RetouchPRO

Go Back   RetouchPRO > Tools > Software
Register Blogs FAQ Site Nav Search Today's Posts Mark Forums Read


Software Photoshop, Lightroom, Paintshop Pro, Painter, etc., and all their various plugins. Of course, you can also discuss all other programs, as well.

Anyone know if this is a false positive?

Reply
 
Thread Tools
  #21  
Old 06-28-2007, 08:23 PM
juggler's Avatar
juggler juggler is offline
Junior Member
 
Join Date: May 2005
Location: Brevard, N.C.
Posts: 23
Re: Anyone know if this is a false positive?

I also use the AVG Anti-virus. I tried to look it up at the whatis.com, but see that you already have.
Reply With Quote top
  #22  
Old 06-29-2007, 02:34 AM
Gary Richardson's Avatar
Gary Richardson Gary Richardson is offline
Senior Member
 
Join Date: Mar 2004
Location: Yorkshire, England
Posts: 2,717
Re: Anyone know if this is a false positive?

Craig, just been looking over your HJT log again.

Are you running both AVG AntiVirus AND Symantec as real-time scanners?

Not a good idea if you are, there will be conflicts. You need to kill the real-time protection of one of them if you are.

Better still remove one of the programmes, 2 AV's rarely co-exist happily, especially when one of them is Norton/Symantec.
Reply With Quote top
  #23  
Old 06-30-2007, 08:42 PM
Craig Walters's Avatar
Craig Walters Craig Walters is offline
Senior Member
 
Join Date: Apr 2005
Location: somewhere over there
Posts: 8,786
Blog Entries: 4
Re: Anyone know if this is a false positive?

gary, no. the symantec stuff is from Ghost.

i've downloaded Gmer. not run it yet.
Reply With Quote top
  #24  
Old 06-30-2007, 09:47 PM
smak smak is offline
Senior Member
 
Join Date: Jan 2007
Location: Gainesville, Florida
Posts: 284
Re: Anyone know if this is a false positive?

That's strange that the file doesn't appear anywhere in Google.
Do you have some program that is named something with an I....
Reply With Quote top
  #25  
Old 06-30-2007, 11:11 PM
Craig Walters's Avatar
Craig Walters Craig Walters is offline
Senior Member
 
Join Date: Apr 2005
Location: somewhere over there
Posts: 8,786
Blog Entries: 4
Re: Anyone know if this is a false positive?

smak, could be. got lots of programs i think there's a program that's supposed to be able to trace back to the parents, but i dont have it installed nor can i even remember the name.
Reply With Quote top
  #26  
Old 07-01-2007, 03:39 AM
Gary Richardson's Avatar
Gary Richardson Gary Richardson is offline
Senior Member
 
Join Date: Mar 2004
Location: Yorkshire, England
Posts: 2,717
Re: Anyone know if this is a false positive?

Quote:
Originally Posted by smak View Post
That's strange that the file doesn't appear anywhere in Google.
Do you have some program that is named something with an I....
It's not at all unusual with a Malware file (not that I'm saying this is such), where random names (which don't Google) are pretty much the norm.

Anything that doesn't Google is pretty much always a reason for suspicion, though there are legit programmes that also use randomly generated file names.

Many AV companies use randomly named files so that they can't be targeted by Malware which tries to shut them down.


Craig, these don't look like Ghost services and files to me, they look like an incomplete Symantec uninstall.

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe


Quote:
Title: [Symantec Event Manager]

Filename: ccEvtMgr.exe

Status=L

Description:
Related to Norton/Symantec AntiVirus

More information:
http://antispyware.nextdesigns.net/0...&name=Symantec Event Manager
Quote:
Title: [Symantec Password Validation]

Filename: ccPwdSvc.exe

Status=L

Description:
Related to Norton/Symantec AntiVirus.

More information:
http://antispyware.nextdesigns.net/0...&name=Symantec Password Validation
Quote:
Title: [Symantec Settings Manager]

Filename: ccSetMgr.exe

Status=L

Description:
Related to Norton/Symantec AntiVirus.

More information:
http://antispyware.nextdesigns.net/0...&name=Symantec Settings Manager
Quote:
Title: [Symantec Core LC]

Filename: symlcsvc.exe

Status=L

Description:
Related to Norton/Symantec Anti-Virus.

More information:
http://antispyware.nextdesigns.net/0...&name=Symantec Core LC
If you want I'll give you instructions for their removal.

