Combofix Detects McAfee After Uninstallation

[JOSHSKORN]

My mother has a HP G72 laptop. Her McAfee has expired and I'd like to get her on something else. From the Control Panel, I have uninstalled everything from McAfee, and Combofix still seems to think McAfee is installed.

I've tried the McAfee removal tool (MCPR), yes I ran it as Administrator from the actual Administrator account. No luck.

I've deleted every registry key I could find on McAfee, except for a few which do not allow me to do so, which I find strange since I'm under the Administrator account. I was unable to change permissions successfully to be able to delete these keys. I have nothing under C:\Program Files (or C:\Program Files 32) pertaining to McAfee.

I was able to install Microsoft Security Essentials, however when clicking it, it just opens and then closes immediately. This is why I decided to give ComboFix a try after some Googling. I went ahead and made ComboFix continue, and 3 lines came up, all related to McAfee with the product IDs. I tried searching the registry for these keys, but no luck.

Any help?

 

[UsernameIssues]

http://www.sevenforums.com/system-security/227589-do-not-use-combofix-your-own.html

:-(

I would not try any other tools/fixes - just wait.

 

[ICIT2LOL]

Josh just a suggestion and you have to make the final decision - what I do sometimes with the stubborn ones is go to regedit hit the HKEY for both the LOCAL MACHINE and USER lists open them out > go to Software > open them out and it should have an entry in there that you can right click on and delete. See my pic

Now BEFORE you do anything like this please back up the registry to do that you need to open regedit go to and click on File > export to Documents. I always do this after installing anyway it is a safe way of saving the reg from getting mucked up and then not being recoverable.

 

[Jacee]

Please attach the Combofix .txt file ... look here --->C:\ComboScan\Supplementary.txt
so I can see your results.

 

[JOSHSKORN]

Josh just a suggestion and you have to make the final decision - what I do sometimes with the stubborn ones is go to regedit hit the HKEY for both the LOCAL MACHINE and USER lists open them out > go to Software > open them out and it should have an entry in there that you can right click on and delete. See my pic

I saw nothing there pertaining to McAfee

Please attach the Combofix .txt file ... look here --->C:\ComboScan\Supplementary.txt
so I can see your results.

This is strange. I just reran combofix today and it didn't detect McAfee. The only thing I can think of which I did differently between today and my last scan last night was installed Malwarebytes and ran part of a full scan, which detected something not having to do with McAfee. I ended the scan because I didn't know if it would actually finish overnight or just halt when the system goes into sleep mode. I haven't changed any Power settings on the laptop, they are factory default.

Sorry for not appropriately naming the files.

Log1 - Last night's scan
Log - Today's scan

If you compare the two, immediately, you will see keys at the top of Log1.txt, which do not appear in Log.txt.

Again, what I'm looking to do is install MSE. I can't get the Security Center to open properly. I changed the Service startup type to Automatic. It still doesn't launch.

 

[Jacee]

McAfee is gone.
Let's see what Security Check shows ...

Download Security Check by screen317 from here http://screen317.spywareinfoforum.org/SecurityCheck.exe or here http://screen317.spywareinfoforum.org/
Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt.
Please post the contents of that document.

 

[ICIT2LOL]

Jacee could this have just been down to a simple reboot after running the Combo??

 

[Jacee]

I don't think McAfee was totally uninstalled before the first Combofix download was run.

 

[ICIT2LOL]

I don't think McAfee was totally uninstalled before the first Combofix download was run.

Gotcha

 

[JOSHSKORN]

McAfee is gone.
Let's see what Security Check shows ...

Download Security Check by screen317 from here http://screen317.spywareinfoforum.org/SecurityCheck.exe or here http://screen317.spywareinfoforum.org/
Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt.
Please post the contents of that document.

I read the log. It said something about Security Center not running. I knew this. I can't get Security Center running. The service is start to run Automatically.

I tried installing Microsoft Security Essentials, again and I got the same problem. MSE would open for a split second and then close. It literally flashed on the screen and that's it.

Do you think I need to do a Repair Install? I've also tried reinstalling Security Center with a .reg file, no luck.

Edit
Could there be something installed by HP, found in the Programs list that I can uninstall which would prevent Security Center from running? Again, this is a G72-262NR laptop.

 

[JOSHSKORN]

I was also looking at System Restore. The laptop I'm working with doesn't even save restore points when accessing System Restore via Start>All Programs>Accessories>System Tools

Sounds like something on this HP laptop is suppressing certain Windows features from being enabled, for instance, System Restore and Security Center. But, how do I fix this? It seems that this HP laptop only wants McAfee installed and I want to change over to something else.

 

[ICIT2LOL]

McAfee is gone.
Let's see what Security Check shows ...

Download Security Check by screen317 from here http://screen317.spywareinfoforum.org/SecurityCheck.exe or here http://screen317.spywareinfoforum.org/
Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt.
Please post the contents of that document.

