Trojan.heur.gm

Hello frmrswife,

First of all, I want to tell you that, at least for the moment, you have nothing to worry about. Even if that detection is real, the detected files are archived (that's why they couldn't be cleaned automatically). And also because they're archived, it means that they are absolutely inactive, because for an application to be able to run it must be unarchived first, and there are no files detected that are not in an archive.

Second of all this detection is based on heuristic scanning, which can produce false positives (clean files wrongly marked as infected). For this, you should submit the file for analysis, so that the clear state of the file can be decided.

So please find this file:

C:\SWSetup\HPQPDP\data2.cab

put it in a password-protected arhive (ZIP file, with the password infected), upload it on a filesharing host and send me the download link through PM. I'll send it to analysis ASAP and give you the result. Also:

- in case the file is clean, detection will be removed (so it won't be marked again as infected)

- in case the file is infected, it will be given a more specific detection name + a removal method

Cris.

I had the exact same situation happen to me. I did a scan on my system the evening of 3/30/2009 and BitDefender reported that I had 2 issues:

C:\SWSetup\HPQPDP\data2.cab

C:\SWSetup\QPW\data2.cab

I have never before received a "Positve" result from BitDefender on these files.

I would be interested in the results of the analysis being performed by BitDefender. I can send my log file if that would help.

Kate

I also did a scan of my computer last night and the scan came back with 3 problems, one of which was deleted, the other two would not.

This is my scan log:

BitDefender Log File !!!!!

Product : BitDefender Antivirus 2008

Version : BitDefender UIScanner v.11

Log date : 18:49:11 31/03/2009

Log path : C:\Users\Jenny\AppData\Roaming\BitDefender\Desktop\Profiles\Logs\manual_scan\1238539751_1_02.xml

Scan Paths: Path0000: C:\

Scan Options: Scan for viruses : Yes

Scan for adware : Yes

Scan for spyware : Yes

Scan for applications : Yes

Scan for dialers : Yes

Scan for rootkits : No

Target selection options: Scan registry keys : No

Scan cookies : No

Scan boot sectors : No

Scan memory processes : No

Scan archives : No

Scan runtime packers : No

Scan emails : No

Scan all files : No

Heuristic Scan : No

Scanned extensions :

Excluded extensions :

Target Processing Default action for infected objects : None

Default action for suspicious objects : None

Default action for hidden objects : None

Scan engines summary Number of virus signatures : 2816164

Archive plugins : 45

Email plugins : 6

Scan plugins : 13

Archive plugins : 45

System plugins : 5

Unpack plugins : 7

Overall scan summary Scanned items : 378522

Infected items : 5

Suspicious items : 0

Resolved items : 1

Individual viruses found : 3

Scanned directories : 23099

Scanned boot sectors : 0

Scanned archives : 4924

Input-output errors : 0

Scan time : 00:01:53:58

Files per second : 55

Scanned processes summary Scanned : 0

Infected : 0

Scanned registry keys summary Scanned : 0

Infected : 0

Scanned cookies summary Scanned : 0

Infected : 0

Remaining issues: Object Name Threat Name Final Status

C:\SwSetup\QPW\data2.cab=](IShield Module 2279) Gen:Trojan.Heur.GM.8000016020 Delete Failed (file was in an archive)

C:\SwSetup\QPW\data2.cab=](IShield Module 2290) Gen:Trojan.Heur.GM.8000016020 Delete Failed (file was in an archive)

C:\SwSetup\QPW\data2.cab=](IShield Module 2301) Gen:Trojan.Heur.GM.8000016020 Delete Failed (file was in an archive)

C:\SwSetup \QPW\data2.cab=](IShield Module 2303) Gen:Trojan.Heur.GM.8000036120 Delete Failed (file was in an archive)

Resolved issues: Object Name Threat Name Final Status

C:\Program Files\Online Services\Vonage\smb\Xtras\regxtra121.x32 Backdoor.Generic.89850 Deleted

Objects that were not scanned: Object Name Reason Final Status

I'm using an HP computer, but I don't quite understand what you need me to do and send to you, I will try but I'm not very advanced with these type things.

