|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
12-30-2007, 07:15 PM
|
#1 (permalink) |
|
Registered User
Join Date: Dec 2007
Posts: 10
OS: windows XP
|
McAfee -- Panda ActiveScan problems
I am new to the group and would appreciate any assistance. I joined because my PC has slowed considerably. It is often running at 100% when I am not doing anything.
On this site, I clicked the "first steps" of HAVING PROBLEMS WITH SPYWARE AND POP-UPS? and was following the steps. In step #2, when I try to load the Panda ActiveScan, my McAfee anti-virus keeps giving me all these warnings, saying it removed a trojan, displaying warnings that the site is suspect, and giving security errors. Any ideas? |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
12-31-2007, 03:16 PM
|
#2 (permalink) |
|
Registered User
Join Date: Dec 2007
Posts: 10
OS: windows XP
|
Re: McAfee -- Panda ActiveScan problems
Here is the hijackthis listing:
Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 4:50:54 PM, on 12/31/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe C:\WINDOWS\System32\CTsvcCDA.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe c:\program files\common files\mcafee\mna\mcnasvc.exe c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\Program Files\McAfee\MPF\MPFSrv.exe C:\Program Files\SiteAdvisor\6253\SAService.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\McAfee.com\Agent\mcagent.exe C:\WINDOWS\System32\hkcmd.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\Program Files\SiteAdvisor\6253\SiteAdv.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Dell\Media Experience\PCMService.exe C:\WINDOWS\BCMSMMSG.exe C:\Program Files\DellSupport\DSAgnt.exe C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.aestheticrealism.org/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file) O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll O2 - BHO: InternetExplorerAssistant - {86afcb62-7631-40ea-b519-5d9269b1a487} - mscoree.dll (file missing) O2 - BHO: (no name) - {92B6B0A3-7258-4AD7-ADAD-639D96820821} - C:\WINDOWS\system32\jkklm.dll O2 - BHO: {326f0c97-84b0-a10a-da64-d64efe9c940e} - {e049c9ef-e46d-46ad-a01a-0b4879c0f623} - C:\WINDOWS\system32\vvfulcyl.dll O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file) O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [diagent] "C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" startup O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6253\SiteAdv.exe O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [78c1d172] rundll32.exe "C:\WINDOWS\system32\hfafljgv.dll",b O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe" O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKUS\S-1-5-21-1894727586-60919236-2319664075-1008\..\Run: [Sonic RecordNow!] (User 'Pauline') O4 - HKUS\S-1-5-21-1894727586-60919236-2319664075-1008\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup (User 'Pauline') O4 - HKUS\S-1-5-21-1894727586-60919236-2319664075-1008\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'Pauline') O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1196054669390 O20 - AppInit_DLLs: c:\windows\system32\ldcore.dll O20 - Winlogon Notify: iifeecd - iifeecd.dll (file missing) O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\wicudbpa.exe (file missing) O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - C:\WINDOWS\system32\drivers\KodakCCS.exe (file missing) O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6253\SAService.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe O23 - Service: Windows Hosts Plugin - Unknown owner - C:\WINDOWS\system32\spoolcv.exe (file missing) -- End of file - 7199 bytes |
|
|
|
|
01-01-2008, 07:08 PM
|
#4 (permalink) |
|
Registered User
Join Date: Dec 2007
Posts: 10
OS: windows XP
|
Re: Problems with Spyware--Pleawe help--McAfee -- Panda ActiveScan problems
Ok--I got through the 5 recommended steps. The last one being running DSS. Below is the contents of main.txt; attached is extra.txt.
Deckard's System Scanner v20071014.68 Run by Joe on 2008-01-01 20:41:05 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 86: 2008-01-02 01:41:38 UTC - RP732 - Deckard's System Scanner Restore Point 85: 2008-01-02 00:47:33 UTC - RP731 - Software Distribution Service 3.0 84: 2008-01-01 21:11:37 UTC - RP730 - Deckard's System Scanner Restore Point 83: 2008-01-01 00:32:31 UTC - RP729 - System Checkpoint 82: 2007-12-30 23:56:53 UTC - RP728 - Removed Java 2 Runtime Environment, SE v1.4.2 -- First Restore Point -- 1: 2007-12-09 23:44:06 UTC - RP647 - System Checkpoint Backed up registry hives. Performed disk cleanup. Total Physical Memory: 254 MiB (512 MiB recommended). -- HijackThis (run as Joe.exe) ------------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 8:44:30 PM, on 1/1/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16574) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe C:\WINDOWS\System32\CTsvcCDA.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe c:\program files\common files\mcafee\mna\mcnasvc.exe c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\Program Files\McAfee\MPF\MPFSrv.exe C:\Program Files\SiteAdvisor\6253\SAService.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\PROGRA~1\McAfee.com\Agent\mcagent.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\wuauclt.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe C:\WINDOWS\System32\hkcmd.