I found a file "McQcModifier.cmd" on my Win 7 system.

It was a script as follows, set to run at highest privilege on the 1at day of every month via as a scheduled task:

@echo off
tasklist > %temp%\mcqc_task.txt
for /f "skip=3 tokens=1" %%A in (%temp%\mcqc_task.txt) do (
if /I "%%A"=="mcoemmgr.exe" ( goto BYPASS )
schtasks.exe /delete /TN "McQcTask" /F
del /q %temp%\mcqc_task.txt
schtasks.exe /delete /TN "McQcModifier-5c47-a7b0" /F

I have disabled it though MS Security Essentials do not identify it as dangerous.

What is it? There are few links about it via Google, and most are not in English.
3 answers Last reply
More about mcqcmodifier
  1. If windows security or any other virus/malware programs do not see it as a threat, chances are that it is part of windows task manager.
  2. Why in the world would "buwish" write such a nonsensical response. Self Gratification? Ego Issue?.. It annoyed me so much I thought I'd look at what that script does.

    Basically it's a task that checks if McAfee OEM version is running at 50 mins past midnight on the first of the month.
    If it finds the McOEMmgr.exe process, it deletes the task that calls the script and also another similar task.
    If it doesn't find the McOEMmgr.exe process it only deletes the task that calls this script.
    Mine has never run (a/ the task still exists and b/ scheduler says so) but the other task is not present. Probably becase I uninstall all the OEM "features" as the first step of turning each new computer on.

    I imagine all this just causes a reminder to register or an initial engine update on new computers where the OEM version is in use and the user may not be be savvy enough to have already sorted this.

    : run tasklist.exe (a windows os component) and dump the output.
    : read the output, skipping the first three lines)
    : if it DOES find mcoemmgr.exe as a running process go to "BYPASS"
    : which will delete the task the calls this file
    : if it DOESN'T find mcoemmgr.exe as a running process
    : it will delete the task McQcTask,
    : and
    : it will delete the task that calls this batch file.

    My suggestion, delete the cmd file, and in fact the directory it's in, and also delete one or more tasks from scheduler starting with McQcTask<anything> unless of course you are running the OEM McAfee that some "helpful" vendor has pre-installed for you.
  3. When just passing by your front window have all the wires unplugged from the back of your computer and chuck it out the window because you sure don't know how to use it.
Ask a new question

Read More

Security Command Prompt Security Essentials Windows 7