Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 178
  • Last Modified:

McAfee keeps removing things - but nothing found

McAfee keeps removing files simultaneously with it's alert.  Each time it refers to different trojans.  Recently it took out two files from my system restore.  I just ran the entire scan on my WINDOWS folder and it found nothing.  I am about to scan the entire drive, but I'm not sure what to do at this point.  
0
linque
Asked:
linque
  • 4
  • 4
  • 2
  • +1
2 Solutions
 
war1Commented:
Greetings, linque !

McAfee cannot remove files in System Restore.  If trojans are on System Restore files, you need to disable system restore and then re-enable system restore to write over the old files.
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001111912274039?OpenDocument&src=sec_doc_nam


Best wishes!
0
 
r-kCommented:
To be on the safe side, download and run RootkitRevealer from: http://www.sysinternals.com/Utilities/RootkitRevealer.html

Sometimes the symptoms you describe could be a hint of a rootkit, i.e. files that are hidden from the normal system.

While running RootkitRevealer, don't use your system if possible to avoid false positives.

If it produces anything interesting please post the list here (after saving to a text file), but if the list is very long then only post the first 50 lines or so.
0
 
linqueAuthor Commented:
I will report back to you on this - thanks
0
Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
r-kCommented:
linque:

Thanks for acepting the answer, but if turns out that war1's suggestion was more helpful then you can post a request in the Support area (link at upper-right of this page) to re-open the question so you can reassign the points.
0
 
linqueAuthor Commented:
Hi - I've run the RootkidRevealer program.  It had 4 lines:

HKLM\SOFTWARE\Microsoft\Cryptography\RNG\Seed      5/22/2006 7:00 PM      80 bytes      Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Microsoft\SchedulingAgent\LastTaskRun      5/22/2006 3:01 PM      16 bytes      Data mismatch between Windows API and raw hive data.
C:\System Volume Information\_restore{6E7E82D8-B1BF-459C-8DAE-8245B1CA39AD}\RP1348\A0177499.exe:Zone.Identifier      1/8/2006 3:39 AM      26 bytes      Hidden from Windows API.
E:\System Volume Information\_restore{6E7E82D8-B1BF-459C-8DAE-8245B1CA39AD}\RP1349\A0177516.exe:Zone.Identifier      5/16/2005 1:47 AM      26 bytes      Hidden from Windows API.

I have 2 hard drives - the E is a backup/clone I create every so often.  I suppose I should disable it.

But I have no idea what this is about.  I do think the long numbers after {restore may be the same I'm seeing in Mcaffee.  I will have to wait until the next time it displays, however, to be certain.
0
 
r-kCommented:
Overall this is good news. It shows that you don't have a rootkit.

You can clear the System Restore by disabling it, then re-enabling it:

 Control Panel -> System -> System Restore

then "check" the box that reads "Disable System Restore"

Then reboot and "un-check" that box to reenable system restore.

That will clear out the old copies and remove any old trojan hiding in there.

To be on the safe side, you can also do the following:

Download and run HijackThis from http://www.hijackthis.de/
Copy-and-paste the resulting log back to that same web site (not here)
Click on "Analyze", and then click on "Save Analysis" at the bottom of the next page.
Finally post a link here to the saved analyzed page.

This will tell us if there anything bad still "active" in your system.

I would not worry about the E: drive.

0
 
linqueAuthor Commented:
Thank you so very much!  I'll attempt to do the Hijackthis also!
0
 
war1Commented:
linque,

As I posted in my first comment, McAfee is finding trojans in System Restore files.  You need to uninstall and reinstall System Restore to get rid of those files.
0
 
linqueAuthor Commented:
This was awkward!  I assume the question was reopened due to the conclusions reached after running RootkitReveal.  I understand the reasoning.  War1 sensed that I should stop and re-start my system restore.  On the otherhand, I've learned about a new tool which gave me hard evidence about what was going on.  Both wise people.  
0
 
AnnieModCommented:
I reopened because war1 asked in CS to do so :)
And after I read here it was clear that the second expert agrees so I just reopened :)

Annie
0
 
r-kCommented:
No problem with that.

linque, in case you find anything interesting with HijackThis do post back.
0

Featured Post

Evaluating UTMs? Here's what you need to know!

Evaluating a UTM appliance and vendor can prove to be an overwhelming exercise.  How can you make sure that you're getting the security that your organization needs without breaking the bank? Check out our UTM Buyer's Guide for more information on what you should be looking for!

  • 4
  • 4
  • 2
  • +1
Tackle projects and never again get stuck behind a technical roadblock.
Join Now