Thanks!

Hello js10053,

We managed to get an installation kit for QPW which seems to have the same detections as posted here. The file has been sent for analysis and as soon as I get the result I will post here.

So for the moment all we need is the answer to the question I posted above:

Cris.

Okay... I'm using the HP Pavilion dv9000t notebook with Windows Vista Home. I'm not sure how the software was downloaded from HP or Quickplay. I generally just get the updates when available from HP, but I'm not 100% sure where it came from.

Sorry I couldn't be of more help.

Hello Kate,

It's good that you pointed out that there are 2 files targeted. I didn't notice that (I thought there's just one CAB, with multiple detections).

I have a question: does anyone of you know what are those files exactly? As I found out, the folder C:\SWSetup is like a temporary folder used by HP installers to temporary unpack some files (installation kits, maybe drivers or other HP specific software). So those files should be clean. However, if the files are too big, I might need the whole installer so I can extract the detected files. Could you tell me if HP provides those applications for download on their site? And a link to those downloads?

Thank you.

Cris.

UPDATE:

I found out that the two products are actually HP QuickPlay for Windows and HP QuickPlay Direct. However, the software is quite large on the HP download site and the speed is very slow.

Please post you computer model and the OS you're using, if the software was downloaded from HP as a driver update, or the version of Quickplay that you use. This way, the files can be found and analyzed as soon as possible and a solution to this can be provided.

Thank you.

Chris - I have an HP dv9000z. I figured the files were for the QuickPlay stuff, but don't want to delete it if not necessary (I don't trust that I can reinstall the applications and HP already messed that up once when I returned the laptop for service and it was quite a hassle to get it working. I'll continue to read this post for what I need to do.

Thanks,

Kate

Right now I have a copy of data2.cab from HPQPDP 2.3.0.3111 (thanks to frmrswife) and QWP 3.0.

I can confirm that neither of them is detected anymore.

If anyone still has a problem, please post here the version of QuickPlay and Operating System.

EDIT:

Kate: There's no need to delete the files. They are clean.

Thank you everyone for reporting this.

Cris.

Hi, all. since 4/1/09 BD tells me repeatedly that an infected file is detected and cannot be removed. It is

gen:trojan.heur.VB.0453acecece in my folder: C:\Program Files\Evidence Eliminator\EE.exe The program runs ok, but the warning pops up 2 or 3 times a session.

any ideas?

Hello Cris can you help me pleaaaase

my system is Xp and is infected by Trojan.heur.Gm 100400082

her is my log file (the part concerned with the failed to delete files):

BitDefender Log File

Product : BitDefender Total Security 2009

Version : BitDefender UIScanner v.12

Scanning task : Deep System Scan

Log date : 6/12/2009 9:35:46 AM

Log path : C:\Documents and Settings\All Users\Application Data\Bitdefender\Desktop\Profiles\Logs\deep_scan\1244788546_1_02.xml

Scan Paths:Path 0000: C:\

Path 0001: \

Path 0002: E:\

Scan Options:Scan for viruses : Yes

Scan for adware : Yes

Scan for spyware : Yes

Scan for applications : Yes

Scan for dialers : Yes

Scan for rootkits : Yes

Target Selection Options:Scan registry keys : Yes

Scan cookies : Yes

Scan boot sectors : Yes

Scan memory processes : Yes

Scan archives : Yes

Scan runtime packers : Yes

Scan emails : No

Scan all files : Yes

Heuristic Scan : Yes

Scanned extensions :

Excluded extensions :

