Delete $McRebootA5E6DEAA56$.lnk, virus?

Solved/Closed
Amelie30530 Posted messages 5 Status Membre -  
bazfile Posted messages 58432 Registration date   Status Modérateur Last intervention   -

Hello

Before asking my question, I did some digging :)

I installed FRST and I have my report.....

Now I'm stuck because I don't know what to do with this report.

If anyone can help me?

Thank you

4 réponses

bazfile Posted messages 58432 Registration date   Status Modérateur Last intervention   20 245
 

Hello @Amelie30530 StatutMembre.

This comes from McAfee, it is not a virus.

Download FRST.

Once downloaded save it on the desktop then right-click on FRST and choose Run as administrator and you will have this:

Wait for the message the tool is ready to operate to appear and then click on Scan


Warning, wait until the messages indicating that the scan is complete are displayed.

At the end of the scan you will have two text files on the desktop FRST and Addition.

Then send the FRST and ADDITION reports to https://www.cjoint.com/ or to https://pixeldrain.com/.

Then provide the two links generated by https://www.cjoint.com/ or https://pixeldrain.com/ in your response.


bazfile
Moderator/Security Contributor.
a hello, a reply, a thank you are always appreciated.

1
Amelie30530 Posted messages 5 Status Membre 1
 

In the meantime, I found part of the answer.

It's a new computer and it would come pre-installed with a McAfee antivirus.

But in the report, there are some shady things.

Thank you

0
bazfile Posted messages 58432 Registration date   Status Modérateur Last intervention   20 245 > Amelie30530 Posted messages 5 Status Membre
 

@Amelie30530 StatutMembre .

Give the links to the reports.

0
Amelie30530 Posted messages 5 Status Membre 1
 

Here are the links

https://www.cjoint.com/c/NEooPdOLuKi

https://www.cjoint.com/c/NEooM5zfMdi

Thank you :o)

0
bazfile Posted messages 58432 Registration date   Status Modérateur Last intervention   20 245
 

@Amelie30530 StatutMembre .

You downloaded a keygen to activate the software Duplicate File Remover luckily Windows Defender blocked it for you, avoid doing that otherwise you're going to end up infecting your PC.

You have leftovers of McAfee and obsolete/orphan processes.

As for $McRebootA5E6DEAA56$.lnk it's a leftover from McAfee that starts at boot but the .lnk file is no longer present.

To fix all this, do the following.

Procedure to be done in the order indicated:

1- Open FRST as an administrator, for this right-click on FRST and choose run as administrator
2 - Copy the entire script that is in the box below:

  For security reasons script removed. 

3- Once the script is copied click on Fix, FRST automatically takes the script in the clipboard.


Let the fix process complete once it’s done you will be prompted to restart your PC, do it as soon as you are asked, see below.

Then once your computer has restarted:
4- You will have a Fixlog file on your desktop then send this fixlog report to https://www.cjoint.com/ then give the link generated by https://www.cjoint.com/ in your response.

5- CHECK AND TELL ME IF YOUR ISSUE IS STILL PRESENT


bazfile
Moderator/Security Contributor.
a hello, a response, a thank you are always appreciated.

0
Amelie30530 Posted messages 5 Status Membre 1 > bazfile Posted messages 58432 Registration date   Status Modérateur Last intervention  
 

There you go, it's done :o) So happy !!!!

I have to admit I freaked out, I'm not used to this kind of manipulation, I'm 70 years old !!!!!!

Thank you !!!!

1
Naoowza Posted messages 6 Status Membre
 

Hello to both of you, and thank you for asking this question @Amelie30530 StatutMembre! I have the same problem, after purchasing a new Lenovo PC two months ago, a window with the same name as Amélie's opens. I followed the procedure from Bazfile but nothing changes. I presume the script needs to be slightly modified. Is it possible for you to help me @bazfile StatutModérateur, Contributeur sécurité please?

Here are the two links generated by FRST after analysis and submission to the site you recommended:

https://www.cjoint.com/c/OAvsfM1xXOO

https://www.cjoint.com/c/OAvsgAYCkOO

Thank you very much and have a good evening!

Sincerely.

