Blooking McAfee (1 Viewer)

[delia todd]

I tried to download a programme today, but my computer blocked it in the end. However the download seems to have included a link to McAfee.

It keeps popping up a message asking me to buy protection. Eventually I saw at the bottom of the box in the tiniest of font, a link to say "Don't show me this message again". I clicked on it, got another box which asked me if I was sure. I said yes, of course.

It still keeps coming back despite requesting not to several times. It is also affecting the running of Firefox, as it keeps going into "Not Responding", so I have to keep restarting it.

How can I finally rid myself of this unwanted intruder!!!?

 

[Andrew Rowlands]

Hiya D.,

I'd suggest flushing Firefox' cache and recent history first, then after closing FF, run Defender.

Malwarebytes Free would be the natural follow up to that (use Edge to download it, if you don't have it installed?).

What was the program name? I'll try to dig up a cleaning routine for it.

 

[delia todd]

Hi Andy - it's wonderful to hear from you lad. Thanks.

The programme is Openshot - for video editing. I'll close FF but do I need to close PaleMoon as well. Erm... what I'm getting at, is do I need to close everything I've got running LOL

I can't get anywhere with the video editor on here (the Microsoft one I think it is. Here is my tale of woe LOL: Dipping my toes into videoing

 

[Arcamedies]

Hi Andy - it's wonderful to hear from you lad. Thanks.

The programme is Openshot - for video editing. I'll close FF but do I need to close PaleMoon as well. Erm... what I'm getting at, is do I need to close everything I've got running LOL

I can't get anywhere with the video editor on here (the Microsoft one I think it is. Here is my tale of woe LOL: Dipping my toes into videoing

You can also go to Storage and look in the C drive for the program. If it is in there, just uninstall it and restart. But it may have hidden itself in another file.

 

[Andrew Rowlands]

Openshot should be clean but I'll give it a quick test now.

Assuming here it's 'just' some annoyance packaged with it by the site you got it from - where did you download it?

 

[Andrew Rowlands]

My download from the Openshot.org site seems to be clean, though it does trigger Firewall popups for 'net access in case of errors - standard stuff in my experience.

 

[Andrew Rowlands]

If only FF is giving popups/choking, leave PM running to continue your online work - if PM does display oddities, then you have my permission to exit it and fall back on Edge - if that should also behave badly, call me and we'll work out a plan to get your PC back on an even keel.

 

[delia todd]

I got it from here: OpenShot Video Editor | Free, Open, and Award-Winning Video Editor for Linux, Mac, and Windows! and it downloaded into the normal FF Downloads.

Yes, it's only FF that's affected PM is behaving as normal.

LOL Wish I'd not started this!! I've cleared FF cache (I think), but struggling to work out how to "run" Defender. Meanwhile I'm now installing Malwarebytes.

 

[Andrew Rowlands]

Okay, chill

Same site I got it from with PM and other than a Firewall popup to allow it access in case of issues, it all looks quite normal.

See if you can recognise which type of fake McAfee you're plagued by: https://malwaretips.com/blogs/?s=mcafee then try to follow their info to flush it out. It's usually multi steps but not too difficult to follow.

'run' Defender - no clue, it just does stuff silently for me, no infections for years here.

Does reconstituted Bamboo count as wood?

 

[delia todd]

The Scan results show 280 Detections. All beginning with PUP

I've exported it to Notepad.... and at the bottom it says "No malicious items detected"

I had a look through and couldn't immediately detect anything related to McAfee

 

[delia todd]

All the items look virtually the same, along the lines of

PUP.Optional.PCAppStore, C:\Users\dltod\PCAppStore\nwjs\NW_store.exe, No Action By User, 3552, 1225128, 1.0.86411, , ame, , E472E46BDFD736351D4B086B4C4CA134, E825A252B5C5C9C2DE8A6A6ADE12A7F9CD0040F6A20E6EE44BA659034E6D5223

or

PUP.Optional.PCAppStore, C:\Users\dltod\PCAppStore\nwjs\nw.dll, No Action By User, 3552, 1225128, 1.0.86411, , ame, , ,


These two just picked our at random

 

[Andrew Rowlands]

Can you sort them by date? Then paste a bunch of the most recent here (you can always remove them when no longer needed here). Assuming again that the download and fake McAfee coincided, rather than the McAfee laying dormant for some time.