Target Processing:Default action for infected objects : Disinfect

Default action for suspicious objects : None

Default action for hidden objects : None

Default action for encrypted infected objects : None

Default action for encrypted suspicious objects : None

Default action for password-protected objects : Log as not scanned

Scan engines summaryNumber of virus signatures : 3347598

Archive plugins : 45

Email plugins : 6

Scan plugins : 13

System plugins : 5

Unpack plugins : 7

Overall scan summaryScanned items : 281140

Infected items : 34

Suspicious items : 0

Resolved items : 26

Unresolved items : 217

Password-protected items : 206

Overcompressed items : 3

Individual viruses found : 22

Scanned directories : 5633

Scanned boot sectors : 6

Scanned archives : 3281

Input-output errors : 25

Scan time : 01:12:33

Files per second : 64

Scanned processes summaryScanned : 29

Infected : 0

Scanned registry keys summaryScanned : 1001

Infected : 0

Scanned cookies summaryScanned : 23

Infected : 0

Remaining issues:Object Name Threat Name Final Status

C:\bdutils.dll.vcd Gen:Trojan.Heur.GM.1004000822 Delete Failed

C:\livesrv.exe.vcd Gen:Trojan.Heur.GM.1004000822 Delete Failed

C:\npcomm.dll.vcd Gen:Trojan.Heur.GM.1004000822 Delete Failed

C:\txmlutil.dll.vcd Gen:Trojan.Heur.GM.1004000822 Delete Failed

C:\wslib.dll.vcd Gen:Trojan.Heur.GM.1004000822 Delete Failed

C:\wspack.dll.vcd Gen:Trojan.Heur.GM.1004000822 Delete Failed

C:\wsutils.dll.vcd Gen:Trojan.Heur.GM.1004000822 Delete Failed

E:\new withphotoshop\VerbAce-Pro V. 0.88.rar=]VerbAce-Pro V. 0.88\Patch\verbace-pro.v.0.88-patch.exe Trojan.Generic.1674101 Delete Failed (file was in an archive)

please tell me Can I delete these files manually I'm afraid deleting them by myself would affect my system

BD can not take any action

many thanks for your help in advance

regards,

FDA

This file:

E:\new withphotoshop\VerbAce-Pro V. 0.88.rar

is missing from the archive you've uploaded. Please find this file and send it to me.

If you can't find the file, read here: http://forum.bitdefender.com/index.php?showtopic=3573

Further more, the bd_sys_log archive is corrupted (it's empty, to be more exact). Please make a new log with AVIS (as written in the topic) and re-upload the archive.

Cris.

I can not update my bitdefender since a long time

I tried many times, it wouldn't!

After looking in the AVIS log you sent, I found that you might have multiple infections in your system. Some of them, as far as I can remember, should already by detected by BitDefender. So please post the whole scanlog (including the section of "Resolved items").

Before proceeding, read (and apply) the steps presented here: How To Find Hidden Malware

After that, find these files:

c:\\windows\\ahnrpta.exe
c:\\windows\\system32\\e8main0.dll
c:\\windows\\system32\\olhrwef.exe
c:\\autorun.inf
c:\xdglur.bat
f:\akish.exe
c:\\windows\\system32\\ogaverify.exe
c:\\windows\\system32\\kb905474\\wgasetup.exe
c:\\windows\\system32\\nmdfgds0.dll
c:\\windows\\system32\\nmdfgds1.dll

All these files are currently present in your system. If you cannot find one (or more) of them, please tell me which one(s).

One side question: is your F drive a HDD drive, or a CD/DVD drive?

Pack all those files in an archive, with the password infected and upload the archive on a file-sharing service. Details about password-protected archives and archive uploading are in my signature.

After upload, send me the download link by PM.

I can not update my bitdefender since a long time

I tried many times, it wouldn't!

What error do you get exactly when you try to update BitDefender?

Cris.

I sent it to you Link3.

Ok, I got that log.

However, I would appreciate if you can find that particular scanlog, which you posted in your previous post.

To be exact, find this file and attach it to your next post:

C:\Documents and Settings\All Users\Application Data\Bitdefender\Desktop\Profiles\Logs\deep_scan\1244788546_1_02.xml

I need to see what that scan found in your system.

I applied these steps very well, the hidden files shown, however could'n't find some of the wanted files

When I go back to Tools>folder options..etc

I see the options are turned back as before as if I made no changes to them. though I'm sure I press (apply) then (OK).

It seems that the infection you have in your system is preventing you from changing that option. I will tell you how to deal with it below.

