Executables in start-up list, located in temp folder

I ran Hijack-This this afternoon, which showed three files to be run
on start-up. These are:
ORKJB.exe;
AYFSVUOO.exe and;
FACRKCLMGRIN.exe

Hijack-This reports O23 (services), and in brackets (file missing).

The files are to be run from the folder:
"c:\documents and settings\[an Administrator account]\local settings
\temp"

Use Explorer to check the temp folder, nothing there.

Checked the component services, and there are four services (none
running) that all look suspect. In addition to the three above, there
is also another ("CYIPCTOOGEN.exe"), also in the temp directory.

I had AVG report a trojan dropper about a month ago. Related?

Cheers,
Timbo

macoovacany@hotmail.com

From: <>

| I ran Hijack-This this afternoon, which showed three files to be run
| on start-up. These are:
| ORKJB.exe;
| AYFSVUOO.exe and;
| FACRKCLMGRIN.exe
|
| Hijack-This reports O23 (services), and in brackets (file missing).
|
| The files are to be run from the folder:
| "c:\documents and settings\[an Administrator account]\local settings
| \temp"
|
| Use Explorer to check the temp folder, nothing there.
|
| Checked the component services, and there are four services (none
| running) that all look suspect. In addition to the three above, there
| is also another ("CYIPCTOOGEN.exe"), also in the temp directory.
|
| I had AVG report a trojan dropper about a month ago. Related?
|
| Cheers,
| Timbo

Your PC is infected and you are posting in the wrong place.


Create a HJT log file and post it in one of the below locations...

{ Please - Do NOT post the HJT Log here ! }

Forums where you can get expert advice for HiJack This! (HJT) logs.

NOTE: Registration is not required in the below before posting a log
http://www.thespykiller.co.uk/forum/?action=forum


NOTE: Registration is REQUIRED in any of the below before posting a log
http://www.bleepingcomputer.com/forums/forum22.html
http://castlecops.com/forum67.html
http://www.dslreports.com/forum/cleanup
http://www.cybertechhelp.com/forums/...splay.php?f=25
http://www.atribune.org/forums/index.php?showforum=9
http://www.geekstogo.com/forum/Malwa..._Here-f37.html
http://gladiator-antivirus.com/forum...?showforum=170
http://forum.networktechs.com/forumdisplay.php?f=130
http://forums.maddoktor2.com/index.php?showforum=17
http://www.spywarewarrior.com/viewforum.php?f=5
http://forums.spywareinfo.com/index.php?showforum=18
http://forums.techguy.org/f54-s.html
http://forums.tomcoyote.org/index.php?showforum=27
http://forums.subratam.org/index.php?showforum=7
http://www.5starsupport.com/ipboard/...p?showforum=18
http://www.malwarebytes.org/forums/i...hp?showforum=7
http://makephpbb.com/phpbb/viewforum.php?f=2
http://forums.techguy.org/54-security/
http://forums.security-central.us/forumdisplay.php?f=13


--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

David H. Lipman