Trojan SwfDL.A detected by Bitdefender only (RESOLVED)

**Darryl** · 23-06-2006

Bitdefender keeps warning me that I have a trojan named trojan SwfDL.A and disinfection failed. I have scanned with ewido and ActiveScan but they do not detect it.

I have tried to delete the six infected files, but I cannot find them using the windows browser. I am also unable to delete them by going to the control panel, under internet options, and deleting the temporary files. I am posting a bitdefender report to show you where the files are supposed to be, along with a Hijack This file.

please advise.

Following is Bitdefender scan report
//-----------------------------------------------------------------
//
// Product: BitDefender 9 Professional Plus
// Version: 9.5
//
// Created on: 23/06/2006 14:23:10
//
//-----------------------------------------------------------------

Statistics

Scan path : C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files
Folders : 13
Files : 208
Archives : 10
Packed files : 1
Identified viruses : 1
Infected files : 6
Warnings : 0
Suspect files : 0
Disinfected files : 0
Deleted files : 6
Copied files : 0
Moved files : 0
Renamed files : 0
I/O errors : 0
Scan time : 00:00:52
Scan speed (files/sec) : 4

Spyware Statistics

Memory processes scanned : 21
Memory processes infected : 0
Registry keys scanned : 902
Registry keys infected : 0
Cookies scanned : 0
Cookies infected : 0
Spyware files infected : 0
Spyware threats detected : 0

Virus definitions : 415299
Scan plugins : 15
Archive plugins : 42
Unpack plugins : 5
Mail plugins : 6
System plugins : 5

Scan options

Detection
[X] Scan boot sectors
[X] Scan archives
[X] Scan packed files
[X] Scan email

File mask
[ ] Programs
[X] All files
[ ] User defined extensions:
[ ] Exclude extensions: ;

Action

Infected objects
[ ] Ignore
[X] Disinfect
[ ] Delete
[ ] Copy to quarantine
[ ] Move to quarantine
[ ] Rename
[ ] Prompt user

Second action
[ ] Ignore
[X] Delete
[ ] Copy to quarantine
[ ] Move to quarantine
[ ] Rename
[ ] Prompt user

Scan options
[X] Enable warnings
[X] Enable heuristics
[ ] Show all files in log
[X] Report file: C:\Program Files\Softwin\BitDefender9\Logs\vscan_1151090590.l og

Spyware scan options

[X] Memory Processes
[X] Registry keys
[X] Cookies

Summary:

C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\6RU9C3WT\sp2-cydoor-728[1].swf=>[SWF command] Infected: Trojan.SwfDL.A
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\6RU9C3WT\sp2-cydoor-728[1].swf=>[SWF command] Disinfection failed
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\6RU9C3WT\sp2-cydoor-728[1].swf=>[SWF command] Deleted
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\6RU9C3WT\sp2-cydoor-728[1].swf Update failed
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\8T634D6Z\sp2-cydoor-728[1].swf=>[SWF command] Infected: Trojan.SwfDL.A
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\8T634D6Z\sp2-cydoor-728[1].swf=>[SWF command] Disinfection failed
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\8T634D6Z\sp2-cydoor-728[1].swf=>[SWF command] Deleted
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\8T634D6Z\sp2-cydoor-728[1].swf Update failed
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\9SKNXDG5\sp2-cydoor-728[1].swf=>[SWF command] Infected: Trojan.SwfDL.A
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\9SKNXDG5\sp2-cydoor-728[1].swf=>[SWF command] Disinfection failed
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\9SKNXDG5\sp2-cydoor-728[1].swf=>[SWF command] Deleted
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\9SKNXDG5\sp2-cydoor-728[1].swf Update failed
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\M99Y32LS\sp2-cydoor-728[1].swf=>[SWF command] Infected: Trojan.SwfDL.A
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\M99Y32LS\sp2-cydoor-728[1].swf=>[SWF command] Disinfection failed
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\M99Y32LS\sp2-cydoor-728[1].swf=>[SWF command] Deleted
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\M99Y32LS\sp2-cydoor-728[1].swf Update failed
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\W9YZ09EF\sp2-cydoor-728[1].swf=>[SWF command] Infected: Trojan.SwfDL.A
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\W9YZ09EF\sp2-cydoor-728[1].swf=>[SWF command] Disinfection failed
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\W9YZ09EF\sp2-cydoor-728[1].swf=>[SWF command] Deleted
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\W9YZ09EF\sp2-cydoor-728[1].swf Update failed
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\WTUJQBW3\sp2-cydoor-728[1].swf=>[SWF command] Infected: Trojan.SwfDL.A
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\WTUJQBW3\sp2-cydoor-728[1].swf=>[SWF command] Disinfection failed
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\WTUJQBW3\sp2-cydoor-728[1].swf=>[SWF command] Deleted
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\WTUJQBW3\sp2-cydoor-728[1].swf Update failed

