View original (French)

Delete $McRebootA5E6DEAA56$.lnk, virus?

Solved/Closed
Amelie30530 Posted messages 5 Status Member -  
bazfile Posted messages 58513 Registration date   Status Moderator Last intervention   -

Hello

Before asking my question, I did some digging :)

I installed FRST and I have my report.....

Now I'm stuck because I don't know what to do with this report.

If anyone can help me?

Thank you

4 answers

  1.
    bazfile Posted messages 58513 Registration date   Status Moderator Last intervention   20 277
     

    Hello @Amelie30530 StatusMember.

    This comes from McAfee, it is not a virus.

    Download FRST.

    Once downloaded save it on the desktop then right-click on FRST and choose Run as administrator and you will have this:

    Wait for the message the tool is ready to operate to appear and then click on Scan

    Warning, wait until the messages indicating that the scan is complete are displayed.

    At the end of the scan you will have two text files on the desktop FRST and Addition.

    Then send the FRST and ADDITION reports to https://www.cjoint.com/ or to https://pixeldrain.com/.

    Then provide the two links generated by https://www.cjoint.com/ or https://pixeldrain.com/ in your response.

    bazfile
    Moderator/Security Contributor.
    a hello, a reply, a thank you are always appreciated.

    1
    1. Amelie30530 Posted messages 5 Status Member 1
       

      In the meantime, I found part of the answer.

      It's a new computer and it would come pre-installed with a McAfee antivirus.

      But in the report, there are some shady things.

      Thank you

      0
    2. bazfile Posted messages 58513 Registration date   Status Moderator Last intervention   20 277 > Amelie30530 Posted messages 5 Status Member
       

      @Amelie30530 StatusMember .

      Give the links to the reports.

      0
    3. Amelie30530 Posted messages 5 Status Member 1
       

      Here are the links

      https://www.cjoint.com/c/NEooPdOLuKi

      https://www.cjoint.com/c/NEooM5zfMdi

      Thank you :o)

      0
    4. bazfile Posted messages 58513 Registration date   Status Moderator Last intervention   20 277
       

      @Amelie30530 StatusMember .

      You downloaded a keygen to activate the software Duplicate File Remover luckily Windows Defender blocked it for you, avoid doing that otherwise you're going to end up infecting your PC.

      You have leftovers of McAfee and obsolete/orphan processes.

      As for $McRebootA5E6DEAA56$.lnk it's a leftover from McAfee that starts at boot but the .lnk file is no longer present.

      To fix all this, do the following.

      Procedure to be done in the order indicated:

      1- Open FRST as an administrator, for this right-click on FRST and choose run as administrator
      2 - Copy the entire script that is in the box below:

        For security reasons script removed.

      3- Once the script is copied click on Fix, FRST automatically takes the script in the clipboard.


      Let the fix process complete once it’s done you will be prompted to restart your PC, do it as soon as you are asked, see below.

      Then once your computer has restarted:
      4- You will have a Fixlog file on your desktop then send this fixlog report to https://www.cjoint.com/ then give the link generated by https://www.cjoint.com/ in your response.

      5- CHECK AND TELL ME IF YOUR ISSUE IS STILL PRESENT

      bazfile
      Moderator/Security Contributor.
      a hello, a response, a thank you are always appreciated.

      0
    5. Amelie30530 Posted messages 5 Status Member 1 > bazfile Posted messages 58513 Registration date   Status Moderator Last intervention  
       

      There you go, it's done :o) So happy !!!!

      I have to admit I freaked out, I'm not used to this kind of manipulation, I'm 70 years old !!!!!!

      Thank you !!!!

      1
  2. Naoowza Posted messages 6 Status Member
     

    Hello to both of you, and thank you for asking this question @Amelie30530 StatusMember! I have the same problem, after purchasing a new Lenovo PC two months ago, a window with the same name as Amélie's opens. I followed the procedure from Bazfile but nothing changes. I presume the script needs to be slightly modified. Is it possible for you to help me @bazfile StatusModerator, Security Contributor please?

