Evil File, KeyLogger?

[GIR]

This evil file appeared on my system (W2K) and it wont go away! it's named "tfyhhhh" ("H:\Documents and Settings\Administrator\Local Settings\Temp\tfyhhhh") I'm assuming this filename was randomly generated, it cannot be deleted, every time I log on, 24 bytes are added to it, to delete it I have to open up "Process Explorer" (www.sysinternals.com) and kill it, but the file reappears, task manager shows nothing, but in the registry a few evil keys keep appearing too:


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"*tfyhhhh"="rundll32 H:\\WINNT\\system32:tfyhhhh.dll,Init 1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"tfyhhhh"="rundll32 H:\\WINNT\\system32:tfyhhhh.dll,Init 1"


Deleting them does nothing, they reappear as soon as they are.
Registry Monitor (www.sysinternals.com) shows that it is Explorer that is creating the key. The file "tfyhhhh.dll" does not exist anywhere.

Ad-Aware & Spybot show nothing, does anyone have any idea as to what is up with this file?

[communist]

Somehow the file has been tagged as system file and gets replaced / restored when you delete it.
Run a Anti-Virus program to see if its a virus.

[TactX]

Have a look at your services. Some malware also registers itself as a service which could be the reason why the registry sttings come back each time.

Also check if this "tfyhhhh.dll" is stored in \system32\dllcache\ and delete it if it is there. The files in that directory are used to replace system files in case of an error.

[GIR]

communist, yep I did that too, tried AVG & McAfee, Nothing!
But it matters not, I have managed to neutralise the situation by killing the processes in Process Explorer that were writing the reg keys, file has not reappeared or the reg keys, possibly there is something EVIL still lurking about, might be some super stealth FBI keylogger, but I'm happy for now.

TactX, I have no dllcache, I thought that was a XP feature :confused:

[TactX]

dllcache is a hidden directory in system32. I'm 99.9% sure you have it, unless you have manually deleted it (which can be done without problems).

Is there any service that looks strange?

[GIR]

TactX, yep found it, the stupid directory was hidden even though I have "Show hidden files and folders" checked, not very logical... wait yes it is, this is a Microsoft OS every thing is normal :)

OK, now that file is nowhere to be found in dllcache.
I've had a look at the services that are running too, everything seems OK. Here is a Tab Delimited list of services running: Services (http://leo.customer.netspace.net.au/services.txt)

[TactX]

Your services look just fine. The only service I did'nt know was "AVG6 Service" which obviously belongs to your anti-virus program.

I'd say you're clean :)