\WINDOWS\Temp\tmp00006ec9\tmp000a690a=>lzma_solid_nsis0010 Move failed


F:\WINDOWS\Temp\tmp00006ec9\tmp001503f7=>lzma_solid_nsis0005 Detected: Adware.VB


F:\WINDOWS\Temp\tmp00006ec9\tmp001503f7=>lzma_solid_nsis0005 Disinfection failed


F:\WINDOWS\Temp\tmp00006ec9\tmp001503f7=>lzma_solid_nsis0005 Move failed


F:\WINDOWS\Temp\tmp00006ec9\tmp001503f7=>lzma_solid_nsis0006 Detected: Adware.BHO


F:\WINDOWS\Temp\tmp00006ec9\tmp001503f7=>lzma_solid_nsis0006 Disinfection failed


F:\WINDOWS\Temp\tmp00006ec9\tmp001503f7=>lzma_solid_nsis0006 Move failed


F:\WINDOWS\Temp\tmp00006ec9\tmp001503f7=>lzma_solid_nsis0010 Detected: Application.Adware.Savenow.G


F:\WINDOWS\Temp\tmp00006ec9\tmp001503f7=>lzma_solid_nsis0010 Disinfection failed


F:\WINDOWS\Temp\tmp00006ec9\tmp001503f7=>lzma_solid_nsis0010 Move failed


could someone guide me through on what to do?


thx in advance :)

Comments

  • maximus
    Options

    Disable real time protection and clean the Temp folder from Windows.


    Do not open that file, just select all files and delete them.


    Catalin

  • is that all i need to do? ill try it out n get back to you thx anyway

  • Hi!


    Don't delete the Temp folder itself, only the files inside it. You can also use a cleanup utility like CCLeaner or Disk Cleanup. Don't forget to disable Real-Time protectiomn befoore, as Catalin mentioned.


    Andrei

  • Niels
    Niels
    edited June 2007
    Options

    If you install ccleaner do not forget to uncheck yahoo toolbar during installation. You can follow that procedure if viruses or malware is found in temp folder. It could be that some temp files are still in use but normally when you disable the realtime protection temporary you must be able. If you receive an message from windows that the file is in use than you can use this tool: http://ccollomb.free.fr/unlocker/unlocker1.8.5.exe Install it rightclick on the files and choose for unlocker,unlock all. So you don't have to disable realtime protection.


    Regards


    Niels

  • hey guys/gurls thx alot ill do a virus scan again and see if the virus is deleted. btw do i need to activate reall time protection again?


    thx again.

  • Yes, you have to reactivate real-time protection, else you will be unprotected. You had to deactivate it to delete the infected files, because if BD shield would still have been active, it would have blocked any kind of acces to those infected files, making it imposible to delete them in the usual way.


    Andrei

  • hey guys thx ALOT.i have cleared all my viruses.. really apprciatted u help thx again.

  • Glad that we could help you! ;)


    Andrei

  • Niels
    Options

    Also glad that we could help you.


    Regards


    Niels

  • hey guys sry to bother you again now i found 1 virus in diffent places. how do i delete them?


    :


    Summary:


    F:\WINDOWS\$NtServicePackUninstall$\inetwiz.exe Infected: Trojan.Patched.V


    F:\WINDOWS\$NtServicePackUninstall$\inetwiz.exe Disinfection failed


    F:\WINDOWS\$NtServicePackUninstall$\inetwiz.exe Moved


    F:\WINDOWS\system32\dllcache\route.exe Infected: Trojan.Patched.V


    F:\WINDOWS\system32\dllcache\route.exe Disinfection failed


    F:\WINDOWS\system32\dllcache\route.exe Moved


    F:\WINDOWS\system32\route.exe Infected: Trojan.Patched.V


    F:\WINDOWS\system32\route.exe Disinfection failed


    F:\WINDOWS\system32\route.exe Moved

  • Hi!


    Route.exe is a windows application. It is most probably a false-positive, I have analyzed the file and it doesn't appear like containing any malicious code. It is a program that manipulates the network routing tables. VR will remove the detection if necesarly.


    Andrei

  • maximus
    Options
    Glad that we could help you! ;)


    +1

  • Hi, eugene199!


    It was indeed a false-positive. Detection has been removed. :)


    Andrei

  • hey thx for the quick reply. so thats not a virus right? o yea whats "VR" ? sry for bothering so much

  • Hi!


    VR stands for "Virus Reseacher", the BD guys who analyze malware, extract their signature, write removal tools etc.


    Once again I'm glad that I could help you.


    Andrei

  • ooo ok ok thx alot.

  • hi


    i need your help


    after installing BF my computer is running very slow.


    what can i do ?


    thanks!

  • Niels
    Options

    Hello gretty


    You can try this :


    Start BitDefender go to antivirus,shield,adjusted level, check the option don't scan files larger then .... (you can change the default value). If you are sure that a path isn't infected you can exclude it by selecting the option don't scan this path on all levels,press add new item. You can also uncheck scanning inside archives. Don't forget to confirm by pressing on ok.


    Regards


    Niels

  • Hello gretty


    You can try this :


    Start BitDefender go to antivirus,shield,adjusted level, check the option don't scan files larger then .... (you can change the default value). If you are sure that a path isn't infected you can exclude it by selecting the option don't scan this path on all levels,press add new item. You can also uncheck scanning inside archives. Don't forget to confirm by pressing on ok.


    Regards


    Niels


    hi Niels,


    Thank you !


    I did what you advised me and I hope to work.


    Regards,


    Gretty

  • Niels
    Niels
    edited June 2007
    Options

    Hello gretty


    I deleted your other post. Normally it will work.


    Regards


    Niels