I read the log. It said something about Security Center not running. I knew this. I can't get Security Center running. The service is start to run Automatically.

I tried installing Microsoft Security Essentials, again and I got the same problem. MSE would open for a split second and then close. It literally flashed on the screen and that's it.

Do you think I need to do a Repair Install? I've also tried reinstalling Security Center with a .reg file, no luck.

Edit
Could there be something installed by HP, found in the Programs list that I can uninstall which would prevent Security Center from running? Again, this is a G72-262NR laptop.

Hmm what you are referring to is what we call bloatware and it is extremely annoying that machines are loaded with this crap.
Three ways I would approach it Josh
1. You can remove the HP stuff piece by piece

2. You can this http://www.sevenforums.com/tutorials/219487-clean-reinstall-factory-oem-windows-7-a.html but you will need to backup ALL of the data you want first or get a new hard drive and clone the original. Then do the tutorial on the original drive.
Sounds complicated but is not really.

3. Get a new hard drive - say a SSD if you can afford one and an OEM version of Windows 7 and install that. This would be my own personal choice only because I can afford it though.

 

[JOSHSKORN]

Hmm what you are referring to is what we call bloatware and it is extremely annoying that machines are loaded with this crap.
Three ways I would approach it Josh
1. You can remove the HP stuff piece by piece

2. You can this http://www.sevenforums.com/tutorials/219487-clean-reinstall-factory-oem-windows-7-a.html but you will need to backup ALL of the data you want first or get a new hard drive and clone the original. Then do the tutorial on the original drive.
Sounds complicated but is not really.

3. Get a new hard drive - say a SSD if you can afford one and an OEM version of Windows 7 and install that. This would be my own personal choice only because I can afford it though.

Would a repair install work as well? If I understand the concept of Clean Install, that would mean wiping the drive and reinstalling EVERYTHING on the computer.

 

[Jacee]

Download DDS from one of these links:
DDS.com
DDS.pif

• Disable any script blocking protection
• Double click the dds icon to run the tool.
• When done, DDS will open two (2) logs:
  1. DDS.txt
  2. Attach.txt <--- will be minimized in the task tray
• Save both reports to your desktop.

Include the contents of both logs in your next post.
The scan will instruct you to post Attach.txt as an attachment.

 

[JOSHSKORN]

Download DDS from one of these links:
DDS.com

DDS.pif

• Disable any script blocking protection
• Double click the dds icon to run the tool.
• When done, DDS will open two (2) logs:
  1. DDS.txt
  2. Attach.txt <--- will be minimized in the task tray
• Save both reports to your desktop.

Include the contents of both logs in your next post.
The scan will instruct you to post Attach.txt as an attachment.

What is DDS and what does it do? Never heard of it.

See attached. The popup afterwards said attached.txt must be zipped but I did not think that was necessary.

 

[JOSHSKORN]

I still haven't had this problem resolved. I'm still unable to load Security Center and successfully be able to run another Anti-virus application. Again, MSE installs just fine, but when trying to open it, will flash to the screen and then close. Also, I've tried changing the Security Center service to Automatic and it somehow changes itself back to Disabled. Any help?

 

[ICIT2LOL]

My 2 cents again Jacee would it be possible for the McAfee to still be in the registry as I have had to in the past go into regedit and the two HKEYs LOCAL_ MACHINE and USER > Software and check for left overs of the really stubborn stuff even after running the removal tools - Norton (Symnatec) & AVG being a prime examples in my experience as still have entries left over??

If Josh could just have a look and get rid of them would it make any difference??

 

[JOSHSKORN]

My 2 cents again Jacee would it be possible for the McAfee to still be in the registry as I have had to in the past go into regedit and the two HKEYs LOCAL_ MACHINE and USER > Software and check for left overs of the really stubborn stuff even after running the removal tools - Norton (Symnatec) & AVG being a prime examples in my experience as still have entries left over??

If Josh could just have a look and get rid of them would it make any difference??

I've already done that. I did actually rerun combofix and McAfee was no longer detected...but something is still up, considering I can't get MSE to function at all.

I also ran a full scan on Malwarebytes...that has nothing to do with registry, though.

 

[ICIT2LOL]

Ok Josh it was stab in the dark really but an option I thought.

Have you tried these

http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

http://www.sevenforums.com/tutorials/433-disk-check.html<= DO NOT run on a SSD

http://www.superantispyware.com/



http://www.bleepingcomputer.com/download/adwcleaner/

(ADW download from bleepingcomputer)

 

[JOSHSKORN]

Ok Josh it was stab in the dark really but an option I thought.

Have you tried these

http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

http://www.sevenforums.com/tutorials/433-disk-check.html<= DO NOT run on a SSD

http://www.superantispyware.com/



http://www.bleepingcomputer.com/download/adwcleaner/

(ADW download from bleepingcomputer)

I don't think any of that will do anything. What if I just uninstalled a program called HP Setup? Could that be preventing Security Center from loading?