GUAGUA.EXE - Dangerous
GUAGUA.EXE
Manual removal instructions:
Antivirus Report of GUAGUA.EXE:
guagua.exe
We suggest you to remove GUAGUA.EXE from your computer as soon as possible.
GUAGUA.EXE is known as: W32/Generic.worm!im [McAfee] Trojan-Downloader.Win32.VB [Ikarus].
MD5 of GUAGUA.EXE = 7B551A1FE0CECA3FAE529CF41861344E
GUAGUA.EXE size is 122880 bytes.
Full path on a computer: %TEMP%\GUAGUA.EXE
Related Files:
%COMMONDESKTOPDIR%\FUNSHION.LNK
%COMMONSTARTMENU%\FUNSHION.LNK
%COMMONPROGRAMS%\FUNSHION\FUNSHION USE HELP.LNK
%COMMONPROGRAMS%\FUNSHION\FUNSHION.LNK
%COMMONPROGRAMS%\FUNSHION\UNINSTALL FUNSHION.LNK
%COMMONPROGRAMS%\FUNSHION\UPDATE HISTORY.LNK
%COMMONPROGRAMS%\STARTUP\GUAGUA VIDEO COMMUNITY.LNK
%PROFILES%\DEFAULT USER\LOCAL SETTINGS\TEMP\TEMPPC.BIN
%DESKTOPDIR%\GUAGUA KPLAYER.LNK
%DESKTOPDIR%\GUAGUA VIDEO COMMUNITY.LNK
%USERPROFILE%\FUNSHION\CACHE\CACHEFLASH\BLANKFS.SWF
%USERPROFILE%\FUNSHION\CACHE\CACHEFLASH\DONGHUANEW_18.SWF
%USERPROFILE%\FUNSHION\INSTALL.INI
%USERPROFILE%\FUNSHION\UPDATE\POP GAME.LNK
%USERPROFILE%\FUNSHION\UPDATE\SHOPPING SITES.LNK
%USERPROFILE%\FUNSHION.INI
%TEMP%\FUNSHIONINSTALL.EXE
%PROGRAMFILES%\FUNSHION ONLINE\FUNSHION\GETMACADDRESS.DLL
%TEMP%\GUAGUA.EXE
%TEMP%\GUAGUA2011SETUP20110223_TG.EXE
%TEMP%\LOADER_FORQD508.EXE
%PROGRAMFILES%\FUNSHION ONLINE\FUNSHION\NICDESCR.DAT
%TEMP%\NSXB.TMP\NSISXML.DLL
%TEMP%\NSED.TMP\DEFCAMSETUP-ENGLISH.INI
%TEMP%\NSED.TMP\DEFCAMSETUP-SIMPCHINESE.INI
%TEMP%\NSED.TMP\DEFCAMSETUP-TRADCHINESE.INI
%TEMP%\NSR8.TMP\DEFCAMSETUP.DLL
%TEMP%\NSED.TMP\GGEXIT.EXE
%TEMP%\NSQ2.TMP\INETC.DLL
%TEMP%\SEEMAOS_SETUP_J704.EXE
%TEMP%\XYSETUP.EXE
%PROGRAMS%\GUAGUA VIDEO COMMUNITY\GUAGUA KPLAYER.LNK
%PROGRAMS%\GUAGUA VIDEO COMMUNITY\GUAGUA VIDEO COMMUNITY.LNK
%PROGRAMS%\GUAGUA VIDEO COMMUNITY\UNINSTALLGUAGUA VIDEO COMMUNITY.LNK
%PROGRAMS%\STARTUP\FUNSHION.LNK
C:\GHOS\GIEX
C:\MSOCACHE\MS0.DLL
%PROGRAMFILES%\BADU\GUAGUA\AUDIOCAPTURE.DLL
%PROGRAMFILES%\BADU\GUAGUA\AUDIOCODEC1.DLL
%PROGRAMFILES%\BADU\GUAGUA\AUDIOCODEC2.DLL
%PROGRAMFILES%\BADU\GUAGUA\AUDIOCODEC3.DLL
%PROGRAMFILES%\BADU\GUAGUA\CHATHALL.EXE
