Share via

Message suspected as malware

Anonymous
2019-07-19T19:24:16+00:00

Shortly after logging into google chrome and opening email, I get a message from McUICnt.exe - Entry Point Not Found which says "The procedure entry point BCryptDeriveKeyPBKDF2 could not be located in the dynamic link library bcrypt.dll. "  It will not let me delete or close it.  Just ran detailed Microsoft Safety Scanner and it detected nothing.  Can anyone tell me what this may be?

Windows for home | Previous Windows versions | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. lmacri 2,500 Reputation points
    2019-07-20T13:30:08+00:00

    Hi MaryPeck1:

    What is the make/model of your computer, your operating system, default browser (if other than the latest Chrome v75.0.x) and antivirus name and version?  Please note that you've posted your question in the Windows Vista board (Chrome has not been supported on Vista since April 2016); we'll ask the Forum Moderators to move your question to a different location in the forum if necessary.

    According to the article at https://www.file.net/process/mcuicnt.exe.html the genuine McUICnt.exe (McAfee HTML User Interface Container) is a executable used in a variety of McAfee products.  If you do not use McAfee as your antivirus then you might have unknowingly installed a free utility like McAfee Security Scan Plus or McAfee Site Advisor that was bundled inside an installer for the Adobe Flash Player or some other third-party program.

    If you suspect you have a PUP (potentially unwanted program) like McAfee Security Scan Plus and can't uninstall it from Control Panel | Programs and Features I'd suggest running a scan with the Malwarebytes Free v3 scanner. For Win 7 and higher, download the latest available Malwarebytes Free v3 installer (currently v3.8.3-1.0.613) from https://www.malwarebytes.com/mwb-download/; for Win XP/Vista, the legacy Malwarebytes Free v3.5.1-1.0.365 is available at https://downloads.malwarebytes.com/file/mb3_legacy.

    If you have a third-party antivirus like Kaspersky, Norton, etc. installed I'd suggest disabling the 14-day trial version of the Premium real-time protection features of Malwarebytes at Settings | Account | Deactivate Premium Trial (see the support article How-To: Deactivate Trial Version in Malwarebytes 3) to avoid possible conflicts with your antivirus and use Malwarebytes as a manual on-demand scanner.  Run a standard Threat Scan to see if it detects any higher-risk malware or lower-risk PUPs / PUMs (potentially unwanted programs / registry modifications) like McAfee Security Scan Plus.  Before running your first scan I would also suggest that you change Settings | Protection | Potential Threat Protection for lower-risk PUPs / PUMs from the default Always Detect to Warn User so you're always prompted before any lower-risk threats (e.g., browser toolbars, adware, registry cleaners and other third-party utilities, etc.) are removed just in case you want to keep them.

    32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Norton v22.15.2.22 * MB v3.5.1-1.0.365

    HP Pavilion dv6835ca, Intel Core2Duo T5550 @ 1.83 GHz, 3 GB RAM, NVIDIA GeForce 8400M GS

    Was this answer helpful?

    9 people found this answer helpful.
    0 comments
  2. lmacri 2,500 Reputation points
    2019-07-21T14:26:16+00:00

    Hi MaryPeck1:

    One other question that may or may not be relevant.  If you have a Vista operating system, have you installed any Vista-compatible Windows Server 2008 security updates on your system since Vista SP2 reached end of support on 11-Apr-2017?

    For example, Microsoft recommends that Vista SP2 users manually install the Windows Server 2008 security update KB4499180 (Security Only Quality Update for Windows Server 2008: May 14, 2019) to patch the recently discovered "BlueKeep" vulnerability - see the MS support article Customer Guidance for CVE-2019-0708 | Remote Desktop Services Remote Code Execution Vulnerability: May 14, 2019.  I checked the file manifest of KB4499180 and noticed that it includes an update for bcrypt.dll.  As of April 2019 (KB4489887 or later) the manual installation of these Windows Server 2008 monthly rollups will also change the build number of a Vista SP2 operating systems from 6.0.6002.xxxxx to 6.0.6003.xxxxx (see the MS support article Build Number Changing to 6003 in Windows Server 2008), and this change to 6.0.6003.xxxxx (Build 3) is known to cause unexpected glitches and incompatibilities with some third-party programs.

    This is pure speculation on my part, but it's always possible that a McAfee program you have on your system is incompatible with the version of bcrypt.dll you currently have on your system (e.g., either the old Vista SP2 v6.0.6002.19720 or the newer Windows Server 2008 v6.0.6002.24394) or now requires a different build number for your operating system.

    32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Norton v22.15.2.22 * MB v3.5.1-1.0.365

    HP Pavilion dv6835ca, Intel Core2Duo T5550 @ 1.83 GHz, 3 GB RAM, NVIDIA GeForce 8400M GS

    Was this answer helpful?

    7 people found this answer helpful.
    0 comments