This forum requires Javascript to be enabled for posting content
Log In
Please consider registering
Guest
Forum Scope


Match



Forum Options



Min search length: 3 characters / Max search length: 84 characters
Register Lost password?
HP Model CQ2713
dandl
Lexa, AR
740 Posts
(Offline)
1
January 21, 2016 - 10:06 am

This is some of the threats MSE found and removed on the initial scan, not including what Super Anti Spyware found and removed. I then started scanning each account that was set up on the PC and found even more threats. Their were four "HELP_DECRYPT" files that kept cropping up that MSE would target, and they were in every nook and cranny on this PC. I finally started deleting user accounts until I got to the account that was first set up on this PC. It is scanning threat free now.
This PC had Norton installed, which had never been updated, so Norton had to go and MSE was installed, because the owner did not want to pay for any virus software. After uninstalling Norton I kept getting this action center popup, which was a notification to turn on Windows Defender. But how?
If the PC had had the gpedit tool this would have been simple but instead I had to find the registry entry that was causing this popup. I finally found a video on youtube, of all places pin pointing where to look. The registry key is located in the "HKLM_SOFTWARE_POLICIES_MICROSOFT_WINDOWS DEFENDER" and you delete the DisableAntiSpy entry.
I do believe this is only an issue after installing MSE, and MSE and WD cannot both run at the same time. After deleting the above entry WD will try to start but it can't if MSE is installed, so one will have to just close WD.
Now if one uses the action center to view what virus and malware protection is installed, one will see two entry, MSE which should be on, and WD which should be off, and no more popup.
Do not know why this entry isn't deleted after uninstalling Norton.
Although their were no important, except for image files, files involved. All important files were saved to a flash drive before deleting accounts. This PC is a perfect example of what happens when access is granted to multiple users.
Hope this can be of use to someone.
David Hartsock
1117 Posts
(Offline)
2
January 21, 2016 - 12:44 pm

dandl said
Their were four "HELP_DECRYPT" files that kept cropping up that MSE would target

Those files are a sure sign of cryptoware. Look out for encrypted user files and don't put that PC on your network!

Forum Timezone: America/Indiana/Indianapolis
All RSSShow Stats
Administrators:
Jim Hillier
Richard Pedersen
David Hartsock
Moderators:
Carol Bratt
dandl
Jason Shuffield
Jim Canfield
Terry Hollett
Stuart Berg
John Durso
Top Posters:
Chad Johnson: 867
Mindblower: 666
carbonterry2: 356
Flying Dutchman: 278
grr: 211
Newest Members:
blutsband
cyberguy
JudeLandry
benjaminlouis680309
drogers97439
Forum Stats:
Groups: 8
Forums: 20
Topics: 1942
Posts: 13522

 

Member Stats:
Guest Posters: 11
Members: 3179
Moderators: 7
Admins: 3
Most Users Ever Online: 2303
Currently Online:
Guest(s) 30
Currently Browsing this Page:
1 Guest(s)
Exit mobile version

WHY NOT SUBSCRIBE TO OUR NEWSLETTER?

Get great content like this delivered to your inbox!

It's free, convenient, and delivered right to your inbox! We do not spam and we will not share your address. Period!