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\Program Files\SiteAdvisor\6253\SiteAdv.exe C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Dell\Media Experience\PCMService.exe C:\WINDOWS\BCMSMMSG.exe C:\Program Files\DellSupport\DSAgnt.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\taskmgr.exe C:\Documents and Settings\Joe\Local Settings\Temporary Internet Files\Content.IE5\FKP5FOSW\dss[1].exe C:\PROGRA~1\TRENDM~1\HIJACK~1\Joe.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.aestheticrealism.org/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file) O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: (no name) - {64428EB5-6A23-4A43-820C-A868C8C0D00B} - C:\WINDOWS\system32\jkklm.dll O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll O2 - BHO: InternetExplorerAssistant - {86afcb62-7631-40ea-b519-5d9269b1a487} - mscoree.dll (file missing) O2 - BHO: {326f0c97-84b0-a10a-da64-d64efe9c940e} - {e049c9ef-e46d-46ad-a01a-0b4879c0f623} - C:\WINDOWS\system32\vvfulcyl.dll O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file) O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [diagent] "C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" startup O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6253\SiteAdv.exe O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [78c1d172] rundll32.exe "C:\WINDOWS\system32\hfafljgv.dll",b O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe" O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1196054669390 O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O20 - AppInit_DLLs: c:\windows\system32\ldcore.dll O20 - Winlogon Notify: iifeecd - iifeecd.dll (file missing) O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\wicudbpa.exe (file missing) O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - C:\WINDOWS\system32\drivers\KodakCCS.exe (file missing) O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6253\SAService.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe O23 - Service: Windows Hosts Plugin - Unknown owner - C:\WINDOWS\system32\spoolcv.exe (file missing) -- End of file - 7677 bytes -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R1 omci (OMCI WDM Device Driver) - c:\windows\system32\drivers\omci.sys <Not Verified; Dell Computer Corporation; OMCI Driver> R3 DSproct - c:\program files\dellsupport\gtaction\triggers\dsproct.sys <Not Verified; Gteko Ltd.; processt> S2 LMIInfo (LogMeIn Kernel Information Provider) - c:\program files\logmein\x86\rainfo.sys (file missing) S3 iAimTV2 - c:\windows\system32\drivers\watv03nt.sys (file missing) -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 CCALib8 (Canon Camera Access Library 8) - c:\program files\canon\cal\calmain.exe <Not Verified; Canon Inc.; > S2 DomainService - c:\windows\system32\wicudbpa.exe /service (file missing) S2 Windows Hosts Plugin - "c:\windows\system32\spoolcv.exe" (file missing) S3 KodakCCS (Kodak Camera Connection Software) - c:\windows\system32\drivers\kodakccs.exe (file missing) -- Device Manager: Disabled ---------------------------------------------------- No disabled devices found. -- Scheduled Tasks ------------------------------------------------------------- 2007-12-30 19:57:32 484 --a------ C:\WINDOWS\Tasks\SpywareBot Scheduled Scan.job 2007-06-15 20:22:44 346 --a------ C:\WINDOWS\Tasks\McDefragTask.job 2007-06-15 20:22:42 348 --a------ C:\WINDOWS\Tasks\McQcTask.job -- Files created between 2007-12-01 and 2008-01-01 ----------------------------- 2008-01-01 20:07:14 0 d-------- C:\WINDOWS\network diagnostic 2008-01-01 16:23:36 686630 --a------ C:\Program Files\dss.exe 2008-01-01 15:48:42 0 d-------- C:\Program Files\ZonedOut 2008-01-01 15:47:06 0 d-------- C:\ie-spyad_zo 2008-01-01 15:42:40 315590 --a------ C:\Program Files\ie-spyad_zo.exe 2008-01-01 15:19:58 0 d-------- C:\Program Files\SpywareBlaster 2007-12-31 17:41:03 0 d-------- C:\WINDOWS\system32\ActiveScan 2007-12-31 16:47:28 0 d-------- C:\Program Files\Trend Micro 2007-12-31 13:47:25 90176 --a------ C:\WINDOWS\system32\hfafljgv.dll 2007-12-31 13:44:25 78912 --a------ C:\WINDOWS\system32\vvfulcyl.dll 2007-12-30 19:49:21 0 d-------- C:\Documents and Settings\Joe\Application Data\SpywareBot 2007-12-30 19:00:34 0 d-------- C:\WINDOWS\pss 2007-12-30 13:45:48 90176 --a------ C:\WINDOWS\system32\logedhbn.dll 2007-12-30 13:42:43 78400 --a------ C:\WINDOWS\system32\jmysnptg.dll 2007-12-29 13:02:36 78912 --a------ C:\WINDOWS\system32\fxiewkgg.dll 2007-12-27 14:27:29 81984 --a------ C:\WINDOWS\system32\cxwfyifg.dll 2007-12-25 10:49:42 78400 --a------ C:\WINDOWS\system32\yubtsgkm.dll 2007-12-22 16:09:55 78400 --a------ C:\WINDOWS\system32\xqixhtfu.dll 2007-12-16 21:18:11 0 d-------- C:\Documents and Settings\Joe\Application Data\iolo 2007-12-16 21:18:11 0 d-------- C:\Documents and Settings\All Users\Application Data\iolo 2007-12-16 19:22:30 0 d-------- C:\WINDOWS\system32\ineWc06 2007-12-16 12:12:33 85568 --a------ C:\WINDOWS\system32\flsvmlwi.dll 2007-12-13 18:17:30 85568 -----n--- C:\WINDOWS\system32\hvgmahwk.dll 2007-12-12 19:54:56 1501216 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2007-12-12 19:44:59 0 d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier 2007-12-12 19:43:49 11264 --a------ C:\WINDOWS\system32\SpOrder.dll <Not Verified; Microsoft Corporation; Microsoft(R) Windows NT(TM) Operating System> 2007-12-12 19:42:02 0 d-------- C:\WINDOWS\system32\ZoneLabs 2007-12-12 18:27:25 0 