Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

persistant trojan in registry- hijack this log enclosed [RESOLVED]


  • This topic is locked This topic is locked

#31
JSntgRvr

JSntgRvr

    Global Moderator

  • Global Moderator
  • 10,962 posts

Did you still want me to complete instructions in post 27?

Yes, please.

I wonder why there isn't a DllCache folder among these results.

Set Explorer to view Hidden Files and Folders:
  • Right-click your Start button and go to "Explore".
  • Select Tools from the menu
  • Select Folder Options
  • Select the View tab
  • Click on Show all Files and Folders
  • Remove the checkmark from Hide extensions for known file types
  • Remove the checkmark from Hide protected operating System files
  • Select Apply to All Folders | Yes | Apply | OK.

Click on My Computer and navigate to the C:\Windows\System32 folder. Is there a folder named DllCache within this folder?

I need to know also if you have the installation CD as we may need to load the Recovery Console.
  • 0

Advertisements


#32
JSntgRvr

JSntgRvr

    Global Moderator

  • Global Moderator
  • 10,962 posts
I don't believe you used the latest RunMe.bat file. That could be the reason.
  • 0

#33
desireejassel

desireejassel

    Member

  • Topic Starter
  • Member
  • PipPip
  • 43 posts
Just completed post 31 and yes there is a folder named DllCache

also i do not have a recovery disc.

Im off to do post 27

Edited by desireejassel, 22 April 2008 - 05:18 PM.

  • 0

#34
JSntgRvr

JSntgRvr

    Global Moderator

  • Global Moderator
  • 10,962 posts
Check Post 28 and post the report also.
  • 0

#35
desireejassel

desireejassel

    Member

  • Topic Starter
  • Member
  • PipPip
  • 43 posts
When trying to make the zip file i get this message


file zipped: C:\WINDOWS\explorer.exe -> catchme.zip -> explorer.exe ( 1034752 bytes )
file zipped: C:\WINDOWS\system32\lsass.exe -> catchme.zip -> lsass.exe ( 14848 bytes )
file zipped: C:\WINDOWS\system32\services.exe -> catchme.zip -> services.exe ( 110592 bytes )
file zipped: C:\WINDOWS\system32\svchost.exe -> catchme.zip -> svchost.exe ( 17408 bytes )
file zipped: C:\WINDOWS\system32\winlogon.exe -> catchme.zip -> winlogon.exe ( 506368 bytes )
read file error: C:\WINDOWS\system32\sqanaonnae.sys, The system cannot find the file specified.

Edited by desireejassel, 22 April 2008 - 05:30 PM.

  • 0

#36
JSntgRvr

JSntgRvr

    Global Moderator

  • Global Moderator
  • 10,962 posts

When trying to make the zip file i get this message


file zipped: C:\WINDOWS\explorer.exe -> catchme.zip -> explorer.exe ( 1034752 bytes )
file zipped: C:\WINDOWS\system32\lsass.exe -> catchme.zip -> lsass.exe ( 14848 bytes )
file zipped: C:\WINDOWS\system32\services.exe -> catchme.zip -> services.exe ( 110592 bytes )
file zipped: C:\WINDOWS\system32\svchost.exe -> catchme.zip -> svchost.exe ( 17408 bytes )
file zipped: C:\WINDOWS\system32\winlogon.exe -> catchme.zip -> winlogon.exe ( 506368 bytes )
read file error: C:\WINDOWS\system32\sqanaonnae.sys, The system cannot find the file specified.

That is Ok. It was expected. Upload the .zip created. See one post above.
  • 0

#37
desireejassel

desireejassel

    Member

  • Topic Starter
  • Member
  • PipPip
  • 43 posts
----a-w 1,034,752 2004-08-04 06:56:50 C:\WINDOWS\explorer.exe
-c----w 1,000,960 2001-08-18 12:00:00 C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
------w 1,032,192 2004-08-04 06:56:50 C:\WINDOWS\ServicePackFiles\i386\explorer.exe