    Here are the two links generated by FRST after analysis and submission to the site you recommended:

    https://www.cjoint.com/c/OAvsfM1xXOO

    https://www.cjoint.com/c/OAvsgAYCkOO

    Thank you very much and have a good evening!

    Sincerely.

    Naoowza

    0
    1. bazfile Posted messages 58513 Registration date   Status Moderator Last intervention   20 277
       

      @Naoowza StatusMember

      You have two active antivirus programs on your PC; you should keep only one, otherwise, there is a risk of severe slowdowns that could lead to the PC freezing.

      So:

      - Either you uninstall McAfee using this McAfee tool.

      - Or you uninstall Kaspersky using this Kaspersky tool.


      For your problem.

      Procedure to follow in the order indicated:

      1- Open FRST as an administrator; for that, right-click on FRST and choose Run as administrator
      2 - Copy the entire script that is in the box below:

       For security measures the script has been removed.

      3- Once the script is copied, click on Fix, FRST will automatically take the script from the clipboard.


      Let the correction take place; once it is finished, you will be asked to restart your PC. Do it as soon as prompted, see below.

      Then once your computer has restarted:
      4- You will have a Fixlog file on your desktop, then send this fixlog report to https://www.cjoint.com/ or https://pixeldrain.com/

      Then provide the link generated by https://www.cjoint.com/ or https://pixeldrain.com/ in your reply.

      5- CHECK AND LET ME KNOW IF YOUR PROBLEM STILL EXISTS.

      0
  3. Naoowza Posted messages 6 Status Member
     

    Hello @bazfile StatusModerator, Security Contributor

    Thank you for your responsiveness and help!


    Here is the link to the fixlog after applying the correction (and removing McAfee)

    https://www.cjoint.com/c/OAxmkWB5k5O


    The Reboot window still appears at startup, but this time without a .BUD file inside.

    0
    1. bazfile Posted messages 58513 Registration date   Status Moderator Last intervention   20 277
       

      This window comes from McAfee since it is installed on your PC, it's possible that it reinstates this entry.

      Run a new FRST analysis and provide the links to the reports.

      0
  4. bazfile Posted messages 58513 Registration date   Status Moderator Last intervention   20 277
     

    @Naoowza StatusMember .

    Procedure to follow in the order indicated:

    1- Open FRST as an administrator by right-clicking on FRST and selecting run as administrator
    2 - Copy the entire script that is in the box below:

     For security reasons script removed.

    3- Once the script is copied, click on Fix, FRST will automatically take the script from the clipboard.
     


    Let the fix happen, once it is done you will be asked to restart your PC, do so as soon as prompted, see below.

    Then once your computer is restarted:
    4- You will have a Fixlog file on your desktop, then send this fixlog report to https://www.cjoint.com/ or https://pixeldrain.com/
     

    Then provide the link generated by https://www.cjoint.com/ or https://pixeldrain.com/ in your response.

    5- CHECK AND TELL ME IF YOUR PROBLEM IS STILL PRESENT.

    bazfile
    Moderator/Security contributor.
    A hello, a response, a thank you are always appreciated.

    0
    1. Naoowza Posted messages 6 Status Member
       

      Here is the new link:

      https://www.cjoint.com/c/OAxp0tx42qO

      That's it, nothing opens when I start the PC anymore! Thank you very much!!

      If the fixlog is good for you, to avoid repeating yourself, am I doing the same procedure as above for Amélie where I need to rename FRST to uninstall, etc., etc.?

      0
      1. bazfile Posted messages 58513 Registration date   Status Moderator Last intervention   20 277 > Naoowza Posted messages 6 Status Member
         

        Yes, uninstall FRST as mentioned above.

        For your information, your version of Windows 11 is not up to date; check Windows Update, version 24H2 of Windows 11 should be offered there.

        0
      2. Naoowza Posted messages 6 Status Member > bazfile Posted messages 58513 Registration date   Status Moderator Last intervention  
         

        All good!

        Thanks for everything, as well as the tips for the update.

        Take care :)

        0
      3. bazfile Posted messages 58513 Registration date   Status Moderator Last intervention   20 277 > Naoowza Posted messages 6 Status Member
         

        @+ on CCM. :)

        0