d-------- C:\Program Files\Internet Explorer Assistant 2007-12-12 18:13:49 85568 --a------ C:\WINDOWS\system32\dbbeldyt.dll 2007-12-09 18:57:44 0 d-------- C:\Documents and Settings\All Users\Application Data\Rabio 2007-12-09 18:43:55 10077 --ahs---- C:\WINDOWS\system32\mlkkj.ini2 2007-12-09 18:43:48 330848 --a------ C:\WINDOWS\system32\jkklm.dll 2007-12-09 18:38:11 0 d-------- C:\WINDOWS\system32\daSgo02 -- Find3M Report --------------------------------------------------------------- 2008-01-01 19:51:24 43038 --a------ C:\Documents and Settings\Joe\Application Data\wklnhst.dat 2008-01-01 15:44:11 240904 --a------ C:\Program Files\ZonedOut.zip 2007-12-31 18:49:01 0 d-------- C:\Program Files\QuickTime 2007-12-31 18:45:36 0 d-------- C:\Program Files\Messenger 2007-12-31 18:41:35 0 d-------- C:\Program Files\DellSupport 2007-12-30 19:20:49 0 d-------- C:\Program Files\McAfee 2007-12-30 18:57:47 0 d-------- C:\Program Files\Java 2007-12-30 18:55:26 0 d--h----- C:\Program Files\InstallShield Installation Information 2007-12-30 18:54:02 0 d-------- C:\Program Files\MUSICMATCH 2007-12-27 15:44:15 0 d-------- C:\Documents and Settings\Joe\Application Data\SiteAdvisor 2007-12-27 15:00:16 0 d-------- C:\Program Files\SiteAdvisor 2007-12-13 20:57:16 0 d-------- C:\Program Files\Common Files 2007-12-12 19:51:59 4212 --ah----- C:\WINDOWS\system32\zllictbl.dat 2007-12-06 11:25:54 0 d-------- C:\Program Files\Common Files\McAfee 2007-11-22 20:58:09 0 d-------- C:\Program Files\Common Files\Intuit -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{549B5CA7-4A86-11D7-A4DF-000874180BB3}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{64428EB5-6A23-4A43-820C-A868C8C0D00B}] 12/09/2007 06:43 PM 330848 --a------ C:\WINDOWS\system32\jkklm.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{86afcb62-7631-40ea-b519-5d9269b1a487}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e049c9ef-e46d-46ad-a01a-0b4879c0f623}] 12/31/2007 01:44 PM 78912 --a------ C:\WINDOWS\system32\vvfulcyl.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [04/07/2003 01:19 AM] "HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [04/07/2003 01:07 AM] "dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [08/06/2003 02:04 AM] "diagent"="C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" [04/03/2002 02:01 AM] "UpdReg"="C:\WINDOWS\UpdReg.EXE" [05/11/2000 02:00 AM] "SiteAdvisor"="C:\Program Files\SiteAdvisor\6253\SiteAdv.exe" [03/30/2007 10:42 AM] "mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [08/03/2007 10:33 PM] "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [09/06/2007 04:14 PM] "78c1d172"="C:\WINDOWS\system32\hfafljgv.dll" [12/31/2007 01:47 PM] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [03/11/2004 04:18 AM] "StorageGuard"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [02/13/2003 02:01 AM] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [08/05/2006 05:17 PM] "PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [08/26/2003 08:47 PM] "KernelFaultCheck"="C:\WINDOWS\system32\dumprep 0 -k" [] "BCMSMMSG"="BCMSMMSG.exe" [08/29/2003 04:59 AM C:\WINDOWS\BCMSMMSG.exe] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sonic RecordNow!"="" [] "DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [03/15/2007 11:09 AM] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [10/13/2004 11:24 AM] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 02:56 AM] C:\Documents and Settings\Joe\Start Menu\Programs\Startup\ DESKTOP.INI [9/3/2002 10:00:00 AM] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ DESKTOP.INI [9/3/2002 10:00:00 AM] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] @= [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\iifeecd] iifeecd.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit] LMIinit.dll 10/18/2007 08:47 PM 75064 C:\WINDOWS\SYSTEM32\LMIinit.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "appinit_dlls"= c:\windows\system32\ldcore.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 C:\WINDOWS\system32\jkklm.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" -- End of Deckard's System Scanner: finished at 2008-01-01 20:47:06 ------------ |
|
|
|
|
01-01-2008, 08:50 PM
|
#5 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,561
OS: 2000 Pro; XP Pro; XP Home
|
Re: McAfee -- Panda ActiveScan problems
Hello, and Welcome to TSF.
Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you.  Microsoft MVP - Consumer Security 2009
|
|
|
|
|
01-03-2008, 09:16 PM
|
#6 (permalink) |
|
Registered User
Join Date: Dec 2007
Posts: 10
OS: windows XP
|
Re: McAfee -- Panda ActiveScan problems
Hi--I have now subscribed to the thread--so I will respond quicker. Thanks for your response. I did what you asked.
