Please help me remove security from my PC.

Now links are coming up on (my typed) virus scan...what's that all about? I didn't put them there!

Smorgs- I don't know if this is applicable to you, but I had something similar happen to me, on my old computer. McAffee had been installed at the factory on my old Win98 computer. I wanted to switch to Norton, and I discovered there was no normal way that I could uninstall the McAffee.

I found out that the program was configured in a way that there were changes in the registry. I contacted McAfee, and they e mailed me a way to remove the program, but the directions were FOUR PAGES LONG. There was no way that I would go thorough THAT.

Eventually, what I did was waited until I reformatted my hard drive, did not reinstall the McAfee, and installed the Norton.

smorgs- I found this. I don't know if you have version 4, but here is the way to manually remove that McAfee.
Between you and me, I would not attempt this, but maybe you are less chicken than me:

http://ts.mcafeehelp.com/doconly.asp?docid=597&CategoryId=&chat=

Pheonix, can't tell you how grateful I am that you took the time to reply. It's hard to get into A2K (well anything really) due to the continuous virus scan download. We have even discussed going out and just buying a new computer! It's Norton that I have been trying to install!

This one is only about twelve months old, but when we bought it we didn't know anything about computers and did not research the best one to get! Any advice?

This problem started when the subscription ran out, we have paid to renew, but the problems have only escalated.

I'm going to try the site you posted (i've printed it out) we are a bit 'chicken' but desperate!

We'll let you know (if we are still on-line when we finish).

Once again - Thanks

Sarah.

x

Sarah- I have had two Dells in my cyberlife, and have loved them both. When I was a complete computer newbie, I called Dell about problems on a regular basis. With this computer, which I have had for over a year, I have never had to call them.

I learned quickly that in order not to go completely bananas, a person needs to get a working knowledge of how computers work. A2K, and our wonderful computer geeks, have been very helpful over the last few years, in walking me through problems.

The books that come with a new computer are woefully inadequate. I would suggest that you go out and buy a book about Windows. which will give you a lot of answers. I have Windows XP Pro- The Missing Manual, by Pogue, Zacker and Zacker. Buy a book that is at your level of understanding. It is well worth the expense.

It's not worked Phoenix

McAfee Icons aren't there...but is still endlessly downloading a virus scan. I have installed Norton, but it's not working as 'other security software' is still stopping me from launching it.

It's so frustrating, I've been at it for hours...I feel like banging my head against a brick wall.

So fed up

Sarah

x

Sarah- You can't have two virus scans on your computer. They will not coexist. The next step would be reformatting your hard drive. reingstalling programs, and leaving out the McAfee. Good luck!

Any links on how to reformat a hardrive? I've got no idea how to do this.

Thanks for your time Phoenix.

Hi Sarah
Give this a shot before reformatting, not knowing what version of mcafee you have or what your OS is go to this Link and look for the link for your windows version and mcafee,

Might be a good idea to uninstall Nortons via Add/Remove programs as well then reboot make sure everything is running normal and then reinstall Nortons.

Hope that helps

http://www.cyberwalker.net/faqs/how-tos/reinstall-faq.html

Smorgs- There are two things that I like better than reformatting a hard drive........................having root canal, and standing in line at the Motor Vehicle Bureau! :wink:

The main thing is to make sure that you back up any file, either in a floppy, or a CD, that is important to you, before you reformat. Once you reformat, the letter from Uncle Oscar where he promises you his entire estate will be gone!

So back up first, and follow the directions in the link. Good luck!

Thanks to both of you. :wink:

I'm going to try in the morning now. I've printed off all the instructions. Now I'm going to have a cup of tea and watch some telly!

I'm really grateful for your help.

The only other alternative is to:

Smash the computer into little pieces with a sledgehammer...

No...it's not worked!

It's moving faster, but the anti virus thing is still interrupting and preventing me launching Norton. I just don't know where I'm going wrong

It's making me upset now...I'm frustrated by my ignorance of such things. It'll cost a fortune if I have to take it to PC world.

