Uninstall the Persistent exes from McAfee on Windows 8.1

[hacxx]

This may not apply to you but it seems that by default Windows 8.1 comes with McAfee Antivirus. After using the trial period and you don't want to keep the McAfee Antivirus on your system then you should uninstall using Programs & Settings > Remove or alter a program.

After uninstaling the McAfee Antivirus, there will be 3 persistent executables that cannot be delete from the system. Attempting to close this executable with task manager or Process Explorer will not work.

The persistent executables are:
mfemms.exe
mfevtps.exe
mfefire.exe

The solution is create a registry key to block them from auto starting with the system and delete them manually. This can be done automatically with the little batch available below.

Download & Run the batch file available below with administrative privileges.

How to:
1) Run the Batch and the first time it run it will create the registry keys.
2) Reboot the computer (To stop the persistent executables)
3) Run the Batch again to remove the files from the system.
4) That's all

Download:
http://rghost.net/7szHFxh8g

[foxidrive]

This is the script from hacxx in the URL in the post above. viewtopic.php?p=42851#p42851

McAfee Persistent Uninstaller
by DataGroove

Run this bat file as Administrator or it won't work

Code: Select all

@echo off
@title McAfee Persistent Uninstaller
@color 19
echo ...............................................
echo .      McAfee Persistent Uninstaller          .
echo .                                             .
echo . This app is for Windows 8.1 that comes with .
echo . McAfee. After using Program - Settings to   .
echo . uninstall. Some persistent files remain.    .
echo .                                             .
echo . mfemms.exe                                  .
echo . mfevtps.exe                                 .
echo . mfefire.exe                                 .
echo ...............................................
echo .                                             .
echo . To remove hit any key to install debugger   .
echo . Restart the system and run this tool again  .
echo ...............................................
pause
cls
if exist %temp%\1 goto 1
reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mfemms.exe" /v Debugger /t REG_SZ /d "rundll32.exe user32.dll,MessageBoxA Filename Blocker" /f
reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mfevtps.exe" /v Debugger /t REG_SZ /d "rundll32.exe user32.dll,MessageBoxA Filename Blocker" /f
reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mfefire.exe" /v Debugger /t REG_SZ /d "rundll32.exe user32.dll,MessageBoxA Filename Blocker" /f
cd c:\ >%temp%\1
cls
goto 2
:1
del /q "C:\Program Files\Common Files\mcafee\SystemCore\mfemms.exe"
del /q "C:\Program Files\Common Files\mcafee\SystemCore\mfefire.exe"
del /q "C:\Program Files\Common Files\mcafee\SystemCore\*.*"
del /q "C:\Windows\System32\mfevtps.exe"
del /q "%temp%\1"
cls
echo ...............................................
echo .      McAfee Persistent Uninstaller          .
echo .                                             .
echo .    The persistent files were deleted        .
echo .                                             .
echo ...............................................
pause
exit
:2
echo ...............................................
echo .      McAfee Persistent Uninstaller          .
echo .                                             .
echo . Restart the system and run this app again   .
echo .                                             .
echo ...............................................
pause
exit

[foxidrive]

it seems that by default Windows 8.1 comes with McAfee Antivirus.

That's an addon software, bundled in an install by a notebook manufacturer or PC seller etc.
Windows itself doesn't include it.

After uninstaling the McAfee Antivirus, there will be 3 persistent executables that cannot be delete from the system. Attempting to close this executable with task manager or Process Explorer will not work.

Other ways to delete the files will be to download autoruns.exe from Microsoft and click on them within that list to stop them running,

or manually stop the services that are still running that are from McAfee - though it's unclear why they are not being uninstalled by the McAfee uninstaller.

[hacxx]

I did try to uninstall using autoruns.exe but i couldn't find the autostart keys.

At first it look suspicious to me and i thought to myself. Am I becoming so dumb or is Microsoft playing hide and seek with me. Yesterday i found the definitive solution.

[Squashman]

Should be able to stop them from starting up with MSCONFIG as well.

[foxidrive]

Here is a reported case of the problem - it does it on XP machines in the thread.

McAfee Stinger leaving mfevtps.exe behind

http://portableapps.com/node/43647

[hacxx]

Thanks

There were a few McAfee Drivers that were left behind. Now they are all deleted too.

Download:
http://rghost.net/6pHMWkM4f