Resident antispyware disables loading of McAfee AV on access scan

[Guest]

I installed Spysweeper and found that it blocked startup McAfee Antivirus on
access scan when I boot up. Right would indicate that I could disable, even
though disabled already, so I disable, and then right click to enable, and it
appears to work. I uninstalled Spysweeper (for that reason and also because
it slowed the computer down too much) but the problem still occurs, MOST of
the time, but not all. The other variable is that I installed SpyBot with
the new resident feature, which I don't use. I assume that Spysweeper made a
registry change, but I don't know how to find it or fix it.

I have run Spyblaster and SpyBot and AdAwareSE on the computer and have run
all of them. I have run McAfee. I ran SpySweeper before I uninstalled it.
Any advice? And if it is a regedit issue, can you give step by step guidance
to an illiterate?

Thanks.

 

[PA Bear]

Run a /thorough/ check for hijackware, including posting your hijackthis log
to an appropriate forum.

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine2.blogspot.com/
http://www.elephantboycomputers.com/page2.html#Removing_Malware

When all else fails, HijackThis v1.99.1
(http://aumha.org/downloads/hijackthis.zip) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware with
assistance from an expert. **Post your log to
http://forums.spybot.info/forumdisplay.php?f=22,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7,
http://aumha.net/viewforum.php?f=30, or other appropriate forums for expert
analysis, not here.**

If the procedures look too complex - and there is no shame in admitting this
isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.

 

[Guest]

Thanks for the advice. A lot of detail to slog through. I cleaned out temp
files, ran Adaware and Spybot in the most thorough mode I could and McAfee AV
(my institutionally maintained version so it is updated daily). All clean.
I then ran HijackThis. Relatively short list, and while I am not a whiz, I
think I found the problem, pasted below. I don't think this is a need to
delete a corrupt insert but probably the need to uninstall the program and
then reinstall and update. Do you agree?

O23 - Service: McAfee Framework Service (McAfeeFramework) - Unknown owner -
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe"
/ServiceStart (file missing)

Thanks

 

[PA Bear]

No, I do not agree. While I have no idea what version of HijackThis you're
using, I can tell you that all versions of HijackThis often show such a
"file missing" status in an O23 entry when the file is NOT missing. [I'm
fairly certain you will find the file "FrameworkService.exe" in C:\Program
Files\Network Associates\Common Framework <=this folder.]

The above notwithstanding, please post your entire HijackThis log in an
appropriate forum for review by an expert on such things. I very much doubt
Spysweeper or Spybot SDHelper has anything to do with the problem. (If you
had Spybot Tea Timer running all along, all bets are off.)