Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

ntnut.exe


  • Please log in to reply
2 replies to this topic

#1 xxboone69xx

xxboone69xx

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:02:32 AM

Posted 12 April 2005 - 09:03 PM

What does ntnut.exe run and why would it keep popping up saying it needs to be reinstalled?

BC AdBot (Login to Remove)

 


#2 jgweed

jgweed

  • Members
  • 28,473 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Chicago, Il.
  • Local time:01:32 AM

Posted 12 April 2005 - 09:29 PM

This exe file is associated with a trojan. I suggest you post a complete HiJackThis! log to the correct forum and have one of the BC volunteer experts look at it. Here are the instructions:


http://www.bleepingcomputer.com/forums/How...s_Log-t956.html

Regards,
John
Whereof one cannot speak, thereof one should be silent.

#3 twinsdad

twinsdad

  • Members
  • 411 posts
  • OFFLINE
  •  
  • Location:Northern California
  • Local time:01:32 AM

Posted 12 April 2005 - 09:34 PM

Google will give you a lot of hits on ntnut.exe. According to this site "it's a memory-resident Trojan that adds several adult-related sites to the
favorites folder of the Web browser. It also adds a folder called
ADULT STORE, which contains its dropped sites or URLs, to the
favorites folder.

In addition, it changes the home page of the Web browser into a
particular site. It also deletes specific files, such as NOTEPAD.COM
and SYSTIME.EXE, if they exist on a system.

An indication that the machine has been affected by this Trojan is the
presence of the following files in the Windows system folder:

NTNUT.EXE an exact copy of itself
SHDOCPE.DLL - contains the .HTML file, which is the assigned home page
of the browser
It runs on Windows 95, 98, ME, NT, 2000, and XP."

Unless someone else posts otherwise, I suggest you post a Hijack This log in the BC Hijack This Forum where the experts can help you remove the problem. A BC Tutorial on posting Hijack This logs can be found here.

Good luck.
"Love to eat them mousies, mousies what I like to eat; bite they little heads off, nibble on they tiny feet". B. Kliban




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users