About the files you sent me:

c:\\windows\\ahnrpta.exe   - CLEAN
c:\\windows\\system32\\e8main0.dll   - INFECTED (already signed)
c:\\windows\\system32\\olhrwef.exe   - INFECTED (signed, pending update)
c:\\autorun.inf   - INFECTED (signed, pending update)
c:\xdglur.bat   - MISSING from archive
f:\akish.exe   - CLEAN
c:\\windows\\system32\\ogaverify.exe   - CLEAN
c:\\windows\\system32\\kb905474\\wgasetup.exe   - CLEAN
c:\\windows\\system32\\nmdfgds0.dll   - INFECTED (signed, pending update)
c:\\windows\\system32\\nmdfgds1.dll   - INFECTED (signed, pending update)

About your update problem, it might also be caused by the infection.

I will now describe some steps which you have to follow in order to disinfect your system. Normally, in a couple of hours, when the above signed files will enter BitDefender update, BitDefender should be able to clean your system. But because you cannot update it, you have to make a manual cleaning.

First of all, a very important thing: do NOT double click on drives in Windows Explorer. You have a type of malware which will re-infect your system everytime you double click a drive. In order to avoid this and still be able to access your drives, please use this method to access them:

• right click on the name of the drive you need to access
• choose Explore (or similar, since you have Windows in a non-English language)
• a new Windows Explorer window will open, showing the contents of that drive.

Step 1:

Go to http://www.gmer.net/ and download gmer. Scroll down on that page until you get to the Download section, then click the button Download EXE. It will download a file with a random name (which is normal) which you have to save somewhere.

After you downloaded it, run it. If you have BitDefender Behavioral module enabled, BitDefender will react to gmer. Please allow any actions related to this tool.

At start, gmer will make a quick scan of your system. If it asks you to do a complete scan, click No (we will get to that part later, if necessary).

After the Quick Scan is done, click on the tab with the text "> > >" (without "). Multiple tabs will appear there. Choose the Files tab. There you will find an Explorer-like interface, with files and folders, where you will be able to see all files in your system (regardless to the hidden-files option).

First of all, try to find this file, in the root of all drives:

xdglur.bat***

If you can find it, select it and click Copy. Choose a location to save the file, find it where you saved it, put it in an archive with a password and upload it (like you did with the rest of the files).

There, find these files:

c:\\windows\\system32\\e8main0.dll
c:\\windows\\system32\\olhrwef.exe
c:\\windows\\system32\\nmdfgds0.dll
c:\\windows\\system32\\nmdfgds1.dll
autorun.inf (in the root of all drives)
xdglur.bat*** (in the root of all drives)

select them, and click Delete.

After you have done this, please restart your system.

Step 2:

After restart, try again to update BitDefender. If it still doesn't work:

• generate a new AVIS log and send it to me (like you did before)
• in addition, open gmer again. After the quick scan is finished, select all checkboxes on the right side of the gmer window (on the Files list, you can select only the drive C) and click Scan. It will take a while to scan. When the scan is done, click Save, save the scan log and send it to me (like the other files).

Remeber: don't double click drives until we know that your system is clean.

Good luck.

Cris.

EDIT: The BAT file marked above with *** appears to have a random name. So instead of searching for that particular file, please search, in the root of all drives, all BAT files and send them to me. You have to look only in the root, not in the folders.

Hello FDA,

It seems that your infection goes a little deeper than I expected. As shown in the scanlog you sent me, BitDefender already detected and deleted multiple files with random names from your drives. However, as shown in the screenshot you attached (which was a very good idea, by the way ), there are still some suspect files there:

1f.bat
6phx.com
9dlvtiil.exe
b.com
fsaht.cmd
sm.exe

Find these files on all your drive roots and send them to me (like before).

Also, in case new files were generated, please send any file with a random name, with the extension cmd, bat, exe, com, dll from the roots of the drives.

Also, remember not to double click drives! (I keep repeating this, so you won't accidentally do it, cos you'll have to start over again).

Question: did you delete the autorun.inf files before you restarted your computer? If you did, please tell me if those file re-appeared after the system restart. If you didn't, please delete them and restart your system.

As for the rest of the files I asked now (these random-named files), don't delete them just yet. I need to get a confirmation from the analysis department first.