Naoowza

0
bazfile Posted messages 58432 Registration date   Status Modérateur Last intervention   20 245
 

@Naoowza StatutMembre

You have two active antivirus programs on your PC; you should keep only one, otherwise, there is a risk of severe slowdowns that could lead to the PC freezing.

So:

- Either you uninstall McAfee using this McAfee tool.

- Or you uninstall Kaspersky using this Kaspersky tool.



For your problem.

Procedure to follow in the order indicated:

1- Open FRST as an administrator; for that, right-click on FRST and choose Run as administrator
2 - Copy the entire script that is in the box below:

 For security measures the script has been removed. 

3- Once the script is copied, click on Fix, FRST will automatically take the script from the clipboard.


Let the correction take place; once it is finished, you will be asked to restart your PC. Do it as soon as prompted, see below.

Then once your computer has restarted:
4- You will have a Fixlog file on your desktop, then send this fixlog report to https://www.cjoint.com/ or https://pixeldrain.com/

Then provide the link generated by https://www.cjoint.com/ or https://pixeldrain.com/ in your reply.

5- CHECK AND LET ME KNOW IF YOUR PROBLEM STILL EXISTS.

0
Naoowza Posted messages 6 Status Membre
 

Hello @bazfile StatutModérateur, Contributeur sécurité

Thank you for your responsiveness and help!


Here is the link to the fixlog after applying the correction (and removing McAfee)

https://www.cjoint.com/c/OAxmkWB5k5O


The Reboot window still appears at startup, but this time without a .BUD file inside.

0
bazfile Posted messages 58432 Registration date   Status Modérateur Last intervention   20 245
 

This window comes from McAfee since it is installed on your PC, it's possible that it reinstates this entry.

Run a new FRST analysis and provide the links to the reports.

0
Naoowza Posted messages 6 Status Membre > bazfile Posted messages 58432 Registration date   Status Modérateur Last intervention  
 

Alright, but I uninstalled it properly.

Here are the new links:

https://www.cjoint.com/c/OAxpyrrEMeO

https://www.cjoint.com/c/OAxpzbOntgO

0
bazfile Posted messages 58432 Registration date   Status Modérateur Last intervention   20 245
 

@Naoowza StatutMembre .

Procedure to follow in the order indicated:

1- Open FRST as an administrator by right-clicking on FRST and selecting run as administrator
2 - Copy the entire script that is in the box below:

 For security reasons script removed. 

3- Once the script is copied, click on Fix, FRST will automatically take the script from the clipboard.
 


Let the fix happen, once it is done you will be asked to restart your PC, do so as soon as prompted, see below.

Then once your computer is restarted:
4- You will have a Fixlog file on your desktop, then send this fixlog report to https://www.cjoint.com/ or https://pixeldrain.com/
 

Then provide the link generated by https://www.cjoint.com/ or https://pixeldrain.com/ in your response.

5- CHECK AND TELL ME IF YOUR PROBLEM IS STILL PRESENT.


bazfile
Moderator/Security contributor.
A hello, a response, a thank you are always appreciated.

0
Naoowza Posted messages 6 Status Membre
 

Here is the new link:

https://www.cjoint.com/c/OAxp0tx42qO

That's it, nothing opens when I start the PC anymore! Thank you very much!!

If the fixlog is good for you, to avoid repeating yourself, am I doing the same procedure as above for Amélie where I need to rename FRST to uninstall, etc., etc.?

0
bazfile Posted messages 58432 Registration date   Status Modérateur Last intervention   20 245 > Naoowza Posted messages 6 Status Membre
 

Yes, uninstall FRST as mentioned above.

For your information, your version of Windows 11 is not up to date; check Windows Update, version 24H2 of Windows 11 should be offered there.

0
Naoowza Posted messages 6 Status Membre > bazfile Posted messages 58432 Registration date   Status Modérateur Last intervention  
 

All good!

Thanks for everything, as well as the tips for the update.

Take care :)

0
bazfile Posted messages 58432 Registration date   Status Modérateur Last intervention   20 245 > Naoowza Posted messages 6 Status Membre
 

@+ on CCM. :)

0