mcinfo.exe - McAfee spy?

[Nortius Maximus]

Hi all

A few weeks ago I removed McAfee virusscan from my PC (XP Pro + updates). Since then I keep getting the entry below (re)inserted into my Start-up list.

Located: HK_LM:Run, msci
command: C: \DOCUME~1\ADMINI~1\LOCALS~1\Temp\200671212538_mcin fo.exe /insfin
file:
(Copied from Spybot’s Start-up tool).

As far as I can tell the numbers are the date of first install and is likely to be a spy that triggers emails promoting subscription renewal, and as I’ve had a clean install of XP since that date it must have been written in by McAfee online – sneaky b*****ds .

I have thoroughly removed all traces of McAfee from all folders and even the registry, and I’m sure there is no mcinfo.exe file to run.

I currently have the my start-up list protected my Spybot’s Resident Tea-Timer Protection, and all McAfee entries are deleted from my firewall (ZA) so at the moment whatever it is that keeps trying to add mcinfo.exe can’t do anything, but something is reinserting the start-up entry, it’s really getting on my nerves.


Does anyone have any ideas how to find this annoyance and kill it once and for all?

[Zer02004]

The file Mcinfo.exe seems to be an integral part of the firewall program. Follow the instructions for removal as given here and if it still persists, we'll tackle it from here.

[centaur]

Just out of curiosity, won't CrapCleaner do this with less 'manual' intervention ?

[Zer02004]

A combination of HJT!, CCleaner and/or EmpTemp and perhaps RegSupreme would probably be my next move.

[Nortius Maximus]

Thnaks for the reponses.

I think I've solved it now.

I'm sure that all traces of McAfee were removed as I've trawled the internet ands gone through all the options I found, usually to find the files/registry entries weren't there anyway.

This led me (eventually) to the conclusion that it wasn't a McAfee component that was reinserting the strat-up entry, but something else.

Zer0's first link suggests checking Active X componets, and sure enough there were two from McAfee.

Aprt from this I removed the entry using msconfig rather than Ccleaner or Spybot as I wondred if Kaspersky's (new AV)may have been responsible for "protecting" the srat-up settings, although I wasn't alerted to any changes so probably not.

Foir good measure I uninstalled and reinstalled Spybot just to make sure it wasn't some error in Tea Timer that was casuing the problem.

My guess would be it was the Active X components, and the restarts since the went haven't seen the entry reappear.

I'm about to try my first restart with Tea Timer running again, and I hope it doesn't decide to replace it.

[Zer02004]

It's not really advisable to use Spybots real time protection as it can lead to all sorts of confusion. You've probably just discovered that!
Use JavaCools SpywareBlaster.

[Nortius Maximus]

Yay!



The start-up entry is no more. It must have been the Active X components 9with maybe a helping hand from something that thought it was helping), so thanks again.

Typically though, I thought I'd wait until after creating a full backup image (Acronis) before solving problem.

[Nortius Maximus]

It's not really advisable to use Spybots real time protection as it can lead to all sorts of confusion. You've probably just discovered that!
Use JavaCools SpywareBlaster.

Originally Posted by Zer02004

I've been using Spybot's Resident protection since Microsoft removed Antispyware's/Defender's abilty to protect the start-up entries. I really missed the security of that component but found that Spybot's Advanced Mode offer's the just about same thing along with a host of other elements.

It was Spybot's notification's that alerted me to msici/mcinfo.exe being added.

The only problem I have with Spybot's alerts is determining whether the allow/deny request refers to the inclusion or exclusion of the entry i.e. whether I'm saying "no" to the entry's removal, and so keeping it in place. This is why I decided to un-/re-install Spybot just be to sure it was operating on a tableau rosa.