Welcome guest. Before posting on our computer help forum, you must register. Click here it's easy and free.

Author Topic: unregistered files  (Read 16278 times)

0 Members and 1 Guest are viewing this topic.

bandalex

    Topic Starter


    Rookie

    • Experience: Experienced
    • OS: Windows XP
    Re: unregistered files
    « Reply #15 on: July 26, 2011, 07:45:12 AM »
    Hi Dave

    Log is pasted after this - have used P2P from Emule thru Limewire then Frostwire.  Latterly had noticed and read about growing number of issues and have not used at all in last 6 months but never got round to deleting it.  Small point though, have had to delete manually as it didn't appear in Control Panel - is that odd or not?

    Anyhow as promised and hope it all amkes sense to you!

    Alex


    SysProt AntiRootkit v1.0.1.0
    by swatkat

    ******************************************************************************************
    ******************************************************************************************

    No Hidden Processes found

    ******************************************************************************************
    ******************************************************************************************
    Kernel Modules:
    Module Name: Combo-Fix.sys
    Service Name: ---
    Module Base: F757C000
    Module End: F758B000
    Hidden: Yes

    Module Name: \SystemRoot\System32\Drivers\dump_atapi.sys
    Service Name: ---
    Module Base: F34B7000
    Module End: F34CF000
    Hidden: Yes

    Module Name: \SystemRoot\System32\Drivers\dump_WMILIB.SYS
    Service Name: ---
    Module Base: F7AB0000
    Module End: F7AB2000
    Hidden: Yes

    Module Name: \??\C:\ComboFix\catchme.sys
    Service Name: catchme
    Module Base: F7914000
    Module End: F791C000
    Hidden: Yes

    Module Name: \??\C:\WINDOWS\system32\Drivers\PROCEXP113.SYS
    Service Name: ---
    Module Base: F7AD6000
    Module End: F7AD8000
    Hidden: Yes

    ******************************************************************************************
    ******************************************************************************************
    SSDT:
    Function Name: ZwTerminateProcess
    Address: F3A38620
    Driver Base: F3A2E000
    Driver End: F3A50000
    Driver Name: \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys

    ******************************************************************************************
    ******************************************************************************************
    Kernel Hooks:
    Hooked Function: ZwYieldExecution
    At Address: 80504B08
    Jump To: F726FDF4
    Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys

    Hooked Function: ZwUnmapViewOfSection
    At Address: 805B2E48
    Jump To: F726FE20
    Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys

    Hooked Function: ZwTerminateProcess
    At Address: 805D29E2
    Jump To: F726FE34
    Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys

    Hooked Function: ZwSetValueKey
    At Address: 80622662
    Jump To: F726FDCA
    Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys

    Hooked Function: ZwSetSecurityObject
    At Address: 805C062E
    Jump To: F726FDE0
    Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys

    Hooked Function: ZwRenameKey
    At Address: 80623B12
    Jump To: F726FD9E
    Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys

    Hooked Function: ZwOpenThread
    At Address: 805CB6CC
    Jump To: F726FD4C
    Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys

    Hooked Function: ZwOpenProcess
    At Address: 805CB440
    Jump To: F726FD38
    Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys

    Hooked Function: ZwOpenKey
    At Address: 806254CE
    Jump To: F726FD60
    Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys

    Hooked Function: ZwMapViewOfSection
    At Address: 805B203A
    Jump To: F726FE0A
    Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys

    Hooked Function: ZwDeleteValueKey
    At Address: 8062475C
    Jump To: F726FDB4
    Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys

    Hooked Function: ZwDeleteKey
    At Address: 8062458C
    Jump To: F726FD88
    Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys

    Hooked Function: ZwCreateKey
    At Address: 806240F0
    Jump To: F726FD74
    Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys

    ******************************************************************************************
    ******************************************************************************************
    Hidden files/folders:
    Object: C:\Documents and Settings\HP_Owner\Cookies\???????????????L???????????????
    Status: Hidden

    Object: C:\Documents and Settings\HP_Owner\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{EE1C98D5-5C6E-7C57-C992-EC9B935BBB83}\01\12-{EE1C98D5-5C6E-7C57-C992-EC9B935
    Status: Hidden

    Object: C:\Documents and Settings\HP_Owner\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{BAFAFF34-6546-1C02-5C98-D03178B14D18}\01\10-{BAFAFF34-6546-1C02-5C98-D03178B14D1
    Status: Hidden

