Internet cut off, McAfee firewall blocked

[shagschain]

I'm attempting to try and remedy my dad's computer, after he took a whack at it for a few hours and decided that reformatting the OS would be the way to go. (I've attempted to talk him out of that one.)

Two days ago the internet suddenly stopped working, McAfee firewall wouldn't turn on (as soon as we turn it on it turns itself back off - and from other forums I've seen this can be anything from zeroaccess to a simple miscommunication with Windows firewall), and this lovely window keeps popping up and refusing to go away, no matter how many times we click the 'ok' button:

"mcagent.exe - Bad Image

C:\Program Files\Common Files\Motive\McciContextHook_6-1-0_DSR.dll is either not designed to run on Windows or it contains an error. Try installing the program again using the original installation media or contact your system administrator or the software vendor for support."

I'm assuming at least part (if not all) of this is virus related, but I just don't know how far any of it goes.

Here are the logs, as follows. I didn't include the HitmanPro because it didn't find anything, but if it's need, just let me know.

Thanks.

[shagschain]

Finally got the HitmanPro log to save. It was giving me the hardest time with that. So here it is, just in case. I'm sure it's going to be oh so useful, what with the dearth of information it has.

[thisisu]

Hello shagschain,

Now download the latest MGtools.exe to the root of your c: drive.

• Replace your existing MGtools.exe with this one.
• Now run this new MGtools.exe by double-clicking it. (Vista/7 right-click and select Run as Administrator)
• When it is finished, attach c:\MGlogs.zip to your next message. (How to attach)

[shagschain]

Sheesh, even downloaded the newer version and then must've accidentally still used the old one by mistake. Guess that's what happens when I try to troubleshoot at 3am.

Here's the new log.

[thisisu]

There's not any malware in your logs.
I suspect that McAfee may be interfering with being able to get an internet connection.

From Programs and Features (via Control Panel), please uninstall the below:

• Coupon Printer for Windows
• Java(TM) 6 Update 31
• McAfee Security Scan Plus (reboot if requested)
• McAfee Total Protection (reboot if requested)
• McAfee Virtual Technician (reboot if requested)

__

Test your internet now

__

If still not working, download this: MCPR.exe
Transfer it to the computer with the issue and execute it. Then reboot your computer once again.

Test internet

__

Now run C:\MGtools\GetLogs.bat by right-mouse clicking it and then selecting Run as Administrator
This updates all of the logs inside MGlogs.zip.
When it is finished, attach C:\MGlogs.zip to your next message. (How to attach)

[shagschain]

It did take using that cleaning program you had linked, but I was able to get hooked back up to the internet once McAfee was completely cleaned off.

There have been all sorts of quirks on his computer with that program. He had a subscription last year, but when that lapsed I bought one and just had him added on under my umbrella (the 3-user deal), but oddly enough it kept kicking him off, going back to his old user, and saying he had no coverage because his protection was expired. Maybe there were some old files related to his previous subscription that never got uninstalled or rewritten with the new update that I added on, but hopefully that's also taken care of with this complete redit.

Now I just have to get McAfee back to working again and hope it doesn't cause any finicky issues in the meantime. *shakes head.*

Thanks for all the help, especially considering it didn't turn out to be malware.

[thisisu]

No problem.

If you are not having any other malware related problems, it is time to do our final steps:

• Any programs we had you download and/or install can be removed at this time.
• If we had you download and run ComboFix, here is how to uninstall it:
  • Press and hold the Windows key and then press the letter R on your keyboard.
  • This opens the Run dialog box.
  • Copy and paste the below text inside the text-field:
    • "%userprofile%\desktop\ComboFix" /uninstall
  • Now press ENTER
  • ComboFix will extract its files one last time and you should receive a notification that ComboFix has been uninstalled shortly after.
• You can re-enable your Disk Emulation software at this time via DeFogger.
• If we had you create or download a registry patch or "fix" script, these can be deleted at this time.
• Go into the C:\MGtools folder and run the MGclean.bat file to remove additional traces of our tools.
• Now we will toggle System Restore to remove any infected system restore points.
  • Read this: How to Disable And Enable System Restore
• Lastly, here is a guide to protect you from future infections: How to Protect yourself from malware!
• Be safe