McAfee quarantine file too large

[Annosborne]

McAfee quarantine file has filled my hard drive with 70000 files taking 35 GB.  These files are read only and seem only to be deletable via the McAfee home navigate page.  This takes hours and hours to load and never completes.  The problem seems to have started via virus W32/Ramnit a, which the  McAfee programme says it has removed. Can I get rid of the 'read only' tag to delete these files to enable me to proceed?  Can anyone help please?

[exbrit]

The quarantine folder sometimes takes ages to fill up and/or delete but it should eventually work via the SecurityCenter interface.   This is a failing we have pointed out so McAfee are fully aware of the situation.

You can either open a new case with Technical Support Chat via Useful Links at the top of this page to see if they can access those folders, or go the easy route and uninstall everything via Control Panel, then run the MCPR removal tool (again Useful Links above), reboot and reinstall your software.

I know that sounds the wrong way to go about it but right now it's the easiest way.

[Annosborne]

Thank you for the reply.  The quarantined items folder after home navigate has now been filling for 6 hours. It seems I cannot select all or any file and delete until this completes.  Have contacted McAfee chat, they think virus has not been removed but the programme thinks it has. Suggestion is that I pay for the virus removal service and they take over operation of my computer remotely on line.  I am not sure this will help with the time the 'simple operation' above is taking.  Are you suggesting that uninstalling McAfee will remove this folder?  Many thanks.

[exbrit]

Try downloading the free version of THIS software and up date it first then let it run.  Let it remove anything it finds and reboot immediately if asked to.

Note that if the malware prevents it from installing in regular mode, all the above can be achieved in 'Safe Mode with Networking' reached by tapping F8 repeatedly while booting up.

[Annosborne]

I have both malware bytes and superanti-spyware on that compute rand recently ran them both.  The McAfee quarantine file was trying to populate for over 24 hours.  Eventually windows shut down my computer and suggested I might like to start up in safe mode. With the McAfee quarantine file filling the hard disk space everything is extremely slow.  I will try creating a little more space by moving some files on to other storage while not connected to the internet.  None of the virus protection programmes were detecring any viruses as they had removed all they had found.  The size of the quarantine file is just stopping everything.  Many thanks.

[exbrit]

Perhaps some professional help such as the (paid) McAfee Virus Removal Service or at the least (free) Technical Support Chat (see Useful Links at the top of this page) is called for here but there is one thing you can try if it will work.

Download Hijackthis and post its log on one of the following forums for expert guidance.

DOWNLOAD HIJACKTHIS

Do not post Hijackthis logs here, we can't help with  those!

Post the logs at a specialist Forum:

AUMHA

BLEEPINGCOMPUTER

MAJOR GEEKS

MALWAREBYTES

MALWARE REMOVAL

SPYWAREHAMMER

SPYWARE INFO

WHATTHETECH

Be sure to read all the sticky announcements/instructions at the top of each malware forum!

What forum you choose is up to you but I am particularly partial to BleepingComputer or MalwareBytes.   They might be able to spot a problem and suggest a cure.

If this infection prevents Highjackthis from installing try "Save as" to your desktop first renaming it in the process to something innocuous such as 12345.exe or similar.

Message was edited by: Ex_Brit on 07/10/10 7:13:52 EDT AM

[mkielkow]

Think I have the solution. This lets you delete the quarantine files in one go without hassle.

In the McAfee Security Centre you need to select 'Navigation' (top right) and then 'General Settings and Alerts' (on the left hand side of the screen). From there select 'Access Protection' and untick the box.

This removes the block preventing the deletion of all the files using Windows Explorer etc.

In XP, the pathway to the quarantine folder is: C:Documents & Settings/All Users/Application Data/McAfee/Virusscan. I deleted that and then created a new folder with the same name. Only takes a few seconds to remove all the files! Bear in mind that Application Data is a hidden folder so you may have to change your settings to be able to see it. This is done in Explorer by selecting the tools drop down menu, then 'folder options', then the 'view' tab and finally choosing the 'show hidden files and folders' option.

Don't forget to re-select Access Protection once you've finished as you don't want to delete something important!

[exbrit]

mkielkow wrote:
Think I have the solution. This lets you delete the quarantine files in one go without hassle.
In the McAfee Security Centre you need to select 'Navigation' (top right) and then 'General Settings and Alerts' (on the left hand side of the screen). From there select 'Access Protection' and untick the box.
This removes the block preventing the deletion of all the files using Windows Explorer etc.
In XP, the pathway to the quarantine folder is: C:Documents & Settings/All Users/Application Data/McAfee/Virusscan. I deleted that and then created a new folder with the same name. Only takes a few seconds to remove all the files! Bear in mind that Application Data is a hidden folder so you may have to change your settings to be able to see it. This is done in Explorer by selecting the tools drop down menu, then 'folder options', then the 'view' tab and finally choosing the 'show hidden files and folders' option.
Don't forget to re-select Access Protection once you've finished as you don't want to delete something important!

Save a step by opening that Quarantine folder and using Edit > Select All and then simply clicking Shift/Delete and they will vanish.

(Shift/Delete pressed together will bypass the Recycle Bin, that applies to any deletion).

Message was edited by: Ex_Brit on 16/02/11 2:54:36 EST PM