Here is the Combo log and the HijackThis log. First the Combo log: ComboFix 08-01-04.1 - Joe 2008-01-03 22:25:37.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.67 [GMT -5:00] Running from: C:\Documents and Settings\Joe\Desktop\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Temp\bkR11 C:\Temp\tpBe12 C:\WINDOWS\cookies.ini C:\WINDOWS\hg173.exe C:\WINDOWS\SYSTEM32\avsnevok.ini C:\WINDOWS\SYSTEM32\brcmtejw.ini C:\WINDOWS\system32\cxwfyifg.dll C:\WINDOWS\system32\daSgo02 C:\WINDOWS\system32\dbbeldyt.dll C:\WINDOWS\system32\drivers\fad.sys C:\WINDOWS\system32\flsvmlwi.dll C:\WINDOWS\SYSTEM32\fndfvsli.ini C:\WINDOWS\system32\fxiewkgg.dll C:\WINDOWS\system32\hfafljgv.dll C:\WINDOWS\system32\hvgmahwk.dll C:\WINDOWS\SYSTEM32\icwxlfxv.ini C:\WINDOWS\system32\ilsvfdnf.dll C:\WINDOWS\SYSTEM32\iwlmvslf.ini C:\WINDOWS\system32\jkklm.dll C:\WINDOWS\system32\jmysnptg.dll C:\WINDOWS\SYSTEM32\kwhamgvh.ini C:\WINDOWS\system32\ldinfo.ldr C:\WINDOWS\system32\logedhbn.dll C:\WINDOWS\SYSTEM32\mlkkj.ini C:\WINDOWS\SYSTEM32\mlkkj.ini2 C:\WINDOWS\SYSTEM32\nbhdegol.ini C:\WINDOWS\system32\pac.txt C:\WINDOWS\SYSTEM32\tydlebbd.ini C:\WINDOWS\SYSTEM32\vgjlfafh.ini C:\WINDOWS\system32\vvfulcyl.dll C:\WINDOWS\system32\wbgnootw.dll C:\WINDOWS\system32\xqixhtfu.dll C:\WINDOWS\system32\yubtsgkm.dll C:\WINDOWS\uninst2.htm C:\WINDOWS\unist1.htm . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\LEGACY_DOMAINSERVICE -------\DomainService ((((((((((((((((((((((((( Files Created from 2007-12-04 to 2008-01-04 ))))))))))))))))))))))))))))))) . 2008-01-03 22:19 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe 2008-01-01 20:17 . 2007-10-10 18:55 459,264 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\msfeeds.dll 2008-01-01 20:17 . 2007-10-10 18:55 52,224 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\msfeedsbs.dll 2008-01-01 20:16 . 2007-10-10 18:55 6,065,664 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\ieframe.dll 2008-01-01 20:16 . 2007-06-30 22:31 2,455,488 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\ieapfltr.dat 2008-01-01 20:16 . 2007-06-30 22:36 991,232 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\ieframe.dll.mui 2008-01-01 20:16 . 2007-10-10 18:55 383,488 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\ieapfltr.dll 2008-01-01 20:16 . 2007-10-10 18:55 267,776 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\iertutil.dll 2008-01-01 20:16 . 2007-10-10 18:55 63,488 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\icardie.dll 2008-01-01 20:16 . 2007-10-10 05:59 13,824 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\ieudinit.exe 2008-01-01 20:07 . 2007-08-13 18:54 33,792 --a------ C:\WINDOWS\SYSTEM32\DLLCACHE\custsat.dll 2008-01-01 16:23 . 2008-01-01 16:23 686,630 --a------ C:\Program Files\dss.exe 2008-01-01 16:09 . 2008-01-01 16:09 <DIR> d-------- C:\Deckard 2008-01-01 15:48 . 2008-01-01 15:48 <DIR> d-------- C:\Program Files\ZonedOut 2008-01-01 15:47 . 2008-01-01 15:47 <DIR> d-------- C:\ie-spyad_zo 2008-01-01 15:44 . 2008-01-01 15:44 240,904 --a------ C:\Program Files\ZonedOut.zip 2008-01-01 15:42 . 2008-01-01 15:42 315,590 --a------ C:\Program Files\ie-spyad_zo.exe 2008-01-01 15:19 . 2008-01-01 15:37 <DIR> d-------- C:\Program Files\SpywareBlaster 2007-12-31 17:41 . 2007-12-31 19:09 <DIR> d-------- C:\WINDOWS\SYSTEM32\ActiveScan 2007-12-31 17:41 . 2007-12-31 17:41 30,590 --a------ C:\WINDOWS\SYSTEM32\pavas.ico 2007-12-31 17:41 . 2007-12-31 17:41 2,550 --a------ C:\WINDOWS\SYSTEM32\Uninstall.ico 2007-12-31 17:41 . 2007-12-31 17:41 1,406 --a------ C:\WINDOWS\SYSTEM32\Help.ico 2007-12-31 16:47 . 2007-12-31 16:47 <DIR> d-------- C:\Program Files\Trend Micro 2007-12-30 19:49 . 2007-12-30 19:58 <DIR> d-------- C:\Documents and Settings\Joe\Application Data\SpywareBot 2007-12-25 10:45 . 2008-01-03 22:45 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2007-12-25 10:45 . 2008-01-03 22:40 1,409 --a------ C:\WINDOWS\QTFont.for 2007-12-22 16:01 . 2007-12-25 10:44 1,315,955 --ahs---- C:\WINDOWS\SYSTEM32\yclsivnt.ini 2007-12-18 17:35 . 2007-12-22 16:00 414 --ahs---- C:\WINDOWS\SYSTEM32\xsnxgkac.ini 2007-12-16 21:18 . 2007-12-16 21:18 <DIR> d-------- C:\Documents and Settings\Joe\Application Data\iolo 2007-12-16 21:18 . 2007-12-16 21:18 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\iolo 2007-12-16 21:18 . 2007-12-16 21:18 406 --a------ C:\WINDOWS\SYSTEM32\ioloBootDefrag.cfg 2007-12-16 19:22 . 2007-12-16 19:22 <DIR> d-------- C:\WINDOWS\SYSTEM32\ineWc06 2007-12-12 19:54 . 2008-01-03 22:43 1,611,808 --ahs---- C:\WINDOWS\SYSTEM32\DRIVERS\fidbox.dat 2007-12-12 19:54 . 2008-01-03 22:43 19,940 --ahs---- C:\WINDOWS\SYSTEM32\DRIVERS\fidbox.idx 2007-12-12 19:44 . 2007-12-12 19:44 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier 2007-12-12 19:43 . 2007-09-06 16:14 75,248 --a------ C:\WINDOWS\zllsputility.exe 2007-12-12 19:43 . 2004-04-27 04:40 11,264 --a------ C:\WINDOWS\SYSTEM32\SpOrder.dll 2007-12-12 19:41 . 2008-01-03 22:44 353,247 --a------ C:\WINDOWS\SYSTEM32\vsconfig.xml 2007-12-12 18:27 . 2007-12-31 18:42 <DIR> d-------- C:\Program Files\Internet Explorer Assistant 2007-12-09 18:57 . 2007-12-09 18:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Rabio . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-01-04 03:05 43,178 ----a-w C:\Documents and Settings\Joe\Application Data\wklnhst.dat 2007-12-31 23:49 --------- d-----w C:\Program Files\QuickTime 2007-12-31 23:41 --------- d-----w C:\Program Files\DellSupport 2007-12-31 18:17 48,958 ----a-w C:\Documents and Settings\Pauline\Application Data\wklnhst.dat 2007-12-31 00:20 --------- d-----w C:\Program Files\McAfee 2007-12-30 23:57 --------- d-----w C:\Program Files\Java 2007-12-30 23:55 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-12-30 23:54 --------- d-----w C:\Program Files\MUSICMATCH 2007-12-29 00:39 --------- d-----w C:\Documents and Settings\Pauline\Application Data\SiteAdvisor 2007-12-27 20:44 --------- d-----w C:\Documents and Settings\Joe\Application Data\SiteAdvisor 2007-12-27 20:00 --------- d-----w C:\Program Files\SiteAdvisor 2007-12-17 00:26 8,244 ----a-w C:\Documents and Settings\David\Application Data\wklnhst.dat 2007-12-06 16:25 --------- d-----w C:\Program Files\Common Files\McAfee 2007-12-04 22:42 --------- d-----w C:\Documents and Settings\LocalService\Application Data\SiteAdvisor 2007-11-23 01:58 --------- d-----w C:\Program Files\Common Files\Intuit 2007-11-23 01:56 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL 2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2007-11-11 03:43 --------- d-----w C:\Documents and Settings\David\Application Data\SiteAdvisor 2006-08-07 15:45 65,016 ----a-w C:\Documents and Settings\Pauline\Application Data\GDIPFONTCACHEV1.DAT 2006-06-25 02:49 65,016 ----a-w C:\Documents and Settings\Joe\Application Data\GDIPFONTCACHEV1.DAT . