Antivirus Program Flawed?

Submarine · Nov 14, 2008

Last night, when hibernating in front of this forum, I decided to do some research related to a post I had made earlier, and Googled for some pretty technical stuff. Suddenly I faced a page with an Aero looking desktop design. It had a progress bar running slowly, indicating it was scanning. A pop-up said something about "scan for mal-ware" (ever heard of this before?) and my hibernation ended abruptly. Cursing myself for not having set the Internet Security Options at High, as I usually do when browsing geek sites, I blocked my firewall. Checked if I could see any unfamiliar process running, but couldn't, and then pressed Alt-F4. A new pop-up suggesting to download some nice scanner was killed likewise. Two seconds later the first one came up again. I pressed Alt-F4 twice and closed the browser tab.

McAfee Internet Security said nothing and its Site Advisor did not worry.

I used the McAfee Tools Quick Clean Feature and had it clean recycle bin, temporary files, cash, cookies and browser history, then again temporary internet files from IE, and rund CCleaner files and Registry Scan, just to check. Cleaned out some more files. Checked for any new Add-ons and the run a full virus scan with McAfee. Run a log with HijackThis. Nothing found, but I am still slightly in chock. Anything else I should have done at that stage?

The EventLog recorded the following error 256 times during 2 seconds:

Log Name: System
Source: DitributedCOM
Event ID: 10016
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID {B299BB78-EBBE-48F9-8725-E6A84C4E7C1D} to the user XPS720\Submarine SID (S-1-5-21-3333333333-2222222222-919095832-1000) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.

Can I trust my McAfee installation? Why the errors?

I now suffer from FUD (thanks NC for this word, new to me), and wonder if it was me browsing to the site or something already in my machine sending me there.

Barman58 · Nov 14, 2008

Hi submarine,

Looks llike you almost got caught by one of the "drive By" attacks. you probably did enough but would suggest you do a full malwarebytes scan of your machine to be sure.

Malwarebytes.org

it may take a while to do full scan but have found it to be the best agaist the current set of nasties

Submarine · Nov 14, 2008

I am afraid McAfee and Malwarebytes do not go along. I will ask Malwarebytes if they have convinced McAfee to leave them alone. If so, I will try it again. First attempt to install failed as McAfee removed it, then it was fixed, and then some weeks later, I had a new Mcafee attack against Malwarebytes which forced me to uninstall.

Submarine · Nov 14, 2008

I should of course add that the COM Server application CLSID refers to McSurrogateHelper Class, which a piece of Mcafee Security Center.

SIW2 · Nov 14, 2008

Hi,

I came across the same thing a while back and deliberately went to the page and let it do it's fake scan for a few seconds.

It added this registry key , which I removed

HKEY_CLASSES_ROOT\CLSID\

{9afb8248-617f-460d-9366-d71cdeda3179}

(Adware.MyWebSearch) - no sign of it since.

You might paste that string into the Find function in Regedit and if it's there, delete it.

Malwarebytes is excellent - if you can't use that , suggest you try Spybot - ( uncheck the Teatimer during installation as to avoid interfering with other security ) , and do a full scan manually - might catch the nasties without you having to dig through the registry.

The home of Spybot-S&D!

Hope it helps

SIW2

Submarine · Nov 14, 2008

I am happy to report no such value was found.

I am going to to some program re-installation this weekend, including McAfee, if just time allows. When McAfee is gone, I will the install Malwarebytes and run it. I know Malwarebytes are talking to McAffe, but it seems to be a slow process. Still worry over the error messages. Something was surely going on, maybe McAfee was trying to tell me or do something but did not have the proper permissions?

Submarine · Nov 17, 2008

Ran Malwarebytes from both normal and safe mode, and Spybot from normal. No infection detected. Have, however, started to get bursts of the following Audit Failure in the Event viewer Security logs (ID5038):

Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error.
File Name: \Device\HarddiskVolume3\Windows\System32\drivers\tcpip.sys

This started a half-hour after the nasty event, recurred ~25 hours later and then again ~21 hours later. I hope I will never see it again, but doubt it. Based on info in the EventID Net, it appears this may be a bug in Vista, and then maybe it is just a coincidence it happened, when it happened. So, maybe I am OK.

SIW2 · Nov 17, 2008

Hi,

Seems there may be a connection, according to this site

Windows Vista tcpip.sys Connection Limit Patch for Event ID 4226 » My Digital Life

Apparently in Windows Vista, Microsoft still enforce and hard-limit (hard coded in tcpip.sys) the maximum simultaneous half-open (incomplete) outbound TCP connection attempts per second that the system can make in order to protect the system from being used by malicious programs, such as viruses and worms.

Replacing the file through doesn't appear to be easy, as you need to get the right version.

If it's causing problems, you could try running SFC to see if that will fix it, or perhaps a repair install

http://www.vistax64.com/software-tools/183170-system-file-check-tool.html

http://www.vistax64.com/tutorials/88236-repair-install-vista.html

Hope it helps

SIW2

Chappy · Nov 17, 2008

Actually, that sounds like a possible Windows Defender scan and would be normal for a late night schedule that Vista has defender running it's scan under. Check your scheduled tasks to see if a defender scan occurred on that night.
To view the Defender files, right click the Windows Defender folder in the left pane of Task Scheduler and select "view - show hidden tasks"

The second one tho, asking you to d'load some scanner...definitely is questionable and could mean the first one was also fake, but for some reason I think that first one could have been a defender scan.

mastoark · Nov 18, 2008

IMO I would get rid of McAffey, and just use something like Avast antivirus a firewall of your choice, like comodo, vista firewall controll, A program named spywareblaster, and something like Spybot or superantispyware....