I will also ask about Zone.Identifier. As far as I know, that is harmless, it's normal to appear in some conditions and they aren't connected to an infection. But I have to double check this.

Also, use gmer to make a complete scan of your system, as I explained in my previous post, and send me the log. After you make a gmer log, please also make a new log with AVIS.

Cris.

I'm sorry to hear this.

Start your system and press F8 multiple times while it's starting (before it starts booting up Windows). You should get to the Boot Menu (that screen where you can select Safe Mode).

There should be an option to Disable Automatic restart on system failure. Choose that option and start your system normally. In case you get a Blue Screen of Death (BSOD), please note what it's said in that screen (mainly the error code, the STOP code and any files that are referenced). Post here that info.

Cris.

Hello FDA,

I'm sorry for the late reply (I've been extremely busy the last few days).

About the files you sent:

All following files are CLEAN:

       all files found in the folder FoundinWindowsFolder are clean (mostly legit system files)
       3DMaker.8bf
       AUTOEXEC.BAT (this is a system file)
       avpagecurl20d.exe
       bitdefender_tsecurity.exe
       bittotal.exe
       boot.ini (this is a system file)
       cleaner5demo.exe
       monkeyking_chinese_105.exe
       NTDETECT.COM (this is a system file)

The following file contains an adware (RelevantKnowledge):

spac2001.exe

The following files are infected:

1f.bat (detected as Trojan.PWS.OnLineGames.KCMS)
6phx.com (sent to labs)
9dlvtiil.exe (detected as Trojan.PWS.OnLineGames.KCMS)
b.com (sent to labs)
sm.exe (sent to labs)
sv8c2bjw.bat (detected as Trojan.PWS.OnLineGames.KCMW)
xdglur.bat (detected as Trojan.PWS.OnLineGames.KCNA)

The good news is that the logs you sent appear to be clean.

BitDefender didn't show any detections.

Gmer didn't detect anything suspicious.

AVIS shows that the processes are clean, there aren't any other autorun.inf files, no hidden processes/files.

Please delete the above files (the ones I said that are infected). Do NOT remove any files I marked as "system file" as deleting them might lead to system failure and failing to boot.

After you remove those files, please tell me if you have other problems.

Cris.

I am not sure if this is where I should inquire about this or not...

My BitDefender 2008 Antivirus has recently started finding numerous Trojan.heur.######## threats.

Several of them have been in old archived emails, but with a deep scan yesterday, I am also seeing them in C:\Windows\assembly\ directory tree.

All of these threats show up as "no action is possible".

I am not sure what to do...

Thanks in advance for any help.

Hello Soulsong ,

Please save the latest Deep System Scan log on your system , go to http://www.sendspace.com/ , upload it and then reply with the download link .

Thank you .

I did another Deep Scan and now no threats are being detected.

Is there any way that I can verify that BitDefender itself hasn't been infected/compromised to mask other viruses?

thanks,

jw

Hello Soulsong ,

Usually , if a BitDefender file or driver becomes infected , the program stops responding . That is why we usually ask our clients to run some diagnostic tools and send us back the resulting reports . If your system still acts as being infected , please let us know and we will further investigate this issue through the email .

Thank you .

Hi, i have a few computers that are infected.

Below is the log from one of the computer. I tried to quarantine the files and restart the computer and did another deep scanning and there are still 2 files being infected.

Is there anyway to remove virus so i will stop infecting other files? How can i be removed?

BitDefender Log File !!!!!

Product : BitDefender Internet Security 2008

Version : BitDefender UIScanner v.11

Log date : 15:52:42 07/07/2009

Log path : C:\ProgramData\BitDefender\Desktop\Profiles\Logs\deep_scan\1246953162_1_02.xml

Scan Paths:Path0000: C:\

Path0001: \

Scan Options:Scan for viruses : Yes

Scan for adware : Yes

Scan for spyware : Yes

Scan for applications : Yes

Scan for dialers : Yes

Scan for rootkits : Yes

Target selection options:Scan registry keys : Yes

Scan cookies : Yes

Scan boot sectors : Yes

Scan memory processes : Yes

Scan archives : Yes

Scan runtime packers : Yes

Scan emails : Yes

Scan all files : Yes

Heuristic Scan : Yes

Scanned extensions :