 

[delia todd]

Stuck!! Can't see anything related to a date.

This is the First one:

Process: 10
PUP.Optional.PCAppStore, C:\USERS\DLTOD\PCAPPSTORE\PCAPPSTORE.EXE, No Action By User, 3552, 1008680, 1.0.86411, , ame, , 92CC70D7D67DB4A1DFC22857920C9364, 71226B69696E60A14E516C80E0852E636E9C2AC1F4498EEB8D38D4A93DC57391

This is the Last one

PUP.Optional.StartPage, C:\USERS\DLTOD\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Secure Preferences, No Action By User, 239, 1220149, 1.0.86411, , ame, , 726A73C03431A674781831D314064C12, 880CACA2AFC9DD474B8DED9D384FBE4462E9ADF4DF5F60BFF8D01CD0A5B1B250

Don't know if it helps at all!!

 

[Andrew Rowlands]

No help whatsoever D, esp. as I'm really way out of touch (as Defender does enough for almost everyone).

I really hate 'PUP' detections, I install so many tools that are (poorly) detected as pups, always in their default locations, not hidden way down/renamed as something innocuous. You need massive experience of your own software to make correct calls on these so-called pups.

Potentially unwanted by M(alwarebytes) or M(icrosoft) but useful for me.

"Process: 10" suggests it's running but it's one of probably several Apps, you might be able to pin that one down with Task Manager and scanning for 10 or 3552, maybe one of the other strings there.

Chrome's Start Page might be Start Page (it's a useful and fairly common page), or something completely different. One of the long strings could be a pointer to the identity.

But nothing like we're looking for.

The MalwareTips page of any use yet?

 

[delia todd]

I can't find MalwareTips page.

I've got Task Manager open, but can't find anything for McAFee

I have re-opened Firefox and unfortunately the pop ups are still happening.

 

[Andrew Rowlands]

https://malwaretips.com/blogs/?s=mcafee (as posted in #9).

See if you can pin down which type, or one very similar and recently published - then follow the instructions carefully.

Good Luck and keep me posted, I'll be offline soon 'cos busy weekend past and I'm bushed. Be back for the good news in the a.m.

Nos da.

 

[delia todd]

I seem to have got rid of it now. But not sure what I did really, except I found PC App Store had been added somehow.

So I got Malwarebytes to Quarantine it and the problem went away after MB did a re-boot. It's still in Quarantine.

However, I still see the logo for PC App Store in my list of Apps? So puzzled. But at least I've lost the pop-ups (for now anyway!!)

Thanks for your help Andy. I'm bushed now, so off to bed.

 

[njlarsen]

PC app store should be from Microsoft, not McAfee?

Niels

 

[delia todd]

That's what I thought Niels.

When I was trying to download that video editor, I thought the box was ticked to put a short cut for it on the task bar. But it turned out to be the icon for the App Store. When I put that into Quarantine, the pop ups stopped.

When I look in my list of Apps this morning the PCAppstore logo is still showing, but I can't use it, as "it's been moved". I went into Quarantine and see there are about 5 Appstore entries in there. I picked the one I thought was relevant and Restored it.

Then when I went back to the List of Apps, and clicked on it again, the Quarantine box popped up.

Looks like I need to restore all 5 of the them. Or do I??

 

[Andrew Rowlands]

I'd only attempt to restore an App you know that you need and that it's trustworthy. Those strings I referred to last night, lines of alpha-numeric text, should enable pinpointing the exact App they refer to.

Once you have the main MS Windows App Store functioning (you should be able to reinstall it 'easily' - don't ask me - never done it!), you can reinstall any Apps you really need from within it.