McAfee scan after removing infection reveals more trojan files

bol - As you know, 'rpg' is the source authority on this stuff, but the ComboFix run in your last computer should have cleared all of your 'Restore Points' and created a new one - AFTER - it was finished running.

One of the quirks of McAfee (in the old days) was that it would keep a report/record of infected files - even after they had been deleted.

Have you physically looked in those folders to see if the files actually exist? As you know, some folders in XP may have to be viewed through some kind of LINUX-type boot disk.

If they files are truly gone, you can clear your McAfee log files and get rid of the 'false positive' messages.

Also - is this your computer?
Is the user accessing files from a remote source (external device or network share)?
Is the user using an account on the Internet that has 'Admin' privs?

Post back when you can, I'll hold the fort until the A Team checks in.
Vic

@awawada -
It is great that you are trying to help other Members here, but your quickie 'cut & paste' posts just really have no validity.
Please start taking the time to read the actual questions that are posted - and then do yourself a real favor and look at the profile of the Asker.

Before you ran Combofix...did you temporarily disable McAfee?

awawada,
Thanks for the effort but when I said "please don't just provide a generic or canned response for this" it was to avoid a post just like yours.  If this is an area where you can provide expertise then please show that in your comment.  Answer my questions and provide info with any links to let me know how they relate.  A group like that makes me suspect I will do more work looking into your response than I want or need to get a solution.  As I said, I am not a novice at this.  I will ignore your post but please feel free to post again if you can provide what I need.

younghv,
Thanks!  She (rpgamergirl) was very helpful in my previous question and I hope she joins this too.  I know that there are other experts who can help too so I welcome all who can (including you ;)).

Thanks for the info on how McAfee works.  If they were quarantined would they still be visible in the original folder, even to a Linux type boot?  I had thought quarantine would move the file from that location.  Sort like Delete but not quite the same.  Let me know if that is not correct or wrong for McAfee.  If the files are kept in the folders, even when quarantined, then I can have the user of that computer look to see if they find them.  At least those that aren't in the Restore subfolders.  I did help the user show the normally hidden files (the OS is XP Pro) so I am pretty sure we could look in the folders for at least those in the screenshots.  I just don't want to start that if the quarantine moved them.

I am not sure this would be a false positive.  At least I know the scan was run after what was done in the previous question.  The files were found during that scan.  Now the "restore" might be old but I thought the first three at least were current and legit.  Let me know if I am wrong or have misunderstood you on this point.

The computer isn't mind; it is my sister's and out of state.  There is no network involved but I can ask about the external drives, etc.  They might have one of those but it isn't connected normally as far as I know.  I will check to see if they use an admin user for normal computer use.  They probably do, like most people.  Even though I suggest and recommend otherwise it isn't always followed and sometimes can't be done when programs need those rights even to run.  Let me know if those questions are more for safe computer use (i.e. general, wise counsel) or are key for getting this fixed completely.

JeremySBrown,
I can double check this but to my knowledge McAfee was disabled before doing anything in the previous question.  In fact I believe the expert in that previous question saw some evidence of that because of the question she asked about "how McAfee was disabled."

ALL,
I will get the info you asked for but hopefully these responses will help you provide me with more too.  If there are any other questions or I missed something please let me know.  Thanks!

bol

awawada,

By the way ... I notice you are new to EE.  Please don't take offense at my response to you or think I am trying to keep you (or anyone) out.  Quite the contrary and I wish you the best as a new expert here.  However I was clear in my post and your response doesn't really show you read it.  Also, as an expert, you should ALWAYS post more than just links.  Show your expertise in your response by including a comment and info.  Even in a case where the link you provide is a perfect, complete answer you can still add that as a comment.  In cases where viruses are involved it is my experience the "shotgun" or canned approach wastes time and can sometimes be more harmful.  The response you provide seemed to be that type of comment so, if it isn't, please improve the info you provide.  I will take time to provide details and info to you and I expect the same from the experts.

I hope the info above helps as you use this site and help here and in other questions.  It is meant as just friendly advise, one expert to another.  Good luck and welcome!

bol

bol - Have a computer in the workshop with McAfee loaded and I'm trying to figure out how to 'clear' the logs.
If you can either clear them or do a new scan to see if those infected files still show up.

"ComboFix" will flash a big warning if any AV process is still running and make you 'accept' it to keep running - so I doubt that McAfee was running during the scan.

