NOD32: Downloading... ushisapi.dll

Discussion in 'NOD32 version 2 Forum' started by sam9879, May 5, 2007.

Thread Status:
Not open for further replies.
  1. sam9879

    sam9879 Registered Member

    Joined:
    Feb 25, 2007
    Posts:
    15
    Anyone has any idea about this msg? it keeps showing and download seems to hang...

    4u12slh.jpg
     
  2. ASpace

    ASpace Guest

    This is IMON scanning (set on Higher efficency) . An application is downloading this.

    Open Control Center -> IMON -> Setup -> "HTTP" tab -> Client compatibility and make sure all applications are set on Higher compatibility

    imoncompmode.png

    Confirm with OK and Hide the Control Center .


    About your file udhisapi.dll , a Google search shows that there is a legitimate Microsoft file (UPnP) called udhisapi.dll , but also there is a malware udhisapi.dll . I suggest you perform search on your computer about such file(s) , check the digital signature and upload it/them on VirusTotal , just in case ... ;)
     
  3. kjempen

    kjempen Registered Member

    Joined:
    May 6, 2004
    Posts:
    379
    The real udhisapi.dll should be 25,0 kBytes in size (and not 3,5 kBytes as shown in your screenshot) and should be located in your C:\WINDOWS\system32 folder. MD5 value of the file: 1a92ebc2e9166547cb699be6f33b4073 . I am going to guess you've been infected with a trojan downloader that your NOD32 doesn't detect, and it (the trojan downloader) keeps trying to download a seemingly "legit" Windows file.

    I would suggest to run a scan with SUPERAntiSpyware, and if that doesn't help. Try posting a HijackThis log at one of the places where they accept this (not here), like for example Castle Cops forum. If you do find the infected files (the downloader and the file it tries to download), try submitting them to ESET. And if you're very very lucky, they might add detection for it.
     
  4. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    If you suspect your computer being infected, just email support[at]eset.com and include a link to this thread so that we know the background information.
     
  5. jdo87

    jdo87 Registered Member

    Joined:
    May 6, 2007
    Posts:
    4
    when u recieve a mail on outlook and u click the send/recieve button on outlook it starts to download the attac. in the e-mail and NOD32 monitor it :)
     
  6. sam9879

    sam9879 Registered Member

    Joined:
    Feb 25, 2007
    Posts:
    15
    Did all troubleshooting as above but nothing helped, its really annoying...
     
  7. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
    Please follow the advice given by Marcos.

    Cheers :D
     
  8. sam9879

    sam9879 Registered Member

    Joined:
    Feb 25, 2007
    Posts:
    15
    I finally figured it out! WMP11 or IE7 was causing this problem. I installed the Windows XP without them and now problem seems to disappear.
     
  9. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
    Thanks for letting us know.

    Cheers :D
     
Thread Status:
Not open for further replies.