mad_hattah Posted September 27, 2006 Report Share Posted September 27, 2006 hi there,Does anyone know what the DLL file "igfnsi.dll" is for? It seems that it is loaded by the winlogon.exe and explorer.exe processes.The reason I am suspicious of the dll is that it was created only a few days ago, and I also have been getting popups and things recently.Cheers,mad_hattah Quote Link to comment Share on other sites More sharing options...
trackrat Posted September 27, 2006 Report Share Posted September 27, 2006 Are you sure the file is igfnsi or is it igfmsi ?. Quote Link to comment Share on other sites More sharing options...
mad_hattah Posted September 27, 2006 Author Report Share Posted September 27, 2006 It is definitely igfnsi. Quote Link to comment Share on other sites More sharing options...
trackrat Posted September 27, 2006 Report Share Posted September 27, 2006 You could send the file for a free scan to this URL.http://www.virustotal.com/en/indexf.html Quote Link to comment Share on other sites More sharing options...
mad_hattah Posted September 27, 2006 Author Report Share Posted September 27, 2006 Well it may be something bad.... but I'm not sure how to get rid of it, because when I unload the DLL (to be able to delete it) from winlogon.exe using Advanced Process Manipulation (from DiamondCS), the comp BSODed.Here is the VirusTotal report:STATUS: FINISHEDComplete scanning result of "igfnsi.dll", received in VirusTotal at 09.27.2006, 20:48:47 (CET).Antivirus Version Update Result AntiVir 7.2.0.18 09.27.2006 no virus found Authentium 4.93.8 09.27.2006 no virus found Avast 4.7.892.0 09.27.2006 no virus found AVG 386 09.27.2006 no virus found BitDefender 7.2 09.27.2006 no virus found CAT-QuickHeal 8.00 09.27.2006 no virus found ClamAV devel-20060426 09.27.2006 no virus found DrWeb 4.33 09.27.2006 no virus found eTrust-InoculateIT 23.73.6 09.27.2006 no virus found eTrust-Vet 30.3.3103 09.27.2006 no virus found Ewido 4.0 09.27.2006 no virus found Fortinet 2.82.0.0 09.27.2006 suspicious F-Prot 3.16f 09.27.2006 no virus found F-Prot4 4.2.1.29 09.27.2006 no virus found Ikarus 0.2.65.0 09.27.2006 no virus found Kaspersky 4.0.2.24 09.27.2006 Packed.Win32.Klone.k McAfee 4861 09.27.2006 no virus found Microsoft 1.1603 09.27.2006 no virus found NOD32v2 1.1780 09.27.2006 probably a variant of Win32/TrojanDownloader.ConHook.AA Norman 5.90.23 09.27.2006 no virus found Panda 9.0.0.4 09.27.2006 Suspicious file Symantec 8.0 09.27.2006 no virus found TheHacker 6.0.1.084 09.27.2006 no virus found UNA 1.83 09.27.2006 no virus found VBA32 3.11.1 09.27.2006 no virus found VirusBuster 4.3.7:9 09.27.2006 no virus found Aditional Information File size: 16934 bytes MD5: 009b37100863bd982649a73eac2469bd SHA1: 26608bd4d1c2a84d25a89f8428fa26bbdf177b75 packers: UPack Quote Link to comment Share on other sites More sharing options...
Scarecrow Man Posted September 27, 2006 Report Share Posted September 27, 2006 You should post a HijackThis log. One of our experts can help you decipher whether or not it is a baddie.See my signature for information. Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.