I'll be back in a bit - prior commitment.

bol - sorry to piece-meal you on the responses.
I just re-read your response and it appears as though ComboFix did NOT clear your restore points, the computer has been re-infected already, or the McAfee logs are reflecting old information, (and maybe something else). :)

I was out in the workshop playing with that McAfee computer, trying to figure out how to clear or delete the files in quarantine. I didn't have any entries in the logs, but the Help link says that you can select either 'Restore' or 'Delete' for each of those files. Looking at your screen captures above, I see the Restore option right there, but not the Delete.

rpg should be coming on-line pretty soon, and I have asked the McAfee Man (legalsrl) to check in also.

Unless I think of something constructive, I'm just going to watch from here on out.

Vic
 

Vic,

Thanks!  It will be a few days before I will be able to have anything tried on the computer anyways.  I can get some more details but the user won't be at the machine for a few days.

Thanks for letting me know about the ComboFix and restore points.  When you get a chance I would be curious to know what you saw in the log that showed that if you can share. :)  Parts of the log are easy to read but I definitely don't know some key things about those logs.  All of this help is invaluable but my curiousity also wishes I knew a little more. :)

bol

I haven't read all the comments in this thread yet so pardon me if I say things that already been said.

I've looked at the images and those files are no longer in their original folders.
Based on those images.... it shows that Combofix hasn't been uninstalled from that system because Qoobox is Combofix own quarantine folder.... if Combofix has been uninstalled then that folder would have been deleted....
Combofix will reset System restore and create a new restore point also.

So what I need to verify is....did the user uninstall combofix and it didn't do what's it supposed to do? which is deleting all its files including the Qoobox folder and resetting the System Restore?

OR: the user did not uninstall Combofix (which is what I would assume looking at those images.

rpggamergirl,

The user had not uninstalled ComboFix before McAfee scanned.  I had the user run it before the post about uninstalling and I didn't realize this would happen with it still installed.  I complete ignored or missed the fact the files were actually in a QOOBOX folder.  I just saw the rest and thought it was the normal Windows or User folders.

Would your recommendation then be to uninstall ComboFix, using the steps you provided in the other Q, and then run McAfee scan again after the uninstall?  It will be a few days until that can be done but it seems like that is what we should've done.

Vic,
Now I understand what you were saying better.  Thanks for the posts and info.

bol

younghv knows about any tools... and he sure knows Combofix too, good job Vic, :)


<<<"I had thought quarantine would move the file from that location.  Sort like Delete but not quite the same">>>

I don't know about McAfee, but when Combofix quarantines a file, it moves and renames that file with a .vir extension, and any files that CF quarantined can be restored at any time while Combofix is still installed.
 
And yes McAfee was disabled as shown in the CF logs at the other thread.

rpg,

I just read your second post.  I will have them uninstall and then run McAfee again.  It sounds like all is clean but we just need to uninstall ComboFix.  With the command you provided it will be easy to uninstall.

Do you think the fact McAfee quarantined some files will cause a problem for the uninstall or the restore point reset?

bol

Sorry didn't see your posts.

I don't think McAfee's quarantining the files from Qoobox will cause any problem with the CF uninstallation nor will it affect the resetting of the System Restore points.

To uninstall Combofix:
Go to Start > Run and 'copy and paste' next command in the field:

ComboFix /u

rpg,

Thanks!  It will be a few days but I will have them do that and post back here with the results.

>> To uninstall Combofix: <<
Those steps look easy.  A side question, if you know, can I run the command without any path because ComboFix "program folder" is added to the Path environment variable or is the program in one of WIndows "system" folders that are already in the path?  If you don't know then no worries but I was just curious.

bol

bol,

As far as I know, the full path is not required for any of the CF switches when ComboFix has already been run on the system.

ComboFix /u <-- is the only uninstall switch that sUBs had instructed Helpers to use.

~rpg

Sorry this was delayed.  I had to wait for results.  Things seem fine now though.  Thanks for everything!

Just as a follow up note ... the ComboFix program seemed to have been removed by some step.  i was told that running the uninstall command gave the message that the program couldn't be found.  I am going to have them check the quarantine area of McAfee, the hard drive for the Qoobox folder, and the status of System Restore but it seems all is good.  If you have any final thoughts on this info then please let me know.  Thanks for all the help and the patience while I got a response.

bol