 |  |  |  |  |  |  |  |
Mcafee virus scan help!
 |
•
•
Join Date: Nov 2004
Posts: 26
Reputation: 
Solved Threads: 0
Light Poster
I cant even pull it up anymore!
I look @ the task manager when I click on the shortcut and it comes up on the task manager for a sec. Then it goes away, it isnt even giving me a message!
I uninstalled it then went to reinstall the firewall and virusscan. I installed the firewall sucessfully but the virusscan installer will not even come up.
I run Windows XP and the virusscan is ver.8.0
Thank you,
The newguy.
I look @ the task manager when I click on the shortcut and it comes up on the task manager for a sec. Then it goes away, it isnt even giving me a message!
I uninstalled it then went to reinstall the firewall and virusscan. I installed the firewall sucessfully but the virusscan installer will not even come up.
I run Windows XP and the virusscan is ver.8.0
Thank you,
The newguy.
•
•
Join Date: Aug 2003
Posts: 9,551
Reputation: 
Solved Threads: 493
•
•
•
•
Originally Posted by importmaster130
I also posted this:
http://www.annoyances.org/exec/forum/winxp/1101599826
Please help!!!!
Linux boot cd http://www.knopper.net/knoppix/index-en.html
•
•
Join Date: Nov 2004
Posts: 26
Reputation:
Solved Threads: 0
Light Poster
I am currently downloading it now. I will post back up after it stops scanning.
•
•
Join Date: Nov 2004
Posts: 26
Reputation:
Solved Threads: 0
Light Poster
I have no viruses.
I also did a adware scan w/ Ad-aware 6 and it didnt find anything.
I also did a adware scan w/ Ad-aware 6 and it didnt find anything.
•
•
Join Date: Aug 2003
Posts: 9,551
Reputation:
Solved Threads: 493
Please do this.
Download 'Hijack This!'.
htt
p://www.spywareinfo.com/~merijn/files/HijackThis.exe
Save it in a convenient permanent folder such as C:\HJT\,
double click HijackThis.exe, and hit "Scan".
When the scan is finished, the "Scan" button will change into a
"Save Log" button.
Press that, save the log, Ctrl-A to Select All, and copy its
contents here. Most of what it lists will be harmless or even
essential, don't fix anything yet.
,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
Scanning in
Spybot
Search and Destroy:
1. Downloaded and Install
Spybot
S&D, accepting the Default Settings
2. In the Menu Bar at the top of the Spybot window you will see
'Mode'. Make certain that 'default mode' has a
check mark beside it.
3. Close ALL windows except Spybot S&D
4. Click the button to ‘Search for Updates’ then
download and install the Updates.
5. Next click the button ‘Check for Problems’
6. When Spybot is complete, it will be showing
‘RED’ entries bold 'Black'
entries and ‘GREEN’ entries in
the window
7. Make certain there is a check mark beside all of the
RED entries ONLY.
8. Choose ‘Fix Selected Problems’ and allow Spybot to fix
the RED entries.
9.REBOOT to complete the scan and clear memory.
Finally if you are going to run both Spybot SD and Ad-Aware SE,
leave the rescan with HijackThis until you have completed
running both tools. If only running Spybot SD then
RESCAN with HijackThis and POST your logfile in
the same thread using ‘Add Reply’. Please do not
attempt to fix anything in HijackThis yourself!
Scanning With
Ad-Aware SE
:
1. Download and Install
Ad-Aware
SE, keeping the default options. However, some of the
settings will need to be changed before your first scan
2.Close ALL windows except Ad-Aware SE
3. Click on the‘world’ icon at the top right of the
Ad-Aware SE window and let AdAware SE update the reference list
for the adware and malware.