Here is my Hijack This log:
Logfile of HijackThis v1.99.1
Scan saved at 2:37:51 PM, on 6/23/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\slserv.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Softwin\BitDefender9\bdoesrv.exe
C:\progra~1\softwin\bitdef~1\bdnagent.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\lotus\organize\easyclip.exe
C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Citrix\ICA Client\pn.exe
C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE
C:\WINDOWS\msagent\AgentSvr.exe
C:\Program Files\Citrix\ICA Client\Wfcrun32.exe
C:\PROGRA~1\Citrix\ICACLI~1\WFICA32.EXE
C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Softwin\BitDefender9\vsserv.exe
c:\program files\softwin\bitdefender9\bdmcon.exe
C:\Program Files\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.scroogle.org/scrapen8.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [BDMCon] c:\progra~1\softwin\bitdef~1\bdmcon.exe
O4 - HKLM\..\Run: [BDOESRV] "C:\Program Files\Softwin\BitDefender9\bdoesrv.exe"
O4 - HKLM\..\Run: [BDNewsAgent] "c:\program files\softwin\bitdefender9\bdnagent.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [RegDoctor] C:\Program Files\RegDoctor\RegDoctor.exe -Quick
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Lotus Organizer EasyClip.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Subscribe to... - \feedscript.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/reso...an8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1133082041592
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1135393219166
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender9\vsserv.exe" /service (file missing)
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)

**VopThis** · 24-06-2006

All the entries noted by Bitdefender are in TEMPORARY FILES which are easily deleted in SAFE MODE.

To clean your temp folder, recycle bin, etc..please download this free tool:

CCleaner http://www.ccleaner.com/downloadbuilds.asp

Install Options:

[Don't install any Toolbars, or other programs, should it ask you!
Just uncheck the option of installing the Yahoo toolbar.

It will put a shortcut on your Desktop.
Boot into SAFE MODE by tapping the F8 key while re-booting (select SAFE MODE option).

Select the ‘Cleaner’ BUTTON option (top LEFT), if not already selected. Use the ’Windows’ TAB up front by default.

Uncheck ‘Cookies’ option (advisable)
Optionally, Uncheck ‘Recently Typed URLs’ option (potentially still useful)
Click the ‘Analyse’ button.
Thereafter, click ‘Run Cleaner’ after you have reviewed what it proposes to clean.

Re-run Bitdefender to see if all identified TROJAN items are no longer present.

**Darryl** · 24-06-2006

I have deleted Bitdefender, since no other AV program is detecting anything and installed AVAST, which says my computer is clean. Thanks for your response anyways.

Originally Posted by VopThis

All the entries noted by Bitdefender are in TEMPORARY FILES which are easily deleted in SAFE MODE.

To clean your temp folder, recycle bin, etc..please download this free tool:

CCleaner http://www.ccleaner.com/downloadbuilds.asp

Install Options:

[Don't install any Toolbars, or other programs, should it ask you!
Just uncheck the option of installing the Yahoo toolbar.

It will put a shortcut on your Desktop.
Boot into SAFE MODE by tapping the F8 key while re-booting (select SAFE MODE option).

