NOD32: Downloading... ushisapi.dll

Anyone has any idea about this msg? it keeps showing and download seems to hang...

 

This is IMON scanning (set on Higher efficency) . An application is downloading this.

Open Control Center -> IMON -> Setup -> "HTTP" tab -> Client compatibility and make sure all applications are set on Higher compatibility



Confirm with OK and Hide the Control Center .


About your file udhisapi.dll , a Google search shows that there is a legitimate Microsoft file (UPnP) called udhisapi.dll , but also there is a malware udhisapi.dll . I suggest you perform search on your computer about such file(s) , check the digital signature and upload it/them on VirusTotal , just in case ...

 

The real udhisapi.dll should be 25,0 kBytes in size (and not 3,5 kBytes as shown in your screenshot) and should be located in your C:\WINDOWS\system32 folder. MD5 value of the file: 1a92ebc2e9166547cb699be6f33b4073 . I am going to guess you've been infected with a trojan downloader that your NOD32 doesn't detect, and it (the trojan downloader) keeps trying to download a seemingly "legit" Windows file.

I would suggest to run a scan with SUPERAntiSpyware, and if that doesn't help. Try posting a HijackThis log at one of the places where they accept this (not here), like for example Castle Cops forum. If you do find the infected files (the downloader and the file it tries to download), try submitting them to ESET. And if you're very very lucky, they might add detection for it.

 

If you suspect your computer being infected, just email support[at]eset.com and include a link to this thread so that we know the background information.

 

when u recieve a mail on outlook and u click the send/recieve button on outlook it starts to download the attac. in the e-mail and NOD32 monitor it

 

Did all troubleshooting as above but nothing helped, its really annoying...

 

Please follow the advice given by Marcos.

Cheers

 

I finally figured it out! WMP11 or IE7 was causing this problem. I installed the Windows XP without them and now problem seems to disappear.

 

Thanks for letting us know.

Cheers