Mcafee Download Site[RESOLVED]

therock247uk · October 7, 2006

Please make sure your PC is set to show all hidden files and folders go here for instructions on how to do this. http://pchowtos.co.uk/index.php?page=tutor...=view&id=34

Please download the Killbox by Option^Explicit.

Note: In the event you already have Killbox, this is a new version that I need you to download.

Boot into safemode to do this keep tapping F8 on your keyboard while your PC is starting up you will get a menu select safemode.

While in safemode open Hijackthis and click scan. Then check mark the following entries

R3 - Default URLSearchHook is missing

O4 - HKLM\..\Run: [iexplore.exe] C:\Program Files\Internet Explorer\iexplore.exe

O20 - AppInit_DLLs: C:\WINDOWS\System32\win_a3.dll

Now close all open windows except Hijackthis and click fix checked

Delete the folders. (if present)

C:\WINDOWS\inet20004

Please double-click Killbox.exe to run Killbox.
Select:
- Delete on Reboot
- then Click on the All Files button.
[*]Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):
C:\WINDOWS\System32\win_a3.dll
[*] Return to Killbox, go to the File menu, and choose Paste from Clipboard.
[*]Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt. Click OK at any PendingFileRenameOperations prompt (and please let me know if you receive this message!).

If your computer does not restart automatically, please restart it manually.

If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run Killbox, click here to download and run missingfilesetup.exe. Then try Killbox again.

Then post a new Hijackthis log here in a reply also...

Open HijackThis, click Config, click Misc Tools

Click "Open Uninstall Manager"

Click "Save List" (generates uninstall_list.txt)

Click Save, copy and paste the results in your next post.

And do you know what file this is? C:\Program Files\Picasa\pinstall.dll

taniguce · October 7, 2006

Please make sure your PC is set to show all hidden files and folders go here for instructions on how to do this. http://pchowtos.co.uk/index.php?page=tutor...=view&id=34
Please download the Killbox by Option^Explicit.
Note: In the event you already have Killbox, this is a new version that I need you to download.
Boot into safemode to do this keep tapping F8 on your keyboard while your PC is starting up you will get a menu select safemode.
While in safemode open Hijackthis and click scan. Then check mark the following entries
R3 - Default URLSearchHook is missing
O4 - HKLM\..\Run: [iexplore.exe] C:\Program Files\Internet Explorer\iexplore.exe
O20 - AppInit_DLLs: C:\WINDOWS\System32\win_a3.dll
Now close all open windows except Hijackthis and click fix checked
Delete the folders. (if present)
C:\WINDOWS\inet20004
Please double-click Killbox.exe to run Killbox.
Select:
Delete on Reboot
then Click on the All Files button.
[*]Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):
C:\WINDOWS\System32\win_a3.dll
[*] Return to Killbox, go to the File menu, and choose Paste from Clipboard.
[*]Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt. Click OK at any PendingFileRenameOperations prompt (and please let me know if you receive this message!).
If your computer does not restart automatically, please restart it manually.
If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run Killbox, click here to download and run missingfilesetup.exe. Then try Killbox again.
Then post a new Hijackthis log here in a reply also...
Open HijackThis, click Config, click Misc Tools
Click "Open Uninstall Manager"
Click "Save List" (generates uninstall_list.txt)
Click Save, copy and paste the results in your next post.
And do you know what file this is? C:\Program Files\Picasa\pinstall.dll

1. I ran Hijack This and checked the boxes to delete. I received an error message regarding deleting the 020 box, O20 - AppInit_DLLs: C:\WINDOWS\System32\win_a3.dll. It should be noted in the hijack logfile.

2. I ran Killblox and did receive the message regarding any PendingFileRenameOperations prompt . I clicked OK at this prompt as you instructed.