    Object: C:\Qoobox\BackEnv\AppData.folder.dat
    Status: Access denied

    Object: C:\Qoobox\BackEnv\Cache.folder.dat
    Status: Access denied

    Object: C:\Qoobox\BackEnv\Cookies.folder.dat
    Status: Access denied

    Object: C:\Qoobox\BackEnv\Desktop.folder.dat
    Status: Access denied

    Object: C:\Qoobox\BackEnv\Favorites.folder.dat
    Status: Access denied

    Object: C:\Qoobox\BackEnv\History.folder.dat
    Status: Access denied

    Object: C:\Qoobox\BackEnv\LocalAppData.folder.dat
    Status: Access denied

    Object: C:\Qoobox\BackEnv\LocalSettings.folder.dat
    Status: Access denied

    Object: C:\Qoobox\BackEnv\Music.folder.dat
    Status: Access denied

    Object: C:\Qoobox\BackEnv\NetHood.folder.dat
    Status: Access denied

    Object: C:\Qoobox\BackEnv\Personal.folder.dat
    Status: Access denied

    Object: C:\Qoobox\BackEnv\Pictures.folder.dat
    Status: Access denied

    Object: C:\Qoobox\BackEnv\PrintHood.folder.dat
    Status: Access denied

    Object: C:\Qoobox\BackEnv\Profiles.Folder.dat
    Status: Access denied

    Object: C:\Qoobox\BackEnv\Profiles.Folder.folder.dat
    Status: Access denied

    Object: C:\Qoobox\BackEnv\Programs.folder.dat
    Status: Access denied

    Object: C:\Qoobox\BackEnv\Recent.folder.dat
    Status: Access denied

    Object: C:\Qoobox\BackEnv\SendTo.folder.dat
    Status: Access denied

    Object: C:\Qoobox\BackEnv\SetPath.bat
    Status: Access denied

    Object: C:\Qoobox\BackEnv\StartMenu.folder.dat
    Status: Access denied

    Object: C:\Qoobox\BackEnv\StartUp.folder.dat
    Status: Access denied

    Object: C:\Qoobox\BackEnv\SysPath.dat
    Status: Access denied

    Object: C:\Qoobox\BackEnv\Templates.folder.dat
    Status: Access denied

    Object: C:\Qoobox\BackEnv\VikPev00
    Status: Access denied

    You can never have too much of what you don't need.

    SuperDave

    • Malware Removal Specialist


    • Genius
    • Thanked: 996
    • Certifications: List
    • Experience: Expert
    • OS: Windows 8
    Re: unregistered files
    « Reply #16 on: July 26, 2011, 04:32:29 PM »
    Quote
    have had to delete manually as it didn't appear in Control Panel - is that odd or not?
    Some of them have their own uninstaller. Just look at All Programs and see if there an uninstaller for that program. Or, you can see if HJT will find it.

    Delete An Uninstall Entry

    •Start HijackThis

    •Click on the Open the Misc Tools section

    •Click on the Open Uninstall Manager button.

    •Highlight the entry you want to remove.
    •Click Delete this entry
    ************************************************

    I'd like to scan your machine with ESET OnlineScan

    •Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
    •Click the button.
    •For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the icon on your desktop.
    •Check
    •Click the button.
    •Accept any security warnings from your browser.
    •Check
    •Push the Start button.
    •ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    •When the scan completes, push
    •Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
    •Push the button.
    •Push
    A log file will be saved here: C:\Program Files\ESET\ESET Online Scanner\log.txt
    Intel(R) Core (TM) i3-3220 CPU 3.30 GHz 8.0 Gb RAM Windows 8.1 with a dual boot to Windows XP  Home with SP3, Comodo  with Windows Firewall & Windows Defender

    bandalex

      Topic Starter


      Rookie

      • Experience: Experienced
      • OS: Windows XP
      Re: unregistered files
      « Reply #17 on: July 27, 2011, 03:43:20 AM »
      Wow, that took a long time (almost 6 hours!) - slept thru most of it.