Entries: 3 (3)
Directories: 0 Files: 3
Bytes: 3,067,904 Blocks: 5,992

----a-w 14,848 2004-08-04 06:56:52 C:\WINDOWS\system32\lsass.exe

Entries: 1 (1)
Directories: 0 Files: 1
Bytes: 14,848 Blocks: 29

----a-w 110,592 2004-08-04 06:56:56 C:\WINDOWS\system32\services.exe

Entries: 1 (1)
Directories: 0 Files: 1
Bytes: 110,592 Blocks: 216

----a-w 17,408 2008-04-13 12:18:42 C:\WINDOWS\system32\svchost.exe

Entries: 1 (1)
Directories: 0 Files: 1
Bytes: 17,408 Blocks: 34

----a-w 506,368 2004-08-04 06:56:58 C:\WINDOWS\system32\winlogon.exe

Entries: 1 (1)
Directories: 0 Files: 1
Bytes: 506,368 Blocks: 989

Total Entries: 7 (7)
Total Directories: 0 Files: 7
Total Bytes: 3,717,120 Blocks: 7,260
  • 0

#38
JSntgRvr

JSntgRvr

    Global Moderator

  • Global Moderator
  • 10,962 posts
No. The problem is that the file that you are running is the first file you downloaded from here. On post #28 I am asking you to remove those folders and replace them with a modified copy I included therein.

Once you do that, and run the modified RunMe.bat file, we will know what to do.
  • 0

#39
desireejassel

desireejassel

    Member

  • Topic Starter
  • Member
  • PipPip
  • 43 posts
log=AegisP Protocol (C:\WINDOWS\inf\AegisP.inf): Created.
log=AegisP Protocol (C:\WINDOWS\system32\drivers\AegisP.sys): Created.
log=AegisP Protocol (network component): Installed.
message=Driver install was successful
reboot=0
log=AegisP Protocol (device driver): Started - now running.
code=0

Edited by desireejassel, 22 April 2008 - 05:51 PM.

  • 0

#40
desireejassel

desireejassel

    Member

  • Topic Starter
  • Member
  • PipPip
  • 43 posts
did i do that correctly
  • 0

Advertisements


#41
JSntgRvr

JSntgRvr

    Global Moderator

  • Global Moderator
  • 10,962 posts
Nope! Lets try this again.

Download the enclosed folder. Save and extract its contents to the desktop. Once extracted, open the GetThem folder and doubleclick on the GetThem.bat file. The MSDOS window will be displayed for a while. That is normal.

Please post the contents of the report it shall produce.
  • 0

#42
desireejassel

desireejassel

    Member

  • Topic Starter
  • Member
  • PipPip
  • 43 posts
MDOS screen flips on for about a second and then I get an execute screen
Some files extracted from the getthem.zip were modified or new files were created.
Do you wish to put them to the archive? Yes or No


log=AegisP Protocol (C:\WINDOWS\inf\AegisP.inf): Created.
log=AegisP Protocol (C:\WINDOWS\system32\drivers\AegisP.sys): Created.
log=AegisP Protocol (network component): Installed.
message=Driver install was successful
reboot=0
log=AegisP Protocol (device driver): Started - now running.
code=0

Edited by desireejassel, 22 April 2008 - 06:34 PM.

  • 0

#43
JSntgRvr

JSntgRvr

    Global Moderator

  • Global Moderator
  • 10,962 posts
  • Copy the entire contents of the Quote Box below to Notepad.
  • Name the file as Find.bat
  • Change the Save as Type to All Files
  • and Save it on the desktop
  • Once saved, double click on the Find.bat file and post the report it should produce..

@ECHO OFF
If exist C:\Results.txt Del C:\Results.txt
Echo Working ..........
pushd C:\Windows
Dir /a /s explorer.exe >> C:\Results.txt
Dir /a /s lsass.exe >> C:\Results.txt
Dir /a /s services.exe >> C:\Results.txt
Dir /a /s svchost.exe >> C:\Results.txt
Dir /a /s winlogon.exe >> C:\Results.txt
popd
Notepad C:\Results.txt & Exit


  • 0

#44
desireejassel

desireejassel

    Member

  • Topic Starter
  • Member
  • PipPip
  • 43 posts
i see a MDOS screen pop up for a second and then nothing else happens
  • 0

#45
JSntgRvr

JSntgRvr

    Global Moderator

  • Global Moderator
  • 10,962 posts
I did some modifications to the batch file above, please retry the instructions and post back the report it shall produce. The report will be saved in the root directory, C:\ as Results.txt
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP