Win32:Kuang2 in C:\WINDOWS

[dakedee]

Hi, I have just installed AVs Home Edition and had it scan my harddrives. and it found Win32:Kuang2 something in many places which i deleted them all exept the one in C:\WINDOWS  that i ignored becoz i am not sure if i should delete the file. Anybody knows how to deal with this?

[Eddy]

To get help, give us more info please.

What file(s) is(are) it(they) exactly and what is the location?
What location is(are) it(they) in?
What windows version?
What version of Avast?
What vps version?

[dakedee]

What file(s) is(are) it(they) exactly and what is the location? > i can not remember the file name, but i can remember the virus name, it is Win32:Kaung2. the location was C:\WINDOWS\system32

What location is(are) it(they) in? > C:\WINDOWS\system32

What windows version? > XP servicepack 1

What version of Avast? > 4 Home editon

What vps version? > vps???

what can i do?

[Eddy]

Run a full system scan and delete everything that is detected as the Kuang virus. Alfter that, run HijackThis and post the log here.

[dakedee]

alright  

[whocares]

Hi,

KUANG-"Virus":
if the filename(s) are
imscan.dll
or pav.sig
it's probably a "false positive" in unencrytped files of PANDA(Online-)AV-Scanner

--> See link "VirusRemoval" below in my sig, or the FAQ on www.avast.com

to be sure, you could scan them online with Trend, RAV, KAV (see "VirusRemoval"; avast shield needs to be paused for this..

--> then there's no need to delete the files, just exclude them from scanning (see avast'S docu/help/FAQs)
 

[Eddy]

Here is the direct link to the Alwil page with the false positives about Panda av.

[dakedee]

thank u so much - those are really helpful. now i am scanning my systerm with Trenmicro's "Housecall".

[nip]

Re:  C:\Windows\system32\
Win32:Kuang2

About a week ago I carried out an online scan from Panda with ActiveScan, and I believe it left a false positive virus file.

O/S WinXP(Sp2); Avast Virus Scanner; ZoneAlarm; Adaware, Spybot, Spywareblaster.
All programs are up to date.

Yesterday I carried out a demand thorough scan with Avast, and it identified a “virus”.  As suggested I put it in the virus chest.

Virus:  Kuang2
File:  imscan.dll
Location:  C:\Windows\system32\ActiveScan

After reading your excellent write up on virus removal etc., as well as the forum(s) regarding Kuang, I came to the conclusion that I most probably had a “false positive virus” identification.  (by the way the link to further information on the Kuang subject in virus removal information did not work for me)

I then deleted the above virus from the virus chest, turned off system restore, rebooted, and turned system restore on again.  I then ran the Trend virus checker as well as Avast thorough system scan, and no virus was detected.

I guess my question is, should I be concerned about any passwords on my system?  And did I correctly take care of the problem. (I guess I’m in deep “doodoo” if I didn’t do it right!)

Thanks,  nip

[Eddy]

Isn't activescan part of Panda?
Have a look HERE

[nip]

Thanks very much for your reply.  And sorry for the bold in my post, I obviously did something incorrect, as this is my first post
Yes, I realize ActiveScan is a part of Panda, and that's the reason I got this so-called false positive.  I do not intend to use Panda as a further verification any more for the reasons given.  I could not find the information you linked me to before I posted.

Given all the information supplied then, I assume everything is OK with what I did to eradicate this from any further detection.  Am I correct in this??

Thanks again,
nip

[Lisandro]

I assume everything is OK with what I did to eradicate this from any further detection.  Am I correct in this??

Yes, you could delete that file...
I hate unencrypted signature files of Panda  

[nip]

Thanks again Tech!

nip