Excluded extensions :

Target ProcessingDefault action for infected objects : Disinfect

Default action for suspicious objects : None

Default action for hidden objects : None

Scan engines summaryNumber of virus signatures : 3654532

Archive plugins : 45

Email plugins : 6

Scan plugins : 13

Archive plugins : 45

System plugins : 5

Unpack plugins : 7

Overall scan summaryScanned items : 262048

Infected items : 6

Suspicious items : 0

Resolved items : 4

Individual viruses found : 2

Scanned directories : 20554

Scanned boot sectors : 3

Scanned archives : 9753

Input-output errors : 0

Scan time : 00:00:44:28

Files per second : 97

Scanned processes summaryScanned : 57

Infected : 0

Scanned registry keys summaryScanned : 945

Infected : 0

Scanned cookies summaryScanned : 10

Infected : 0

Remaining issues:Object Name Threat Name Final Status

C:\WINDOWS\System32\spool\drivers\w32x86\PCC\es3cx2.inf_f07d5554.cab=]eS3cx3.dll Gen:Trojan.Heur.Hype.114DB2B2B2 Delete Failed (file was in an archive)

C:\WINDOWS\System32\spool\drivers\w32x86\PCC\es3cp2.inf_f215c200.cab=]eS3cp3.dll Gen:Trojan.Heur.Hype.316D929292 Delete Failed (file was in an archive)

Resolved issues:Object Name Threat Name Final Status

C:\WINDOWS\System32\DriverStore\FileRepository\es3cx2.inf_f07d5554\eS3cx3.dll Gen:Trojan.Heur.Hype.114DB2B2B2 Moved to Quarantine

C:\WINDOWS\System32\spool\drivers\w32x86\3\eS3cx3.dll Gen:Trojan.Heur.Hype.114DB2B2B2 Moved to Quarantine

C:\WINDOWS\System32\DriverStore\FileRepository\es3cp2.inf_f215c200\eS3cp3.dll Gen:Trojan.Heur.Hype.316D929292 Moved to Quarantine

C:\WINDOWS\System32\spool\drivers\w32x86\3\eS3cp3.dll Gen:Trojan.Heur.Hype.316D929292 Moved to Quarantine

Objects that were not scanned:Object Name Reason Final Status

Hello mclarensquall ,

Please go to the next link:http://kb.bitdefender.com/KB490-br--The-sy...s-infected.html , run the Avis and the Gmer tools and after you obtain the reports , upload them here : http://sendspace.com/ and post here the download links.

Thank you .

Hello Hadi Darwiche ,

Unfortunately the BitDefender files that were detected as infected cannot be disinfected and that is why , as a first steps , we need to remove them . After that you will have to perform a repair in order to replace them . Here is what you have to do :

1. Open BitDefender and click on Switch to Advanced View . Select Antivirus then click on the Quarantine tab .

2. Select all the files that you will find there , right click on them and choose Delete .

3. Click on Start from Windows and choose All Programs and then choose BitDefender 2009 .

4. Select Repair or Remove , choose Next when the new window will appear and then choose Repair .

5. Reboot your computer when prompted and proceed with the repair process of BitDefender.

If you could not repair BitDefender following these steps , you can download the BitDefender installation kit from the next link:http://download.bitdefender.com/windows/de...ty_2009_32b.exe . After you do this , run it , click on Next on the first window that will be displayed and then choose Repair .

Thank you .

Hello Hadi Darwiche ,

Please try reinstalling BitDefender following the steps bellow :

1. Save and run first the uninstall tool from the next link and then reboot the PC:

http://www.bitdefender.com/uninstall

2. Download and install BitDefender from one of the following links :

BitDefender Antivirus 2009

http://download.bitdefender.com/windows/de...us_2009_32b.exe

BitDefender Internet Security 2009

http://download.bitdefender.com/windows/de...ty_2009_32b.exe

BitDefender Total Security 2009

http://download.bitdefender.com/windows/de...ty_2009_32b.exe

3. Register it with you license .

Please let us know what happened .

Thank you .