Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

looks like a strange startup file


  • Please log in to reply
No replies to this topic

#1 rsimcox

rsimcox

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:05:37 AM

Posted 13 September 2010 - 04:06 AM

I noticed something today in my startup (maybe it's been there awhile) that I wanted a second opinion on. It was something called ijupibanov. It is nesting as a dll file (ijupibanov.dll0 and is being activated in startup at rundll32.exe "C:\WINDOWS\ijupibanov.dll",Startup
I checked regedit and it is under the name: Uwicudezenoc

If I unchecked it in msconfig/startup it came back on the next computer boot. the dll file itself had properties of the following:
ACELP-NET Voice Codec for Real Audio version 10.0.0.891 created 8/4/2004

I have windows XP Pro and the only thing new i installed that I recall is a new Canon printer. I didn't see this file in google so I renamed it while in safe mode and now it doesn't load anymore. So what the heck did I actually disable? Avira and antimalware says the dll file is ok but I'm not sure. I just don't recall seeing this loaded before. I did look at the code with a hex editor (which is gibberish to me) and at the end I see english words that say original file name SIPR.dll. Has anyone come across this before?

All seems to be running ok though I did have a virus a couple weeks ago (that darned one that starts a phony virus checker program that it says you need). I used avira and antimalware to remove it in safe mode and all has checked out ok since then.

Thanks for the help,
Randy

Edited by hamluis, 17 September 2010 - 07:14 AM.
Moved from XP forum to Am I Infected ~ Hamluis.


BC AdBot (Login to Remove)

 





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users