I use PrevX for virus/spyware defense.
During the install of UBCD4WIN PrevX had a problem with keyfinder.exe and this DLL: ubcd4win/bartpe4/i386/system32/srchui.dll.
FYI: And I used a DELL OEM WinXP disk for installation.
I've read the forum where the keyfinder.exe bundled with ubcd4win is necessary and harmless.
However. ubcd4win would not build the boot CD without keyfinder.exe, yet PrevX would not allow it on my hard drive.

So I started over by disabling PrevX.
1. Reboot
2. Uninstall ubcd4win
3. Reboot
4. shutdown PrevX
5. Install ubcd4win
6. Build the boot CD, burn. No Errors.
7. Uninstall ubcd4win (so that the offending files wont be flagged by PrevX later).
8. Reboot with CD and test. Yay!
9. Reboot to hard drive OS
10. Everything normal (for a while) Yay!

What then happens is that, after a while, PrevX finds and alerts me to, hidden versions of keyfinder.exe in, what I think is, the WinXP system restore folder.

This was the first file PrevX claimed was keyfinder.exe:
c:\SYSTEM VOLUME INFORMATION\_RESTORE{A63977A6-yada-yada-2C444}\RP761\A0110063.EXE

I let PrevX 'Clean' this file. Afterward, PrevX reboots my machine. After awhile, PrevX *again* finds another version of keyfinder.exe. The next time it is in the same location except is called A0104621.EXE. PrevX cleans and reboots. Next time the file found is named A0107201.EXE.
So, I've booted 3 times now and PrevX continues to find new versions of keyfinder with different names. The reason I know these files are keyfinder.exe is that PrevX reports the file as 'keyfinder' in a properties page. The signature of the file remains keyfinder.exe even though the name keeps changing.

Question: Is this symptomatic of a keyfinder infestation or is this fixable by removing the restore point where the files continue to be found? Apparently the restore point is identified in the file spec as 'RP761'.

Thanks!
Jim

It is not an infection... Prevx is telling you about it being riskware and the FAQ's already cover this quite well.

You will probably have to exclude it from detection.


As usual, this is a false positive being made by your antivirus program. This often happens with many antivirus programs and the main cause is from the fact that the malware authors are also using the very same compilers and file libraries of code that normal programs use so when a new malware detection is added to the antivirus definition files... it can have enough common code with normal programs that the normal program gets misdetected as a malware threat.

There is little that we can do about these detections except try and educate the users a bit and provide a bit of info to help support our statements.

I'll start by using a third party confirmation for what we state that UBCD4Win has been tested by Softpedia and was awarded a 100% Clean Award as can be verified on their website here http://www.softpedia.com/progClean/UBCD4WIN-Clean-76994.html

Since each time this happens its with a different program or detected as different threats we've can only address them in general. So we also got some info about these in the FAQ's here http://www.ubcd4win.com/faq.htm#false

Before you do anything else... update your antivirus or other protection program and test the file again. Most of the companies will update their definitions often and may have already corrected the issue... so always test with the latest updates before you do anything else.

We can also tell you how to double check all of the above by doing additional testing. Before you even run anything in the project... disable your On Access scanner for your protection program and then test the file or files in question at either http://virusscan.jotti.org/ or at http://www.virustotal.com . If you don't disable your protection you won't be able to upload the file because your protection software will block access to it.

Once you have tested and proven to yourself that it truely is a false positive... report the detection to your antivirus program's company so they can correct the issue. Don't get mad at them and switch for this type of reason alone... you would only switch one set of false detections for another that another program would have... so work with the company directly to get the issue resolved and you will help all users of the antivirus program.

If they want you to email them a copy of the file being detected... remember to archive the file ( arc, cab, tar, zip etc ) using a password and then send the archive file, tell them the password and tell them what it is being reported as along with any other info they may request.

One other thing to note with this is the fact of where the file is. Evidently the "feature" of XP made a backup copy of UBCD4Win so that file still exisits.

The title of this post makes it sound like KeyFinder is doing something malicious and is attempting to hide in a system. I hope everyone understands what really happened.

There is nothing wrong with keyfinder, but its nature alone makes it labled as a "Threat" or "Riskware"

Window XP keeps "Restor Points" which will contain the file even after you remove it from the filesystem you are using.

To completely remove s file, you will have to do the following:
-Delete the file from you hard drive.
-Create a new "Restore Point"
-Remove all previous "Restore Points" (via disk cleanup wizard)
-Reboot & your done.

This is usefull when trying to remove a virus, but please keep in minf that there is nothing malacious about keyfinder.exe.
If you have ever lost your software key, you would know why this program is here to stay.

This is the first I've heard about an issue like this but I'm also not familiar with the protection software you use either.

Removing the restore point should resolve your issue but I don't know why it keeps finding it as a different file name after every reboot, unless maybe it's setting a restore point every time before it attempts to "Clean" it from an earlier restore point ???

@Tom
That folder is locked so you cannot simply clean one file out of a restore point by any method I have heard of.
You must remvoe the restore point all together to remove all traces of a file.

Actually most of the protection software's I've seen can remove a single file from a restore point now... but I'm not sure if Prevx is able to yet or not. I think Tom's idea that a new restore point is being set is likely but perhaps the source that wasn't thought about wasn't... the actual UBCD4Win install file itself, after all its just an archive of sorts and Prevx ( or any other software ) can't simply remove a single file from it without removing the whole file... so it starts by creating a RP but is unable to complete the process.

Ok, so I'm not the greatest topic writer. I did not mean to imply anything wrong with ubcd4win or keyfinder. i understand the need for it since, in the past, i've lost my winxp key and needed it. but due to the symptoms of the file continuing to appear under diff names, i needed to ask and present the facts. now i've noted that since my fourth PrevX cleaning and booting, PrevX has not found another version of keyfinder.exe. maybe there were mult versions of the file in the same restore point? i also couldnt find anywhere to tell PrevX to leave alone anything in my XP restore point directory. I like PrevX cuz it is the only program that was able to clean my daughters computer a year ago after she opened a malicious attachment.
thanx for the tip about how to remove old restore points. if keyfinder.exe shows up again i will follow those instructions.
ubcd4win is a great tool! I never thought i'd see winXP running from a CD!
Thanx!
Jim

The way a Windows SR point is made will create a new filename each time... the original filename is indexed by Windows and it then creates the new name like you were seeing.

It's really not a full blown XP... its a subset and does have some limitations.