Could you help me to analyse hijackthis.log?

General Topics
1

My question is in the subject of the topic. Could anybody help? The log is in the attachment.

2

I would remove:
O16 - DPF: {CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1_02) -
O23 - Service: McAfee Application Installer Cleanup (0187691230067849) (0187691230067849mcinstcleanup) - - (no file)

3

Thank you. I was surprised when I saw JRE 1.4 and McAfee in the log - in reality I have JRE 1.6.16 and no any McAfee application.

4

O16s are dynamically installed so if you ran something that needed it then the entry wil be there and the next time its needed it will be loaded and as Java Runtime Environment 1.4.1_02 is vulnerable it should be removed.

The O23 entry is from a dead entry from when you removed McAfee at one time.

5

Strange enough but I can’t remove this line:

O23 - Service: McAfee Application Installer Cleanup (0187691230067849) (0187691230067849mcinstcleanup) -  - (no file)

It appears again and again in new scans, even after computer reboot.

6

Did you have McAfee installed at one time?

Did you run the removal tool?
http://www.softpedia.com/get/Tweak/Uninstallers/McAfee-Consumer-Product-Removal-Tool.shtml

7

I don’t remember. I wanted to attach the McAfee Removal Tool log for you to see but it is too large to be posted (500 Kb). It’s a pitty ZIPs are not allowed here.

Did you run the removal tool? http://www.softpedia.com/get/Tweak/Uninstallers/McAfee-Consumer-Product-Removal-Tool.shtml
I downloaded and ran it. Then I cleaned and compacted the register. After that I ran HijackThis and saw the line "Service: McAfee Application Installer Cleanup" again. I chose to fix it, rebooted the computer and ran HijackThis again - the line is still there. The new HijackThis.log is in the attachment.
8

Since this is a service, check and see if there is a service running for that in task manager, if so end the process.

Check the services list, type services.msc in the Windows Run command window, if running, stop it and then disable it.

If you are able to find that and carry out the actions, try HJT again.

9

I found it in the list but the only available command is to start the service. The service itself is not marked as running.

10

Is there not a drop down list which gives the option to disable ?

Are you running HJT from an account with admin privileges as that is the only thing I can think of that ‘might’ stop you fixing it ?

Or do you have any registry protection program or function in a secirity program >

11

In the drop-down menu all other commands are in grey and only Start is available. I tried to click “Start” and got the message that it is impossible (without any explanation why). And, yes, I always run HJT with admin privileges.

Or do you have any registry protection program or function in a secirity program >
Spywareterminator? Spywareblaster?
12

Presumably there is no associated file, though it isn’t telling you anything like that.

Spywareblaster doesn’t have any such functionality. I don’t know about ST I used it for a very short time and was unimpressed.

The only other thing I can suggest is that you search the registry for any of the data in that HJT entry or the service name. Or try a registry cleaner to see if that clears out redundant entries.

13

I found the following entries in regedit:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_0187691230067849MCINSTCLEANUP
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_0187691230067849MCINSTCLEANUP\0000
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_0187691230067849MCINSTCLEANUP\0000\Control

I tried to remove them but regedit shows error messages.

14

Try by the last, key by key, and go up in the tree. It’s the only way to delete them.
Well, if you can take ownership of the key, you’ll be able to delete them (it’s a second valid way).

15

I managed to remove the McAfee service with the help of Service Manager from Auslogics BoostSpeed suit.