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{86afcb62-7631-40ea-b519-5d9269b1a487}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sonic RecordNow!"="" [] "DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 11:09 460784] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24 1694208] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2003-04-07 01:19 155648] "HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2003-04-07 01:07 114688] "dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2003-08-06 02:04 114741] "diagent"="C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" [2002-04-03 02:01 135264] "UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 02:00 90112] "SiteAdvisor"="C:\Program Files\SiteAdvisor\6253\SiteAdv.exe" [2007-03-30 10:42 36904] "mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-08-03 22:33 582992] "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-09-06 16:14 919016] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2004-03-11 04:18 151597] "StorageGuard"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-02-13 02:01 155648] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-08-05 17:17 77824] "PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2003-08-26 20:47 204800] "BCMSMMSG"="BCMSMMSG.exe" [2003-08-29 04:59 122880 C:\WINDOWS\BCMSMMSG.exe] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\iifeecd] iifeecd.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit] LMIinit.dll 2007-10-18 20:47 75064 C:\WINDOWS\SYSTEM32\LMIinit.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" R2 LMIRfsDriver;LogMeIn Remote File System Driver;C:\WINDOWS\system32\drivers\LMIRfsDriver.sys [2007-09-12 10:20] S2 LMIInfo;LogMeIn Kernel Information Provider;C:\Program Files\LogMeIn\x86\RaInfo.sys [] S2 Windows Hosts Plugin;Windows Hosts Plugin;"C:\WINDOWS\system32\spoolcv.exe" [] . Contents of the 'Scheduled Tasks' folder "2007-06-16 01:22:44 C:\WINDOWS\Tasks\McDefragTask.job" - c:\program files\mcafee\mqc\QcConsol.exe' "2007-06-16 01:22:42 C:\WINDOWS\Tasks\McQcTask.job" - c:\program files\mcafee\mqc\QcConsol.exe "2007-12-31 00:57:32 C:\WINDOWS\Tasks\SpywareBot Scheduled Scan.job" - C:\Program Files\SpywareBot\SpywareBot.ex - C:\Program Files\SpywareBot . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-01-03 22:46:08 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-01-03 22:52:13 - machine was rebooted ComboFix-quarantined-files.txt 2008-01-04 03:52:06 . 2008-01-02 01:20:20 --- E O F --- ------------------------------------------------------------ Here is the HijackThis log: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:01:21 PM, on 1/3/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16574) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe C:\WINDOWS\System32\CTsvcCDA.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe c:\program files\common files\mcafee\mna\mcnasvc.exe c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\Program Files\McAfee\MPF\MPFSrv.exe C:\Program Files\SiteAdvisor\6253\SAService.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\McAfee.com\Agent\mcagent.exe C:\WINDOWS\System32\hkcmd.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\Program Files\SiteAdvisor\6253\SiteAdv.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe C:\Program Files\Dell\Media Experience\PCMService.exe C:\WINDOWS\BCMSMMSG.exe C:\Program Files\DellSupport\DSAgnt.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\McAfee\MSC\mcuimgr.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.aestheticrealism.org/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll O2 - BHO: InternetExplorerAssistant - {86afcb62-7631-40ea-b519-5d9269b1a487} - mscoree.dll (file missing) O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [diagent] "C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" startup O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6253\SiteAdv.exe O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe" O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1196054669390 O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O20 - Winlogon Notify: iifeecd - iifeecd.dll (file missing) O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - C:\WINDOWS\system32\drivers\KodakCCS.exe (file missing) O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6253\SAService.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe O23 - Service: Windows Hosts Plugin - Unknown owner - C:\WINDOWS\system32\spoolcv.exe (file missing) -- End of file - 6748 bytes |
|
|
|
|
01-03-2008, 09:23 PM
|
#7 (permalink) | |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,561
OS: 2000 Pro; XP Pro; XP Home
|
Re: McAfee -- Panda ActiveScan problems
Good job.