I personnaly dont think McAffey is that great,,

Also if you dont have it Use Firefox web browser and get the No script extension, this alone will help out alot as its way more secure than IE..

I like the Avast scanner alot as you can do a bootup scan...

Submarine · Nov 18, 2008

The source of the tcpip event was "Microsoft Windows Security Auditing", not Defender. Defender run its scheduled scan somewhat later at night. I have not had this issue for 62 hours now. Had en error telling me that the BITS service failed to start when booting yesterday; in this context a scary perspective. This still likely to be one of those things that just happens.

I ran a SFC scan the day after the last tcpip event. As I have not seen any since, perhaps it did something. Don't really think so, though, as there was no reference to tcpip in the CBS log.

I had another "close encounter", one or two weeks earlier. It was in similar context. That time I had the security settings at high, when a very well designed pop-up proposed I enter my account number. It was quite out of context as this too was some geek site, and no reason for it being there. Suspect a hoax, and it did not generate any noise in the logs. This made me better prepared for the latest event.

Most likely, after all, is that I have no infection.

Would anyway like to probe further. Anyone having a suggestion for a good, free root-kit detector? With good, I mean something that never tries to fix anything without my explicit consent, and which is known for being a reliable tool, rather than a virus itself. If I cannot find anything then, I think it is high time to drop the issue.

SIW2 · Nov 18, 2008

Hi Submarine,

I use Avast free home edition, which has a rootkit detector included.

If you want a free standalone manual scanner to put your mind at rest, you could try FSecure Blacklight - click the middle one under Downloads at the bottom of this link

Overview

Hope it helps

SIW2

Submarine · Nov 18, 2008

Chappy said:
Actually, that sounds like a possible Windows Defender scan and would be normal for a late night schedule that Vista has defender running it's scan under. Check your scheduled tasks to see if a defender scan occurred on that night.
To view the Defender files, right click the Windows Defender folder in the left pane of Task Scheduler and select "view - show hidden tasks"

The second one tho, asking you to d'load some scanner...definitely is questionable and could mean the first one was also fake, but for some reason I think that first one could have been a defender scan.

Aha, misunderstood. No, no, this was no Defender message. I had the option to say OK or NO on both, the second to download some secure scanner. The typical attempt to make me download something I absolutely did not want. If it was not for my own AV scanner's error messages, I would not have worried. That gave it all a much more advanced touch.

Submarine · Nov 19, 2008

Anybody having this string in the registry editor: C:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll

Note the JRE16~ rather than JRE1.6~

Submarine · Nov 20, 2008

OK, found it. This is a folder that is hidden yet the Folder Option settings are all set to show hidden and system files. I was able to get into the folder, and display the files, from the command prompt, using the folder name above. This, however, does not work in Windows Explorer. Anybody know how to access it from there?

Barman58 · Nov 20, 2008

Hi submarine,

have you tried to enter the string to the folder into the explorer address bar or just via the folder tree/folders method?

otherwise you could try something like ...

Code:

takeown C:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll
ren C:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll C:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll.old

... in a admin cmd prompt

Submarine · Nov 21, 2008

No, it does not work from Win Explorer. I have no immediate need to rename this file. Just noticed it in my HijackThis log but could not find the folder in the Explorer. This may be normal, or not. Is this folder hidden for everybody else, or is it just in my machine? There was a Java Web Files in XP, do you have that one in Vista?

Submarine · Nov 22, 2008

From my HijackThis log I see I have a folder C:\PROGRA~1\Java\JRE16~3.0_0. From googling the internet, it is also clear, I am not the only one having it. I cannot see it from Windows Explorer but I can enter it from the Command Prompt. It contains folders with files.

Looking at the properties of the Java folder, it contains 2377 files. This corresponds the sum of files I get from the properties of the visible subfolders, those containing the various Java updates. When virus scanning the Java folder, the scanner reports it has scanned 2377 files.

Could I please ask if you can see your JRE16~3.0_0 folder from the Explorer?
If it is hidden like this, why is that, and is it hidden from virus scanners as well?

Barman58 · Nov 22, 2008

Hi submarine,

Am on Seven at the moment but will try to check out the java folders when I get back to Vista later.

you may want to have a look at this ....

Display Super Hidden Files In Windows Vista ~ Windows Fanatics

I know that JAVA can be very lax with removing old versions when it updates have a look in Add/Remove programs and see if you have more than one version of JAVA showing.

The 16 as opposed to 1.6 in the folder name could just be by design as Dots in file paths can cause all sorts of problems

Submarine · Nov 22, 2008

Thanks, the ShowSuperHidden value is already at 1. I belive this is what you get when you uncheck the "Hide protected operating system files".

Antivirus Program Flawed?

Member

My Computer

My Computers

Member

My Computer

Member

My Computer

My Computers

Member

My Computer

Member

My Computer

My Computers

Tech Help since 1993

My Computer

New Member

My Computer

Member

My Computer

My Computers

Member

My Computer

Member

My Computer

Member

My Computer

My Computers

Member

My Computer

Member

My Computer

My Computers

Member

My Computer