Select the ‘Cleaner’ BUTTON option (top LEFT), if not already selected. Use the ’Windows’ TAB up front by default.

Uncheck ‘Cookies’ option (advisable)
Optionally, Uncheck ‘Recently Typed URLs’ option (potentially still useful)
Click the ‘Analyse’ button.
Thereafter, click ‘Run Cleaner’ after you have reviewed what it proposes to clean.

Re-run Bitdefender to see if all identified TROJAN items are no longer present.

**VopThis** · 25-06-2006

TEMPORARY files are often the very places where potential 'false positives' or actual TROJANS will turn up. Accordingly, it is always prudent to keep such areas clean of the garbage and clutter that accumulates in those places.

**Darryl** · 26-06-2006

I was able to run CCleaner in safe mode and it worked. Thanks for your help. By the way, this site was the only one of three help sites that was able to solve the problem.

Thanks again,

Darryl

**VopThis** · 26-06-2006

Good results for you. Thanks for the feedback and compliments.

To help avoid serious infection again, please look carefully at this post for some excellent preventative measures. Prevention must be made the first line of defense to improve upon.

ONLY ONCE you are as clean as possible from any needed cleanup steps - As a final cleanup step (after serious infection), it may be advisable to Reset and Re-enable your System Restore to remove any bad files that MAY have been backed up by Windows . The files in System Restore are protected to prevent any programs changing them. And, this is the only complete way to clean these files: (You will lose all previous restore points which could likely be infected, anyway.)

PLEASE NOTE: you will need to log into your computer with an account that has full administrator access. You will know if the account has administrator access because you will be able to see the System Restore tab. If the tab is missing, you are logged in under a limited account. Accordingly and of further note; it can be very unsafe to run with admin rights on any PC that you browse the Internet with.

(Windows XP)

FOLDER LOCATION: c:\System Volume Information\_restore….

To Turn OFF System Restore.

Click the Start button.
Right-click My Computer, and then click Properties.
On the System Restore tab, check Turn off System Restore or Turn off System Restore on all drives.
Click Apply.

REBOOT.

To Turn ON System Restore.

Follow the steps in the previous section, but in step 3, uncheck Turn off System Restore or Turn off System Restore on all drives. Then click OK.
Create new System Restore points.

(Windows ME)

FOLDER LOCATION: c:\_RESTORE\TEMP\….

See the following link for instructions:
http://service1.symantec.com/SUPPORT...rc=sec_doc_nam

To reduce the re-infection potential for malware and protect your PC against spyware, here are a few helpful suggestions:

Keep Windows and Internet Explorer current with the latest critical security updates from Microsoft . This will patch many of the security holes through which attackers can gain access to your computer . You CANNOT complete this update using an alternate browser – you must use Internet Explorer.
http://v5.windowsupdate.microsoft.com/v5co...t.aspx?ln=en-us
http://www.microsoft.com/windows/ie/default.asp
- http://www.securityfocus.com/news/11273
  If you surf to questionable (blockable) parts of the Web, you could encounter sites that compromise your PC without any user interaction. In experiments [reported Aug 2005], Microsoft identified 752 specific addresses owned by 287 Web sites that contain programs able to install themselves on a completely unpatched Windows XP system. Also, be aware that the WinXP Service Pack 2 was an update that focused almost exclusively on security. Also reported was that a fully patched Windows XP SP2 system cannot be compromised by any such discovered rogue Web sites.
Run your antivirus software regularly, and to keep its definitions up-to-date. If you are thinking about switching (using a real-time AV tool only one at a time), there are some good free Antivirus programs that are decent, including AVG and Avast!.
AVG: http://free.grisoft.com/doc/1
Avast: http://www.avast.com/eng/avast_4_home.html
In addition to using Ad-aware, consider using another free malware scanning/removal program :
Adaware SE: http://www.download.com/Ad-Aware-SE-Person...ubj=dl&tag=top5
Spybot S&D: http://www.download.com/Spybot-Search-Dest...tml?tag=lst-0-1
Microsoft Windows Defender beta 2 : http://www.download.com/Microsoft-Wi...ml?tag=lst-0-1
Consider using a free firewall if you are not already using one (use only one firewall at a time – normally you will need to disable the MS firewall). Some good free ones (for incoming and added outgoing traffic protection) are:
Kerio Personal Firewall: http://www.sunbelt-software.com/Kerio.cfm
*** After 30 days, Kerio shuts down selected features, but will continue to run in 'free' mode.
Zone Alarm: http://www.zonelabs.com/store/content/company/products/znalm/comparison.jsp?lid=ho_za

