Author Topic: Win32:kuang2????  (Read 6767 times)

0 Members and 1 Guest are viewing this topic.

628748

  • Guest
Win32:kuang2????
« on: May 18, 2005, 12:12:22 PM »
 >:(  >:(  >:(  >:(  >:(  >:(  >:(  >:(  >:(  >:(  >:(  >:(  >:(  >:(  >:(  >:(  >:(  >:(  >:(  >:(  >:(  >:(  >:(  >:(

Hi,

I have got this Win32:kuang2 virus om my computer, but I can´t delete it, when I restart my computer a lot of popup windows appear with sex sites, and my desktoppic. is a man with at spiderman tattoo in his but crack... :-[

I can´t use any icon on my desktop, and the START button is not in the left corner, instead it is in his but crack....

Can anyone help me????

Martin (628748)
You are welcome to write to me at this email: lauren@sol.dk

Spyros

  • Guest
Re: Win32:kuang2????
« Reply #1 on: May 18, 2005, 12:22:15 PM »
Please read here --> http://forum.avast.com/index.php?topic=5373.0, follow the steps and give us the info it requests (windows version, hijackthis logfile, where is the virus found by avast etc)

628748

  • Guest
Re: Win32:kuang2????
« Reply #2 on: May 18, 2005, 01:27:44 PM »
- What WIN do you have ? Are all ServicePacks and Windowsupdates applied ? Please CHECK !!  I have Windows XP, MS Internet Explorer 6,0 and all windowsupdates and servicepacks are updated...

- What name does avast give the virus (e.g. like: "Win32:Netsky-P [Wrm]" )  ?
Win32:kuang2 and Win32:NGVCK-E and JS:Classloader-6

- Where exactly was the infected File found (full path/folder/filename, e.g. like c:\Windows\system32\virusfile.exe) ?
You'll get this info from the Alert/PopUp window or from avast's report/Log-files. If you can't start avast, look for the info in the logfiles in the avast (sub-)folders and
in the EventLog of Win XP / 2000: Controlpanel -> Administration -> Event-log

Sign of "Win32:Kuang2" has been found in "http://www.pandasoftware.com/ActiveScan/as5/motor.cab\imscan.dll" file. 


Sign of "Win32:Kuang2" has been found in "C:\System Volume Information\_restore{2962B5F5-CE85-47F2-9A89-08415DE3C955}\RP260\A0037576.COM\[UPX]" file. 

Sign of "Win32:Kuang2" has been found in "C:\Programmer\ACE Mega CoDecS Pack\Anti-Virus\Quick Remove\PAVCL.COM\[UPX]" file. 

Sign of "Win32:NGVCK-E" has been found in "C:\Programmer\ACE Mega CoDecS Pack\Anti-Virus\Quick Remove\PAV.SIG" file. 

Sign of "JS:Classloader-6" has been found in "C:\Documents and Settings\Martin\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv480.jar-3d101f41-3017222b.zip" file. 


I hope that is what you are asking for?

Martin

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67198
Re: Win32:kuang2????
« Reply #3 on: May 18, 2005, 01:34:31 PM »
These are false detections as per panda active scan: http://forum.avast.com/index.php?topic=12432.msg104932#msg104932

IMSCAN.DLL
PAVDLL.DLL
PAV.SIG
APVXD.VX2
APVXD.VXD

Quote
Every virus can be identified, because it contains some unique signatures. Antiviral programs have their own database of that signatures. We call this database the "virus definition file". When an antiviral program scans a file for viruses, it compares all the signatures (of all viruses) in the database with the signatures in that file. If the signatures match (they are the same), the file is marked as infected. For an antivirus program, it is important to hide this database of signatures somehow - e.g. by encrypting it. Panda Antivirus does not encrypt its virus database - the signatures inside are clearly "visible" to other antiviral programs, so they detect this file as infected (but there is actually no virus inside - only the signatures are the same).
The best things in life are free.

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88733
  • No support PMs thanks
Re: Win32:kuang2????
« Reply #4 on: May 18, 2005, 02:26:28 PM »
Quote
Sign of "JS:Classloader-6" has been found in "C:\Documents and Settings\Martin\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv480.jar-3d101f41-3017222b.zip" file. 

This is not a false positive, ensure that you are using the latest version of Sun's JAVA.

Cleare your browser cache and temporary files, including the JAVA cache.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.1.6099 (build 24.1.8821.762) UI 1.0.796/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security