Avast WEBforum

Other => Viruses and worms => Topic started by: ikunal15 on May 09, 2012, 08:20:46 AM

Title: Help win32:kukacka
Post by: ikunal15 on May 09, 2012, 08:20:46 AM

I am using avast internet security 7 [updated]. When i scan my whole computer, avast shows no virus found but when i open some old setups, avast detected "win32:kukacka" and avast delete my all setups[.exe files] saying these files are infected with "win32:kukacka". It always happens when i open any .exe file from same folder. I run full scan with avast but this problem does not solved. Please Help.

Title: Re: Help win32:kukacka
Post by: REDACTED on May 09, 2012, 09:02:01 AM

Quote from: ikunal15 on May 09, 2012, 08:20:46 AM

I am using avast internet security 7 [updated]. When i scan my whole computer, avast shows no virus found but when i open some old setups, avast detected "win32:kukacka" and avast delete my all setups[.exe files] saying these files are infected with "win32:kukacka". It always happens when i open any .exe file from same folder. I run full scan with avast but this problem does not solved. Please Help.

Good Day!

http://www.freedrweb.com/cureit/how_it_works/?lng=en

or

http://support.kaspersky.com/faq/?qid=208279889

Recover deleted files from quarantine Avast, and the scan tools scan the parties off Avast shields.

Title: Re: Help win32:kukacka
Post by: Pondus on May 09, 2012, 09:19:14 AM

you have a fileinfector infection....

i recomend you leave this to the forums removal experts

follow the guide here and attach (not copy and paste) the logs from malwarebytes / OTL / aswMBR
http://forum.avast.com/index.php?topic=53253.0


when done the removal experts will be notified

Title: Re: Help win32:kukacka
Post by: ikunal15 on May 10, 2012, 08:35:30 AM

Logs as you demanded

Title: Re: Help win32:kukacka
Post by: Maxx_original on May 10, 2012, 12:42:30 PM

Win32:Kukacka belongs to Sality family, which is generally hard to cure :-\

Title: Re: Help win32:kukacka
Post by: Pondus on May 10, 2012, 03:59:16 PM

essexboy is notified

Title: Re: Help win32:kukacka
Post by: essexboy on May 10, 2012, 07:14:10 PM

Quote

when i open some old setups, avast detected "win32:kukacka

Avast has probably saved you from the file infector

The relevant MD5's look good..  And there are no known sality files present

Quote

It always happens when i open any .exe file from same folder

. An indication here that the folder is infected... Is it a Torrent/P2P folder ?

Please download the following programmes to your desktop:

Dr Web Live CD (http://www.freedrweb.com/livecd/)

ImgBurn (http://www.filehippo.com/download_imgburn/)

Install IMGBurn

• Double click Dr Web
• IMGBurn will open
• Burn the ISO to a cd

• Reboot the infected computer with the CD in the drive
• Ensure that the first boot device is CD - If you are not sure about that then see this page (http://www.hiren.info/pages/bios-boot-cdrom) for instructions
  
• As loading starts, a dialogue window will prompt you to choose between the standard and safe modes.

(http://i1224.photobucket.com/albums/ee362/Essexboy3/Dr%20Web%20shots/livecdbootscreen.gif)

• Use arrow keys to select  DrWeb-LiveCD (Default)
• When the system is loaded, check the disks or folders you want to scan, and click on “Start”.

(http://i1224.photobucket.com/albums/ee362/Essexboy3/Dr%20Web%20shots/livecdDriveselection.gif)

• The programme will now scan for and cure/delete any malware that it finds.  Allow it to do so 
• Once completed reboot to normal windows
• No log is produced so once in normal windows run a fresh OTL scan and let me know if the problems persist

Title: Re: Help win32:kukacka
Post by: ikunal15 on May 11, 2012, 10:04:11 AM

According to my knowledge and research on google "win32:kukacka" is "win32:sality.ag". Last night i scaned my computer using "kaspersky sality killer". Sality killer detected "win32:sality.ag" in my same old .exe files in which avast is showing "win32:kukacka". After the scan all cured files by sality killer becomes corrupted but the good thing is now avast is not detecting win32:kukacka.

Title: Re: Help win32:kukacka
Post by: Pondus on May 11, 2012, 06:55:18 PM

Quote

No log is produced so once in normal windows run a fresh OTL scan and let me know if the problems persist

do you have a new OTL log?

Title: Re: Help win32:kukacka
Post by: ikunal15 on May 13, 2012, 12:49:32 PM

new OTL log

Title: Re: Help win32:kukacka
Post by: essexboy on May 13, 2012, 01:16:00 PM

Have you deleted the infected folder ?

Also did you set the Firefox and IE proxies ?

Title: Re: Help win32:kukacka
Post by: ikunal15 on May 13, 2012, 05:11:16 PM

No i don`t delete infected folders. there was many infected folders but after scanning with "sality killer" all infected programs become corrupted so i am going to delete them.
and yes i am using proxy in firefox and in IE.
whats the matter with using proxy in firefox and in IE??

Title: Re: Help win32:kukacka
Post by: essexboy on May 13, 2012, 05:13:30 PM

Nothing at all as long as you know what they are ..

Title: Re: Help win32:kukacka
Post by: ikunal15 on May 18, 2012, 11:50:12 AM

ok
i think problem is SOLVED  :)

Title: Re: Help win32:kukacka
Post by: essexboy on May 18, 2012, 09:02:52 PM

RUn OTL and hit the cleanup button to remove it.. Is all OK now ?

Title: Re: Help win32:kukacka
Post by: SlobodanIF on May 29, 2013, 11:29:15 AM

Best way to remove SalitiCode , Sality and Win32 Kukacka is Shedule boot time scaning from avast. If u dont have installed Avast yet on system, try to scan from other Parition or scan hard drive from another computer.

Title: Re: Help win32:kukacka
Post by: Pondus on May 29, 2013, 11:39:46 AM

@slobodan

you are posting in a topic that is 1 year old.   ::)