Next.... Open notepad and copy/paste the text in the quotebox below into it: Quote:
 Refering to the picture above, drag CFScript.txt into ComboFix.exe When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply. Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall --------------------------------------------------------------------------------------------- Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here. ---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
|
01-03-2008, 09:59 PM
|
#8 (permalink) |
|
Registered User
Join Date: Dec 2007
Posts: 10
OS: windows XP
|
Re: McAfee -- Panda ActiveScan problems
Ok, I ran the two steps with no problem. Here is the Combofix log followed by the Hijack This log:
ComboFix 08-01-04.1 - Joe 2008-01-03 23:26:15.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.60 [GMT -5:00] Running from: C:\Documents and Settings\Joe\Desktop\ComboFix.exe Command switches used :: C:\CFScript.txt * Created a new restore point FILE C:\WINDOWS\SYSTEM32\xsnxgkac.ini C:\WINDOWS\SYSTEM32\yclsivnt.ini C:\WINDOWS\Tasks\SpywareBot Scheduled Scan.job . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Joe\Application Data\SpywareBot C:\Documents and Settings\Joe\Application Data\SpywareBot\Log\2007 Dec 30 - 07_49_21 PM_218.log C:\Documents and Settings\Joe\Application Data\SpywareBot\Log\2007 Dec 30 - 07_49_33 PM_515.log C:\Documents and Settings\Joe\Application Data\SpywareBot\Log\2007 Dec 30 - 07_56_23 PM_734.log C:\Documents and Settings\Joe\Application Data\SpywareBot\Log\2007 Dec 30 - 07_57_30 PM_531.log C:\Documents and Settings\Joe\Application Data\SpywareBot\rs.dat C:\Documents and Settings\Joe\Application Data\SpywareBot\Settings\ScanResults.pie C:\WINDOWS\SYSTEM32\ineWc06 C:\WINDOWS\SYSTEM32\xsnxgkac.ini C:\WINDOWS\SYSTEM32\yclsivnt.ini C:\WINDOWS\Tasks\SpywareBot Scheduled Scan.job . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\LEGACY_WINDOWS_HOSTS_PLUGIN -------\Windows Hosts Plugin ((((((((((((((((((((((((( Files Created from 2007-12-04 to 2008-01-04 ))))))))))))))))))))))))))))))) . 2008-01-03 22:19 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe 2008-01-01 20:17 . 2007-10-10 18:55 459,264 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\msfeeds.dll 2008-01-01 20:17 . 2007-10-10 18:55 52,224 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\msfeedsbs.dll 2008-01-01 20:16 . 2007-10-10 18:55 6,065,664 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\ieframe.dll 2008-01-01 20:16 . 2007-06-30 22:31 2,455,488 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\ieapfltr.dat 2008-01-01 20:16 . 2007-06-30 22:36 991,232 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\ieframe.dll.mui 2008-01-01 20:16 . 2007-10-10 18:55 383,488 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\ieapfltr.dll 2008-01-01 20:16 . 2007-10-10 18:55 267,776 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\iertutil.dll 2008-01-01 20:16 . 2007-10-10 18:55 63,488 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\icardie.dll 2008-01-01 20:16 . 2007-10-10 05:59 13,824 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\ieudinit.exe 2008-01-01 20:07 . 2007-08-13 18:54 33,792 --a------ C:\WINDOWS\SYSTEM32\DLLCACHE\custsat.dll 2008-01-01 16:23 . 2008-01-01 16:23 686,630 --a------ C:\Program Files\dss.exe 2008-01-01 16:09 . 2008-01-01 16:09 <DIR> d-------- C:\Deckard 2008-01-01 15:48 . 2008-01-01 15:48 <DIR> d-------- C:\Program Files\ZonedOut 2008-01-01 15:47 . 2008-01-01 15:47 <DIR> d-------- C:\ie-spyad_zo 2008-01-01 15:44 . 2008-01-01 15:44 240,904 --a------ C:\Program Files\ZonedOut.zip 2008-01-01 15:42 . 2008-01-01 15:42 315,590 --a------ C:\Program Files\ie-spyad_zo.exe 2008-01-01 15:19 . 2008-01-01 15:37 <DIR> d-------- C:\Program Files\SpywareBlaster 2007-12-31 17:41 . 2007-12-31 19:09 <DIR> d-------- C:\WINDOWS\SYSTEM32\ActiveScan 2007-12-31 17:41 . 2007-12-31 17:41 30,590 --a------ C:\WINDOWS\SYSTEM32\pavas.ico 2007-12-31 17:41 . 2007-12-31 17:41 2,550 --a------ C:\WINDOWS\SYSTEM32\Uninstall.ico 2007-12-31 17:41 . 2007-12-31 17:41 1,406 --a------ C:\WINDOWS\SYSTEM32\Help.ico 2007-12-31 16:47 . 2007-12-31 16:47 <DIR> d-------- C:\Program Files\Trend Micro 2007-12-25 10:45 . 2008-01-03 23:38 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2007-12-25 10:45 . 2008-01-03 22:40 1,409 --a------ C:\WINDOWS\QTFont.for 2007-12-16 21:18 . 2007-12-16 21:18 <DIR> d-------- C:\Documents and Settings\Joe\Application Data\iolo 2007-12-16 21:18 . 2007-12-16 21:18 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\iolo 2007-12-16 21:18 . 2007-12-16 21:18 406 --a------ C:\WINDOWS\SYSTEM32\ioloBootDefrag.cfg 2007-12-12 19:54 . 2008-01-03 23:37 1,652,768 --ahs---- C:\WINDOWS\SYSTEM32\DRIVERS\fidbox.dat 2007-12-12 19:54 . 2008-01-03 23:35 20,396 --ahs---- C:\WINDOWS\SYSTEM32\DRIVERS\fidbox.idx 2007-12-12 19:44 . 2007-12-12 19:44 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier 2007-12-12 19:43 . 2007-09-06 16:14 75,248 --a------ C:\WINDOWS\zllsputility.exe 2007-12-12 19:43 . 2004-04-27 04:40 11,264 --a------ C:\WINDOWS\SYSTEM32\SpOrder.dll 2007-12-12 19:41 . 2008-01-03 23:37 353,247 --a------ C:\WINDOWS\SYSTEM32\vsconfig.xml 2007-12-12 18:27 . 2007-12-31 18:42 <DIR> d-------- C:\Program Files\Internet Explorer Assistant 2007-12-09 18:57 . 2007-12-09 18:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Rabio . