Adaware complains about ip6fw

[David Arnstein]

I updated Adaware and ran it today. It complains about some registry
entries that define a service named ip6fw. The description of this
service (in my Windows registry) is "Provides intrusion prevention
services for a home or small office network."

Adaware classifies these registry entries as an installation of
Win32.TrojanDropper.

One additional oddity. I easily found the registry definition of this
service in HKLM\SYSTEM\CurrentControlSet\Services\ip6fw. However, when
I run Windows MMC panel My Computer\Manage\Services, I cannot find
this service!

I hesitate to blow away this service from the registry. Perhaps
Adaware is making a mistake.
--
David Arnstein (00)
arnstein+usenet@pobox.com {{ }}
^^

[Default User]

On Mon, 23 Apr 2007 17:00:36 +0000 (UTC), arnstein@panix.com (David
Arnstein) wrote:

>I updated Adaware and ran it today. It complains about some registry
>entries that define a service named ip6fw. The description of this
>service (in my Windows registry) is "Provides intrusion prevention
>services for a home or small office network."
>
>Adaware classifies these registry entries as an installation of
>Win32.TrojanDropper.
>
>One additional oddity. I easily found the registry definition of this
>service in HKLM\SYSTEM\CurrentControlSet\Services\ip6fw. However, when
>I run Windows MMC panel My Computer\Manage\Services, I cannot find
>this service!
>
>I hesitate to blow away this service from the registry. Perhaps
>Adaware is making a mistake.

This sounds like a false positive, or possibly a detection of a potential
hijack. The ip6fw service is the Windows firewall service for IPV6
communication and would only be used in the case where you used IPV6
communication (very few people use IPV6, the normal standard for most
people is IPV4.) The normal image path for ip6fw should be
"system32\drivers\ip6fw.sys", if you have something different in your
registry, then that may be the cause of the Adaware alert. At any rate it
is not recommended that you delete the key from your registry, but you may
need to modify it to correct a hijack attempt.

[siljaline]

Update, again, David, as this was a false-positive detection.
See http://www.lavasoftsupport.com/index.php?showtopic=8673

Silj

--
siljaline

"Arguing with anonymous strangers on the Internet is a sucker's game
because they almost always turn out to be -- or to be indistinguishable from
-- self-righteous sixteen-year-olds possessing infinite amounts of free time."
- Neil Stephenson, _Cryptonomicon_

[David H. Lipman]

From: "David Arnstein" <arnstein@panix.com>

| I updated Adaware and ran it today. It complains about some registry
| entries that define a service named ip6fw. The description of this
| service (in my Windows registry) is "Provides intrusion prevention
| services for a home or small office network."

| Adaware classifies these registry entries as an installation of
| Win32.TrojanDropper.

| One additional oddity. I easily found the registry definition of this
| service in HKLM\SYSTEM\CurrentControlSet\Services\ip6fw. However, when
| I run Windows MMC panel My Computer\Manage\Services, I cannot find
| this service!

| I hesitate to blow away this service from the registry. Perhaps
| Adaware is making a mistake.
| --
| David Arnstein (00)
| arnstein+usenet@pobox.com {{ }}
| ^^


It is a hidden RootKit service and should be removed ASAP !

You can use GMer or maybe CatchIt by Gmer or someother anti rootkit utility.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

[David Arnstein]

In article <v1cXh.8300$Fs6.2209@trnddc03>,
David H. Lipman <DLipman~nospam~@Verizon.Net> wrote:
>It is a hidden RootKit service and should be removed ASAP !

No, it is not a hidden root kit. It is a false positive returned by
AdAware. AdAware posted an update yesterday. After that, it no longer
complained about this service.

>You can use GMer or maybe CatchIt by Gmer or someother anti rootkit utility.

Thanks for that recommendation. I will carefully avoid GMer software in
the future.
--
David Arnstein (00)
arnstein+usenet@pobox.com {{ }}
^^

[Default User]

On Tue, 24 Apr 2007 16:50:30 +0000 (UTC), arnstein@panix.com (David
Arnstein) wrote:

>>You can use GMer or maybe CatchIt by Gmer or someother anti rootkit utility.
>
>Thanks for that recommendation. I will carefully avoid GMer software in
>the future.

Dave may have been wrong about the rootkit, but his recommendations for
Gmer and CatchME (not catchIT) are correct. Probably the best rootkit
revealers out there.

http://www.gmer.net/index.php
http://www.gmer.net/catchme.php