Persistent threat warning (smss.exe)

Discussion in 'NOD32 version 2 Forum' started by Kenr, Jul 12, 2008.

Thread Status:
Not open for further replies.
  1. Kenr

    Kenr Registered Member

    Joined:
    Feb 3, 2008
    Posts:
    15
    For several days now I've been getting an AMON "Threat detected" warning every time I boot that says the following:

    File: C:\Windows\smss.exe

    Threat: Win32\Hupigon trojan

    Comment: Event occurred on a new file created by the application C:\Windows\driver.exe. The file was moved to quarantine. You may close this window.

    All of the buttons below the message are greyed out, suggesting there is no further action I can take. Why, then, does the message keep reappearing, and what do I have to do to clear up this situation? Interestingly, it all started after I ran a full scan, thinking that the ZoneAlarm problem that cropped up last week with the Windows update might have been caused by a virus (I found out the true cause later). The scan found some problems, and I believe the offending files were placed in quarantine. Could that be why I'm getting these messages?

    Ken
     
  2. ASpace

    ASpace Guest

    Download and run ESET SysInspector
    http://www.eset.com/download/sysinspector.php

    When the utility has collected the information , click File > Save Log
    Confirm your wish. A log file , placed in a zip archive , will be created.

    Send that archived file (+ C:\Windows\driver.exe) as attachments to ESET Threat Lab , samples@eset.com . Then , they'll guide you to a way to eliminate the threat and possibly recover the problems :thumb:

    Because the file called driver.exe keeps re-creating a malicious file smss.exe . Each and every time the malicious smss.exe is re-created , NOD32 pics it up .
     
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.