McAfee - Error starting on demand scanner

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by cmitchell1975, Sep 4, 2009.

  1. cmitchell1975

    cmitchell1975 Private E-2

    I started getting some unwanted pop-ups on a work lap top and have noticed things are running much slower than normal. I tried to run a scan on McAfee and it threw an error message that it could not start its on demand scanner.

    Whats going on here? Does this computer have a virus?

    Any help would be deeply appreciated.

    Thanks in advance.

    :confused
     
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    The best way to find out is by doing the below.


    Please read ALL of this message including the notes before doing anything.

    Pleases follow the instructions in the below link:


    READ & RUN ME FIRST. Malware Removal Guide


    and attach the requested logs when you finish these instructions.
    • **** If something does not run, write down the info to explain to us later but keep on going. ****
    • Do not assume that because one step does not work that they all will not. MGtools will frequently run even when all other tools will not.

    • After completing the READ & RUN ME and attaching your logs, make sure that you tell us what problems still remain ( if any still do )!
    Helpful Notes:

    1. If you run into problems trying to run the READ & RUN ME or any of the scans in normal boot mode, you can run the steps in safe boot mode but make sure you tell us what you did later when you post logs. See the below if you do not know how to boot in safe mode:
    2. If you have problems downloading on the problem PC, download the tools and the manual updates for SUPERAntiSpyware and Malwarebytes ( links are given in the READ & RUN ME) onto another PC and then burn to a CD. Then copy them to the problem PC. You will have to skip getting updates if (and only if) your internet connection does not work. Yes you could use a flash drive too but flash drives are writeable and infections can spread to them.
    3. If you cannot seem to login to an infected user account, try using a different user account (if you have one) in either normal or safe boot mode and running only SUPERAntiSpyware and Malwarebytes while logged into this other user account. Then reboot and see if you can log into the problem user account. If you can then run SUPERAntiSpyware, Malwarebytes, ComboFix and MGtools on the infected account as requested in the instructions.
    4. To avoid additional delay in getting a response, it is strongly advised that after completing the READ & RUN ME you also read this sticky:
    Any additional post is a bump which will add more delay. Once you attach the logs, your thread will be in the work queue and as stated our system works the oldest threads FIRST.
     
  3. cmitchell1975

    cmitchell1975 Private E-2

    Ok...I completed as much of the "read and run me first" tutorial as possible. After I downloaded and ran SAS, I rebooted and then couldnt open the program again to aquire the logs. The "alternantive start" does nothing, and the "normal" start throws an error - "windows cannot access the specified device path or file. You may not have the appropriate permissions to access the item". I also get this message when I try to run mbam. I was able to initially open mbam and started to run a scan, but then it just shut down and now I get that same error message.

    I was able to download, install, and sucessfully run the other programs and have attatched the logs.

    Things seem to be running smoother, and I haven't gotten another random pop-up, but I just completed running everything. Also, earlier today, when I was doing a google search and clicked on a link, the virus sent me to a whole different website then the links I was clicking on. I was having to copy and paste the lnks in my browser to get to where I wanted to go.

    Let me know what else I can do to smash this thing
     

    Attached Files:

  4. cmitchell1975

    cmitchell1975 Private E-2

    I haven't had the pop ups recurring, but things are still sluggish and my McAfee was disabled. It's prompting me to reinstall the entire program. I won't do anything until I hear back from you.

    Thanks for the assistance
     
  5. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    The infection you had (which ComboFix removed) quite possibly changed permissions on your system which is probably the reason for you problems with McAfee. Let's see if we can fix it.

    First I suggest that you uninstall McAfee. And then run this: McAfee Consumer Product Removal Tool

    Reboot after running the removal tool! DO NOT reinstall McAfee yet.

    Uninstall the below old versions of software:
    Java(TM) 6 Update 11

    Now we need to use ComboFix
    • Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
      • If it is not on your Desktop, the below will not work.
    • Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
    • If ComboFix tells you it has expired or need to be updated to a new version, make sure you allow it to update.
    • Open Notepad and copy/paste the text in the below quote box into it:
    • Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    • At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    • You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    • Now use your mouse to drag CFscript.txt on top of ComboFix.exe
    • Follow the prompts.
    • When it finishes, a log will be produced named c:\combofix.txt
    • I will ask for this log below
    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.


    After reboot, now install the current version of Sun Java from: Sun Java Runtime Environment

    Now reinstall your McAfee Software.

    Now run Ccleaner. Only use the Run Cleaner button. Do not run anything else on any other forms.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:
    • C:\ComboFix.txt
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
  6. cmitchell1975

    cmitchell1975 Private E-2

    Everything appeared to run ok from those last set of instructions. I did get a couple of error windows pop up after combofix ran and was trying to reboot the system. One said "catchme.cfxxe - DLL Initialization Failed" and the other was the same error message, but I couldn't get the title written down fast enough before the system rebooted. It's probably nothing, but I thought I should mention it.

    I will work on this computer today to see how things are working.

    Thanks for your help with this!
     

    Attached Files:

  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome. Your logs are clean.

    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
    2. If we used Pocket Killbox during your cleanup, do the below
      • Run Pocket Killbox and select File, Cleanup, Delete All Backups
    3. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /u
        • Notes: The space between the combofix" and the /u, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
    4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    7. Go to add/remove programs and uninstall HijackThis.
    8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    9. If you are running Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures in step 3 the READ ME for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    10. After doing the above, you should work thru the below link:
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds