Persistent threat warning (smss.exe)

Discussion in 'NOD32 version 2 Forum' started by Kenr, Jul 12, 2008.

Thread Status:
Not open for further replies.
  1. Kenr

    Kenr Registered Member

    Joined:
    Feb 3, 2008
    Posts:
    15
    For several days now I've been getting an AMON "Threat detected" warning every time I boot that says the following:

    File: C:\Windows\smss.exe

    Threat: Win32\Hupigon trojan

    Comment: Event occurred on a new file created by the application C:\Windows\driver.exe. The file was moved to quarantine. You may close this window.

    All of the buttons below the message are greyed out, suggesting there is no further action I can take. Why, then, does the message keep reappearing, and what do I have to do to clear up this situation? Interestingly, it all started after I ran a full scan, thinking that the ZoneAlarm problem that cropped up last week with the Windows update might have been caused by a virus (I found out the true cause later). The scan found some problems, and I believe the offending files were placed in quarantine. Could that be why I'm getting these messages?

    Ken
     
  2. ASpace

    ASpace Guest

    Download and run ESET SysInspector
    http://www.eset.com/download/sysinspector.php

    When the utility has collected the information , click File > Save Log
    Confirm your wish. A log file , placed in a zip archive , will be created.

    Send that archived file (+ C:\Windows\driver.exe) as attachments to ESET Threat Lab , samples@eset.com . Then , they'll guide you to a way to eliminate the threat and possibly recover the problems :thumb:

    Because the file called driver.exe keeps re-creating a malicious file smss.exe . Each and every time the malicious smss.exe is re-created , NOD32 pics it up .
     
Thread Status:
Not open for further replies.