[darlabbq]

I am trying to uninstall McAfee Antivurus (system suite) or something like that version. I go to add/remove programs and it does not show up. I go to C: -> programs -> McAfee.com and it is empty. I might have tried deleting it before. I don't know what to do next.

This pc has major software problems, probably lots of spyware and viruses. Somehow I can't even get on internet eplorer. Can't find file. So I am using my laptop to download moxilla foxfire to a cd to put on it to get a hijack file on for information later. But 1st I wanted to install and run the Panda Antivirus scan! This is a nice program, but it won't let me install because it still says McAfee is around.

Also this pc will not let me reinstall windows with the recovery cd that came with the pc. The one you make in system tools hasn't been helpful so far and that is my last resort.
(Problems started, power supply quit, this newbie decided to put it in a prettier case, and about 6 months later all the kinks are worked out -that sneaky motherboard plugin- so now I need to fix the software and remove programs I don't need.
It is a Windows ME Compaq Presario 5100 Series. Any help would greatly be appreciated!

[Advertisements]

well first I recomend that we run an online virus scan. please go to http://ewido.net/ click on the start button on the left hand pane and follow the instructions it gives. once its complete post the log on what it found here then make sure you have removed the infections.

once its complete and you posted the infections here please follow the manuall removal instructions here: http://ts.mcafeehelp...goryId=245

[starjax]

well first I recomend that we run an online virus scan. please go to http://ewido.net/ click on the start button on the left hand pane and follow the instructions it gives. once its complete post the log on what it found here then make sure you have removed the infections.

once its complete and you posted the infections here please follow the manuall removal instructions here: http://ts.mcafeehelp...goryId=245

[darlabbq]

After I burned both internet explorer and moxilla firefox to disk, I successfully installed firefox on it, but it kept saying page not available even though I had a good connection. So I tried to do the manual uninstall like you said, but none of the files in that list on the mcafee website was there. So I can't access the internet to do the online virus scan.

[Retired Tech]

Open my documents, click tools, folder options, view, tick show hidden files and folders, go to programme files, open the McAfee folder to check it is empty. You can delete it anyway

[starjax]

any luck?

[darlabbq]

Sorry for the delay in replying. I had an emergency vet trip (puppy ok now) on Friday and come home from college on weekends to work. I will be back later this evening to look for hidden folders, but I already deleted the Mcafee folder. I even searched the pc for files under that name. I also tried contacting Mcafee customer support, but my internet connection would not let me chat with them. I still can't get on internet with my desktop. It just acts like there is no connection when there is. I will keep trying though.

[starjax]

ok, if you can't use your web browser can you do anything else?

if you could post a HijackThis log here just so we can rule out any spyware causing this issue that would be great.

also lets check the basics. you are getting an ip address for that computer?

[darlabbq]

I will download hijack to my laptop and burn a copy to install on the home pc tonight. The Mcafee website isn't even helpful to remove this stuff. I can really only get on the net quickly at school (my dial up at home is like 16k which is sooo slow that I barely want to get on it. That is why it takes me a while to answer between going between houses. On campus is the quickest way to download programs. Thanks.

[darlabbq]

This computer has a bunch of junk on it that I hope to get rid of soon!