%PROGRAMFILES%\BADU\GUAGUA\CHATHALL.INI
%PROGRAMFILES%\BADU\GUAGUA\FNNCROOM\CHATROOMCLIENT.DLL
%PROGRAMFILES%\BADU\GUAGUA\CHATROOM\CHATROOMUI.DLL
%PROGRAMFILES%\BADU\GUAGUA\CHATROOM\CONFIG.INI
%PROGRAMFILES%\BADU\GUAGUA\FNNCROOM\DATA\FLOWERDATA.DAT
%PROGRAMFILES%\BADU\GUAGUA\CHATROOM\SKIN\2010BETA1CHATROOM.GGS
%PROGRAMFILES%\BADU\GUAGUA\CHATROOM\SKIN\THUMBS.DB
%PROGRAMFILES%\BADU\GUAGUA\CHATROOM\UITOOLTIP.DLL
%PROGRAMFILES%\BADU\GUAGUA\CHATROOM\VCRMEDIALIB.DLL
%PROGRAMFILES%\BADU\GUAGUA\CHATROOM\VOLUMECTRL.DLL
%PROGRAMFILES%\BADU\GUAGUA\CHATROOMUI.OCX
%PROGRAMFILES%\BADU\GUAGUA\DATA\COMMON.DAT
%PROGRAMFILES%\BADU\GUAGUA\DATA\HOSTLIST.DAT
%PROGRAMFILES%\BADU\GUAGUA\DATA\HPADR.DAT
%PROGRAMFILES%\BADU\GUAGUA\DATA\ILLWORD.DAT
%PROGRAMFILES%\BADU\GUAGUA\DATA\OEMCFGU.DAT
%PROGRAMFILES%\BADU\GUAGUA\DATA\SVRADDR000.DAT
%PROGRAMFILES%\BADU\GUAGUA\DATA\UPDATE.DAT
%PROGRAMFILES%\BADU\GUAGUA\DNSSESSION.DLL
%PROGRAMFILES%\BADU\GUAGUA\DOWNLOADER.EXE
%PROGRAMFILES%\BADU\GUAGUA\ENCWMV.DLL
%PROGRAMFILES%\BADU\GUAGUA\EQUIPCENTER.DLL
%PROGRAMFILES%\BADU\GUAGUA\FNNCROOM\CAPSCREEN.DLL
%PROGRAMFILES%\BADU\GUAGUA\FNNCROOM\CONFIG.INI
%PROGRAMFILES%\BADU\GUAGUA\FNNCROOM\ENCWMV.DLL
%PROGRAMFILES%\BADU\GUAGUA\FNNCROOM\FNNCMEDIALIB.DLL
%PROGRAMFILES%\BADU\GUAGUA\FNNCROOM\FNNCROOMCLIENT.DLL
%PROGRAMFILES%\BADU\GUAGUA\FNNCROOM\FNNCROOMUI.DLL
%PROGRAMFILES%\BADU\GUAGUA\FNNCROOM\SKIN\2010BETA2FNNCROOM.GGS
%PROGRAMFILES%\BADU\GUAGUA\FNNCROOM\SKIN\2010BETA2ROOMRADIOMGR.GGS
%PROGRAMFILES%\BADU\GUAGUA\FNNCROOM\UITOOLTIP.DLL
%PROGRAMFILES%\BADU\GUAGUA\FNNCROOM\VCRMEDIALIB.DLL
%PROGRAMFILES%\BADU\GUAGUA\FNNCROOM\VOLUMECTRL.DLL
%PROGRAMFILES%\BADU\GUAGUA\GAME\LANDLORD\AZIMUTHINFO.INI
%PROGRAMFILES%\BADU\GUAGUA\GAME\LANDLORD\BASS.DLL
%PROGRAMFILES%\BADU\GUAGUA\GAME\LANDLORD\CONFIG.INI
%PROGRAMFILES%\BADU\GUAGUA\GAME\LANDLORD\GAMECLIENTUI.EXE
| GUAGUA.EXE | W32/Generic.worm!im [McAfee] Trojan-Downloader.Win32.VB [Ikarus]. |
| GUAGUA.EXE | Dangerous |
| GUAGUA.EXE | High Risk |
GUAGUA.EXE is known as: W32/Generic.worm!im [McAfee] Trojan-Downloader.Win32.VB [Ikarus].
