I have a relatively new Vista box (trying to find a weekend to upgrade to 7) that I've kept up to date with all windows updates. Running the firewall and MS's Security Essentials.

I was checking network traffic in Resource Overview and I have an entry for svchost sending data to the address of 'kuk'. I also have another svchost sending data to an address of my username. I assume/hope 'kuk' is some sort of system account? Googling it led to a few pages that referenced a virus but only in the context of there being some 'kuk.exe' file quarantined by virus scanning software.

Some more details from Resource Monitor:

Image:   svchost.exe (NetworkService)
PID:     1392
Address: kuk

Regarding the thought that it may be a trojan, I just ran a full scan with MS's security tools...nothing found. This machine isn't used heavily. It's mainly my dev machine. So I haven't been downloading random stuff. Any suggest additional scanning software for Vista (and/or 7?)

  • Upgrading to 7 will only take a few hours. Do it overnight. – Jim Deville Nov 18 '09 at 5:46
  • The network traffic will not show connections to accounts but to machines or devices. By the sound of things kuk isn't an account but the name of something on your network. What IP address is it and what ports is it trying to connect to? Is your pc name the same as your username? That would explain why the svchost was talking to it. – Sim Nov 18 '09 at 6:36
  • @Sim I'll update my post with some more details... – DA. Nov 18 '09 at 13:20
  • Thanks for the update SA. Your machine still thinks there is a device it is talking to called kuk. It would help if at a command prompt you could do a ping kuk or a nslookup kuk as that would help establish what the IP address of kuk is. – Sim Nov 19 '09 at 2:39

There is, apparently, a trojan named Kuk.

See: http://forums.cnet.com/5208-6132_102-0.html?threadID=353712&start=45


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.