It is not a bad idea to also consider using a Router/Hardware firewall device where you have a High-Speed Internet access connection. A software firewall may occasionally need to be disabled or it gets/remains disabled by someone or something. Such an added layer of security consistency has a lot of merit to it.
Consider using an alternate free browser for general web surfing but you must use IE for windows updates. The use of Firefox (or similar alternate) mitigates the many types of malware that are now possible when using IE ActiveX based components.
Mozilla Firefox: http://www.mozilla.org/products/firefox/
Consider increasing your browser security by using these programs:
SpywareGuard will help protect your homepage from being hijacked: http://www.javacoolsoftware.com/spywareguard.html
SpywareBlaster will increase browser protection by blocking access to thousands of known malware sites by adding them to IE's restricted sites zone. It essentially blocks known- bad ActiveX program items from being installed or running on your computer. Download it here: http://www.javacoolsoftware.com/spywareblaster.html
- If you use SpywareBlaster, you can also use a customblocklist to add even more entries into IE restricted sites zone. Go to this site for the current list and how to use instructions: http://customblockinglist.cjb.net/
- IE-SPYAD is similar in that it adds thousands more known malware sites to IE's restricted zone. Download it here:
  http://www.spywarewarrior.com/uiuc/resource.htm
A HOSTS file can block Internet access to thousands of known-bad sites by not allowing you any easy browser access to such sites knowingly or unknowingly. Use HJT to determine if a current HOSTS file exists and any contents therein:
- Run the HiJackThis tool and select ‘Open the Misc Tools section’.
- Next select ‘Open host file manager’ button.
- Use the ‘Open in Notepad’ button in XP/W2K or use WORDPAD if necessary [type wordpad.exe in the RUN box (Start>Run)] and load the FILE PATH identified in HJT.
- Go to http://www.mvps.org/winhelp2002/hosts.txt . # Read the initial instructions #. Copy and paste (append or replace) the RELEVANT host address entry contents of that file into Notepad or Wordpad and save the updated file contents.
  
  EXCERPT:
  
  #start of lines added by WinHelp2002
  # [Misc A - Z]
  127.0.0.1 phpadsnew.abac.com
  127.0.0.1 a.abnad.net
  127.0.0.1 e.abnad.net
  127.0.0.1 www.accoona.com #[Adware-Accoona][Adware.Atoolb][Panda.Accoona]
  .
  .
  .
  #end of lines added by WinHelp2002

*Remember just like your primary anti-virus software, it is important to:
Keep all of these programs up-to-date (using auto-updates where possible), and

Use them on a regular (minimum weekly) basis.

REALITY CHECK:

Who else uses your PC? What are the potential risks created by multiple (potentially loose cannon) users and why?
What about bad luck, simple mistakes, and bad browsing choices (SEE: www.siteadvisor.com and their BLOG)?

ABOVE ALL, it is most imperative that users exercise "safe surfing" habits such as banning or at least verifying attachments (with scanning tools) before opening, and by not executing programs unless obtained from a trusted (or researched) source, etc.

Trojan SwfDL.A detected by Bitdefender only (RESOLVED)

Trojan SwfDL.A detected by Bitdefender only (RESOLVED)

Similar Threads

McAfee Detected Trojan

Virus not being detected by AntiVirus

Trojan SwfDL.A... HELP! :) (RESOLVED)

Trojan.Adclicker detected by Nortons when running Microsoft AntiSpyware (RESOLVED)

Trojan Horse detected on my PC. Cannot remove.