Removing McAfee and bootracer

Closed
sipke Posts 4 Registration date Wednesday March 5, 2014 Status Member Last seen March 7, 2014 - Mar 5, 2014 at 05:20 PM
2011N2 Posts 13352 Registration date Saturday January 29, 2011 Status Security contributor Last seen December 24, 2016 - Mar 23, 2014 at 10:20 AM
I have removed McAfee virus scanner and Bootracer umpteen times i.e with Revo uninstaller-windows uninstaller- from the registree etc.
It comes back every time.
In some cases Creating a restore point failed.
Am I hit with malware? What can I do about it?
sipke
Related:

58 responses

Hello Gabriel,

Sorry for the delay!

Although the report stated that McAfee and Bootracer were
deleted they are still there.

When I rebooted Bootracer was working again.

Later there were "funny" movements on the screen and I got
-access denied- on several files, even on text files and some
opened full screen.

Also some ini-files were corrupted.

Please do not think I blame you for this.
I have probably done some stupid things.

I think it is probably best to do a system restore
as I cannot uninstall any programmes.

sipke
0
2011N2 Posts 13352 Registration date Saturday January 29, 2011 Status Security contributor Last seen December 24, 2016 39
Mar 16, 2014 at 01:25 PM
Hello,

Strange... Run again ZHPDiag as the last time please.

Yes, it will be probably better if you can restore you system. Have you got a point before this problems ?

Gabriel.
0
Hello Gabriel,

Sorry for the delay!

Tried to restore 3 times but got the same message:
Message:
System Restore did not complete successfully.
Your sysem files and settings were not changed
Details:
The shadow copy provider timed out while flushing
data to the volume being shadow copied.
This is probably due to excessive activity on the
vlume. Try again later when the volume is not being
used so heavily. (0x 80042323)

I ran again ZHPDiag

The link is

http://speedy.sh/zJx5F/ZHPDiag.txt

sipke
0
2011N2 Posts 13352 Registration date Saturday January 29, 2011 Status Security contributor Last seen December 24, 2016 39
Mar 18, 2014 at 02:23 PM
Hello,

OK.

1- Download OTM on your desktop.
2- Run it.
3- In the left part, paste the lines which are in this link.
4- Click on MoveIt!
5- Post the log saved at C:\_OTM\MovedFiles\[MMJJAAAA_***].txt

Gabriel.
0

Didn't find the answer you are looking for?

Ask a question
Hello,

clicking on the link got me the following error:

Error (404)
We can't find the page you're looking for. Check out our Help Center and forums for help, or head back to home.

sipke
0
2011N2 Posts 13352 Registration date Saturday January 29, 2011 Status Security contributor Last seen December 24, 2016 39
Mar 18, 2014 at 02:45 PM
Hi,

OK, so try this link : https://www.cjoint.com/14ma/DCstTkyRtXi_for_spike.txt

Gabriel.
0
Hello,

This worked, but....

After the right hand side was filled
I was asked to reboot which I did.

After the reboot i could not find the report.

Sipke
0
2011N2 Posts 13352 Registration date Saturday January 29, 2011 Status Security contributor Last seen December 24, 2016 39
Mar 18, 2014 at 04:12 PM
Hello,

In C:\_OTM\MovedFiles\ ?

Gabriel.
0
Hello,

I have looked and looked
At last I found

E:\_otm\ moved files etc.
containing sub dir 03182014_195112 :
containing sub dirs C_ProgramData , "C_Program Files" , and C_Users

In C_ProgramData 4 subdirs
InstallMate , "McAfee Security Scan" , McAfee , BootRacer .

In the other subdirs I found:
"Toolbar Cleaner"
"McAfee Security Scan"
BootRacer

Is this useful?

sipke
0
2011N2 Posts 13352 Registration date Saturday January 29, 2011 Status Security contributor Last seen December 24, 2016 39
Mar 19, 2014 at 02:00 PM
Hello,

You don't have a .txt file ?

And, are McAfee and Boot Racer always present ?

Gabriel.
0
Hello Gabriel,

Apparently both program files were moved to
C:\programfiles

Yes they are both present.

In E:\_OTM\ moved files\
ther is a log file:
03182014_195112.log 32kb

which begins with

All processes killed
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\Software\McAfee.com\ deleted successfully.
Registry key HKEY_CURRENT_USER\Software\AppDataLow\Software\TelevisionFanatic\ deleted successfully.
Registry key HKEY_CURRENT_USER\Software\ToolbarCleaner\ deleted successfully.
Registry key HKEY_CURRENT_USER\Software\ToolbarCleaneroptions\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\TelevisionFanatic\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Toolbar Cleaner\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Classes\Interface\{0FA32667-9A8A-4E9C-902F-CA3323180003}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0FA32667-9A8A-4E9C-902F-CA3323180003}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Classes\Interface\{2a42d13c-d427-4787-821b-cf6973855778}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2a42d13c-d427-4787-821b-cf6973855778}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Classes\Interface\{3d8478aa-7b88-48a9-8bcb-b85d594411ec}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3d8478aa-7b88-48a9-8bcb-b85d594411ec}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Classes\Interface\{452AE416-9A97-44CA-93DA-D0F15C36254F}\ deleted successfully.

Sipke
0
2011N2 Posts 13352 Registration date Saturday January 29, 2011 Status Security contributor Last seen December 24, 2016 39
Mar 19, 2014 at 05:55 PM
Hello,

OK and you don't have more in the file ? Because it is a part of the report that i want.
Please try to post all.

Gabriel.
0
Hello Gabriel,

The link is
http://speedy.sh/PuKHv/03182014-195112.log

Permit me a suggestion.

A number of times the program could not find
the report on the C-drive.
In all these cases traces of the report
were found on the E-partition.

This led me to the following thought:
Normally I receive my downloads on the E-partition.

When I start your programs from this partition
maybe part(s) of the procedure take place on this
partition instead of on the C-drive.

Could this be heart of the trouble?


sipke
0
2011N2 Posts 13352 Registration date Saturday January 29, 2011 Status Security contributor Last seen December 24, 2016 39
Mar 21, 2014 at 09:44 AM
Hello,

OK, run Delfix now please : https://ccm.net/faq/10663-delfix-removal-of-disinfection-tools
Send the report.

Then, search in your computer if McAfee and BootRacer are always here.

Gabriel.
0
Hello Gabriel,

# DelFix v10.6 - Logfile created 21/03/2014 at 18:50:42
# Updated 11/11/2013 by Xplode
# Username : Wil - WIL-PC
# Operating System : Windows 7 Home Premium Service Pack 1 (32 bits)

~ Removing disinfection tools ...

Deleted : C:\AdwCleaner[R11].txt
Deleted : HKLM\SOFTWARE\AdwCleaner

########## - EOF - ##########

Bootracer and McAfee still present.

sipke
0
2011N2 Posts 13352 Registration date Saturday January 29, 2011 Status Security contributor Last seen December 24, 2016 39
Mar 22, 2014 at 04:13 PM
Hello,

I think that Avast is blocking the deletion.

Run again ZHPDiag as the last time please.

Gabriel.
0
Hello Gabriel,

The link is

http://speedy.sh/myezN/ZHPDiag.txt

sipke
0
2011N2 Posts 13352 Registration date Saturday January 29, 2011 Status Security contributor Last seen December 24, 2016 39
Mar 23, 2014 at 10:20 AM
0