The Notebook Review forums were hosted by TechTarget, who shut down them down on January 31, 2022. This static read-only archive was pulled by NBR forum users between January 20 and January 31, 2022, in an effort to make sure that the valuable technical information that had been posted on the forums is preserved. For current discussions, many NBR forum users moved over to NotebookTalk.net after the shutdown.
Problems? See this thread at archive.org.

    Virus: What is GILJABIUNIS.EXE ?

    Discussion in 'Security and Anti-Virus Software' started by c2ironfist, Jul 18, 2009.

  1. c2ironfist

    c2ironfist Notebook Consultant

    Reputations:
    47
    Messages:
    221
    Likes Received:
    0
    Trophy Points:
    30
    I have a question regarding GILJABIUNIS.EXE. I scanned with F-Secure online scanner
    and this file came up as a Virus located in

    C:\WINDOWS\SYSTEM32\GILJABIUNIS.EXE (Not cleaned)
    DeepScan:Generic.Malware.P!Pk!.B5EBE897 (virus)

    F-Secure wasn't able to clean it but when I rebooted in Safe mode with networking and scanned
    again with F-Secure online scanner the Virus was no longer there. The only thing left that always comes up is
    Trackingcookie.admt.

    I've did a number of scans so far

    F-Secure: Found the virus
    F-Secure Safe Mode: No Virus
    F-Secure: No Virus
    F-Secure Safe Mode: No Virus
    Windows Defender Full Scan Safe Mode: Nothing
    Bitdefender Safe Mode: Nothing
    ESET Online Scanner Safe Mode: Nothing
    F-Secure Safe Mode: Nothing again

    Now should I worry about the infection or am I potentially safe as of now?
     
  2. Rodster

    Rodster Merica

    Reputations:
    1,805
    Messages:
    5,043
    Likes Received:
    396
    Trophy Points:
    251
    I found this with a simple Google search. :)

    http://forums.techguy.org/malware-removal-hijackthis-logs/729054-trojan-packed-nsanti.html

    =======================================
    Please download the OTMoveIt2 by OldTimer.

    * Save it to your desktop.
    * Please double-click OTMoveIt2.exe to run it.
    * Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

    C:\WINDOWS\system32\amvo.exe
    C:\WINDOWS\system32\kvosoft.exe

    * Return to OTMoveIt2, right click on the "Paste List of Files/Folders to be moved" window and choose Paste.
    * Click the red Moveit! button.
    * OTMoveit2 will create a log of moved files in the C:\_OTMoveIt\MovedFiles folder. The log's name will appear as the date and time it was created, with the format mmddyyyy_hhmmss.log. Open this log in Notepad and post its contents in your next reply.
    * Close OTMoveIt2

    If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

    =========================================
    Run HijackThis, and press "Do a System Scan Only".
    1. When the scan is complete place a check mark next to the following entries:

    O4 - HKCU\..\Run: [amva] C:\WINDOWS\system32\amvo.exe
    O4 - HKCU\..\Run: [kvasoft] C:\WINDOWS\system32\kvosoft.exe

    2. After checking these items CLOSE ALL open windows EXCEPT HijackThis and click "Fix Checked." Then, reboot your computer...

    ==========================================

    Please download Malwarebytes Anti-Malware from Here or Here
    Double Click mbam-setup.exe to install the application.

    * Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes Anti-Malware, then click Finish.
    * If an update is found, it will download and install the latest version.
    * Once the program has loaded, select Perform Quick Scan, then click Scan.
    * The scan may take some time to finish,so please be patient.
    * When the scan is complete, click OK, then Show Results to view the results.
    * Make sure that everything is checked, and click Remove Selected.
    * When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
    * The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
    * Copy&Paste the entire report in your next reply.

    Extra Note:

    If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer, please do so immediately.
     
  3. Relativity17

    Relativity17 Notebook Evangelist

    Reputations:
    141
    Messages:
    387
    Likes Received:
    0
    Trophy Points:
    30
    If you're not running Vista x64 or Windows 7 x64, I'd say run a rootkit scan with Avenger (by Swandog) followed by a scan with Combofix. It is hard to say whether this is an independent infection, or just the payload of something else.
     
  4. c2ironfist

    c2ironfist Notebook Consultant

    Reputations:
    47
    Messages:
    221
    Likes Received:
    0
    Trophy Points:
    30
    I found that as well but the thing is is that I no longer am able to find the virus. I'm no sure if its cleaned or if its still there.

    I've done about 8 F-Secure scans and the virus no longer comes up