      Here's the results

      C:\Bens Stuff\MsgPlusLive-460.exe   a variant of Win32/Adware.CiDHelp application   cleaned by deleting - quarantined
      C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WinBankerfgv.zip   Win32/Bagle.gen.zip worm   cleaned by deleting - quarantined
      C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WinBankerfgv1.zip   Win32/Bagle.gen.zip worm   cleaned by deleting - quarantined
      C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WinBankerfgv2.zip   Win32/Bagle.gen.zip worm   cleaned by deleting - quarantined
      C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WinBankerfgv3.zip   Win32/Bagle.gen.zip worm   cleaned by deleting - quarantined
      C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WinBankerfgv4.zip   Win32/Bagle.gen.zip worm   cleaned by deleting - quarantined
      C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WinBankerfgv5.zip   Win32/Bagle.gen.zip worm   cleaned by deleting - quarantined
      C:\Documents and Settings\HP_Owner\Application Data\Sun\Java\Deployment\cache\6.0\11\7ed88b0b-6574cc5b   multiple threats   deleted - quarantined
      C:\Documents and Settings\HP_Owner\Local Settings\Application Data\Google\Chrome\User Data\Default\Default\hfnfjpohnpggkhfgolfffpcljnllfojl\contentscript.js   Win32/TrojanDownloader.Tracur.F trojan   cleaned by deleting - quarantined
      C:\Qoobox\Quarantine\C\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\jvo1qb88.default\extensions\{73e1e35c-27c2-44c5-90fa-cf9da6cbfec3}\chrome\xulcache.jar.vir   JS/Agent.NCP trojan   deleted - quarantined
      C:\Qoobox\Quarantine\C\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\jvo1qb88.default\extensions\{b9452a5b-916c-404f-8479-850185ae13bc}\chrome\xulcache.jar.vir   JS/Agent.NCP trojan   deleted - quarantined
      C:\System Volume Information\_restore{D5F7A20F-1294-41E9-A947-A77075103E2E}\RP1209\A0310536.exe   a variant of Win32/Adware.CiDHelp application   cleaned by deleting - quarantined

      Have just re-started and (so far) no d**mned messages!

      Also, why did you appear a little critical of Firefox v Explorer - are there serious security problems with it?

      Cheers
      Alex
      You can never have too much of what you don't need.

      SuperDave

      • Malware Removal Specialist


      • Genius
      • Thanked: 996
      • Certifications: List
      • Experience: Expert
      • OS: Windows 8
      Re: unregistered files
      « Reply #18 on: July 27, 2011, 05:39:51 PM »
      Quote
      Also, why did you appear a little critical of Firefox v Explorer - are there serious security problems with it?
      Firefox is reported to be a safer browser than IE but I'm not critical about Firefox. In fact, I use both.
      Let's give it a few days to see what happens and then come back and we'll do some cleanup.
      Intel(R) Core (TM) i3-3220 CPU 3.30 GHz 8.0 Gb RAM Windows 8.1 with a dual boot to Windows XP  Home with SP3, Comodo  with Windows Firewall & Windows Defender

      bandalex

        Topic Starter


        Rookie

        • Experience: Experienced
        • OS: Windows XP
        Re: unregistered files
        « Reply #19 on: July 28, 2011, 02:58:52 AM »
        Thanks for that.  Just a small note to say I did first cold start this a.m. and again no repetition of the problem.  If I may ask a slightly unrelated question - McAfee Security Centre is pretty resource hungry and vibes I'm getting from around the Net are that it's not as efficient as some of the free systems like AVG.  What's your take?

        Alex
        You can never have too much of what you don't need.

        SuperDave

        • Malware Removal Specialist


        • Genius
        • Thanked: 996
        • Certifications: List
        • Experience: Expert
        • OS: Windows 8
        Re: unregistered files
        « Reply #20 on: July 28, 2011, 04:11:23 PM »
        Quote
        McAfee Security Centre is pretty resource hungry and vibes I'm getting from around the Net are that it's not as efficient as some of the free systems like AVG.  What's your take?
        In my opinion, the best of the free AV's is MSE. It's lightweight and updates all the time and no need to register; install it and forget about it. AVG is also very resource hungry.

        Microsoft Security Essentials for Windows Vista\Windows 7 - 64 bit Download
        Microsoft Security Essentials for Windows XP

        We may just as well do some cleanup.

        To uninstall ComboFix

        • Click the Start button. Click Run. For Vista: type in Run in the Start search, and click on Run in the results pane.
        • In the field, type in ComboFix /uninstall


        (Note: Make sure there's a space between the word ComboFix and the forward-slash.)

        • Then, press Enter, or click OK.
        • This will uninstall ComboFix, delete its folders and files, hides System files and folders, and resets System Restore.
        If this doesn't remove ComboFix, please let me know.
        *************************************************************
        Clean out your temporary internet files and temp files.

        Download TFC by OldTimer to your desktop.

        Double-click TFC.exe to run it.

