most recent 30 from superuser.com 2010-03-19T05:00:20Z http://superuser.com/feeds/question/71986 http://www.creativecommons.org/licenses/by-nc/2.5/rdf http://superuser.com/questions/71986/resource-monitor-showing-svchost-exe-connecting-to-kuk-legit-virus 1 DA http://superuser.com/users/11923 2009-11-18T05:21:21Z 2009-11-18T13:23:38Z

<p>I have a relatively new Vista box (trying to find a weekend to upgrade to 7) that I've kept up to date with all windows updates. Running the firewall and MS's Security Essentials. </p> <p>I was checking network traffic in Resource Overview and I have an entry for svchost sending data to the address of 'kuk'. I also have another svchost sending data to an address of my username. I assume/hope 'kuk' is some sort of system account? Googling it led to a few pages that referenced a virus but only in the context of there being some 'kuk.exe' file quarantined by virus scanning software. </p> <p>Some more details from Resource Monitor:</p> <pre><code>Image: svchost.exe (NetworkService) PID: 1392 Address: kuk </code></pre> <p>Regarding the thought that it may be a trojan, I just ran a full scan with MS's security tools...nothing found. This machine isn't used heavily. It's mainly my dev machine. So I haven't been downloading random stuff. Any suggest additional scanning software for Vista (and/or 7?) </p>

http://superuser.com/questions/71986/resource-monitor-showing-svchost-exe-connecting-to-kuk-legit-virus/72002#72002 2 briealeida http://superuser.com/users/16199 2009-11-18T06:42:23Z 2009-11-18T06:42:23Z

<p>There is, apparently, a trojan named Kuk.</p> <p>See: <a href="http://forums.cnet.com/5208-6132%5F102-0.html?threadID=353712&amp;start=45" rel="nofollow">http://forums.cnet.com/5208-6132%5F102-0.html?threadID=353712&amp;start=45</a></p> <p><a href="http://www.sophos.com/security/analyses/viruses-and-spyware/trojagentkuk.html?%5Flog%5Ffrom=rss" rel="nofollow">http://www.sophos.com/security/analyses/viruses-and-spyware/trojagentkuk.html?%5Flog%5Ffrom=rss</a></p>