cancel
Showing results for 
Search instead for 
Did you mean: 
blastitall
Level 7

After McAfee Antivirus uninstall, explorer.exe is randomly creating files and playing system sounds. Scans with other tools come up clean.

https://i.imgur.com/tuYiwRK.png

I have been asked more frequently lately which antivirus solution is "best".  I normally use Avast, but I wanted to be able to give a good answer to that question, based upon experience.  So, I installed McAfee's free antivirus solution.  I uninstalled it because it kept annoying me with popups about the presence of competitors' products on my system.  My antivirus solution is paid; I have no intention of changing just for the sake of inter-business competition.

After uninstalling McAfee, I started seeing system behavior that I've never seen before.  Randomly, mouse clicks cause a "click" sound similar to what would play in Windows 98 when a file was double clicked.  This can happen due to any kind of mouse click, doing any thing.  I grabbed Process Monitor from Microsoft's Sysinternals and started monitoring for applications playing sound files.  Then, I just pressed shift+tab in Chrome a bunch of times, and then closed the tabs that opened.  Sure enough, the click sound sporadically, unpredictably played in response. 

What I've found is that explorer.exe isn't only reading files -- it is CREATING them!  This is virus behavior, and my system scans clean.  This began immediately upon uninstalling McAfee, and I've even purged my registry and file system of anything mentioning McAfee to be sure it's gone.

What gives?  Why does uninstalling McAfee seem to corrupt explorer.exe to grow files?  How can I stop this from happening before it destroys my system?

0 Kudos
16 Replies
blastitall
Level 7

Re: After McAfee Antivirus uninstall, explorer.exe is randomly creating files and playing system sounds. Scans with other tools come up clean.

Note that I'm aware that CreateFile() could open an IO device, such as, say, an audio stream to the sound card.  Small problem with that idea here: the file attributes are changing for last access.  That only happens with physical files, not volatile temporary streams with handles that only exist in RAM.

edit: I wish that I could update the original post, as I begin to anticipate some of the low effort responses that might come in if I don't predict them first.

Here's the smoking gun: the other way I know a file is being written.  https://i.imgur.com/yF5Ds9b.png

CreateFileW is called to open a file for writing.  What I'm *not* sure of yet is which write options are being used.  So, either after uninstalling Mcafee my system is growing files, or it is writing randomly to my SSD for no reason (which will gradually destroy it).

For now I'm disabling the "Start Navigation" system sound to stop this from damaging my system.  I've now seen two poor tactics used by McAfee to drum up business: annoying the user with popups for using a competitor's product and corrupting system files to damage the system if McAfee is uninstalled.  Needless to say, I will not be recommending McAfee to anybody.  Ever. 

0 Kudos
Moderator
Moderator

Re: Re: After McAfee Antivirus uninstall, explorer.exe is randomly creating files and playing system sounds. Scans with other tools come up clean.

Hi

I would suggest to clear all temp files and see if this is occurring. FYKI it is not recommended to use two AV solutions installed on the same machine. This will result in conflicts and cause System Instability (as you experience now).

The best method is to Remove existing AV application and Install McAfee.

Tier 2.5 Technician
0 Kudos
exbrit
Level 21

Re: After McAfee Antivirus uninstall, explorer.exe is randomly creating files and playing system sounds. Scans with other tools come up clean.

I moved this to Malware Discussion > Home User Assistance as this sounds like you have malware onboard.

Check the last link below for some hints.

What competitor products was it warning you about?   Maybe there was a reason as, for instance, some product running alongside any antivirus, not just McAfee's, could actually allow infections in as they may cancel each other out.

Toronto ▪ Canada
Volunteer Moderator - Consumer Products
I CAN'T HELP PRIVATELY - PLEASE POST IN THE FORUMS
Use Advanced Search To Find Answers

Consumer Technical Support (alter Country @ top right as needed)

Consumer Customer Service (Accounts, Billing, Registration, etc.)
Anti-Spyware/Malware/Hijacker Removal Tools

0 Kudos
blastitall
Level 7

Re: Re: After McAfee Antivirus uninstall, explorer.exe is randomly creating files and playing system sounds. Scans with other tools come up clean.

It was warning me about Avast -- a solution I've used for four years with not one single problem.  The only reason that multiple antivirus solutions can conflict is that they have full system root access and can hide files (quarantine), thus giving them functionality like rootkits.  One solution might then mistake another one for malware, or they might conflict if they scan simultaneously (such as through live scanning). 