3. I do not know what the C:\Program Files\Picasa\pinstall.dll is. I do have a "Hello" folder in the C:\Program Files\ directory which I don't know anything about. In the folder, it has a Picasa icon. I did a search on Google regarding the Hello.exe program. It looks like another spyware. I have a feeling this is also a bad program or something that should be deleted. I also have a Picasa and a Picasa2 folder in the C:\Program Files\ directory of which I do not know anything about. Can I just unistall these programs? Please advise on these.

Hijack Logfile:

Logfile of HijackThis v1.99.1

Scan saved at 3:42:17 PM, on 10/7/2006

Platform: Windows XP (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/

R3 - Default URLSearchHook is missing

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL

O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O3 - Toolbar: McAfee VirusScan - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - C:\Program Files\McAfee\McAfee VirusScan\VSCShellExtension.dll

O4 - HKLM\..\Run: [systemTray] SysTray.Exe

O4 - HKLM\..\Run: [iexplore.exe] C:\Program Files\Internet Explorer\iexplore.exe

O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP

O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [PopUpStopperFreeEdition] C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe

O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe

O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll

O9 - Extra 'Tools' menuitem: Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O16 - DPF: {A22FCC59-1921-45B8-AA99-CD01D1A01DA9} - http://nexpoly.co.kr/controls/nixplay25.cab

O20 - AppInit_DLLs: C:\WINDOWS\System32\win_a3.dll

O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe

O23 - Service: AVSync Manager (AvSynMgr) - Network Associates, Inc. - C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe

O23 - Service: McAfee Firewall - Unknown owner - C:\Program Files\McAfee\McAfee Firewall\CPD.EXE" /SERVICE (file missing)

O23 - Service: McShield - Unknown owner - C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe

********************************************************************************

******

Uninstall_list.txt:

Adaptec DirectCD

Adaptec Easy CD Creator 4

Ad-Aware SE Personal

Adobe Acrobat 5.0

Adobe Download Manager 1.2 (Remove Only)

Adobe Photoshop 6.0

Adobe Reader 6.0.1

Adobe SVG Viewer

Arabic Language Support

ATI - Software Uninstall Utility

ATI Control Panel

AVG Anti-Spyware 7.5

AVG Free Edition

Backpack Driver

By Design Home

CCleaner (remove only)

Chinese (Simplified) Language Support

Chinese (Traditional) Language Support

Eudora

Galaris Musicians Directory 2005

Hebrew Language Support

Hello (remove only)

HijackThis 1.99.1

HP DeskJet 930C Series (Remove only)

HP PhotoSmart Photo Printing Software

HydraVision

Intel HaM Modem Drivers and Utilities

J2SE Runtime Environment 5.0 Update 6

Japanese Language Support

Keynote Connector

Korean Language Support

Kova-Solutions jBackup

LSP Explorer plug-in for Ad-Aware SE

Macromedia Dreamweaver

Macromedia Flash Player 8

Macromedia Shockwave Player

McAfee Firewall

McAfee VirusScan Home Edition

Microsoft Data Access Components KB870669

Microsoft Office 97, Professional Edition

Microsoft VGX Q833989

Mozilla Firefox (1.5)

Offer Optimizer

Outlook Express Q837009

Paint Shop Pro Shareware Version 3.11

Panda ActiveScan

Pan-European Language Support

Picasa 2

Pop-Up Stopper Free Edition

RealPlayer

RegScrubXP 3.25

Shopping Wizard

Sound Blaster AudioPCI

Spybot - Search & Destroy 1.3

SpywareBlaster v3.5.1

SpywareGuard v2.2

STOMP Backup MyPC

STOMP Backup MyPC Update Manager

Thai Language Support

Tweak-SE plug-in for Ad-Aware SE

VIA Audio Driver Setup Program

Windows XP Hotfix - KB823559

Windows XP Hotfix - KB828741

Windows XP Hotfix - KB833987

Windows XP Hotfix - KB834707

Windows XP Hotfix - KB835732

Windows XP Hotfix - KB840987

Windows XP Hotfix - KB841356

Windows XP Hotfix - KB841533

Windows XP Hotfix - KB842773

Windows XP Hotfix - KB873376

Windows XP Hotfix - KB887822

Windows XP Hotfix (SP1) [see Q329048 for more information]