Last edited by Gary Richardson; 07-01-2007 at 03:49 AM.
Reply With Quote top
  #27  
Old 07-01-2007, 01:43 PM
Craig Walters's Avatar
Craig Walters Craig Walters is offline
Senior Member
 
Join Date: Apr 2005
Location: somewhere over there
Posts: 8,786
Blog Entries: 4
Re: Anyone know if this is a false positive?

gary,

i unzipped and ran gmer.exe. as it was loading i got several error messages, all the same: cannot find drive (this may be my printer flash card slot which is seen by windows as a drive. i disabled it before doing the scan). i simply clicked 'continue' a few times and gmer seemed ok with that.

next, i checked to see that all the stuff you said about using the rootkit tab and that all was checkmarked except 'show all' and then hit the 'scan' button. gmer started running through a bunch of stuff and then crashed with a notice to send to microsoft or not. i double checked that i'd done all you said and ran it again. it crashed again.

on the 2nd try, before hitting the 'dont send' button, i hit save and copied what i had so far over to notepad. i'll post that. i then hit the 'dont send' and everything closed down again.

in preparation to running gmer, i disconnected my dsl cable, turned off zone alarm, avg, sound manager, the hp photosmart flash stick device, win patrol and an nvidia display manager. all that stuff i could turn off in the systray, i turned off. it would not let me turn off the service pack 2 security manager.

i dont know if turning all that off was a good idea or not, but it said turn off all running programs, so i did.

after all this, the turning off of all that and running and crashing gmer twice, i finally rebooted. oddly, the nvidia display manager did not come back up in my systray, though it's still in my right click on desktop menu. everything else came back up fine, as far as i can tell.

ok, here's as much of the log as i could get:
Attached Files
File Type: txt incomplete-gmer-scan-07-01-07-1.txt (38.8 KB, 8 views)
Reply With Quote top
  #28  
Old 07-02-2007, 02:23 AM
Gary Richardson's Avatar
Gary Richardson Gary Richardson is offline
Senior Member
 
Join Date: Mar 2004
Location: Yorkshire, England
Posts: 2,717
Re: Anyone know if this is a false positive?

Far as I can see your GMER log is clean (didn't expect it to be otherwise, just being thorough). Nothing there that i wouldn't have expected to be there.

ntkrnlpa.exe is a M$ system file.

vsdatant.sys is the driver for Zone Alarm, as is srescan.sys

avg7rsw.sys and avgtdi.sys belongs to AVG

SymSnap.sys is Norton Ghost

It's not entirely unheard of for GMER to crash a system (which is why I mention it in my use speech), it has to install a driver into a sensitive kernel area and sometimes this results in instability. I don't think it's anything other than this.

I'm happy you've not got anything skulking away on your box that you should be worried about.

Don't know why NVidia hasn't come up in your systray, can you start the program manually?


The stray Norton Services I mentioned in my last post could still do with removing. Don't use HJT, it won't remove them properly.

Did you have Norton installed previously?

Norton is infamous for not removing all its services when uninstalled, so this is not an unusual thing for me to deal with.
Reply With Quote top
  #29  
Old 07-03-2007, 02:46 PM
Craig Walters's Avatar
Craig Walters Craig Walters is offline
Senior Member
 
Join Date: Apr 2005
Location: somewhere over there
Posts: 8,786
Blog Entries: 4
Re: Anyone know if this is a false positive?

thanks, gary

as far as the norton stuff, the only thing i can think of is that this is a leftover from the last computer, though i thought i'd reformatted this drive. i'm quite aware of the nature of most norton products, some being almost bloat-ware. so, are you sure these arent Ghost files? the last norton anti-virus i had was the 2003 version and i just cant imagine any part of that still being on this drive, unless it's something tucked away on the D: drive perhaps. i'm pretty sure, when i had all that computer problems that i left the D: drive alone but reformatted the C: and i'm also pretty sure that the only anti-virus i've had on the current C: drive is AVG.

i've checked 'add/remove software' is control panel and no mention of other norton or symantec products there. nothing in 'start > all programs' and nothing in windows explorer besides Ghost except for one thing under program files, 'symantec live update'. could that be it?
Reply With Quote top
  #30  
Old 07-03-2007, 03:43 PM
Gary Richardson's Avatar
Gary Richardson Gary Richardson is offline
Senior Member
 
Join Date: Mar 2004
Location: Yorkshire, England
Posts: 2,717
Re: Anyone know if this is a false positive?

Have you checked to see if the files are present?

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

If so, leave things alone, I'll check to see if any of them are used with Ghost as well as with Norton AV (they're all in the Shared folder so it's possible they're common to more than one Norton product).

Don't have a copy of Ghost so I'll have to ask someone who has.

If files not present let me know.


Ghost service is

O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Norton Ghost\Agent\VProSvc.exe
Reply With Quote top
Reply

  RetouchPRO > Tools > Software


Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
True or false Doug Nelson Salon 8 06-14-2007 03:07 AM
positive glass slides chrishoggy Image Help 6 11-25-2006 04:53 PM
Positive Film! Help me please! arcadhia Image Help 9 09-08-2006 11:55 PM
Worshipping False Gods! chris h Hardware 26 01-03-2005 09:01 AM
False Hope Toad Critiques 7 07-13-2003 11:52 AM


All times are GMT -6. The time now is 07:01 PM.


Powered by vBulletin® Version 3.8.4
Copyright ©2000 - 2017, Jelsoft Enterprises Ltd.
SEO by vBSEO ©2011, Crawlability, Inc.
Copyright © 2016 Doug Nelson. All Rights Reserved