What I'm seeing here is unique to McAfee.  I can use any other non-rogue solution in conjunction with Avast with no issues whatsoever.  McAfee does something unethical when it is uninstalled.  I'd like to know how to fix whatever it broke to cause explorer.exe to behave this way.  This is not a problem with malware aside from whatever McAfee did.  Avast, Malwarebytes, various rootkit scanners used by one of my former employers, and an array of other tools I won't go into here have all come up with clean scans, to include boot time scans.  Whatever this is, it is the result of a change that McAfee made someplace on my system.

0 Kudos
exbrit
Level 21

Re: Re: Re: After McAfee Antivirus uninstall, explorer.exe is randomly creating files and playing system sounds. Scans with other tools come up clean.


blastitall wrote:



So, the way to deal with bad practices in competition is to just cave in to them?  No thanks.



Not at all.  No antivirus is perfect or 100% guaranteed.  A lot is up to you and what you click on, download etc. and if you keep your system slap-bang up to date, all parts of it.



It was warning me about Avast -- a solution I've used for four years with not one single problem.  The only reason that multiple antivirus solutions can conflict is that they have full system root access and can hide files (quarantine), thus giving them functionality like rootkits.  One solution might then mistake another one for malware, or they might conflict if they scan simultaneously (such as through live scanning).



What I'm seeing here is unique to McAfee.  I can use any other non-rogue solution in conjunction with Avast with no issues whatsoever.  McAfee does something unethical when it is uninstalled.  I'd like to know how to fix whatever it broke to cause explorer.exe to behave this way.  This is not a problem with malware aside from whatever McAfee did.  Avast, Malwarebytes, various rootkit scanners used by one of my former employers, and an array of other tools I won't go into here have all come up with clean scans, to include boot time scans.  Whatever this is, it is the result of a change that McAfee made someplace on my system.



So it never occurred to you to use the Avast removal tool that is available on their support pages or here: http://www.avast.com/eng/avast-uninstall-utility.html ?   That is Avast's fault, not McAfee's and you should be blaming them.   Most antivirus software, no matter what brand, will balk at finding remnants of competing brands.   It's a standard precaution against what I said earlier about running 2 together.   The software also warns against  Malwarebytes routinely as the pro version comes with a real-time scanner and feasibly could be a problem, but in actual fact you could have over-rode that and carried on and not got the warning again.  As far as "Various Rootkit Scanners" I can't make a decision as you don't list them, but I find it ominous that various scanners needed to be used in the first place.



If you don't take my advice, and believe me I have many years of experience at this, even got an award for it one time, that's your prerogative and as you've stated you have uninstalled McAfee then really it's a moot point.  But I assure you the advice is good.

Back to your original complaint.  McAfee's uninstall isn't causing the problems.  Obviously you have malware onboard.   I suggest running Hijackthis and posting it's log, as suggested further down the last link in my signature below.   Those specialist forums give excellent advice.

Toronto ▪ Canada
Volunteer Moderator - Consumer Products
I CAN'T HELP PRIVATELY - PLEASE POST IN THE FORUMS
Use Advanced Search To Find Answers

Consumer Technical Support (alter Country @ top right as needed)

Consumer Customer Service (Accounts, Billing, Registration, etc.)

How To Uninstall/Reinstall McAfee Consumer Products EXCEPT Anti-Theft
How To Submit A False Detection To McAfee
Beta Test McAfee Products For PC & MAC
Anti-Spyware/Malware/Hijacker Removal Tools

0 Kudos
blastitall
Level 7

Re: Re: Re: After McAfee Antivirus uninstall, explorer.exe is randomly creating files and playing system sounds. Scans with other tools come up clean.

You didn't even read this thread or you'd know that Avast wasn't uninstalled.  All you're doing is trying to sell McAfee while pretending to offer tech support.  No sale.

0 Kudos
blastitall
Level 7

Re: Re: After McAfee Antivirus uninstall, explorer.exe is randomly creating files and playing system sounds. Scans with other tools come up clean.

So, the way to deal with bad practices in competition is to just cave in to them?  No thanks.

0 Kudos
SafeBoot
Level 21

Re: After McAfee Antivirus uninstall, explorer.exe is randomly creating files and playing system sounds. Scans with other tools come up clean.

what EXACTLY did you install, and where did you download it from?

I ask, because McAfee doesn't have a free AV solution... I suspect you might have been scammed into installing something that said it was McAfee AV, but in fact was malware?

0 Kudos
blastitall
Level 7

Re: Re: Re: After McAfee Antivirus uninstall, explorer.exe is randomly creating files and playing system sounds. Scans with other tools come up clean.

0 Kudos