4. Once the update is finished click on the ‘Gear’ icon
(second from the left at the top of the window) to access the
preferences/settings window
1) In the ‘General’ window make sure the following are
selected in green:
*Automatically save log-file
*Automatically quarantine objects prior to removal
*Safe Mode (always request confirmation)
Under Definitions:
*Prompt to udate outdated definitions - set the number of
days
2) Click on the ‘Scanning’ button on the left and select
in green :
Under Driver, Folders & Files:
*Scan Within Archives
Under Select drives & folders to scan -
*choose all hard drives
Under Memory & Registry: all
green
*Scan Active Processes
*Scan Registry
*Deep Scan Registry
*Scan my IE favorites for banned URL’s
*Scan my Hosts file
3) Click on the ‘Advanced’ button on the left and select
in green:
Under Shell Integration:
*Move deleted files to recycle bin
Under Logfile Detail Level: (all green)
*include addtional object information
*DESELECT - include negligible objects information
*include environment information
Under Alternate Data Streams:
*Don't log streams smaller than 0 bytes
*Don't log ADS with the following names: CA_INOCULATEIT
4) Click the ‘Tweak’ button and select in
green:
Under the ‘Scanning Engine’:
*Unload recognized processes during scanning
*Scan registry for all users instead of current user only
Under the ‘Cleaning Engine’:
*Let Windows remove files in use at next reboot
Under the Log Files:
*Include basic Ad-aware SE settings in logfile
*Include additional Ad-aware SE settings in logfile
*Please do not check or make green: Include Module list
in logfile
5. Click on ‘Proceed’ to save the settings.
6. Click ‘Start’
*Choose:'Perform Full System Scan'
*DESELECT "Search for negligible risk entries", as
negligible risk entries (MRU's) are not considered to be a
threat.
7. Click ‘Next’ and Ad-Aware SE will scan your hard
drive(s) with the options you have selected and clean
automatically.
8. If Ad-Aware SE finds bad entries, you will receive a list
of what it found in the window
9. Save the log file when it asks and then click
‘finish’
10. REBOOT to complete the removal of what Ad-Aware SE
found
Finally after running both Spybot SD and Ad-Aware SE,
RESCAN with HijackThis and POST your logfile in the same
thread using ‘Add Reply’. Do not attempt to fix
anything in HijackThis yourself!
,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
Download 'Hijack This!'.
htt
p://www.spywareinfo.com/~merijn/files/HijackThis.exe
Save it in a convenient permanent folder such as C:\HJT\,
double click HijackThis.exe, and hit "Scan".
When the scan is finished, the "Scan" button will change into a
"Save Log" button.
Press that, save the log, Ctrl-A to Select All, and copy its
contents here. Most of what it lists will be harmless or even
essential, don't fix anything yet.
,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
Scanning in
Spybot
Search and Destroy:
1. Downloaded and Install
Spybot
S&D, accepting the Default Settings
2. In the Menu Bar at the top of the Spybot window you will see
'Mode'. Make certain that 'default mode' has a
check mark beside it.
3. Close ALL windows except Spybot S&D
4. Click the button to ‘Search for Updates’ then
download and install the Updates.
5. Next click the button ‘Check for Problems’
6. When Spybot is complete, it will be showing
‘RED’ entries bold 'Black'
entries and ‘GREEN’ entries in
the window
7. Make certain there is a check mark beside all of the
RED entries ONLY.
8. Choose ‘Fix Selected Problems’ and allow Spybot to fix
the RED entries.
9.REBOOT to complete the scan and clear memory.
Finally if you are going to run both Spybot SD and Ad-Aware SE,
leave the rescan with HijackThis until you have completed
running both tools. If only running Spybot SD then
RESCAN with HijackThis and POST your logfile in
the same thread using ‘Add Reply’. Please do not
attempt to fix anything in HijackThis yourself!
Scanning With
Ad-Aware SE
:
1. Download and Install
Ad-Aware
SE, keeping the default options. However, some of the
settings will need to be changed before your first scan
2.Close ALL windows except Ad-Aware SE
3. Click on the‘world’ icon at the top right of the
Ad-Aware SE window and let AdAware SE update the reference list
for the adware and malware.
4. Once the update is finished click on the ‘Gear’ icon
(second from the left at the top of the window) to access the
preferences/settings window
1) In the ‘General’ window make sure the following are
selected in green:
*Automatically save log-file
*Automatically quarantine objects prior to removal
*Safe Mode (always request confirmation)
Under Definitions:
*Prompt to udate outdated definitions - set the number of
days
2) Click on the ‘Scanning’ button on the left and select
in green :
Under Driver, Folders & Files:
*Scan Within Archives
Under Select drives & folders to scan -
*choose all hard drives
Under Memory & Registry: all
green
*Scan Active Processes
*Scan Registry
*Deep Scan Registry
*Scan my IE favorites for banned URL’s
*Scan my Hosts file
3) Click on the ‘Advanced’ button on the left and select
in green:
Under Shell Integration:
*Move deleted files to recycle bin
Under Logfile Detail Level: (all green)
*include addtional object information
*DESELECT - include negligible objects information
*include environment information
Under Alternate Data Streams:
*Don't log streams smaller than 0 bytes
*Don't log ADS with the following names: CA_INOCULATEIT
4) Click the ‘Tweak’ button and select in
green:
Under the ‘Scanning Engine’:
*Unload recognized processes during scanning
*Scan registry for all users instead of current user only
Under the ‘Cleaning Engine’:
*Let Windows remove files in use at next reboot
Under the Log Files:
