Mleady-MWR

Well, I do believe there is only need for one real-time scanner so I'llmake the suggestion first of uninstalling Defender. I'll take my time with her and just post back when I actually come to do a fix?

OK.

Hi Askey

Is it something Im doing, or not doing? That 023 just wont go away.

The batch file is not correct:

@echo off
sc stop "Content Monitoring Tool"
sc delete "Content Monitoring Tool"
del Fixservices.bat
exit

should be:

Open Notepad and choose [b]File, New[/b]

Copy the content of the quote box below into notepad.

[quote]@echo off

sc stop "Content Monitoring Tool"

sc disable "Content Monitoring Tool"

sc delete msCMTSrvc

[/quote]

Use Notepad's [b]File, Save As[/b] and save to your desktop as FileType [b]All Files[/b] and Filename [b]FixService.bat[/b] 

Do not save as File Type [b]Text[/b] or it won't work.

Exit Notepad



Then double-click [b]FixService.bat[/b] on your desktop.

sc delete always needs the name in parentheses in the O23 line.
Then the O23 line can be removed in HJT if it's still there.

Post it and get one more HJT log.

Im getting some great replies today! Tried google but cant find a definitive answer. Maybe it's something to do with (file missing)?
Im just guessing now.

Mistakenly posted this in the real thread instead of here.
Got to stop leaving both open at once!
That's twice in the same month!
I deleted it, but his ref to me is that.

suggested remove the kernel dump O4
and
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\support.com\bin\tgcmd.exe" /server
and suggested that he was probably OK after that.
the O23 is only a minor nuisance.

He posted he's still worried about the McAfee malware.j note he's getting.
I don't know if it's just a heuristics catch (that name sounds like it).
No other AV's have noted that one yet.
Can't find out anything else online either.
Maybe you can ask the user if he is able to find out what file is involved and we can upload it to Virustotal or Jotti.

I would run a Kaspersky Online scan and see if it picks up anything.
If nothing, I would give the all clear.

Hi askey

Will do.

I should add, asking this op to id and find a file might be a bit much.

Think I owe you a pint for this one.

OK. I think I can guide her to delete the two temp files and the My Websearch folder. How do you clear out Spysweeper's temp files?

You don't need to delete the Spysweeper Temp files and they are probably protected. They are no risk to the user.

Go ahead and make up your post for the other stuff.

We have three files we need to delete. First these files:

Go to Start then My Computer and double-click on the Local Drive ( C ) icon.
You should see these two files.

47.tmp/data0002 and 47.tmp NSIS.

Right-click once on each and in the sub-menu that appears select Delete.

Stay in that same location and double-click on the Program Files folder.
Now seek out this file in there

Uninstall My Web Search.dll

right-click on it and select Delete.

Close all open windows then right-click on the Recycle-bin and select Empty Recycle Bin.

Let me know you have done that correctly or if you have any problems.

47.temp may be a folder. Have User delete it whatever it is.

Post it.

Hello Askey

One more HJT log or All-Clean? She got the files.

Looks OK.

All-clean
this one needs a few extra protections against the operator
SWBlaster prob a must in this case.

Good job