Hijack This Log

You can use this to see if they're malware. Example below.

Please go to http://virusscan.jotti.org , click on Browse, and upload the following file for analysis:

C:\WINDOWS\system32\dngxjcf.exe

Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see.


If Jotti is too busy you can try these.

http://www.kaspersky.com/scanforvirus.html


http://www.virustotal.com/en/indexf.html

I found out today that the igfxpers.exe is something to do with nvidia graphics.. I saw those files on another computer I was working on today. why can't I get rid of this carp**? Is this stuff coming from the new domain I got on?

igfxpers.exe <–is OK. What about the others? C:\WINDOWS\system32\dngxjcf_navps.dat C:\WINDOWS\system32\dngxjcf.dat C:\WINDOWS\system32\dngxjcf.exe C:\WINDOWS\system32\dngxjcf_nav.dat

I will check those out… I have to add a few more computers to the new domain tomorrow.. so Ill do a before and after check on their systems to see what turns out. It didn't even occur to me to check the other files..

OK

Those other files are good to go.. they seem to be on all the newer computers here. I'm flustered… I logged in as adminstrator locally and had no problems.. well I ran spybot and it found a few things, even that winantiviruspro 2007… got rid of it.. logged off, then back on as my user, checked spybot.. nothing showed up.. but I still get popups. Im at work right now but have to leave for about an hour here in a few minutes…

Download and install AVG Antirootkit
http://www.softpedia.com/get/Antivirus/AVG…i-Rootkit.shtml

• Install it, and follow the prompts to restart your computer.
• Run the program and select Perform in-depth search.
• When it has finished, click Save result to file
• Post the contents of the results in your reply.

Well.. it would only save as a .csv file, which I probably could just open and copy and paste.. but it only found 2 items: c:\windows\system32\drivers\SISAGPk.sys rootkit type: Hidden driver file c:\windows\system32\drivers\drmknt.sys rootkit type: Hidden driver fil

Lets see if we can rename them first and see what happens:

c:\windows\system32\drivers\SISAGPk.sys <–Rename to c:\windows\system32\drivers\SISAGPk.OLD
c:\windows\system32\drivers\drmknt.sys <–Rename to c:\windows\system32\drivers\drmknt.OLD

I don't see those two files… I even went into folder options and made sure i could see system files, and show hidden files.. I see similar files, but with the "k" in it..

• Reboot your pc first before running AVG Antirootkit Beta.
• After rebooting, run the AVG Anti-Rootkit Beta, click "Perform in-depth search." Allow AVG to complete the scan. The AVG scanner will give the "Rootkit path"
  [external image: Posted Image]
  [external image: Posted Image]
• Select the Rootkit Driver by placing a checkmark against it and click "Remove selected items." Next, agree for the terms and conditions that is displayed by AVG and click "OK" to reboot the PC.
• AVG Anti-Rootkit Beta renames the Mailbot.AZ Rootkit Driver so that the driver will not be loaded at the next reboot. But, it doesn't remove the actual Rootkit ADS and its Registry Entries. These can be removed by using ADS Spy.
• Download ADS Spy, a freeware which can be used to detect and remove ADS in NTFS systems. Extract ADS Spy to its own folder then, run ADS Spy. Select the "Full Scan (all NTFS drives)" and click "Scan the System for Alternate Data Streams." Once the scan is complete, select the what's from the scan result, and click "Remove selected streams"
  [external image: Posted Image]
• Close ADS Spy and ALL open Windows.

==========================
Open notepad. It must be notepad, not wordpad.
Copy and paste the text inside the code box below into notepad, including the blank line at the end.
Choose file save as and set file type to all files.

All it found was those 5 dngxjcf fies… All hidden in c:\windows\system32 It won't let me delete them, and I can't see them when I go in and manually try to find them and remove them. I don't see them in my process list either. I do not get popup windows as administrator on local machine, or as administrator logging into the domain. I still get popup windows, but not until I open a browser. I have to open a browser first.

4 or 5 files? These? C:\WINDOWS\system32\dngxjcf_navps.dat C:\WINDOWS\system32\dngxjcf.dat C:\WINDOWS\system32\dngxjcf.exe C:\WINDOWS\system32\dngxjcf_nav.dat

yes.. but there are 2 of the dngxjcf.exe in the same location..

I suspect those files but didn't you say those are on all the PC's?