Hi, Have to say to begin today, you have truly been a real pleasure to work with and you obviously "know your stuff" when it comes to computers, so I have to thank you.
Now I have done some more research here, this thing is, as I am sure it is with you, driving me crazy! It appears what has been on the computer is the Zero Access Rootkit and as you've seen, a "bear to remove". One thing it seems to have done is corrupt all of those McAfee files so that the removal of course didn't fully work and the files are there but can't be found. We need to really attempt to get rid of all of them so that any new security software works properly. So here is what I want you to try.
First of all, as I said earlier, delete that DDS if you have not already done so.
I also want you to Uninstall Combofix. Follow these instructions:
Click on the Start button (
) and then in the Search field enter combofix /uninstall, as shown in the image below with the blue arrow.
Please note that there is a space between combofix and /uninstall.
Once you have typed this in, press Enter on your keyboard. A Open File security warning will appear asking if you are sure you want to run ComboFix. Please click on the Run button to start the program.
ComboFix will now uninstall itself from your computer and remove any backups and quarantined files. When it has finished you will be greeted by a dialog box stating that ComboFix has been uninstalled. You can now delete the ComboFix.exe program from your computer. ComboFix has now been uninstalled from the computer.
After you have done those two removals. Do the following:
We need to determine if you are still infected with Zero.Access Rootkit
1. Open the Task Manager by pressing Ctrl + Shift + Esc on your keyboard or by right-clicking the Start Menu bar and selecting Task Manager.
2. Be sure that "Show processes from all users" is selected at the bottom left-hand corner of the window. Click "Image Name" to sort this column alphabetically and then look at the top of the list.
If you are infected with the Zero.Access rootkit, you will see a running process such as "1077238835:3433286335.exe" (example only; your computer may display different numbers).
====================================
IF you see a process similar to that one above ESET has provided a stand-alone malware removal tool to hopefully remove it. Follow the steps below.
- . Download, save and run the 'Win32/Sirefef' stand-alone malware removal tool while in Normal Mode and follow the prompts as directed.
- Restart your computer into Safe Mode with Networking after running the stand-alone tool.
[o] Reboot and begin pressing the F8 key on your keyboard after the logo loads
[o] Select the Safe Mode with Networking option when the Windows Advanced Options menu appears, and then press ENTER - . Run the ESET Online Scanner while in Safe Mode with Networking.
(Note: If you receive an error during any part of the process, locate the ESET Online Scanner program by clicking Start> Control Panel> Add/Remove Programs and remove it from your system. Run the scan again by double-clicking the esetsmartinstaller.exe installer you downloaded before. No restart is necessary after running the ESET Online Scanner.)
- . Once the machine is clean and while still in Safe Mode with Networking, run the ESET Uninstaller. Follow the instructions by clicking one of the links below for your operating system.
- Windows 7/2008 R2/2008
Post back with your results. If you didn't see a process similar to the one noted above then post back immediately, if you do see one then follow the rest of the instructions. After that then we can work to get that McAfee off the computer.
Reply With Quote