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-01-04 03:05 43,178 ----a-w C:\Documents and Settings\Joe\Application Data\wklnhst.dat 2007-12-31 23:49 --------- d-----w C:\Program Files\QuickTime 2007-12-31 23:41 --------- d-----w C:\Program Files\DellSupport 2007-12-31 18:17 48,958 ----a-w C:\Documents and Settings\Pauline\Application Data\wklnhst.dat 2007-12-31 00:20 --------- d-----w C:\Program Files\McAfee 2007-12-30 23:57 --------- d-----w C:\Program Files\Java 2007-12-30 23:55 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-12-30 23:54 --------- d-----w C:\Program Files\MUSICMATCH 2007-12-29 00:39 --------- d-----w C:\Documents and Settings\Pauline\Application Data\SiteAdvisor 2007-12-27 20:44 --------- d-----w C:\Documents and Settings\Joe\Application Data\SiteAdvisor 2007-12-27 20:00 --------- d-----w C:\Program Files\SiteAdvisor 2007-12-17 00:26 8,244 ----a-w C:\Documents and Settings\David\Application Data\wklnhst.dat 2007-12-06 16:25 --------- d-----w C:\Program Files\Common Files\McAfee 2007-12-04 22:42 --------- d-----w C:\Documents and Settings\LocalService\Application Data\SiteAdvisor 2007-11-23 01:58 --------- d-----w C:\Program Files\Common Files\Intuit 2007-11-23 01:56 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL 2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2007-11-11 03:43 --------- d-----w C:\Documents and Settings\David\Application Data\SiteAdvisor 2006-08-07 15:45 65,016 ----a-w C:\Documents and Settings\Pauline\Application Data\GDIPFONTCACHEV1.DAT 2006-06-25 02:49 65,016 ----a-w C:\Documents and Settings\Joe\Application Data\GDIPFONTCACHEV1.DAT . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sonic RecordNow!"="" [] "DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 11:09 460784] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24 1694208] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2003-04-07 01:19 155648] "HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2003-04-07 01:07 114688] "dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2003-08-06 02:04 114741] "diagent"="C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" [2002-04-03 02:01 135264] "UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 02:00 90112] "SiteAdvisor"="C:\Program Files\SiteAdvisor\6253\SiteAdv.exe" [2007-03-30 10:42 36904] "mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-08-03 22:33 582992] "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-09-06 16:14 919016] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2004-03-11 04:18 151597] "StorageGuard"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-02-13 02:01 155648] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-08-05 17:17 77824] "PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2003-08-26 20:47 204800] "BCMSMMSG"="BCMSMMSG.exe" [2003-08-29 04:59 122880 C:\WINDOWS\BCMSMMSG.exe] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit] LMIinit.dll 2007-10-18 20:47 75064 C:\WINDOWS\SYSTEM32\LMIinit.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" R2 LMIRfsDriver;LogMeIn Remote File System Driver;C:\WINDOWS\system32\drivers\LMIRfsDriver.sys [2007-09-12 10:20] S2 LMIInfo;LogMeIn Kernel Information Provider;C:\Program Files\LogMeIn\x86\RaInfo.sys [] . Contents of the 'Scheduled Tasks' folder "2007-06-16 01:22:44 C:\WINDOWS\Tasks\McDefragTask.job" - c:\program files\mcafee\mqc\QcConsol.exe' "2007-06-16 01:22:42 C:\WINDOWS\Tasks\McQcTask.job" - c:\program files\mcafee\mqc\QcConsol.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-01-03 23:38:27 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-01-03 23:44:40 - machine was rebooted ComboFix-quarantined-files.txt 2008-01-04 04:44:30 ComboFix2.txt 2008-01-04 03:52:14 . 2008-01-02 01:20:20 --- E O F --- ---------------------------------------------------------------- Here is the HijackThis log: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:46:41 PM, on 1/3/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16574) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe C:\WINDOWS\System32\CTsvcCDA.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe c:\program files\common files\mcafee\mna\mcnasvc.exe C:\WINDOWS\Explorer.EXE c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\Program Files\McAfee\MPF\MPFSrv.exe C:\Program Files\SiteAdvisor\6253\SAService.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\PROGRA~1\McAfee.com\Agent\mcagent.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\WINDOWS\System32\hkcmd.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\Program Files\SiteAdvisor\6253\SiteAdv.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Dell\Media Experience\PCMService.exe C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe C:\WINDOWS\BCMSMMSG.exe C:\Program Files\DellSupport\DSAgnt.exe C:\WINDOWS\system32\ctfmon.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.aestheticrealism.org/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [diagent] "C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" startup O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6253\SiteAdv.exe O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe" O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1196054669390 O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - C:\WINDOWS\system32\drivers\KodakCCS.exe (file missing) O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6253\SAService.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe -- End of file - 6469 bytes |
|
|
|
|
01-03-2008, 10:07 PM
|
#9 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,561
OS: 2000 Pro; XP Pro; XP Home
|
Re: McAfee -- Panda ActiveScan problems
Ok, looking good. A bit more work to do.
Please download ATF Cleaner by Atribune. This program is for XP and Windows 2000 only
For Technical Support, double-click the e-mail address located at the bottom of each menu. --------------------------------------------------------------------------------------------- Please run this online scan to help look for remnants. This will take some time, perhaps an hour or so. Establish an internet connection & perform an online scan using Internet Explorer at Kaspersky Online Scanner http://www.kaspersky.com/kos/eng/par...avwebscan.html Answer Yes, when prompted to install an ActiveX component.
Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%. ---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
01-03-2008, 11:41 PM
|
#10 (permalink) |
|
Registered User
Join Date: Dec 2007
Posts: 10
OS: windows XP
|
Re: McAfee -- Panda ActiveScan problems
Ok, I ran the two steps. The Kaspersky scanner found viruses. Below is the report. What did I have a massive infection of viruses and spyware? It seems the McAfee isn't so effective. Thanks for all your help.