Do you think it's worth putting an advert in the University for some poverty stricken but genius student to come and 'sort it'?

did ytou try and uninstall both ?

Please go Here and unzip the newest version of HJT into a new dedicated folder,
Create a folder on the C: drive called C:\HJT.
You can do this by going to My Computer (Windows key+e) then double click on C: then right click and select New then Folder and name it hjt. Unzip HijackThis into this folder. Launch Hijack This, then press Scan, and press Save Log
This will generate a text file that will list all running processes, all applications that are loaded automatically when you start Windows, and more.
Most things are harmless and needed so don't make any changes.
post a log here please.


Lets see what we are looking at

Also,
Please Download
Silent Runners
Please create a folder for it please, Then double click on the program, It will save a notebook file in the same folder, Open that, copy, paste the log back to this thread please

Don 77,

I'm in work this morning, but I've booked a half day this afternoon...I'll try what you said then post back at Teatime.

Much gratitude!

Sarah

x

Don,

I've managed to do this from Hijack. The PC won't allow me to open the Silent Runners file. When I try...nothing happens. I just remembered that this is after I tried to load Norton again (I can't open it as it says 'another instance of configuration wizard is running). Should I re-post after I have removed Norton (again).

You must be groaning inwardly everytime I post now...so please say if you've had enough!

Sarah

x


Logfile of HijackThis v1.98.2
Scan saved at 15:28:09, on 24/01/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\carpserv.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\iWare\iWare Mouse\3.2\lwbwheel.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\SM1BG.EXE
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Symantec Shared\AdBlocking\NSMdtr.exe
C:\DOCUME~1\Sarah2\LOCALS~1\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe
C:\Program Files\Messenger\msmsgs.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.iesearch.freeserve.com/iesearch/default.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.wanadoo.co.uk
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Wanadoo
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Wanadoo - {8B68564D-53FD-4293-B80C-993A9F3988EE} - C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll
O3 - Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [LWBMOUSE] C:\Program Files\iWare\iWare Mouse\3.2\lwbwheel.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SM1BG] C:\WINDOWS\SM1BG.EXE
O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [IS CfgWiz] C:\Program Files\Norton Internet Security\cfgwiz.exe /GUID {257BBC47-1B26-432e-9F84-188603799DD3} /MODE CfgWiz /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Search with Wanadoo - res://C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll/VSearch.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.wanadoo.co.uk
O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540000} (CInstall Class) - http://www.spywarestormer.com/files2/Install.cab
O16 - DPF: {5D9E4B6D-CD17-4D85-99D4-6A52B394EC3B} (WSDownloader Control) - http://www.webshots.com/samplers/WSDownloader.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{6DF62C23-287C-4FD5-99C5-6CA5EC5C1E04}: NameServer = 195.92.195.95 195.92.195.94

No worry Sarah,,,
Being on different time zones makes it interesting,

Please click Start >Run> type in msconfig in the box> Click OK>> Click Start up >>Look for these MskAgent.exe and mcupdate.exe
Untick the check next to them > Click Apply> Reboot



Seems like Nortons loaded up is it running ok ?

It's not worked Don! I don't know where to go from here.

Norton is not running, I've had to take it off. The message is that I have 'another configuration wizard running'.

McAfee is still trying to continually download a virus scan.

I keep thinking I've got rid of everything, but then when I reboot it starts again.

Any more ideas?

Sarah
x

I just want to make sure I have this straight,
Norton's is uninstalled ? By looking at your HJT log it shows it as running,
Did you uninstall Norton's after you ran HJT ?

Reboot to safe mode ( By tappping the F8 key on start up) Go to Add/Remove programs, and look for McAfee and see if you can uninstall it,
If no luck serach for the following 2 files and delete

MskAgent.exe
mcupdate.exe

Look under program files for a folder for McAfee if found delete it,
Restart your computer,

Run HJT and post a fresh log please
and let me know if you have uninstalled Norton's please