Help win32:kukacka

I am using avast internet security 7 [updated]. When i scan my whole computer, avast shows no virus found but when i open some old setups, avast detected “win32:kukacka” and avast delete my all setups[.exe files] saying these files are infected with “win32:kukacka”. It always happens when i open any .exe file from same folder. I run full scan with avast but this problem does not solved. Please Help.

Good Day!

http://www.freedrweb.com/cureit/how_it_works/?lng=en

or

http://support.kaspersky.com/faq/?qid=208279889

Recover deleted files from quarantine Avast, and the scan tools scan the parties off Avast shields.

you have a fileinfector infection…

i recomend you leave this to the forums removal experts

follow the guide here and attach (not copy and paste) the logs from malwarebytes / OTL / aswMBR
http://forum.avast.com/index.php?topic=53253.0

when done the removal experts will be notified

Logs as you demanded

Win32:Kukacka belongs to Sality family, which is generally hard to cure :-\

essexboy is notified

when i open some old setups, avast detected "win32:kukacka
Avast has probably saved you from the file infector

The relevant MD5’s look good… And there are no known sality files present

It always happens when i open any .exe file from same folder
. An indication here that the folder is infected... Is it a Torrent/P2P folder ?

Please download the following programmes to your desktop:

Dr Web Live CD

ImgBurn

Install IMGBurn

[]Double click Dr Web
[
]IMGBurn will open
[*]Burn the ISO to a cd

[]Reboot the infected computer with the CD in the drive
[
]Ensure that the first boot device is CD - If you are not sure about that then see this page for instructions
[*]As loading starts, a dialogue window will prompt you to choose between the standard and safe modes.

http://i1224.photobucket.com/albums/ee362/Essexboy3/Dr%20Web%20shots/livecdbootscreen.gif

[*]Use arrow keys to select DrWeb-LiveCD (Default)

[*]When the system is loaded, check the disks or folders you want to scan, and click on “Start”.

http://i1224.photobucket.com/albums/ee362/Essexboy3/Dr%20Web%20shots/livecdDriveselection.gif

[]The programme will now scan for and cure/delete any malware that it finds. Allow it to do so
[
]Once completed reboot to normal windows
[*]No log is produced so once in normal windows run a fresh OTL scan and let me know if the problems persist

According to my knowledge and research on google “win32:kukacka” is “win32:sality.ag”. Last night i scaned my computer using “kaspersky sality killer”. Sality killer detected “win32:sality.ag” in my same old .exe files in which avast is showing “win32:kukacka”. After the scan all cured files by sality killer becomes corrupted but the good thing is now avast is not detecting win32:kukacka.

No log is produced so once in normal windows run a fresh OTL scan and let me know if the problems persist
do you have a new OTL log?

new OTL log

Have you deleted the infected folder ?

Also did you set the Firefox and IE proxies ?

No i don`t delete infected folders. there was many infected folders but after scanning with “sality killer” all infected programs become corrupted so i am going to delete them.
and yes i am using proxy in firefox and in IE.
whats the matter with using proxy in firefox and in IE??

Nothing at all as long as you know what they are …

ok
i think problem is SOLVED :slight_smile:

RUn OTL and hit the cleanup button to remove it… Is all OK now ?

Best way to remove SalitiCode , Sality and Win32 Kukacka is Shedule boot time scaning from avast. If u dont have installed Avast yet on system, try to scan from other Parition or scan hard drive from another computer.

@slobodan

you are posting in a topic that is 1 year old. ::slight_smile: