Uninstall the Persistent exes from McAfee on Windows 8.1

Discussion forum for all Windows batch related topics.

Moderator: DosItHelp

Post Reply
Message
Author
hacxx
Posts: 57
Joined: 09 Apr 2015 13:18

Uninstall the Persistent exes from McAfee on Windows 8.1

#1 Post by hacxx » 08 Sep 2015 14:02

This may not apply to you but it seems that by default Windows 8.1 comes with McAfee Antivirus. After using the trial period and you don't want to keep the McAfee Antivirus on your system then you should uninstall using Programs & Settings > Remove or alter a program.

After uninstaling the McAfee Antivirus, there will be 3 persistent executables that cannot be delete from the system. Attempting to close this executable with task manager or Process Explorer will not work.

The persistent executables are:
mfemms.exe
mfevtps.exe
mfefire.exe

The solution is create a registry key to block them from auto starting with the system and delete them manually. This can be done automatically with the little batch available below.

Download & Run the batch file available below with administrative privileges.

How to:
1) Run the Batch and the first time it run it will create the registry keys.
2) Reboot the computer (To stop the persistent executables)
3) Run the Batch again to remove the files from the system.
4) That's all

Download:
http://rghost.net/7szHFxh8g

foxidrive
Expert
Posts: 6031
Joined: 10 Feb 2012 02:20

Re: Uninstall the Persistent exes from McAfee on Windows 8.1

#2 Post by foxidrive » 08 Sep 2015 18:55

This is the script from hacxx in the URL in the post above. viewtopic.php?p=42851#p42851

McAfee Persistent Uninstaller
by DataGroove

Run this bat file as Administrator or it won't work


Code: Select all

@echo off
@title McAfee Persistent Uninstaller
@color 19
echo ...............................................
echo .      McAfee Persistent Uninstaller          .
echo .                                             .
echo . This app is for Windows 8.1 that comes with .
echo . McAfee. After using Program - Settings to   .
echo . uninstall. Some persistent files remain.    .
echo .                                             .
echo . mfemms.exe                                  .
echo . mfevtps.exe                                 .
echo . mfefire.exe                                 .
echo ...............................................
echo .                                             .
echo . To remove hit any key to install debugger   .
echo . Restart the system and run this tool again  .
echo ...............................................
pause
cls
if exist %temp%\1 goto 1
reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mfemms.exe" /v Debugger /t REG_SZ /d "rundll32.exe user32.dll,MessageBoxA Filename Blocker" /f
reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mfevtps.exe" /v Debugger /t REG_SZ /d "rundll32.exe user32.dll,MessageBoxA Filename Blocker" /f
reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mfefire.exe" /v Debugger /t REG_SZ /d "rundll32.exe user32.dll,MessageBoxA Filename Blocker" /f
cd c:\ >%temp%\1
cls
goto 2
:1
del /q "C:\Program Files\Common Files\mcafee\SystemCore\mfemms.exe"
del /q "C:\Program Files\Common Files\mcafee\SystemCore\mfefire.exe"
del /q "C:\Program Files\Common Files\mcafee\SystemCore\*.*"
del /q "C:\Windows\System32\mfevtps.exe"
del /q "%temp%\1"
cls
echo ...............................................
echo .      McAfee Persistent Uninstaller          .
echo .                                             .
echo .    The persistent files were deleted        .
echo .                                             .
echo ...............................................
pause
exit
:2
echo ...............................................
echo .      McAfee Persistent Uninstaller          .
echo .                                             .
echo . Restart the system and run this app again   .
echo .                                             .
echo ...............................................
pause
exit

foxidrive
Expert
Posts: 6031
Joined: 10 Feb 2012 02:20

Re: Uninstall the Persistent exes from McAfee on Windows 8.1

#3 Post by foxidrive » 08 Sep 2015 19:02

hacxx wrote:it seems that by default Windows 8.1 comes with McAfee Antivirus.

That's an addon software, bundled in an install by a notebook manufacturer or PC seller etc.
Windows itself doesn't include it.
After uninstaling the McAfee Antivirus, there will be 3 persistent executables that cannot be delete from the system. Attempting to close this executable with task manager or Process Explorer will not work.

Other ways to delete the files will be to download autoruns.exe from Microsoft and click on them within that list to stop them running,

or manually stop the services that are still running that are from McAfee - though it's unclear why they are not being uninstalled by the McAfee uninstaller.

hacxx
Posts: 57
Joined: 09 Apr 2015 13:18

Re: Uninstall the Persistent exes from McAfee on Windows 8.1

#4 Post by hacxx » 09 Sep 2015 13:34

I did try to uninstall using autoruns.exe but i couldn't find the autostart keys.

At first it look suspicious to me and i thought to myself. Am I becoming so dumb or is Microsoft playing hide and seek with me. Yesterday i found the definitive solution.

Squashman
Expert
Posts: 4484
Joined: 23 Dec 2011 13:59

Re: Uninstall the Persistent exes from McAfee on Windows 8.1

#5 Post by Squashman » 09 Sep 2015 13:59

Should be able to stop them from starting up with MSCONFIG as well.

foxidrive
Expert
Posts: 6031
Joined: 10 Feb 2012 02:20

Re: Uninstall the Persistent exes from McAfee on Windows 8.1

#6 Post by foxidrive » 09 Sep 2015 14:26

Here is a reported case of the problem - it does it on XP machines in the thread.

McAfee Stinger leaving mfevtps.exe behind

http://portableapps.com/node/43647

hacxx
Posts: 57
Joined: 09 Apr 2015 13:18

Re: Uninstall the Persistent exes from McAfee on Windows 8.1

#7 Post by hacxx » 12 Sep 2015 17:44

Thanks

There were a few McAfee Drivers that were left behind. Now they are all deleted too.

Download:
http://rghost.net/6pHMWkM4f

Post Reply