security software problem

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

Win XP Pro SP2
Until recently I have been running Zonealarm Pro v4 and Mcafee Virus Scan
v6. When Mcafee failed to start up and started behaving strangely, I
decided to uninstall and upgrade to f-secure's internet security suite. I
removed Mcafee, ZA and cleaned up the registry (using Registry Healer). But
f-secure wouldn't install.....

When I went looking around, I found that the Windows Security Centre (via
Control Panel) gave me a message that 'security centre has not started or
was stopped. Please restart...' etc etc

I ran spybot, Adaware Pro and an online virus scanner (via f-secure's
website) and although they found cookies etc, nothing sinister was reported.

Then I went to the config utility, and on the startup tab I found an entry
(ticked) called firewall_anti - which doesn't sound great. I unchecked it
and rebooted, same deal. So I went to the Windows folder, and found both a
firewall_anti exe file and a dll, which I deleted. RegHealer also showed a
Run entry for a dll with the same name, so I chose to have RegHealer delete
that entry.

Nothing has changed. I cannot install the security suite (it gets most of
the way through and then reports an eror and closes). The Windows security
centre is not starting when I boot the machine. (I do have a hardware
firewall built into my adsl router). The entry for firewall_anti is still
on the startup tab, although it is no longer checked.

Can anyone please tell me what's going on, and what I can do to repair it
please? Thanks
1 answer Last reply
More about security software problem
  1. Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

    Jeff,

    It may be this trojan : Troj/Netdeny-A
    http://www.sophos.com/virusinfo/analyses/trojnetdenya.html
    Click the Advanced tab to see where it loads in the registry.

    " It also drops another component to %Windows%\firewall_anti.exe.dll
    (this file is 139,264 bytes in size). The file is a DLL, which is
    injected into the explorer.exe process, so as to run under the guise of
    Explorer. "
    Translation : show hidden files, folders, and system files
    http://www.xtra.co.nz/help/0,,4155-1916458,00.html

    Then check the WINDOWS\system32 folder for the presence of
    firewall_anti.exe.dll . To see if it is running under the guise of
    Windows Explorer download Hijack This :
    http://www.aumha.org/downloads/hijackthis.zip
    Extract it to My Documents. Open Hijack This, click the Config button,
    then the Misc Tools button. Then click the Open process manager button.
    Put a check in the box next to Show Dll's. Click on Explorer.EXE in the
    list of Running processes. The bottom window will show if
    firewall_anti.exe.dll is running.

    MowGreen [MVP 2004-2005]
    ===============
    *-343-* FDNY
    Never Forgotten
    ===============


    Jeff wrote:

    > Win XP Pro SP2
    > Until recently I have been running Zonealarm Pro v4 and Mcafee Virus Scan
    > v6. When Mcafee failed to start up and started behaving strangely, I
    > decided to uninstall and upgrade to f-secure's internet security suite. I
    > removed Mcafee, ZA and cleaned up the registry (using Registry Healer). But
    > f-secure wouldn't install.....
    >
    > When I went looking around, I found that the Windows Security Centre (via
    > Control Panel) gave me a message that 'security centre has not started or
    > was stopped. Please restart...' etc etc
    >
    > I ran spybot, Adaware Pro and an online virus scanner (via f-secure's
    > website) and although they found cookies etc, nothing sinister was reported.
    >
    > Then I went to the config utility, and on the startup tab I found an entry
    > (ticked) called firewall_anti - which doesn't sound great. I unchecked it
    > and rebooted, same deal. So I went to the Windows folder, and found both a
    > firewall_anti exe file and a dll, which I deleted. RegHealer also showed a
    > Run entry for a dll with the same name, so I chose to have RegHealer delete
    > that entry.
    >
    > Nothing has changed. I cannot install the security suite (it gets most of
    > the way through and then reports an eror and closes). The Windows security
    > centre is not starting when I boot the machine. (I do have a hardware
    > firewall built into my adsl router). The entry for firewall_anti is still
    > on the startup tab, although it is no longer checked.
    >
    > Can anyone please tell me what's going on, and what I can do to repair it
    > please? Thanks
    >
    >
Ask a new question

Read More

Security Software Windows XP