trojan.antimcafee.b

Spyware Doctor is reporting I have a McAfee file infected with the antimcafee.b trojan and is highlighting several Registry entries relating to this file - no other files are referenced within the registry just those related to mcupdmgr.exe.

Have run in safe mode Spybot, McAfee, AVG Anti Spyware, Ad-Adaware and all come up with nothing. Deleting the registry entries and the exe file itself remove the trojan but then when I reinstall Virusscan it returns.

The question is do I have a trojan or is this a false positive return from Spyware Doctor, it only added this trojan to it's list on 23 Nov 06 and updated it further 24 Nov 06.

Thanks

The registry entries affected are:

Infection Name Location Risk
Trojan.AntiMcAfee.B HKLM\SYSTEM\ControlSet001\Services\mcupdmgr.exe High
Trojan.AntiMcAfee.B HKLM\SYSTEM\ControlSet001\Services\mcupdmgr.exe## High
Trojan.AntiMcAfee.B HKLM\SYSTEM\ControlSet001\Services\mcupdmgr.exe##DependOnGroup High
Trojan.AntiMcAfee.B HKLM\SYSTEM\ControlSet001\Services\mcupdmgr.exe##DependOnService High
Trojan.AntiMcAfee.B HKLM\SYSTEM\ControlSet001\Services\mcupdmgr.exe##DisplayName High
Trojan.AntiMcAfee.B HKLM\SYSTEM\ControlSet001\Services\mcupdmgr.exe##ErrorControl High
Trojan.AntiMcAfee.B HKLM\SYSTEM\ControlSet001\Services\mcupdmgr.exe##ImagePath High
Trojan.AntiMcAfee.B HKLM\SYSTEM\ControlSet001\Services\mcupdmgr.exe##ObjectName High
Trojan.AntiMcAfee.B HKLM\SYSTEM\ControlSet001\Services\mcupdmgr.exe##Start High
Trojan.AntiMcAfee.B HKLM\SYSTEM\ControlSet001\Services\mcupdmgr.exe##Type High
Trojan.AntiMcAfee.B HKLM\SYSTEM\ControlSet001\Services\mcupdmgr.exe\Enum High
Trojan.AntiMcAfee.B HKLM\SYSTEM\ControlSet001\Services\mcupdmgr.exe\Enum## High
Trojan.AntiMcAfee.B HKLM\SYSTEM\ControlSet001\Services\mcupdmgr.exe\Enum##0 High
Trojan.AntiMcAfee.B HKLM\SYSTEM\ControlSet001\Services\mcupdmgr.exe\Enum##Count High
Trojan.AntiMcAfee.B HKLM\SYSTEM\ControlSet001\Services\mcupdmgr.exe\Enum##NextInstance High
Trojan.AntiMcAfee.B HKLM\SYSTEM\ControlSet001\Services\mcupdmgr.exe\Security High
Trojan.AntiMcAfee.B HKLM\SYSTEM\ControlSet001\Services\mcupdmgr.exe\Security## High
Trojan.AntiMcAfee.B HKLM\SYSTEM\ControlSet001\Services\mcupdmgr.exe\Security##Security High
Trojan.AntiMcAfee.B HKLM\SYSTEM\ControlSet003\Services\mcupdmgr.exe High
Trojan.AntiMcAfee.B HKLM\SYSTEM\ControlSet003\Services\mcupdmgr.exe## High
Trojan.AntiMcAfee.B HKLM\SYSTEM\ControlSet003\Services\mcupdmgr.exe##DependOnGroup High
Trojan.AntiMcAfee.B HKLM\SYSTEM\ControlSet003\Services\mcupdmgr.exe##DependOnService High
Trojan.AntiMcAfee.B HKLM\SYSTEM\ControlSet003\Services\mcupdmgr.exe##DisplayName High
Trojan.AntiMcAfee.B HKLM\SYSTEM\ControlSet003\Services\mcupdmgr.exe##ErrorControl High
Trojan.AntiMcAfee.B HKLM\SYSTEM\ControlSet003\Services\mcupdmgr.exe##ImagePath High
Trojan.AntiMcAfee.B HKLM\SYSTEM\ControlSet003\Services\mcupdmgr.exe##ObjectName High
Trojan.AntiMcAfee.B HKLM\SYSTEM\ControlSet003\Services\mcupdmgr.exe##Start High
Trojan.AntiMcAfee.B HKLM\SYSTEM\ControlSet003\Services\mcupdmgr.exe##Type High
Trojan.AntiMcAfee.B HKLM\SYSTEM\ControlSet003\Services\mcupdmgr.exe\Security High
Trojan.AntiMcAfee.B HKLM\SYSTEM\ControlSet003\Services\mcupdmgr.exe\Security## High
Trojan.AntiMcAfee.B HKLM\SYSTEM\ControlSet003\Services\mcupdmgr.exe\Security##Security High
Trojan.AntiMcAfee.B HKLM\SYSTEM\CurrentControlSet\Services\mcupdmgr.exe High
Trojan.AntiMcAfee.B HKLM\SYSTEM\CurrentControlSet\Services\mcupdmgr.exe## High
Trojan.AntiMcAfee.B HKLM\SYSTEM\CurrentControlSet\Services\mcupdmgr.exe##DependOnGroup High
Trojan.AntiMcAfee.B HKLM\SYSTEM\CurrentControlSet\Services\mcupdmgr.exe##DependOnService High
Trojan.AntiMcAfee.B HKLM\SYSTEM\CurrentControlSet\Services\mcupdmgr.exe##DisplayName High
Trojan.AntiMcAfee.B HKLM\SYSTEM\CurrentControlSet\Services\mcupdmgr.exe##ErrorControl High
Trojan.AntiMcAfee.B HKLM\SYSTEM\CurrentControlSet\Services\mcupdmgr.exe##ImagePath High
Trojan.AntiMcAfee.B HKLM\SYSTEM\CurrentControlSet\Services\mcupdmgr.exe##ObjectName High
Trojan.AntiMcAfee.B HKLM\SYSTEM\CurrentControlSet\Services\mcupdmgr.exe##Start High
Trojan.AntiMcAfee.B HKLM\SYSTEM\CurrentControlSet\Services\mcupdmgr.exe##Type High
Trojan.AntiMcAfee.B HKLM\SYSTEM\CurrentControlSet\Services\mcupdmgr.exe\Enum High
Trojan.AntiMcAfee.B HKLM\SYSTEM\CurrentControlSet\Services\mcupdmgr.exe\Enum## High
Trojan.AntiMcAfee.B HKLM\SYSTEM\CurrentControlSet\Services\mcupdmgr.exe\Enum##0 High
Trojan.AntiMcAfee.B HKLM\SYSTEM\CurrentControlSet\Services\mcupdmgr.exe\Enum##Count High
Trojan.AntiMcAfee.B HKLM\SYSTEM\CurrentControlSet\Services\mcupdmgr.exe\Enum##NextInstance High
Trojan.AntiMcAfee.B HKLM\SYSTEM\CurrentControlSet\Services\mcupdmgr.exe\Security High
Trojan.AntiMcAfee.B HKLM\SYSTEM\CurrentControlSet\Services\mcupdmgr.exe\Security## High
Trojan.AntiMcAfee.B HKLM\SYSTEM\CurrentControlSet\Services\mcupdmgr.exe\Security##Security High

