Originally Posted by axeman88
Yea I did hijack this..
Logfile of HijackThis v1.98.1
Scan saved at 1:40:24 PM, on 11/21/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
C:\WINDOWS\Config\key.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
F:\download\progtools\freeram\FreeRAM XP Pro 1.40.exe
C:\Utopia\Angel\Angel.exe
C:\Program Files\ASUS\Probe\ASUSPROB.EXE
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\downloads\HijackThis.exe
O2 - BHO: CATLEvents Object - {02F96FB7-8AF6-439B-B7BA-2F952F9E4800} - C:\DOCUME~1\Robert\LOCALS~1\Temp\yek.dat
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: Pop-Up Stopper &Companion - {8F05B1A8-9D77-4B8F-AF54-6B2202066F95} - C:\Program Files\Panicware\Pop-Up Stopper Companion\popupus.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [*key] C:\WINDOWS\Config\key.exe
O4 - HKLM\..\Run: [DXDllRegExe] C:\WINDOWS\System32\dxdllreg.exe
O4 - HKLM\..\RunOnce: [*key] C:\WINDOWS\Config\key.exe rerun
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [FreeRAM XP] "F:\download\progtools\freeram\FreeRAM XP Pro 1.40.exe" -win
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Utopia Angel] "C:\Utopia\Angel\Angel.exe"
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Probe V2.19.07.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\MICROS~1\Office10\EXCEL.EXE/3000
As you can see the key. exe is in there. I removed it with hijackthis but it comes back. I ran spybot, AVG, Ad-Aware, Trend Vcleaner.. Nothing found with any of them. I found the location of all files. Yes I know which files in the log to remove.. Problem is they just come back. I posted this so you could see the files for yourself. ;)
c:\windows\config
has key.exe, yek.ini, yek1.bak & yek2.bak.
I can delete the .bak files. I can delete the ini file BUT it comes right back in 30 secs or less. the key.exe file you can not delete. In taskman you can try to stop the process but it just comes back.
C:\Documents and Settings\Robert\Local Settings\Temp
there is yek.dat
it won't let you delete it either.
Now I found the files with regedit & removed the keys with the key.exe in it as well as the yek.dat. BUT it keeps coming back!!
I've tried in safe mode as administrator & you can not stop the process there either. therefore you can not delete the key.exe file.. I'm pretty sure that key.exe is what is replacing it all. That or the yek.dat.. BUT as admin as was able to delete yek.dat.. SO I am almost positive it is the key.exe file that is replacing everything..
I tried finding info at several anti-virus company sites.. BUT they don't have anything listed under yek or key.exe
In fact this is the first place I have found..
Just for background purposes, I am a A+ Computer tech/ast.network admin. 18 yrs expeirence. I've removed every kind of bug, worm & virus known to the PC community.. this one has become a pain in my backside! So any ideas would be cool.. ;)
