friends laptop seems clean

Hi. I've faithfully followed the read me and run instructions. Logs attached. I think everything is clean.

There is a process that always starts that is not in msconfig startup--McciCMService. Is it necessary? Is there a way to get rid of it if it is not necessary? The only thing I thnk that needs to be done, otherwise, is delete the CyberDefender exe on the desktop. Oh, and then re-enable UAC. Please advise when I can proceed with those.

Thanks so much in advance!

j

 

Thanks for the quick reply.

I'm stuck on the RogueKiller step, as the registry tab doesn't list the items you indicated. When it finishes running, it automatically opens a webpage indicating how to remove necurs (www.adlice.com/necurs-removal-roguekiller).

I have attached a screenshot of the registry entries listed in RK.

Can you please verify which items I should mark? Thank you!!!!!

j

 

Hi. Thanks for the quick response.

I've run the scan twice just now, it doesn't show up, but this time RK sent me to a different webpage (www.adlice.com/userland-rootkits-part-1-iat-hooks/).

RK saves a log file with each scan, I've attached the logs from the three scans done since the initial scan. I haven't quite figured out the log file naming; the one with 104042 as the last part of the name is from 10:40 this morning; 200028 -- 8:00 this evening; 201144 -- 8:11 this evening.

Thanks again for your help!

j

BTW, noticing that all the RogueKiller instructions talk about it putting reports as RKReport[#].txt on desktop, but they are going into c:\program data\roguekiller\logs as .log files -- I'm uploading them without renaming. I suppose that's just due to a newer version of RK. Just wondering if the newer version could make a difference...

 

ok, Here are all the results-hopefully I have attached all requested. RK opened up a webpage again (www.adlice.com/kernelmode-rootkits-part-3-kernel-filters). It showed several items as red in the registry tab -- they are marked VT Unknown in the log (I have a screen shot if you'd like to see them).

McciCMService is still getting started.

Restart works now (before, I had to do a shutdown, otherwise it just hung after windows quit).

Windows security claims there are two other antivirus programs in addition to Windows Defender: Norton 360 and McAfee. They are not installed according to Control Panel->Programs and Features. ??

Would like to see the task manager showing less processes running once booted (14 svchost processes??) -- I've disable what I think I can and surprised so many -- which led me to look for malware/etc. Still seems like a lot (maybe that belongs in a different forum?)

Some questions: Should I delete "cyberdefender_scorecard.exe" from the desktop? Don't know what it is, searches seem to indicate it is garbage.

malwarebtyes shows up in the system tray, but is not in startup. Should I do anything about that? Just leave it be?

Sorry for all the questions :confused, and thank you so much for all your help.

j

 

ok, normal startup mode enabled. cyberdefender gargbage deleted and n360 .ini file deleted. log attached.

Thank you!

 

The workweek has crashed in on me, will probably be this weekend before I can get into it again. Thanks! I will let you know.

 

Hi. Sorry to take so long to get back to this. As far as I can tell, things seem to be ok. For some unexplained reason, everything slowed to a crawl and then Windows Explorer died when I booted the laptop this evening. Was not connected to Wifi at the time.

The only thing I don't like is all the unnecessary stuff running at startup. My friend is very unsavvy, so I want to leave things as simple as possible when I'm done with this. Recommendations on where to find software to manage startup programs?

Thanks for all your help. :cool

 

Then again, maybe things aren't ok. After posting, I opened a simple word document. scrolled through it's three pages, and then tried to close it. Word hung for about a minute, and then I finally got the dialog -- word is not responding -- with three options (look for a fix, close, wait I think were the three).

Odd. hasn't done that before.

 

Ok, so I'm done cleaning and can re-enable UAC? Can malware byes and ccleaner be removed or do you recommend they remain? (My friend is rarely connected to the internet anymore and very non-computer savvy.)

Oh, after I posted, when I shut down her laptop it literally took over 5 minutes to shut down (no updates being installed, it was on the "shutting down" screen for 5 minutes). Is that a possible malware issue?

Thank you so much.

 

Thanks again. Windows is still claiming that Norton 360 and McAfee are present, even though they are not installed. I did see a registry key for McAfee. No, I haven't touched the registry, just looked around a bit. Can you help me get rid of these? Or does that belong in a different forum? Or should I just forget it and leave well enough alone. Thank you!!!!:wave

 

And now it no longer does (say I've got anti-virus that isn't installed). I give up. Thanks again for all your help.

 

yes, sorry, all is well.