        Note: If you are running on Vista, right-click on the file and choose Run As Administrator

        TFC will close all programs when run, so make sure you have saved all your work before you begin.

        * Click the Start button to begin the cleaning process.
        * Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two.
        * Please let TFC run uninterrupted until it is finished.

        Once TFC is finished it should restart your computer. If it does not, please manually restart the computer yourself to ensure a complete cleaning.
        ***********************************************************
        Use the Secunia Software Inspector to check for out of date software.

        •Click Start Now

        •Check the box next to Enable thorough system inspection.

        •Click Start

        •Allow the scan to finish and scroll down to see if any updates are needed.
        •Update anything listed.
        .
        ----------

        Go to Microsoft Windows Update and get all critical updates.

        ----------

        I suggest using WOT - Web of Trust. WOT is a free Internet security addon for your browser. It will keep you safe from online scams, identity theft, spyware, spam, viruses and unreliable shopping sites. WOT warns you before you interact with a risky website. It's easy and it's free.

        SpywareBlaster- Secure your Internet Explorer to make it harder for ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox.
        * Using SpywareBlaster to protect your computer from Spyware and Malware
        * If you don't know what ActiveX controls are, see here

        Protect yourself against spyware using the Immunize feature in Spybot - Search & Destroy. Guide: Use Spybot's Immunize Feature to prevent spyware infection in real-time. Note: To ensure you have the latest Immunizations always update Spybot - Search & Destroy before Immunizing. Spybot - Search & Destroy FAQ

        Check out Keeping Yourself Safe On The Web for tips and free tools to help keep you safe in the future.

        Also see Slow Computer? It may not be Malware for free cleaning/maintenance tools to help keep your computer running smoothly.
        Safe Surfing!
        Intel(R) Core (TM) i3-3220 CPU 3.30 GHz 8.0 Gb RAM Windows 8.1 with a dual boot to Windows XP  Home with SP3, Comodo  with Windows Firewall & Windows Defender

        bandalex

          Topic Starter


          Rookie

          • Experience: Experienced
          • OS: Windows XP
          Re: unregistered files
          « Reply #21 on: July 29, 2011, 02:47:05 AM »
          Hi Dave

          Oh dear - switched on this a.m. and the messages are back.  I thought they might be as I was updating my GTA user radio file and as I was copying across the message flashed up again.  That might mean that there's a nasty in my music files or there's a meanie in the games disk (unlikely I guess).  Before I follow your last lot of instructions, how should I proceed next?

          Alex
          You can never have too much of what you don't need.

          bandalex

            Topic Starter


            Rookie

            • Experience: Experienced
            • OS: Windows XP
            Re: unregistered files
            « Reply #22 on: July 29, 2011, 06:11:18 AM »
            Also should mention there was an update of McAfee during the day - again it seems unlikely but is it possible there's a glitch in my files that might be causing this?

            Alex
            You can never have too much of what you don't need.

            SuperDave

            • Malware Removal Specialist


            • Genius
            • Thanked: 996
            • Certifications: List
            • Experience: Expert
            • OS: Windows 8
            Re: unregistered files
            « Reply #23 on: July 29, 2011, 04:38:07 PM »
            Quote
            again it seems unlikely but is it possible there's a glitch in my files that might be causing this?
            I'm sorry but I'm at a loss as to what to do next.
            Are you just getting the WFP message?
            Have you ever received messages like this?
            Quote
            Windows File Protection
            Files that are required for Windows to run properly have been replaced by unrecognized versions. To maintain system stability, Windows must restore the original versions of these files. Insert your product CD-ROM now.
            or this?[/COLOR]
            Quote
            Windows File Protection
            Files that are required for Windows to run properly have been replaced by unrecognized versions. To maintain system stability, Windows must restore the original versions of these files. The network location from which these files should be copied, \\server\share, is not available. Contact your system administrator or insert product CD-ROM now.
            Note: You must be logged in as Administrator to receive these messages.
            Intel(R) Core (TM) i3-3220 CPU 3.30 GHz 8.0 Gb RAM Windows 8.1 with a dual boot to Windows XP  Home with SP3, Comodo  with Windows Firewall & Windows Defender

            bandalex

              Topic Starter


              Rookie

              • Experience: Experienced
              • OS: Windows XP
              Re: unregistered files
              « Reply #24 on: July 29, 2011, 05:01:14 PM »
              Yes, the first of the 2 messages you quote has been the one appearing regularly for the past couple of weeks.  You may recall that I bought the machine 3 years ago without a system disk (Its a hewlett packard by the way) but with Windows XP duly loaded up and full I386 backup.  Until this started I'd never had this message before.

