Gen:Trojan.Heur.A423DCE978

Hello CPS,

Please find this file:

C:\Program Files\unispim30.msi

put it in a password-protected archive, with the password infected, upload the archive on a file-sharing server and send me the download link by PM.

As for the detected file from System Volume Information, please read this topic: http://forum.bitdefender.com/index.php?showtopic=3575

Follow the steps presented there and post back if you can solve the problem.

Cris.

How do I put a file in a password-protected archive?

How to archive a file using a password

Is yousendit.com a file-sharing server that I can use?

Yes, it is.

Cris.

Please open Recycle Bin on your Desktop and restore the 3 files. Please DON'T permanently delete them. We need them for analysis.

Then find the one in Program Files, archive it and send it to me (as I said above).

Cris.

It seems to be somekind of Adware application (as far as I can tell).

You should be able to remove it from Add/Remove Programs in Windows Control Panel (the first and the last programs in this list):

The application is in Chinese (probably) and I couldn't read any of those characters. This screenshot is the much I can provide.

There is also an entry in StartMenu which might help you uninstall it.

Try to uninstall it, and see if the 3 files which are detected are removed. There should also be other components of this application that are detected by BitDefender.

The fact that the detection is named Application. means that it's not a high-risk threat. In this case, it's most likely just annoyance. If you don't really need this application, you should remove it from your system (and Add/Remove Programs would be the best approach, instead of just deleting a few files).

If you want, I can forward this application to the Analysis department, so one of BitDefender Virus Analysts can take a professional look at it. But my guess is that this detection is correct and my advice, as I said, is to remove this application if you don't really need it.

Cris.

Strangely, I cannot see either of the two programs you identified in my Add/Remove Programs window.

The first two files, located in C:\Documents and Settings\HP\Desktop\ (and in one of it's sub-folders) are part of the original installation kit. Those two you have to be manually removed.

About the third one, C:\Program Files\unispim30.msi... I double checked my results and it seems this file is not part of the installed application. It's just the installer. You will also have to remove it manually.

After you delete the files, also open Recycle Bin and empty it.

If you already tried to uninstall it in the past, chances are that you succeeded in removing it.

Just to double-check, this is a list of files generated by the installer:

- in C:\Windows\Downloaded Program Files:

• BDHelper.dll
• BDPlugin.dll (detected by BitDefende)
• BDSrHook.dll (detected by BitDefender)

- in C:\Windows\System32

• unispim.ime
• upengine.dll
• version_BDH

- in C:\Windows\System32\ime

• a folder called unispim which contains multiple files

Check for these files. If you find them, move them to a secure location (maybe in a password-protected archive). Reboot your system and then test a few days to see if any errors appear. If everything goes OK, you can permanently remove the files.

What about the password protected files that cannot be scanned? Are they important? I did try to extract them with IZArc but got errors every time. Any special trick to extract and get them scanned?

As I said above, if you don't know the password, you cannot open the archives. And since you didn't create those archives, you don't know the password.

Also, you don't need to worry about them, since they are archived and don't represent any threat to your system while they are archived.

All the identified objects that cannot be scanned are all Spybot related (My laptop has 4 and my PC has 55!). e.g. C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\BDHelper.zip=]sbRecovery.reg

In my PC, the spybot related files are all under drivers and include various file types (.exe .sys .inf .cat .cpl .ini)

You can probably remove those files by opening SpyBot and empty-ing all restore points or backups, and the quarantined files.

SpyBot, as well as all other security applications (even BitDefender) keep some backup data, or quarantined files. This happens in cas you want to restore anything that the application removed. It normal, and since we are talking here about trusted security applications, those files are secured and don't represent any threat. You don't have to open those archives to scan the files.

You can ignore those alerts.

Cris.