aretzj.exe -- reappearing unknown system file

From: Kevin Snively (kevinsnively_at_comcast.net)
Date: 05/27/05

  • Next message: Diego Kellner: "Re: Leaving a door open?" 
    To: <security-basics@securityfocus.com>
Date: Fri, 27 May 2005 11:27:59 -0500

    I've come across, on a client's machine, a reappearing / self propogating
    read only system file. The box is running a copy of XP pro fully patched.

    c:\windows\system32\aretzj.exe

    When Internet explorer is brought up this program (aretzj.exe) asks for
    internet access via ZoneAlarm. When deleted it reappears at bootup and even
    if the computer has not been restarted.

    I can not find any reference in Technet or any of the search engines. It is
    read only and when deleted the XP claims it is a system file. I tried about
    20+ search engines. One mentioned a Name an author of a book published in
    1935 - author ha'aretz (without the "j").

    What I have done to try and identify the source:

    1. looked for other "unknown" files inside of system32, including checking
    dates of files such as the KERNEL and KERNEL32 and looked for "suspicious"
    files. No results except aretzj.exe

    2. cleaned out the [prefetch] folder (no positive results)

    3. [Downloaded prgram files] is and was empty

    4. Checked c:\program files\internet explorer
    Looked for suspicous or unknown folders in common files.

    5 Spent an almost inordinate amoutn of time poking around in general looking
    for clues, identifying plugins, checking system and hidden folders to no
    avail.

    I am not sure what it is but as I renamed the file to a .txt extension and
    read through the "readable" portion of the binary file hoping for some hook
    on identifying it.

    At this point I am concerned as it is "unidentifable" the terminology inside
    the binary file might be construed with "data mining" and the client does
    run propriatary databases - Oh Yes, and I have checked with the vendor of
    the clients database software. They tell me nothing is stored on the PC nor
    is anything except a browser required to view the database.

    We are now using firefox but the unknown file continues to reappear. The
    only solution I have come up with is to wipe everything reinstall and
    restore actual data from a backup.

    Any help or suggestions will be greatly appreciated.
    Or has anyone run across this culprit?

    Sincerely,
    Kevin Snively

    The HelpDesk Inc ®
    kevin@thehelpdeskinc.com
    615-781-1922 (office)
    615-582-0877 (Mobile)

  • Next message: Diego Kellner: "Re: Leaving a door open?"
    • Quantcast