Windows XP Hotfix (SP1) [see Q329390 for more information]

Windows XP Hotfix (SP1) [see Q329441 for more information]

Windows XP Hotfix (SP1) [see Q329834 for more information]

Windows XP Hotfix (SP1) Q329170

Windows XP Hotfix (SP1) Q810577

Windows XP Hotfix (SP1) Q810833

Windows XP Hotfix (SP1) Q817606

Windows XP Hotfix (SP2) [see Q329115 for more information]

WinZip

taniguce · October 7, 2006

Please make sure your PC is set to show all hidden files and folders go here for instructions on how to do this. http://pchowtos.co.uk/index.php?page=tutor...=view&id=34
Please download the Killbox by Option^Explicit.
Note: In the event you already have Killbox, this is a new version that I need you to download.
Boot into safemode to do this keep tapping F8 on your keyboard while your PC is starting up you will get a menu select safemode.
While in safemode open Hijackthis and click scan. Then check mark the following entries
R3 - Default URLSearchHook is missing
O4 - HKLM\..\Run: [iexplore.exe] C:\Program Files\Internet Explorer\iexplore.exe
O20 - AppInit_DLLs: C:\WINDOWS\System32\win_a3.dll
Now close all open windows except Hijackthis and click fix checked
Delete the folders. (if present)
C:\WINDOWS\inet20004
Please double-click Killbox.exe to run Killbox.
Select:
Delete on Reboot
then Click on the All Files button.
[*]Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):
C:\WINDOWS\System32\win_a3.dll
[*] Return to Killbox, go to the File menu, and choose Paste from Clipboard.
[*]Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt. Click OK at any PendingFileRenameOperations prompt (and please let me know if you receive this message!).
If your computer does not restart automatically, please restart it manually.
If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run Killbox, click here to download and run missingfilesetup.exe. Then try Killbox again.
Then post a new Hijackthis log here in a reply also...
Open HijackThis, click Config, click Misc Tools
Click "Open Uninstall Manager"
Click "Save List" (generates uninstall_list.txt)
Click Save, copy and paste the results in your next post.
And do you know what file this is? C:\Program Files\Picasa\pinstall.dll
1. I ran Hijack This and checked the boxes to delete. I received an error message regarding deleting the 020 box, O20 - AppInit_DLLs: C:\WINDOWS\System32\win_a3.dll. It should be noted in the hijack logfile.
2. I ran Killblox and did receive the message regarding any PendingFileRenameOperations prompt . I clicked OK at this prompt as you instructed.
3. I do not know what the C:\Program Files\Picasa\pinstall.dll is. I do have a "Hello" folder in the C:\Program Files\ directory which I don't know anything about. In the folder, it has a Picasa icon. I did a search on Google regarding the Hello.exe program. It looks like another spyware. I have a feeling this is also a bad program or something that should be deleted. I also have a Picasa and a Picasa2 folder in the C:\Program Files\ directory of which I do not know anything about. Can I just unistall these programs? Please advise on these.
Hijack Logfile:
Logfile of HijackThis v1.99.1
Scan saved at 3:42:17 PM, on 10/7/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: McAfee VirusScan - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - C:\Program Files\McAfee\McAfee VirusScan\VSCShellExtension.dll
O4 - HKLM\..\Run: [systemTray] SysTray.Exe
O4 - HKLM\..\Run: [iexplore.exe] C:\Program Files\Internet Explorer\iexplore.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