Logfile of HijackThis v1.99.1
Scan saved at 9:31:00 PM, on 2/16/2006
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\SCARDSVR.EXE
C:\PROGRAM FILES\COMPAQ\COMPAQ MESSAGE SCREENER\BIN\COMPAQ-RBA.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\COMPAQ\DIGITAL DASHBOARD\CPQMLDET.EXE
C:\WINDOWS\SYSTEM\HIDSERV.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\DIGITAL IMAGING\BIN\HPOTDD01.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\DIGITAL IMAGING\BIN\HPOHMR08.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.geekstogo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://server224.sma...t/7search/?hklm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by BellSouth
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:7900
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.www.ebay.com;64.136.29.30;64.136.21.30;64.136.29.34;127.0.0.1;localhost;*windowsupdate.microsoft.com;*windowsupdate.com;*wustat.windows.com;*.nyc.office.juno.com;*.corp.netzero.net;*.kbb.com;*.flipdog.com;*.pogo.com;*test-speed.com;www.ebay.com;www.sco.com;www.microsoft.com;<local>
R3 - URLSearchHook: IncrediFindBHO Class - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - (no file)
O1 - Hosts: 216.177.73.139 auto.search.msn.com
O1 - Hosts: 216.177.73.139 search.netscape.com
O1 - Hosts: 216.177.73.139 ieautosearch
O2 - BHO: Natural Language Navigation - {60E78CAC-E9A7-4302-B9EE-8582EDE22FBF} - C:\WINDOWS\SYSTEM\BHO001.DLL
O2 - BHO: Popup Manager - {08E74C67-99A6-45C7-94DA-A397A8FD8082} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: IEWatchObj Class - {9527D42F-D666-11D3-B8DD-00600838CD5F} - C:\WINDOWS\SYSTEM\IETie.dll
O2 - BHO: NavErrRedir Class - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - (no file)
O2 - BHO: SafeGuard Popup Blocker - {B824E7B0-E8E3-4D75-895E-2C309EA4CC5D} - C:\PROGRAM FILES\SAFEGUARD POPUP BLOCKER PRO\SGPOPUPBLOCKER.DLL
O2 - BHO: Core Library - {6CDF3C49-20E6-48d7-811B-9F5DD17F1D90} - (no file)
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\PROGRAM FILES\MSN APPS\MSN TOOLBAR\01.02.3000.1001\EN-US\MSNTB.DLL (file missing)
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\PROGRAM FILES\MSN APPS\ST\01.02.3000.1002\EN-XU\STMAIN.DLL (file missing)
O2 - BHO: Setup.Setup1 - {2E65A557-173C-4DE9-860B-28FC5CACA542} - C:\WINDOWS\ALL USERS\APPLICATION DATA\SETUP\SETUP.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\PROGRAM FILES\MSN APPS\MSN TOOLBAR\01.02.3000.1001\EN-US\MSNTB.DLL (file missing)
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Hidserv] Hidserv.exe run
O4 - HKLM\..\Run: [WCOLOREAL] C:\Program Files\COMPAQ\COLOREAL\COLOREAL.EXE
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Digital Dashboard] C:\Program Files\Compaq\Digital Dashboard\CPQMLDET.exe
O4 - HKLM\..\Run: [CpqBootPerfDb] C:\Cpqs\Scom\CpqBootPerfDb.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [CMESys] "C:\PROGRAM FILES\COMMON FILES\CMEII\CMESYS.EXE"
O4 - HKLM\..\Run: [WINSTART001.EXE] C:\WINDOWS\System\WINSTART001.EXE -b
O4 - HKLM\..\Run: [RCScheduleCheck] C:\RCSCHED.EXE -CHECK
O4 - HKLM\..\Run: [Fix-It AV] C:\PROGRA~1\VCOM\SYSTEM~1\MEMCHECK.EXE
O4 - HKLM\..\Run: [Popup Blocker Updater] regsvr32 /s C:\WINDOWS\SYSTEM\SFG45C1.DLL
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-us\msnappau.exe"
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [ScardSvr] C:\WINDOWS\SYSTEM\ScardSvr.exe
O4 - HKLM\..\RunServices: [Compaq_RBA] C:\PROGRAM FILES\COMPAQ\COMPAQ MESSAGE SCREENER\BIN\COMPAQ-RBA.EXE
O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunOnce: [Compaq_RBA] C:\PROGRAM FILES\COMPAQ\COMPAQ MESSAGE SCREENER\BIN\COMPAQ-RBA.EXE -z
O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background
O4 - Startup: hpoddt01.exe.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - Startup: hp instant support.lnk = C:\Program Files\Hewlett-Packard\hpis\bin\matcli.exe
O4 - Startup: hp psc 1000 series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {D5770C25-E0F4-4bb9-BCB6-DB17F7BFBB7F} - C:\Program Files\SafeGuard Popup Blocker Pro\PBOptions.exe
O9 - Extra 'Tools' menuitem: Popup Blocker Options - {D5770C25-E0F4-4bb9-BCB6-DB17F7BFBB7F} - C:\Program Files\SafeGuard Popup Blocker Pro\PBOptions.exe
O10 - Broken Internet access because of LSP provider 'c:\program files\vcom\systemsuite\mxavlsp.dll' missing
O12 - Plugin for .bcf: C:\PROGRA~1\INTERN~1\Plugins\NPBelv32.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.bellsouth.net

[jeu198]

I had MAJOR problems removing McAfee until I contacted one of their live technicians. The advice he gave me worked and I have pasted from the conversation window below.

Gabriel Williams: Restart your computer in "Safe Mode". To do this press "F8" every second during boot-up and select safe mode.
Gabriel Williams: The steps are given below, let me know when you have saved or printed them.
Gabriel Williams: Ending McAfee tasks.

1) Right click the "M" icon in your system tray and click EXIT.
2) Then press Ctrl+Alt+Del, go to Process tab and End Task all the McAfee process.(Mostly Starting with Mc)

Backing Up Registry.

Before beginning to edit the registry be sure to back it up. This will safeguard your Windows installation. You can recover your Windows configuration by restoring the backup if something goes wrong.

1) From the Taskbar, click Start-->Run-->type REGEDIT and click OK.
The Registry Editor appears. From the menubar, click Registry.
Note: If using Windows XP, click File
2) Click Export.
3) The Export Registry File dialog box appears. In the 'Save in' drop-down menu, select Desktop.
4) In the 'File Name' field, type backup.
5) In the 'Export range' section, select All.
6) Click Save.

Note: To restore the registry, double click on the backup file you just created and follow the prompts. After completing all of these steps and verifying that everything is working properly, delete this file to avoid restoring the old registry.

Deleting McAfee entries.

1)Click (+) next to HKEY_CURRENT_USER.
2)Click (+) next to Software.
3)Under Software look for any entries like McAfee, McAfee.com and Network Associates if found delete them.
4)Click (+) next to HKEY_LOCAL_MACHINE.
5)Click (+) next to Software.
6)Under Software look for any entries like McAfee, McAfee.com and Network Associates if found delete them.
7)Then click (+) next to Microsoft.
8)Click (+) next to Windows.
9)Click (+) next to CurrentVersion.
10)Under CurrentVersion select the Run folder, now on right hand side look for any McAfee entries if found delete them.
11)Then under CurrentVersion look for Uninstall folder, click (+) next to Uninstall.
12)Under Uninstall look for all McAfee entries if found delete them.
13)Now close registry editor.
14)Then click Start-->Run-->type "C:\Documents and Settings\All Users\Application Data\" and click OK and delete McAfee.com folder.
15)Then go to C:\Program Files\ and delete McAfee and McAfee.com folder, if you get any Access Denied then right click McAfee.com folder select CUT then go to Desktop right click in the center of your desktop and click PASTE. Now delete McAfee.com folder.
16)Now restart your system for the settings to take effect.
James Unna: have no printer - will it be ok to save steps as a txt file and access the txt file in safe mode?
Gabriel Williams: Sure, that would be perfectly fine.

Hope this works as well for you guys as it did for me. Hours of googling got me nowhere which is why i felt the need to sign up to this and relay this information.