9 Replies Latest reply on Aug 7, 2011 5:09 AM by Peter M

    Trojan = 1

      Hello. I've resorted to joining this forum after significant time and effort attempting to answer a *simple* question without having to pay for it.


      Whenever I run a full scan of Antivirus Plus, it tells me there were "0 viruses and spyware detected in your last scan,"  but when I view the security report, it says there is 1 trojan.  That trojan has been apparently squatting somewhere on my system for over a month now, but McAffee doesn't give me any information on 1.) what the trojan is, 2.) how to deal with it, or 3.) whether it has already automatically been dealt with.


      Thanks for any information that will help me resolve this issue.

        • 1. Re: Trojan = 1
          Peter M

          That report means a trojan was possibly detected once...at some stage, since installation.

          Click Navigation at top right of SecurityCenter

          Go down to Quarantined and Trusted Items

          Click those sections to expand and see if anything is in there.

          • 2. Re: Trojan = 1

            Oh ho!  After all my searching (where I was advised there was this mythical place called Quarantined and Trusted Items), it never once directed me to click on Navigation to get there (as obvious as the word "navigation" is ).


            How long does it normally take for the Quarantined and Trusted items to load?  I opened the page twelve minutes ago and the little loading icon is still spinning...



            • 3. Re: Trojan = 1
              Peter M

              It can take a while for the first 'drawer' to open as it fills up with cookies that have been removed.  You can eliminate those from detection in the Real-Time Scanner settings.


              If it fails to load in a reasonable time it means there are simply too many and they would have to be deleted in Windows Explorer.


              What operating system/service pack is this?

              • 4. Re: Trojan = 1

                It took twenty minutes and there were six old items that I deleted.




                When I click on Quarantined Potentially Unwanted Programs, McAffee freezes up, my system goes nuts (Task Manager tells me mcagent.exe is overloading my CPU) and I have to reboot every time I attempt it.  That's not good.  What do I do NOW?



                • 5. Re: Trojan = 1
                  Peter M

                  Well you still haven't told me what operating system this is so I'll start without that info and hope I hit the right folders.


                  You'll have to delete the items via Windows Explorer.


                  This lets you delete the quarantine files in one go without hassle.


                  In the McAfee Security Centre you need to select 'Navigation' (top right) and then 'General Settings and Alerts' (on the left hand side of the screen). From there select 'Access Protection' and untick the box.


                  This removes the block preventing the deletion of all the files using Windows Explorer etc.


                  In XP, the pathway to the quarantine folder is: C:Documents & Settings/All Users/Application Data/McAfee/Virusscan. Delete the contents only not the folder itself.   Only takes a few seconds to remove all the files!   Bear in mind that Application Data is a hidden folder so you may have to change your settings to be able to see it. This is done in Explorer by selecting the Tools drop down menu, then 'Folder Options', then the 'View' tab and finally choosing the 'Show hidden files and folders' option.


                  Save a step by opening that Quarantine folder and using Edit > Select All and then simply clicking Shift/Delete and they will vanish.


                  (Shift/Delete pressed together will bypass the Recycle Bin, that applies to any deletion anywhere in Windows).


                  Don't forget to re-select Access Protection once you've finished as you don't want to delete something important!


                  In Vista/Windows 7 the folder is C:\ProgramData\McAfee\VirusScan\Quarantine (don't forget to disable Access Protection first!)


                  If you don't want the Quarantine folder to fill up you can stop VirusScan from deleting cookies in Real-Time Scanning settings as I stated earlier.


                  Message was edited by: Ex_Brit on 05/08/11 8:07:17 EDT PM
                  • 6. Re: Trojan = 1

                    Thanks, Ex_Brit.  I had NO IDEA McAffee was quarantining a ton of files - it never gave me a msg saying so, nor did I know I was supposed to check on it. 


                    Anyhoo, my OS is Windows 7, and I found the quarantine folder in C:programdata/mcaffee/virusscan/quarantine.  I followed your directions to use shift/delete to permanently get rid of all 90,000 files, however a pop-up informed me that it was preparing to send them to the recycle bin anyway.  I freaked out and cancelled the delete.  Then I went online and found out that if you go to recycle bin properties and click "don't move files to the recycle bin" you can bypass it altogether.  I am now running another scan - hopefully that pesky trojan is gone forever!


                    Thanks again.

                    • 7. Re: Trojan = 1
                      Peter M

                      I don't have that item checked and use Shift - Delete clicked simultaneously to permanently delete such things.  The danger with having that box checked is something might be deleted later on that you realise you subsequently need.   I only use Shift - Delete when I know I don't need anything.


                      There's an excellent forum for help with Windows 7 here:  http://www.sevenforums.com/ should you ever need it.  They have marvellous tutorials on lots of tweaks.

                      • 8. Re: Trojan = 1

                        I'm grateful for your help.  Ran a full scan today after deleting everything in quarantine and the report is still showing that it found 1 trojan.  If what you say is true and this trojan was probably discovered at some point in the last few years since I've used McAffee, then I have no worries and never did.  From my perspective, the scan report is misleading since all my angst could have been avoided had the scan report SAID the trojan had been dealt with previously.  Although it IS nice knowing that those 90,000 files are gone for good and that I should keep an eye on my quarantine file from now on. ;o)

                        • 9. Re: Trojan = 1
                          Peter M

                          I agree that report is misleading and we have discussed that with management and they are considering a different approach in the next version.  Glad it's sorted out. ;-)