O9 - Extra 'Tools' menuitem: Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {A22FCC59-1921-45B8-AA99-CD01D1A01DA9} - http://nexpoly.co.kr/controls/nixplay25.cab
O20 - AppInit_DLLs: C:\WINDOWS\System32\win_a3.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVSync Manager (AvSynMgr) - Network Associates, Inc. - C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
O23 - Service: McAfee Firewall - Unknown owner - C:\Program Files\McAfee\McAfee Firewall\CPD.EXE" /SERVICE (file missing)
O23 - Service: McShield - Unknown owner - C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
********************************************************************************
******
Uninstall_list.txt:
Adaptec DirectCD
Adaptec Easy CD Creator 4
Ad-Aware SE Personal
Adobe Acrobat 5.0
Adobe Download Manager 1.2 (Remove Only)
Adobe Photoshop 6.0
Adobe Reader 6.0.1
Adobe SVG Viewer
Arabic Language Support
ATI - Software Uninstall Utility
ATI Control Panel
AVG Anti-Spyware 7.5
AVG Free Edition
Backpack Driver
By Design Home
CCleaner (remove only)
Chinese (Simplified) Language Support
Chinese (Traditional) Language Support
Eudora
Galaris Musicians Directory 2005
Hebrew Language Support
Hello (remove only)
HijackThis 1.99.1
HP DeskJet 930C Series (Remove only)
HP PhotoSmart Photo Printing Software
HydraVision
Intel HaM Modem Drivers and Utilities
J2SE Runtime Environment 5.0 Update 6
Japanese Language Support
Keynote Connector
Korean Language Support
Kova-Solutions jBackup
LSP Explorer plug-in for Ad-Aware SE
Macromedia Dreamweaver
Macromedia Flash Player 8
Macromedia Shockwave Player
McAfee Firewall
McAfee VirusScan Home Edition
Microsoft Data Access Components KB870669
Microsoft Office 97, Professional Edition
Microsoft VGX Q833989
Mozilla Firefox (1.5)
Offer Optimizer
Outlook Express Q837009
Paint Shop Pro Shareware Version 3.11
Panda ActiveScan
Pan-European Language Support
Picasa 2
Pop-Up Stopper Free Edition
RealPlayer
RegScrubXP 3.25
Shopping Wizard
Sound Blaster AudioPCI
Spybot - Search & Destroy 1.3
SpywareBlaster v3.5.1
SpywareGuard v2.2
STOMP Backup MyPC
STOMP Backup MyPC Update Manager
Thai Language Support
Tweak-SE plug-in for Ad-Aware SE
VIA Audio Driver Setup Program
Windows XP Hotfix - KB823559
Windows XP Hotfix - KB828741
Windows XP Hotfix - KB833987
Windows XP Hotfix - KB834707
Windows XP Hotfix - KB835732
Windows XP Hotfix - KB840987
Windows XP Hotfix - KB841356
Windows XP Hotfix - KB841533
Windows XP Hotfix - KB842773
Windows XP Hotfix - KB873376
Windows XP Hotfix - KB887822
Windows XP Hotfix (SP1) [see Q329048 for more information]
Windows XP Hotfix (SP1) [see Q329390 for more information]
Windows XP Hotfix (SP1) [see Q329441 for more information]
Windows XP Hotfix (SP1) [see Q329834 for more information]
Windows XP Hotfix (SP1) Q329170
Windows XP Hotfix (SP1) Q810577
Windows XP Hotfix (SP1) Q810833
Windows XP Hotfix (SP1) Q817606
Windows XP Hotfix (SP2) [see Q329115 for more information]
WinZip

This is an addition to my last reply. I didn't know if I was suppose to create another HiJack logfile after the 3 boxes were checked and deleted. So, I went back and ran another scan and create logfile just in case. I am sorry if I should have done this before I sent you the previous Hijack Logfile. Hope this is not confusing. Thanks for all the help you have been giving me. I really appreciate it.

New HiJack Logfile:

Logfile of HijackThis v1.99.1

Scan saved at 4:26:46 PM, on 10/7/2006