------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT Friday, January 04, 2008 1:28:11 AM Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 4/01/2008 Kaspersky Anti-Virus database records: 502336 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ Scan Statistics: Total number of scanned objects: 56575 Number of viruses found: 6 Number of infected objects: 26 Number of suspicious objects: 0 Duration of the scan process: 00:50:46 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\All Users\Application Data\McAfee\MNA\NAData Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\MPF\data\log.edb Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\MSC\Logs\Events.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\MSC\Logs\{2E9DC5E3-2AFA-4CE9-B68B-82D9F3436E13}.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\MSC\McUsers.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\VirusScan\Logs\OAS.Log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp Object is locked skipped C:\Documents and Settings\Joe\Application Data\Gtek\GTUpdate\AUpdate\DellSupport\DSAgnt.log Object is locked skipped C:\Documents and Settings\Joe\Application Data\Gtek\GTUpdate\AUpdate\DellSupport\DSAgnt_GTActions.log Object is locked skipped C:\Documents and Settings\Joe\Application Data\Gtek\GTUpdate\AUpdate\DellSupport\gdql_d_DSAgnt.log Object is locked skipped C:\Documents and Settings\Joe\Application Data\Gtek\GTUpdate\AUpdate\DellSupport\glog.log Object is locked skipped C:\Documents and Settings\Joe\Cookies\INDEX.DAT Object is locked skipped C:\Documents and Settings\Joe\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Joe\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Joe\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped C:\Documents and Settings\Joe\Local Settings\Temp\~DF99E9.tmp Object is locked skipped C:\Documents and Settings\Joe\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped C:\Documents and Settings\Joe\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Joe\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Joe\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Cookies\INDEX.DAT Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\INDEX.DAT Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\QooBox\Quarantine\C\WINDOWS\hg173.exe.vir Infected: Trojan-Clicker.Win32.VB.vx skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\dbbeldyt.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.bjc skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\flsvmlwi.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.bjc skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\hfafljgv.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.din skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\hvgmahwk.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.bjc skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\logedhbn.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.din skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP721\A0054480.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.bjc skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP724\A0054630.dll Infected: Backdoor.Win32.Agent.dlj skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP725\A0055630.dll Infected: Backdoor.Win32.Agent.dlj skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP725\A0055681.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.din skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP728\A0056223.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.din skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP728\A0056430.exe Infected: Trojan-Downloader.Win32.Agent.gwe skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP728\A0056431.dll Infected: not-a-virus:AdWare.Win32.SuperJuan.ao skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP728\A0056432.dll Infected: not-a-virus:AdWare.Win32.SuperJuan.ao skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP728\A0056433.exe Infected: Trojan-Downloader.Win32.Agent.gwe skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP728\A0056434.exe Infected: Trojan-Downloader.Win32.Agent.gwe skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP728\A0056435.exe Infected: Trojan-Downloader.Win32.Agent.gwe skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP728\A0056436.exe Infected: Trojan-Downloader.Win32.Agent.gwe skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP728\A0056438.exe Infected: Trojan-Downloader.Win32.Agent.gwe skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP728\A0056439.exe Infected: Trojan-Downloader.Win32.Agent.gwe skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP733\A0056801.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.bjc skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP733\A0056802.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.bjc skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP733\A0056804.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.din skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP733\A0056805.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.bjc skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP733\A0056808.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.din skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP733\A0056824.exe Infected: Trojan-Clicker.Win32.VB.vx skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP734\change.log Object is locked skipped C:\WINDOWS\$NtUninstallKB824141$\user32.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB824141$\win32k.sys Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\catsrv.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\catsrvut.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\clbcatex.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\clbcatq.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\colbact.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\comadmin.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\comrepl.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\comsvcs.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\comuid.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\es.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\msdtcprx.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\msdtctm.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\msdtcuiu.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\mtxclu.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\mtxoci.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\ole32.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\rpcrt4.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\rpcss.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\txflog.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\callcont.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\gdi32.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\h323.tsp Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\h323msp.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\helpctr.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\ipnathlp.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\lsasrv.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\mf3216.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\msasn1.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\msgina.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\mst120.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\netapi32.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\nmcom.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\rtcdll.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\schannel.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\xpsp2res.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB837001$\dao360.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB837001$\expsrv.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB837001$\msexch40.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB837001$\msexcl40.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB837001$\msjet40.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB837001$\msjetoledb40.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB837001$\msjint40.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB837001$\msjter40.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB837001$\msjtes40.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB837001$\msltus40.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB837001$\mspbde40.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB837001$\msrd2x40.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB837001$\msrd3x40.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB837001$\msrepl40.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB837001$\mstext40.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB837001$\mswdat10.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB837001$\mswstr10.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB837001$\msxbde40.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB837001$\vbajet32.dll Object is locked skipped C:\WINDOWS\$NtUninstallQ828026$\msdxm.ocx Object is locked skipped C:\WINDOWS\$NtUninstallQ828026$\wmpcore.dll Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\EventCache\{12A75714-F04F-45AF-86BC-CE6F1458972A}.bin Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\SYSTEM32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\SYSTEM32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\AppEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\Internet.evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SAM Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SecEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SECURITY Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SysEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\DRIVERS\fidbox.dat Object is locked skipped C:\WINDOWS\SYSTEM32\DRIVERS\fidbox.idx Object is locked skipped C:\WINDOWS\SYSTEM32\H323LOG.TXT Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\Temp\mcafee_fXFeJKBnFXXiIaE Object is locked skipped C:\WINDOWS\Temp\mcmsc_6H3QNDu6Fcs5QtP Object is locked skipped C:\WINDOWS\Temp\mcmsc_fJAi4g6RCFCeKul Object is locked skipped C:\WINDOWS\Temp\mcmsc_nxdzBg8CBPbb0LR Object is locked skipped C:\WINDOWS\WIADEBUG.LOG Object is locked skipped C:\WINDOWS\WIASERVC.LOG Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed. |
|
|
|
|
01-03-2008, 11:51 PM
|
#11 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,561
OS: 2000 Pro; XP Pro; XP Home
|
Re: McAfee -- Panda ActiveScan problems
Those items are all in quarantine or System Restore points, and will be addressed by uninstalling ComboFix using the method described below.
As far as McAfee goes, it's ok. For me, there are better AVs such as Kaspersky and Eset (NOD32), but none will protect against everything. All it takes is one visit to the wrong site, or one click on an infected email or IM message, and BAM. Have a look at this site: http://www.av-comparatives.org/ Your logs appear clean.You should be good to go. We still have a few items to address. Go to  -> Run -> copy/paste in the following single line command & click OKcombofix /u  This will uninstall ComboFix. It will also implement some cleanup procedures and reset System Restore points. Now that your system is clean, to help protect your computer in the future I recommend that you follow these steps and use the following free programs:
Scan here http://secunia.com/software_inspector/ for out of date & vulnerable common applications on your computer Here are some additional utilities that will further enhance your safety.
In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles If you want to fight back the Malware Writers that have made your life a misery, please take a look here and read what you can do against it. Please respond to this thread one more time so we can mark this thread as resolved.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
01-04-2008, 12:12 AM
|
#12 (permalink) |
|
Registered User
Join Date: Dec 2007
Posts: 10
OS: windows XP
|
Re: McAfee -- Panda ActiveScan problems
Ok, I have uninstalled the combofix. Things seem to be ok.
I will follow your suggestions and read the attached articles. Thanks for all your help--this has been terrific. |
|
|
|
| Thread Tools | |
|
|