MD5 of GUAGUA.EXE = 7B551A1FE0CECA3FAE529CF41861344E
GUAGUA.EXE size is 122880 bytes.
Full path on a computer: %TEMP%\GUAGUA.EXE
Related Files:
%COMMONDESKTOPDIR%\FUNSHION.LNK
%COMMONSTARTMENU%\FUNSHION.LNK
%COMMONPROGRAMS%\FUNSHION\FUNSHION USE HELP.LNK
%COMMONPROGRAMS%\FUNSHION\FUNSHION.LNK
%COMMONPROGRAMS%\FUNSHION\UNINSTALL FUNSHION.LNK
%COMMONPROGRAMS%\FUNSHION\UPDATE HISTORY.LNK
%COMMONPROGRAMS%\STARTUP\GUAGUA VIDEO COMMUNITY.LNK
%PROFILES%\DEFAULT USER\LOCAL SETTINGS\TEMP\TEMPPC.BIN
%DESKTOPDIR%\GUAGUA KPLAYER.LNK
%DESKTOPDIR%\GUAGUA VIDEO COMMUNITY.LNK
%USERPROFILE%\FUNSHION\CACHE\CACHEFLASH\BLANKFS.SWF
%USERPROFILE%\FUNSHION\CACHE\CACHEFLASH\DONGHUANEW_18.SWF
%USERPROFILE%\FUNSHION\INSTALL.INI
%USERPROFILE%\FUNSHION\UPDATE\POP GAME.LNK
%USERPROFILE%\FUNSHION\UPDATE\SHOPPING SITES.LNK
%USERPROFILE%\FUNSHION.INI
%TEMP%\FUNSHIONINSTALL.EXE
%PROGRAMFILES%\FUNSHION ONLINE\FUNSHION\GETMACADDRESS.DLL
%TEMP%\GUAGUA.EXE
%TEMP%\GUAGUA2011SETUP20110223_TG.EXE
%TEMP%\LOADER_FORQD508.EXE
%PROGRAMFILES%\FUNSHION ONLINE\FUNSHION\NICDESCR.DAT
%TEMP%\NSXB.TMP\NSISXML.DLL
%TEMP%\NSED.TMP\DEFCAMSETUP-ENGLISH.INI
%TEMP%\NSED.TMP\DEFCAMSETUP-SIMPCHINESE.INI
%TEMP%\NSED.TMP\DEFCAMSETUP-TRADCHINESE.INI
%TEMP%\NSR8.TMP\DEFCAMSETUP.DLL
%TEMP%\NSED.TMP\GGEXIT.EXE
%TEMP%\NSQ2.TMP\INETC.DLL
%TEMP%\SEEMAOS_SETUP_J704.EXE
%TEMP%\XYSETUP.EXE
%PROGRAMS%\GUAGUA VIDEO COMMUNITY\GUAGUA KPLAYER.LNK
%PROGRAMS%\GUAGUA VIDEO COMMUNITY\GUAGUA VIDEO COMMUNITY.LNK
%PROGRAMS%\GUAGUA VIDEO COMMUNITY\UNINSTALLGUAGUA VIDEO COMMUNITY.LNK
%PROGRAMS%\STARTUP\FUNSHION.LNK
C:\GHOS\GIEX
C:\MSOCACHE\MS0.DLL
%PROGRAMFILES%\BADU\GUAGUA\AUDIOCAPTURE.DLL
%PROGRAMFILES%\BADU\GUAGUA\AUDIOCODEC1.DLL
%PROGRAMFILES%\BADU\GUAGUA\AUDIOCODEC2.DLL
%PROGRAMFILES%\BADU\GUAGUA\AUDIOCODEC3.DLL
%PROGRAMFILES%\BADU\GUAGUA\CHATHALL.EXE
%PROGRAMFILES%\BADU\GUAGUA\CHATHALL.INI
%PROGRAMFILES%\BADU\GUAGUA\FNNCROOM\CHATROOMCLIENT.DLL
%PROGRAMFILES%\BADU\GUAGUA\CHATROOM\CHATROOMUI.DLL
%PROGRAMFILES%\BADU\GUAGUA\CHATROOM\CONFIG.INI
