Forum Home
Press F1
Thread ID: 71480	2006-08-07 02:28:00	Have unistalled Mcafee virus protection, need help removing residual Mcafee spyware	annie (6010)	Press F1

Post ID	Timestamp	Content	User
476712	2006-08-07 02:28:00	A few days ago discontinued my Mcafee subscription and uninstalled ALL of their software. Now, every 2 minutes, I get a WinPatrol alert which says: "A new startup setting has been detected: C:\DOCUME~1\Anne\LOCALS~1\Temp\200685102416_mcinfo .exe /insfin No description found. Company name not included in this program." I deny the startup, and 2 minutes later the same thing happens. There is a ReadMe text file somewhere on my system which says that mcinfo.exe is a file which needs internet access once after uninstalling McAfee, and which will then lie quiet. Googling mcinfo.exe brings up a few sites, many of which say the program is an integral part of the McAfee security software and should not be removed. Other sites describe the same problem as mine, and the consensus seems to be that this is a program that phones home to trigger nag emails about subscription renewal. Whatever - I don't expect spyware to be left behind by paid-for security software. This site: www.jarra.nl gives detailed instructions on how to remove the spyware, which seems to have infested the registry as well as various non-Mcafee directories, and I have followed them, but have one remaining problem. The file C:\DOCUME~1\Anne\LOCALS~1\Temp\200685102416_mcinfo .exe /insfin needs to be deleted, and I can't find it in the directory, despite 'show hidden files' being checked. I tried a global delete of all files in the directory, but many of them are in use or whatever and won't delete. The only .exe file in the directory is u784aemt.exe, which originates from Microsoft. This is the list of files in the Temp folder (Karen's directory print): COMMENT FOLDER C:\Documents and Settings\Anne\Local Settings\Temp\ FILE ~DF3504.tmp 25/07/2006 07:18 FILE ~DF38A.tmp 7/08/2006 13:08 FILE ~DF3951.tmp 24/07/2006 10:44 FILE ~DF9A5A.tmp 7/08/2006 12:52 FILE ~DF9FB4.tmp 25/07/2006 11:13 FILE ~DFA2AA.tmp 31/07/2006 07:25 FILE ~DFACBF.tmp 30/07/2006 07:00 FILE ~DFB88F.tmp 1/08/2006 21:16 FILE ~DFB8E7.tmp 24/07/2006 00:25 FILE ~DFBC82.tmp 24/07/2006 00:24 FILE ~DFCD46.tmp 7/08/2006 13:21 FILE ~DFE4F4.tmp 28/07/2006 14:07 FILE ~DFEC86.tmp 7/08/2006 13:08 FILE ~DFED1D.tmp 25/07/2006 21:32 FILE ~DFF22A.tmp 1/08/2006 11:30 FILE ~DFFF09.tmp 2/08/2006 10:42 FILE ~WRF0000.tmp 7/08/2006 13:08 FILE 2103669.dmp 2/08/2006 20:18 FILE 224C896.dmp 5/08/2006 20:24 FILE avg7inst.log 5/08/2006 10:27 FILE GLF10.tmp 30/07/2006 18:21 FILE InstHelp.dll 30/07/2006 18:23 FILE pcf1.tmp 25/07/2006 21:31 FILE pcf4.tmp 28/07/2006 08:54 FILE pcf6.tmp 28/07/2006 08:49 FILE pcf7.tmp 24/07/2006 09:07 FILE tmp.xpi 25/07/2006 09:08 FILE tmp-1.xpi 30/07/2006 20:55 FILE u784aemt.exe 6/08/2006 15:37 FOLDER C:\Documents and Settings\Anne\Local Settings\Temp\~offfilt\ ------- 0 0 0 0 TOTAL C:\Documents and Settings\Anne\Local Settings\Temp\~offfilt\ ------- 0 0 0 0 FOLDER C:\Documents and Settings\Anne\Local Settings\Temp\msohtml1\ ------- 1 0 0 0 FOLDER C:\Documents and Settings\Anne\Local Settings\Temp\msohtml1\01\ ------- 0 0 0 0 Spybot, Adaware and CCleaner - no effect. I also have zonealarm and AVG Free antivirus running, Windows XP, Winpatrol, google desktop search. Nothing else exciting. Any help killing this pest greatly appreciated - thanks	annie (6010)
476713	2006-08-07 06:49:00	Annie, try reading the thread at this link forums1.itrc.hp.com Its fairly long but the solution seems to be in the last but 2 posting, the solution for someone anyway. HTH JT	jinja_thom (4306)
476714	2006-08-07 07:09:00	Thanks - I have been trying all sorts of things, including deleting the temp folder from Safe Mode. I think I will try the thread you posted and the stuff from the thread I referenced, all in safe mode in one session. This thing is like the Terminator - just keeps popping up, all its registry entries restored. It actually slows the system nocieably when it's active. Will let you know how it goes	annie (6010)
476715	2006-08-07 08:03:00	Delete all that clutter in the Temp folder . Log on as Administrator - the system administrator that is . And go through the registry manually . Using F2 - Search - look for all instances of McAffee and delete them . I've always found programs like CCleaner and other Reg cleaners to be fairly useless . Just so long as you don't delete anything else form the registry you're safe .	pctek (84)
476716	2006-08-07 22:02:00	Thanks for that, I will try again this morning - though unfortunately some git allowed the program to run last night, and the problem appears to have vanished, program doesn't show in startup list. (Which I gather it doesn't anyway).	annie (6010)
1