I am frequently getting an windows error popup saying some problem with nvukz.exe. The system hangs and the taskbar disappears. After some time the taskbar comes back. I am able to see two instances of nvukz.exe running in my task manager. I made a full system scan. But avast didn’t find anything. The error popup comes frequently when I browse. At msconfig, I removed nvukz.exe from startup. But however when I restart, the process comes back and the windows error popups… I am pretty much sure that this is a virus. Can someone help me getting rid of this.
Welcome
What is your operating system and Service Pack level?
Its a sign of Troj/Agent-LMN:
http://www.bleepingcomputer.com/startups/NVUKZ.exe-25249.html
windows xp service pack 3
Welcome to the forums, arunchristopher.
More information about … nvukz.exe … can be found at the below link. Use this link for information only.
http://www.prevx.com/filenames/1308989057159503911-X1/NVUKZ.EXE.html
Thanks Charley.
Should I use Prevx 3.0 to fix it?
Cant fix through avast?
You have to purchase Previx to fix it.
Please read:
http://www.sophos.com/security/analyses/viruses-and-spyware/trojagentlmn.html <== click on the More Information tab
Hi arunchristopher,
This is the way to do it:
Name: 9UmxQPSiTJMbA
File information
File name: NVUKZ.exe
File size: 88.04 KB (90157 bytes)
Md5: 1d6ce3f070a2a90f43fd68cef08e7187
Command: C:\Windows\System32\NVUKZ.exe
Description: Added by the Troj/Agent-LMN Trojan.
File Location: %System%
Startup Type: This startup entry is started automatically from a Run, RunOnce, RunServices, or RunServicesOnce entry in the registry.
HijackThis Category: O4 Entry
Note: %System% is a variable that refers to the Windows System folder.
By default this is C:\Windows\System for Windows 95/98/ME,
C:\Winnt\System32 for Windows NT/2000,
or C:\Windows\System32 for Windows XP and Vista.
Product information
Product name: Unknown
Company name: Unknown
Program name: Unknown
Loading point information
Execution type: REGISTRY
Registry section: HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Entry: zvb0dl2X8tt
Please make sure Teatimer is disabled before we do this, otherwise this fix will fail.
* Open HijackThis
* Choose "Do a system scan only"
* Check the boxes in front of these lines:
O4 - HKLM\..\Run: [zvb0dl2X8tt] C:\WINDOWS\system32\NVUKZ.exe
O4 - HKCU\..\Run: [9UmxQPSiTJMbA] C:\WINDOWS\system32\NVUKZ.exe
* Press "Fix Checked"
* Close Hijack This.
Please download and run this tool.
Download Malwarebytes’ Anti-Malware from Here http://www.malwarebytes.org/mbam/program/mbam-setup.exe
Double Click mbam-setup.exe to install the application.
* Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and
Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select "Perform Quick Scan", then click Scan.
* The scan may take some time to finish,so please be patient.
* When the scan is complete, click OK, then Show Results to view the results.
* Make sure that everything is checked, and click Remove Selected.
* When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.
(See Note)
* The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.
Post the contents of the MBAM Log,
polonus
Yokenny’s reply tells why I posted to use the link for information only.
Please follow Polonus’ above information and advice.
Run malware bytes and do a system scan
Hi all,
Sry for the late reply,
Thanks 4 all your suggestions,
polonus solution worked great and the virus has been removed now.
I am herewith attaching the mbam log file.
Once again thanks all…