*Include basic Ad-aware SE settings in logfile
*Include additional Ad-aware SE settings in logfile
*Please do not check or make green: Include Module list
in logfile
5. Click on ‘Proceed’ to save the settings.
6. Click ‘Start’
*Choose:'Perform Full System Scan'
*DESELECT "Search for negligible risk entries", as
negligible risk entries (MRU's) are not considered to be a
threat.
7. Click ‘Next’ and Ad-Aware SE will scan your hard
drive(s) with the options you have selected and clean
automatically.
8. If Ad-Aware SE finds bad entries, you will receive a list
of what it found in the window
9. Save the log file when it asks and then click
‘finish’
10. REBOOT to complete the removal of what Ad-Aware SE
found
Finally after running both Spybot SD and Ad-Aware SE,
RESCAN with HijackThis and POST your logfile in the same
thread using ‘Add Reply’. Do not attempt to fix
anything in HijackThis yourself!
,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
Linux boot cd http://www.knopper.net/knoppix/index-en.html
•
•
Join Date: Nov 2004
Posts: 26
Reputation:
Solved Threads: 0
Light Poster
Logfile of HijackThis v1.98.2
Scan saved at 6:10:09 PM, on 11/27/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\crypserv.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
C:\WINDOWS\System32\00THotkey.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\MSN\MSNCoreFiles\msn.exe
C:\Program Files\Shareaza\Shareaza.exe
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\O72RSTCD\stinger[1].exe
C:\Documents and Settings\Owner\My Documents\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchAssistant = http://www.sharempeg.com/find/
R1 - HKCU\Software\Microsoft\Internet Explorer,CustomizeSearch = http://www.sharempeg.com/find/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,(Default) = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://htalxu.t.muxa.cc/h.php?aid=35 (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
F0 - system.ini: Shell=Explorer.exe C:\WINDOWS\system32\winmgd.win
F1 - win.ini: run=C:\WINDOWS\system32\mouse_configurator.win
F2 - REG:system.ini: UserInit=c:\windows\system32\userinit.exe
O2 - BHO: (no name) - {3BDC6A26-E74D-2DBB-D503-6D550DF5731E} - C:\WINDOWS\system32\rmp.dll
O2 - BHO: (no name) - {9C691A33-7DDA-4C2F-BE4C-C176083F35CF} - (no file)
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O4 - HKLM\..\Run: [TouchED] C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [00THotkey] C:\WINDOWS\System32\00THotkey.exe
O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKCU\..\Run: [Microsoft Update] mssmgrd.exe
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\RunServicesOnce: [washindex] C:\Program Files\Washer\washidx.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - (no file)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - (no file)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O13 - WWW. Prefix: http://ehttp.cc/?
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/is...10/mcfscan.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{8D823DD4-D752-47B4-B642-A571B3433745}: NameServer = 204.147.80.5,206.81.192.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{F0A7297A-5F38-4403-9342-B238C89421D1}: NameServer = 205.171.3.65 205.171.2.65
O19 - User stylesheet: (file missing)
Scan saved at 6:10:09 PM, on 11/27/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\crypserv.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
C:\WINDOWS\System32\00THotkey.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\MSN\MSNCoreFiles\msn.exe
C:\Program Files\Shareaza\Shareaza.exe
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\O72RSTCD\stinger[1].exe
C:\Documents and Settings\Owner\My Documents\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchAssistant = http://www.sharempeg.com/find/
R1 - HKCU\Software\Microsoft\Internet Explorer,CustomizeSearch = http://www.sharempeg.com/find/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,(Default) = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://htalxu.t.muxa.cc/h.php?aid=35 (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
F0 - system.ini: Shell=Explorer.exe C:\WINDOWS\system32\winmgd.win
F1 - win.ini: run=C:\WINDOWS\system32\mouse_configurator.win
F2 - REG:system.ini: UserInit=c:\windows\system32\userinit.exe
O2 - BHO: (no name) - {3BDC6A26-E74D-2DBB-D503-6D550DF5731E} - C:\WINDOWS\system32\rmp.dll
O2 - BHO: (no name) - {9C691A33-7DDA-4C2F-BE4C-C176083F35CF} - (no file)
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O4 - HKLM\..\Run: [TouchED] C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [00THotkey] C:\WINDOWS\System32\00THotkey.exe
O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKCU\..\Run: [Microsoft Update] mssmgrd.exe
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\RunServicesOnce: [washindex] C:\Program Files\Washer\washidx.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - (no file)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - (no file)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O13 - WWW. Prefix: http://ehttp.cc/?
