nutvss.exe?

[Patty Deer]

I seem to have a problem with this exe, I can not stop the process and it it taken all of my resources. I have run about everyscan their is and still nothing has gotten rid of it. It seems to have taken over one of my hook.dll files, when I boot up it shows that it is missing.
Any ideas?

[puff-m-d]

Hi Patty Deer,

I tried a search for the exe you mentioned and came up with nada.....

If you have already tried "about every scan their is", I would suggest you post a HijackThis log. However I am afraid we no longer allow the posting of unsolicited HijackThis logs as per our Posting Policy stated in this Announcement (http://www.wilderssecurity.com/showthread.php?t=42148). You will find a link in the Announcement Post to several other sites that still do provide HijackThis log analysis service.

You may also click on the ASAP in my signature and it will take you to the ASAP page that lists sites that accept HijackThis log submissions.

Whichever site you decide to go to, please be sure and follow their posting policy before you post your HijackThis log.

[Patty Deer]

Thanks!
I will do that.

[puff-m-d]

{QUOTE-> Thanks!
I will do that. <-QUOTE}You are most welcome!!!

Let us know how things go ;) .....

[bigc73542]

I just did an extended search also and could't come up with a thing either.

bigc

[puff-m-d]

{QUOTE-> I just did an extended search also and couldn't come up with a thing either. <-QUOTE}It is possible that it may be a new baddie and that is why I suggested she go to an ASAP site and submit a HJT log. That way if it is something new, the expert will request a sample of the new bad guy.....

[bigc73542]

In the back of my mind I am thinking that is a norton utilities virusscan command but I could be wrong. but I have seen that somewhere before? I just can't remember where.

(edit) I just did a search on the symantec site and came up blank, wish I could remember where I saw that before?

[BlueZannetti]

It sounds too simplistic, but how about locating the image path, renaming the file and rebooting? Simple, but can work wonders under the right conditions. If you're not sure of the image path - download SysInternals Process Explorer (http://www.sysinternals.com/ntw2k/freeware/procexp.shtml) and under View>Select Columns make sure Image Path is checked.

Blue

[puff-m-d]

{QUOTE-> It sounds too simplistic, but how about locating the image path, renaming the file and rebooting? <-QUOTE}Good idea Blue ;) . Then of course if that solves the problem, she can wait and see if any of her programs start crying :'( out for that exe.

Another thing that would not hurt is to upload that exe to JOTTI's SITE (http://virusscan.jotti.dhs.org/) and see if anything is picked up on it there....

[dvk01]

It's almost certainly the vundo trojan

download & run http://securityresponse.symantec.com/avcenter/venc/data/trojan.vundo.removal.tool.html

post the log from that tool back here afterwards