              It seems odd to me that there is no software that seems able to monitorregistry files and identify which ones are specifically unregistered so that I/we can pinpoint the area that's causing problems.  Maybe it's just something I'll have to live with.

              Should I continue with the instructions from your previous post or go back over some of the prior routines - if the latter, advice please.

              If there's nothing else you can suggest then many thanks for your efforts and my apologies for being a nuisance!

              Alex
              You can never have too much of what you don't need.

              SuperDave

              • Malware Removal Specialist


              • Genius
              • Thanked: 996
              • Certifications: List
              • Experience: Expert
              • OS: Windows 8
              Re: unregistered files
              « Reply #25 on: July 30, 2011, 05:50:18 PM »
              I'm going to check with my colleague about this problem.
              Intel(R) Core (TM) i3-3220 CPU 3.30 GHz 8.0 Gb RAM Windows 8.1 with a dual boot to Windows XP  Home with SP3, Comodo  with Windows Firewall & Windows Defender

              SuperDave

              • Malware Removal Specialist


              • Genius
              • Thanked: 996
              • Certifications: List
              • Experience: Expert
              • OS: Windows 8
              Re: unregistered files
              « Reply #26 on: July 31, 2011, 01:29:41 PM »
              Ok. Let's try this. Please remove McAfee using this tool below and then re-install McAfee and see what happens.

              Download the McAfee Consumer Product Removal Tool to your Desktop.

              Using McAfee Consumer Product Removal tool:

              * Double click the MCPR.exe
              * A Command Line window will be displayed, and then close automatically.
              * Wait for a second Command Line window to be displayed.

              Note: Do not double-click MCPR.exe again, you may have to wait up to 1 minute for the next window to appear.

              * After the second window appears, the program will begin the cleanup.
              * Observe the installation, which could take several minutes. The following message will be displayed in the Command Line window: The machine must reboot to complete the un-installation. Reboot now? [y.n]
              * Press Y on the keyboard.
              * Wait for the computer to restart.
              * All McAfee products are now removed from your computer.
              Intel(R) Core (TM) i3-3220 CPU 3.30 GHz 8.0 Gb RAM Windows 8.1 with a dual boot to Windows XP  Home with SP3, Comodo  with Windows Firewall & Windows Defender

              bandalex

                Topic Starter


                Rookie

                • Experience: Experienced
                • OS: Windows XP
                Re: unregistered files
                « Reply #27 on: August 02, 2011, 04:31:55 AM »
                Okay, that's done.  2 warm starts and no re-occurence so I'll wait for the next cold start before I get too excited!  Apparently McAfee doesn't get along with Malwarebytes or Spybot.  I've let it delete the first but it couldn't scupper the second.

                Alex
                You can never have too much of what you don't need.

                bandalex

                  Topic Starter


                  Rookie

                  • Experience: Experienced
                  • OS: Windows XP
                  Re: unregistered files
                  « Reply #28 on: August 03, 2011, 09:49:27 AM »
                  Cold start resulted in 2 things - first a re-occurrence of the File Protection message - just once though, not twice) and then a re-installation of McAfee which I can only assume was automatically generated from the host after I deleted and didn't noticed that I'd manually re-instated it!

                  Just warm-started again and again got a single repetition of the problem - maybe we're making some progress.  I want to remind you that this is not having any apparent negative effects on speed or performance.

                  Alex
                  You can never have too much of what you don't need.

                  SuperDave

                  • Malware Removal Specialist


                  • Genius
                  • Thanked: 996
                  • Certifications: List
                  • Experience: Expert
                  • OS: Windows 8
                  Re: unregistered files
                  « Reply #29 on: August 04, 2011, 01:23:36 PM »
                  Did you use the Removal tool I provided? Programs do not re-install by themselves unless it's malware.
                  Please run this scan for me.


                  Download OTL to your desktop.

                  * Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
                  * When the window appears, underneath Output at the top change it to Minimal Output.
                  * Check the boxes beside LOP Check and Purity Check.
                  * Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan won't take long.

                  When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.

                  Please copy and pate the contents of these files, one at a time, into your next reply.

                  Note: You may need two or more posts to fit them all in.
                  Intel(R) Core (TM) i3-3220 CPU 3.30 GHz 8.0 Gb RAM Windows 8.1 with a dual boot to Windows XP  Home with SP3, Comodo  with Windows Firewall & Windows Defender