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/is...10/mcfscan.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{8D823DD4-D752-47B4-B642-A571B3433745}: NameServer = 204.147.80.5,206.81.192.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{F0A7297A-5F38-4403-9342-B238C89421D1}: NameServer = 205.171.3.65 205.171.2.65
O19 - User stylesheet: (file missing)
•
•
Join Date: Nov 2004
Posts: 26
Reputation:
Solved Threads: 0
Light Poster
Its weird, I can download and install Spybot!
I have tried to install both virus scan 7.0 and 8.0.
I am doing the spybot scan now.
I have tried to install both virus scan 7.0 and 8.0.
I am doing the spybot scan now.
•
•
Join Date: Aug 2003
Posts: 9,551
Reputation:
Solved Threads: 493
Download then unzip and run CWShredder to clean up clicking "FIX" to have it remove all it finds.
CWShredder available from these places :-
http://www.zerosrealm.com/downloads.php
http://www.aluriasoftware.com/tools/cwshredder.zip
Or this as a full download without any unzipping required
http://www.downloads.subratam.org/CWShredder.exe
http://www.spywareinfo.com/downloads...CWShredder.exe
We have found that some of the CWS infections can be removed better from safe mode, rather than normal mode.
To get to safe mode use the F8 key while booting the machine. Detailed instructions from here :-
http://service1.symantec.com/SUPPORT...01052409420406
reboot and post a fresh hijackthis log
Forget the virus scans for now .Please run Ad-Aware ,spybot and CWShredder first
CWShredder available from these places :-
http://www.zerosrealm.com/downloads.php
http://www.aluriasoftware.com/tools/cwshredder.zip
Or this as a full download without any unzipping required
http://www.downloads.subratam.org/CWShredder.exe
http://www.spywareinfo.com/downloads...CWShredder.exe
We have found that some of the CWS infections can be removed better from safe mode, rather than normal mode.
To get to safe mode use the F8 key while booting the machine. Detailed instructions from here :-
http://service1.symantec.com/SUPPORT...01052409420406
reboot and post a fresh hijackthis log
Forget the virus scans for now .Please run Ad-Aware ,spybot and CWShredder first
Linux boot cd http://www.knopper.net/knoppix/index-en.html
|
Similar Threads
- Can't even virus scan... (Troubleshooting Dead Machines)
- cant run virus scan or install/uninstall programs (Viruses, Spyware and other Nasties)
Other Threads in the Viruses, Spyware and other Nasties Forum
- Previous Thread: Problem with msshed32.exe and more
- Next Thread: Internet Explorer
| Thread Tools | Search this Thread |
You need to join our community in order to build your list of favorite forums. You can visit the forum index for a listing of all forums.
Related Forum Features
Latest Viruses, Spyware and other Nasties Posts
adware anti-virussitesaccessissue antivirus apple attack audio avg backtoschoolspeech bar blackhat botnet censorship china commercial commercials conficker connect control crosssitescripting cyber cybercrime cyberwarfare ddos domains e-mafia education email europe exam exploit facebook fake gaming gtaiv gumblar halloween hijack hosting internet iphone kaspersky legal logfiles mail malware mcafee mega-d messagelabs microsoft mobile msn nazi news obama onlinethreats paedophile panel parents patch phishing police policeprovirusmba-mblockedinternetaccess president privacy pro problem redirecting reliability report research risk rogueantivirus samhain sans scareware school search security sites software spam spyware spywareexternalwindows7adminstratortrojans sqlinjection symantec system teen translate trojan unabletoaccessanti-virussites unwanted usa virus viruses war warning windows worm yahoo zeroday