Hijack this returns:

Logfile of HijackThis v1.99.1
Scan saved at 11:26:11, on 26/11/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\McAfee.com\VSO\mcvsshld.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\McAfee.com\VSO\oasclnt.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\PROGRA~1\mcafee.com\mps\mscifapp.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\TalkTalk\bin\sprtcmd.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Lexmark 2400 Series\lxcrmon.exe
C:\Program Files\Lexmark 2400 Series\ezprint.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\WINDOWS\system32\lxcrcoms.exe
C:\Program Files\Messenger\msmsgs.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\CCleaner\ccleaner.exe
C:\WINDOWS\explorer.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Hijack_This\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.co.uk/myway
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.rmweb2.co.uk/forums/default.asp
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.co.uk/myway
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell.co.uk/myway
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O2 - BHO: McBrwHelper Class - {227B8AA8-DAF2-4892-BD1D-73F568BCB24E} - c:\program files\mcafee.com\mps\mcbrhlpr.dll
O2 - BHO: McAfee PopupKiller - {3EC8255F-E043-4cae-8B3B-B191550C2A22} - c:\program files\mcafee.com\mps\popupkiller.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~2\tools\iesdsg.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-gb\msntb.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-gb\msntb.dll
O3 - Toolbar: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [MPSExe] c:\PROGRA~1\mcafee.com\mps\mscifapp.exe /embedding
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [TalkTalk] "C:\Program Files\TalkTalk\bin\sprtcmd.exe" /P TalkTalk
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [lxcrmon.exe] "C:\Program Files\Lexmark 2400 Series\lxcrmon.exe"
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 2400 Series\ezprint.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [LXCRCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCRtime.dll,_RunDLLEntry@16
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\RunOnce: [DelayShred] "C:\program files\mcafee.com\shredder\SHRED32.EXE" /q C:\DOCUME~1\Pants\LOCALS~1\History\History.SH!
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://www.mcafeehelp.com
O15 - Trusted Zone: http://loginnet.passport.com
O15 - Trusted Zone: http://login.passport.net
O15 - Trusted Zone: http://www.rmweb2.co.uk
O16 - DPF: {0713E8D2-850A-101B-AFC0-4210102A8DA7} (Microsoft ProgressBar Control, version 5.0 (SP2)) - http://download.mcafee.com/molbin/Shared/C…22/ComCtl32.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1150234588203
O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.ofoto.co.uk/downloads/BUM/BUM_W…_1/axofupld.cab
O16 - DPF: {78AEEDE8-7345-4FB5-A8FE-4BFF16EF25FC} - http://mvt.mcafee.com/mvt/bin/3,0,1,0/mvt.cab
O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} - http://support.euro.dell.com/global/apps/s…er/PROFILER.CAB
O16 - DPF: {D42ED9FF-DF46-4AD9-A3FE-46BAF896466E} - http://www.sunbelt-software.com/dell/CounterSpy.CAB
O17 - HKLM\System\CCS\Services\Tcpip\..\{5F6EE21F-7620-405E-8E19-38FA3BA821B4}: NameServer = 62.24.199.13 62.24.199.23
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: lxcr_device - - C:\WINDOWS\system32\lxcrcoms.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe