Infected Laptop

aliEnRIK

Run combofix again to see if it shows anything

macman

aliEnRIK wrote: »

Run combofix again to see if it shows anything

Thanks, will do now.
In the meantime, impossible to remove McAfee Enterprise VirusScan or McAfee Agent. They won't uninstall via Add/Remove Programs, says they are required by other services, even after disabling all McAfee services via msconfig.
Then tried the McAfee Removal Tool, says 'Enterprise Software detected, contact tech support'.
The AV sub expired some time ago (as you'll have gathered by the state of this laptop), so really do need to get McCrappy off somehow-any ideas please?

dogmaryxx

How to manually remove VirusScan Enterprise 8.5i

https://kc.mcafee.com/corporate/index?page=content&id=kb50602

aliEnRIK

This could be one of those cases where a full format and reinstall is needed

Anyways

You could try REVO UNINSTALLER

Download REVO UNINSTALLER (Make sure you click 'DOWNLOAD NOW')
http://www.download.com/Revo-Uninstaller/3000-2096_4-10687648.html

Theres also a registry delete program im thinking of, but I cant recall whats its called. gonna boot my old computer and hopefully find it on there

aliEnRIK

dogmaryxx wrote: »

How to manually remove VirusScan Enterprise 8.5i

https://kc.mcafee.com/corporate/index?page=content&id=kb50602

Jesus!

Rather him than me

macman

dogmaryxx wrote: »

How to manually remove VirusScan Enterprise 8.5i

https://kc.mcafee.com/corporate/index?page=content&id=kb50602

Thanks, but this one is Viruscan 8.6.0. That doc refers to every version except 8.6.0 unfortunately. Have tried Googling it but nothing coming up.
if not might try the method for version 8.5.
Will give Revo a try now.

aliEnRIK

Probably no good, but I found this ~

Uninstall McAfee ePO Agent (3.6) and McAfee VirusScan Enterprise 8.5i
For installations prior to Mar. 5 2007 for faculty and staff for XP

Note: First you will need to remove the ePO Agent, otherwise it will continue to try to install. Then you can add/remove the McAfee program. Ensure you have administrator privileges.


1. Right-click on the McAfee shield in the bottom right-hand corner of the screen (the tray).
2. Left-click to select 'VirusScan Console' from the list.
3. In the console highlight 'Access Protection'. Right-click and select 'Disable' to disable Access Protection.
4. Go to 'Start' then select 'Run' from the start menu.
5. In the text area type 'cmd'
6. A black MS-DOS prompt will appear.
7. Enter the drive letter of the appropriate installation (typically c:)
8. Enter the command 'cd\' to navigate to the root folder
9. Navigate to the McAfee Directory, typically C:\Program Files\Network Associates\Common Framework or C:\Program Files\McAfee\Common Framework You can follow the steps below.
10. Type 'cd Pro[tab]' where [tab] denotes hitting the tab key. You should see cd "Program Files". Continue to hit the tab key if this is not displayed.
11. Now type '\netw[tab]'. You should see cd "Program Files\Network Associates". Continue to hit the tab key if this is not displayed.
12. Now type '\Com[tab]'. You should see cd "Program Files\Network Associates\Common Framework". Continue to hit the tab key if this is not displayed.
13. Hit the enter key to change the directory.
14. Now that you are in the proper directory type the following command to uninstall the ePO agent: 'FrmInst.exe /forceuninstall'.
15. A pop-up should be displayed and give you the status of the uninstall.
16. You should see a message similar to 'setup completed successfully'. Click 'OK'
17. Go back to the start menu and select 'Control Panel'
18. From the control panel window select 'Add/Remove Programs'.
19. In the list select 'McAfee VirusScan Enterprise'. Click 'Remove' to begin the uninstall process
20. Once the uninstall completes, you should reboot the computer.

RobertoMoir

dogmaryxx wrote: »

How to manually remove VirusScan Enterprise 8.5i

https://kc.mcafee.com/corporate/index?page=content&id=kb50602

I've seen viruses that were easier to remove by hand than that. By a considerable degree too.

aliEnRIK

The regcleaner tool I sometimes use is REGCLEANER 4.3 ~
http://majorgeeks.com/download460.html

Be warned, it surgically removes whatever you select so make sure your happy to remove it first!

macman

Revo just brings up the Windows Installer with the same error message I get via Add/Remove Programs:
'This patch package could not be opened. Verify that the patch package exists and you can access it, or contact the application vendor to verify that this is a valid Windows Installer patch package'.
Think I'll start another ComboFix run and in the meantime stick my head in a bucket of cold water...
Then (if I'm feeling brave) I'll try your manual method RIK.