system
September 28, 2008, 8:05am
1
I use Avast 4.8 on WinXP Home.
I have a folder, “.kvkxcvkzdyz” (note the initial “dot”) in the following folder:
D:\Documents and Settings<user>
The folder contains a file: “.nynafyncgbc” (also with a “dot”). The date of both files is 5 days ago. The first few characters in the file are:
ÃC Ñ ×Ú/†ð¥6¢ E½¤»øZMäµèd¥M’ûã†$ÒjVäŠ@œs
There is no meaningful text in the file.
I ran Avast, Ad-Aware, and SpyBot. All fully up to date. None of these programs found anything.
I searched the registry for both of these values. Nothing.
A google search for the names found nothing.
Can I simply delete these files?
system
September 28, 2008, 8:18am
2
Welcome to the forums, OldGrantonian
Please download HijackThis from the link below. Do not download HJT to the desktop but instead download it into it’s own folder on the hard drive.
Run the program but do not make any fixes and then post the log results using the “copy & paste” method. It will probably take more than one post to be able to get the complete log posted.
OR, you can post it as an attachment to your post by clicking on “Additional Options…” below left of the posting box. Someone will review your log and then offer help.
http://filehippo.com/download_hijackthis/
system
September 28, 2008, 8:42am
3
Welcome to the forums, OldGrantonian
Please download HijackThis from the link below. Do not download HJT to the desktop but instead download it into it’s own folder on the hard drive.
Run the program but do not make any fixes and then post the log results using the “copy & paste” method. It will probably take more than one post to be able to get the complete log posted.
OR, you can post it as an attachment to your post by clicking on “Additional Options…” below left of the posting box. Someone will review your log and then offer help.
http://filehippo.com/download_hijackthis/
Before making my first post, as a temporary fix, I renamed the folder to: “kvkxcvkzdyz$”, hoping that any malicious program would not be able to find the file until I found out what it was.
I had to remove the dot first, because otherwise Windows said “You must type a filename”.
After your reply, I can remove the $ from the filename, but I cannot insert the dot at the front. Windows said “You must type a filename”.
So the folder name is now “kvkxcvkzdyz” (with no dot at the front).
Does it matter?
system
September 28, 2008, 9:10am
4
No, I do not think that will matter.
system
September 28, 2008, 9:17am
5
Thanks for your help. Here is the stuff from HijackThis.
Logfile of Trend Micro HijackThis v2.0.2
Running processes:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=74005 @xpsp3res.dll ,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exehttp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1182352671671 http://help.broadbandassist.com/bbdesktop/PreQual/files/MotivePreQual.cab
–
OldGrantonian, did you try the general cleaning procedures?
I suggest:
Clean your temporary files.
Schedule a boot time scanning with avast with archive scanning turned on. If avast does not detect it, you can try DrWeb CureIT! instead.
Use SUPERantispyware , MBAM or Spyware Terminator to scan for spywares and trojans. If any infection is detected, better and safer is send the file to Quarantine than to simple delete than.
Test your machine with anti-rootkit applications . I suggest avast! antirootkit or Trend Micro RootkitBuster .
Make a HijackThis log to post here or this analysis site . Or even submit the RunScanner log to to on-line analysis.
Disable System Restore and then reenable it again.
Immunize your system with SpywareBlaster or Windows Advanced Care .
Check if you have insecure applications with Secunia Software Inspector .
Nothing obvious in the log. Check with Secunia Software Inspector as Tech mentioned because I think your Java needs updating.
system
October 2, 2008, 7:23am
9
Schedule a boot time scanning with avast with archive scanning turned on. If avast does not detect it, you can try DrWeb CureIT! instead.
I followed the instructions for boot time scanning. I left the scan running overnight. In the morning, the Windows login screen was present.
There was no message about the results of the scan.
Does that mean that I’m OK? Or is there a log file to check somewhere?
Best regards.
system
October 2, 2008, 10:27am
10
Hi OldGrantonian
To check your log for your boot scan
1 Go to Programs Folder
Every Bootscan that you do avast will record it there.
Hope you can understand this as i am not the sharpest tool in the shed.
Cheers
system
October 2, 2008, 12:28pm
11
Thanks for the help. The final part of the log said:
Scan finished: 02 October 2008 01:59:01
So, that looks OK