%PROGRAMFILES%\BADU\GUAGUA\FNNCROOM\DATA\FLOWERDATA.DAT
%PROGRAMFILES%\BADU\GUAGUA\CHATROOM\SKIN\2010BETA1CHATROOM.GGS
%PROGRAMFILES%\BADU\GUAGUA\CHATROOM\SKIN\THUMBS.DB
%PROGRAMFILES%\BADU\GUAGUA\CHATROOM\UITOOLTIP.DLL
%PROGRAMFILES%\BADU\GUAGUA\CHATROOM\VCRMEDIALIB.DLL
%PROGRAMFILES%\BADU\GUAGUA\CHATROOM\VOLUMECTRL.DLL
%PROGRAMFILES%\BADU\GUAGUA\CHATROOMUI.OCX
%PROGRAMFILES%\BADU\GUAGUA\DATA\COMMON.DAT
%PROGRAMFILES%\BADU\GUAGUA\DATA\HOSTLIST.DAT
%PROGRAMFILES%\BADU\GUAGUA\DATA\HPADR.DAT
%PROGRAMFILES%\BADU\GUAGUA\DATA\ILLWORD.DAT
%PROGRAMFILES%\BADU\GUAGUA\DATA\OEMCFGU.DAT
%PROGRAMFILES%\BADU\GUAGUA\DATA\SVRADDR000.DAT
%PROGRAMFILES%\BADU\GUAGUA\DATA\UPDATE.DAT
%PROGRAMFILES%\BADU\GUAGUA\DNSSESSION.DLL
%PROGRAMFILES%\BADU\GUAGUA\DOWNLOADER.EXE
%PROGRAMFILES%\BADU\GUAGUA\ENCWMV.DLL
%PROGRAMFILES%\BADU\GUAGUA\EQUIPCENTER.DLL
%PROGRAMFILES%\BADU\GUAGUA\FNNCROOM\CAPSCREEN.DLL
%PROGRAMFILES%\BADU\GUAGUA\FNNCROOM\CONFIG.INI
%PROGRAMFILES%\BADU\GUAGUA\FNNCROOM\ENCWMV.DLL
%PROGRAMFILES%\BADU\GUAGUA\FNNCROOM\FNNCMEDIALIB.DLL
%PROGRAMFILES%\BADU\GUAGUA\FNNCROOM\FNNCROOMCLIENT.DLL
%PROGRAMFILES%\BADU\GUAGUA\FNNCROOM\FNNCROOMUI.DLL
%PROGRAMFILES%\BADU\GUAGUA\FNNCROOM\SKIN\2010BETA2FNNCROOM.GGS
%PROGRAMFILES%\BADU\GUAGUA\FNNCROOM\SKIN\2010BETA2ROOMRADIOMGR.GGS
%PROGRAMFILES%\BADU\GUAGUA\FNNCROOM\UITOOLTIP.DLL
%PROGRAMFILES%\BADU\GUAGUA\FNNCROOM\VCRMEDIALIB.DLL
%PROGRAMFILES%\BADU\GUAGUA\FNNCROOM\VOLUMECTRL.DLL
%PROGRAMFILES%\BADU\GUAGUA\GAME\LANDLORD\AZIMUTHINFO.INI
%PROGRAMFILES%\BADU\GUAGUA\GAME\LANDLORD\BASS.DLL
%PROGRAMFILES%\BADU\GUAGUA\GAME\LANDLORD\CONFIG.INI
%PROGRAMFILES%\BADU\GUAGUA\GAME\LANDLORD\GAMECLIENTUI.EXE
Dmitry Sokolov:
I created UnHackMe in 2006 to fix the problem that antivioruses did not fix: detecting rootkits.
Since that time I work every day to fix the issues that antiviruses cannot.
If your antivirus have not helped you solve the problem, you should try UnHackMe.
We are a small company and you can ask me directly, if you have any questions.