"jjjfnaxm.dat" what the heck is that?

[kamo287]

Sony Laptop just started to work on. Got the computer to safe mode so far and i have taken care of plenty of laptops that have boot files missing and errors but NEVER with this "jjjfnaxm.dat"

did some searches and tried to find what it is and NOTHING... so im here - help? any ideas? anything would help me out.

the computer can boot in debug mode but not normal or safe- still doing some work on it and i will post updates in a bit

 

[kamo287]

WINDOWS\system32\drivers\jjjfnaxm.dat

 

[NYJimbo]

Your problem is that you are assuming that "jjjfnaxm.dat" is a normal file needed by the system.

What else do you think could be going on ?

 

[kamo287]

i have been schooled... or will be- i can load/access windows just fine through loop holes and different things but nothing i do has fixed the basic generic start-up. it still stops and freezes at this file. regular and safemode...

 

[kamo287]

because i can load windows perfectly through the hardware profile configuration i feel like this mystery file might be related to their docking station or something it is trying to do from their specific location.

sad that this client does not have any of their original CD's and i highly dislike sony -

all the hardware has tested just fine- the windows boot seems fine- i need to figure out how to disable this file or figure out where it's from -

anyone have any suggestions?

 

[14049752]

I'll be more direct than Jimbo.

It's a rootkit.

 

[kamo287]

hmm did some scans already and didnt pick up anything- ill do it again- thx

 

[MM PC Solutions]

I'll be more direct than Jimbo.

It's a rootkit.

That takes half the fun out of it though!

 

[iptech]

hmm did some scans already and didnt pick up anything- ill do it again- thx

You've already identified what the problem is, why keep running scanning software? It would be far better for you to use this experience to learn how to deal with the rootkit manually.

 

[iisjman07]

i have taken care of plenty of laptops that have boot files missing and errors but NEVER with this "jjjfnaxm.dat"

did some searches and tried to find what it is and NOTHING...

FYI - malware can generate a random file name which is why you didn't get any search results

 

[kamo287]

I took out the hard drive from the laptop and made it an external to one of my workstations.

Dug into the windows files- took ownership- deleted the jjjfnaxm.dat file. Re-ran some scans/tests from the workstation and found tons of malware and virus that did not show up before.

the hard drive is back in the laptop and it's working great.

 

[joydivision]

I know you don't have the original Sony CD but I don't think it matters. Slipstream a service pack which installed onto the Sony onto a Win XP installation CD and then run SFC.

This will check all the Windows files are original and have not been modified e.g by a rootkit.

The problem I find with manually deleting such files is any one of the Windows system files could be edited to reproduce the rootkit should it be deleted. Now of course you could check each system file manually to make sure they have not been edited but that could take for ever.

 

[maclaptech]

Yeh it seems like a rootkit to me too. I have good luck with ComboFix on those if it is not a VISTA machine.

 

[vdub12]

You've already identified what the problem is, why keep running scanning software? It would be far better for you to use this experience to learn how to deal with the rootkit manually.

I agree. I don't know why everyone is so dependent on scanning software. Scans take to long and if you have identified the problem just deal with it. Thats like calling the maid back over because you found a piece of paper on the ground, "just pick it up"

 

[Vicenarian]

Yeah, malware (e.g. rootkits) often generate random, or pseudo-random names (taking parts of names from software in your Program Files folder and merging them).

You can't rely on google alone

 

[Joines]

Yeah, malware (e.g. rootkits) often generate random, or pseudo-random names (taking parts of names from software in your Program Files folder and merging them).

You can't rely on google alone

..Someone watched Mark Russinovich's advanced malware removing video

I feel as if they are the exact words haha

 

[Vicenarian]

..Someone watched Mark Russinovich's advanced malware removing video

I feel as if they are the exact words haha

Haha yeah...I have watched that entire thing like 4 times, and not just watched, but taken notes and made an outline

That guy is awesome...I'm going to pick up his book on Windows Internals sometime soon.

 

[Elemdee]

Haha yeah...I have watched that entire thing like 4 times, and not just watched, but taken notes and made an outline

That guy is awesome...I'm going to pick up his book on Windows Internals sometime soon.

Yes it is a must-watch. Nothing motivates me more to want to create a honeypot and play around lol. For anyone who hasn't seen it, here is the link: http://www.microsoft.com/emea/spotlight/sessionh.aspx?videoid=359

 

[vdub12]

Yes it is a must-watch. Nothing motivates me more to want to create a honeypot and play around lol. For anyone who hasn't seen it, here is the link: http://www.microsoft.com/emea/spotlight/sessionh.aspx?videoid=359

I hate MS silverlight.

 

[dbdawn]

I tried to download that video, but could not figure out a way to save it to my hdd. So every time I want to watch it I have to re-stream it.