Solved Do I have the w32 Blaster?

[Prescottbob]

That tutorial does not give a clue for removal of our Mc filter.

 

[VistaKing]

Download MBAR.exe

Unzip the contents to a folder on your Desktop.

Open the folder where the contents were unzipped and run mbar.exe by right-clicking and choose Run as administrator .

Follow the instructions in the wizard to update and allow the program to scan your computer for threats.

Once the scan as completed . Click on the Exit button and click on Yes that you're sure you want to exit . Locate the logs inside the MBAR folder and upload the logs .

Logs : system-log.txt and mbar-log.txt

 

[Prescottbob]

MBAR is scanning. Is this another 4 to 6 hour scan on this 1.5 tab drive???

 

[VistaKing]

I believe so .

On second thought . If it does locate any infections click on the CleanUp button

 

[Prescottbob]

View attachment mbar-log-2013-05-17 (01-07-20).txt

View attachment system-log.txt

 

[Prescottbob]

I'm going to the ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ store!

 

[cottonball]

Prescottbob,

Just an experiment...

Open Internet Explorer 10

Click: Tools (in the upper menu bar)

Go to: SmartScreen Filter > Turn Off SmartScreen Filter

In the Microsoft SmartScreen Filter dialog box, click: Turn off SmartScreen Filter
Click: OK

What happens now when you download with IE? Still get "xxx contained a virus", or can you download?

 

[Prescottbob]

cottonball,

I turned off MSS and tried a download. I still get the "virus detected/deleted" message but it comes up at the first of the download instead of the end. (0% vs. 99%)

 

[VistaKing]

cottonball

Looking at his DDS log . He has a McAfee Phishing Filter .

 

[Jacee]

Yes, that and McAfee firewall are still showing on DDS.

Prescottbob, do you know what these application data files are? Backups, possibly? If you right click and select properties, do they give you a clue?

C:\Users\Binnie\AppData\Local\{98CA4375-4D23-47A3-BDED-BCE37F75DA99}
C:\Users\Binnie\AppData\Local\{60AC3F47-08B2-44B7-9FFC-55CFBA88856C}
C:\Users\Binnie\AppData\Local\{76ADCD7F-4CF7-4B41-B905-9FC0A3121E44}
C:\Users\Binnie\AppData\Local\{9ACA6345-A5A8-4BDC-9A91-5CF3B5F71EE7}
C:\Users\Binnie\AppData\Local\{CB09C1A3-3A26-4DD0-8B78-D57E72772B45}
C:\Users\Binnie\AppData\Local\{508080C2-78AA-4EA6-AE1F-AD628EC88B09}
C:\Users\Binnie\AppData\Local\{12454734-C29B-48AD-A1FD-FD94357F28CE}
C:\Users\Binnie\AppData\Local\{8BD5EE9C-F962-4D96-AF4A-749C3D8DD938}
C:\Users\Binnie\AppData\Local\{CAAEF7ED-B2B2-4587-9EE9-FE90767D3C93}
C:\Users\Binnie\AppData\Local\{84EF6CB8-CA76-48D8-8557-870A81101FBE}

 

[Prescottbob]

I'll look and post in about an hour (5:15) PST

 

[Prescottbob]

jacee,

Those are all EMPTY FOLDERS.

 

[cottonball]

Folks,

Got a bad cold...head is not quite connected.

If you have not gotten rid of the McAfee stuff, here is something to try...

If you want to scrub whatever is left of the McAfee Phishing Filter here is a command:

Please close all open windows.
Open a Command Prompt.
Right-click and select: Run as Administrator

Copy (using the mouse) all the text inside the quote box below, and Paste at the blinking cursor. Then, press: Enter

echo Start
echo #
echo ######################## Default dirctory for x86 x64 ########################
echo #
echo this command is default system32 directory for x86 OS or x64 OS
cd %windir% & cd system32
echo Remove IE BHO 01 & reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{27B4851A-3207-45A2-B947-BE8AFE6163AB}" /f
echo Remove IE BHO 02 & reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{27B4851A-3207-45A2-B947-BE8AFE6163AB}" /f
echo Remove IE BHO 03 & reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{27B4851A-3207-45A2-B947-BE8AFE6163AB}" /f
echo Toolbar delete 01 & reg delete "HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar" /v "{27B4851A-3207-45A2-B947-BE8AFE6163AB}" /f
echo Toolbar delete 02 & reg delete "HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser" /v "{27B4851A-3207-45A2-B947-BE8AFE6163AB}" /f
echo Toolbar delete 03 & reg delete "HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks" /v "{27B4851A-3207-45A2-B947-BE8AFE6163AB}" /f
echo Toolbar delete 04 & reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{27B4851A-3207-45A2-B947-BE8AFE6163AB}" /f
echo Toolbar delete 05 & reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{27B4851A-3207-45A2-B947-BE8AFE6163AB}" /f
echo CLSID delete & reg delete "HKCR\CLSID\{27B4851A-3207-45A2-B947-BE8AFE6163AB}" /f
echo #
echo ######################## Change the dirctory for x64 ########################
echo #
echo this command is x86 application's registry for x64 OS
cd %windir% & cd syswow64
echo Remove IE BHO 01 & reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{27B4851A-3207-45A2-B947-BE8AFE6163AB}" /f
echo Remove IE BHO 02 & reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{27B4851A-3207-45A2-B947-BE8AFE6163AB}" /f
echo Remove IE BHO 03 & reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{27B4851A-3207-45A2-B947-BE8AFE6163AB}" /f
echo Toolbar delete 01 & reg delete "HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar" /v "{27B4851A-3207-45A2-B947-BE8AFE6163AB}" /f
echo Toolbar delete 02 & reg delete "HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser" /v "{27B4851A-3207-45A2-B947-BE8AFE6163AB}" /f
echo Toolbar delete 03 & reg delete "HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks" /v "{27B4851A-3207-45A2-B947-BE8AFE6163AB}" /f
echo Toolbar delete 04 & reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{27B4851A-3207-45A2-B947-BE8AFE6163AB}" /f
echo Toolbar delete 05 & reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{27B4851A-3207-45A2-B947-BE8AFE6163AB}" /f
echo CLSID delete & reg delete "HKCR\CLSID\{27B4851A-3207-45A2-B947-BE8AFE6163AB}" /f
echo End

To nuke the McAfee Personal Firewall Service:

Once again, please close all open windows.
Open a Command Prompt
Right-click and select: Run as Administrator

Copy (using the mouse) all the text inside the quote box below, and Paste at the blinking cursor. Then, press: Enter

sc stop "McMPFSvc"
sc config "McMPFSvc" start= disabled
sc delete "McMPFSvc"

Restart the computer.

Please run DDS once again, and post the results.

 

[Prescottbob]

View attachment attach.txt

View attachment dds.txt

On the Command Prompt screen " MpMPFSvc failed
the service has not been started "

 

[Prescottbob]

I forgot the restart. Will send them again.

 

[Prescottbob]

View attachment dds.txt

View attachment attach.txt

 

[VistaKing]

Still seeing McAfee personal firewall service listed .

 

[Prescottbob]

My head is in reverse tonite---am rerunning DDS and will send again.

 

[VistaKing]

Go to services .

Click on rb: type services.msc inside the Search programs and files . Press <ENTER> when you see services under Programs .

Inside the Services window . Do you see McAfee Personal Firewall ?

 

[Prescottbob]

Yes it's there marked disabled.