I have a question regarding GILJABIUNIS.EXE. I scanned with F-Secure online scanner
and this file came up as a Virus located in
C:\WINDOWS\SYSTEM32\GILJABIUNIS.EXE (Not cleaned)
DeepScan:Generic.Malware.P!Pk!.B5EBE897 (virus)
F-Secure wasn't able to clean it but when I rebooted in Safe mode with networking and scanned
again with F-Secure online scanner the Virus was no longer there. The only thing left that always comes up is
Trackingcookie.admt.
I've did a number of scans so far
F-Secure: Found the virus
F-Secure Safe Mode: No Virus
F-Secure: No Virus
F-Secure Safe Mode: No Virus
Windows Defender Full Scan Safe Mode: Nothing
Bitdefender Safe Mode: Nothing
ESET Online Scanner Safe Mode: Nothing
F-Secure Safe Mode: Nothing again
Now should I worry about the infection or am I potentially safe as of now?
-
-
I found this with a simple Google search.
http://forums.techguy.org/malware-removal-hijackthis-logs/729054-trojan-packed-nsanti.html
=======================================
Please download the OTMoveIt2 by OldTimer.
* Save it to your desktop.
* Please double-click OTMoveIt2.exe to run it.
* Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):
C:\WINDOWS\system32\amvo.exe
C:\WINDOWS\system32\kvosoft.exe
* Return to OTMoveIt2, right click on the "Paste List of Files/Folders to be moved" window and choose Paste.
* Click the red Moveit! button.
* OTMoveit2 will create a log of moved files in the C:\_OTMoveIt\MovedFiles folder. The log's name will appear as the date and time it was created, with the format mmddyyyy_hhmmss.log. Open this log in Notepad and post its contents in your next reply.
* Close OTMoveIt2
If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.
=========================================
Run HijackThis, and press "Do a System Scan Only".
1. When the scan is complete place a check mark next to the following entries:
O4 - HKCU\..\Run: [amva] C:\WINDOWS\system32\amvo.exe
O4 - HKCU\..\Run: [kvasoft] C:\WINDOWS\system32\kvosoft.exe
2. After checking these items CLOSE ALL open windows EXCEPT HijackThis and click "Fix Checked." Then, reboot your computer...
==========================================
Please download Malwarebytes Anti-Malware from Here or Here
Double Click mbam-setup.exe to install the application.
* Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform Quick Scan, then click Scan.
* The scan may take some time to finish,so please be patient.
* When the scan is complete, click OK, then Show Results to view the results.
* Make sure that everything is checked, and click Remove Selected.
* When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
* The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
* Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer, please do so immediately. -
If you're not running Vista x64 or Windows 7 x64, I'd say run a rootkit scan with Avenger (by Swandog) followed by a scan with Combofix. It is hard to say whether this is an independent infection, or just the payload of something else.
-
I found that as well but the thing is is that I no longer am able to find the virus. I'm no sure if its cleaned or if its still there.
I've done about 8 F-Secure scans and the virus no longer comes up
Virus: What is GILJABIUNIS.EXE ?
Discussion in 'Security and Anti-Virus Software' started by c2ironfist, Jul 18, 2009.