NtControlSvc and StaffCop - how to fight?

Question

Information Security

On our corporate PCs, a hundred years ago, apparently some remote system administrator installed the notorious Staffcop program to monitor the work of employees. For a long time nothing happened, then on random PCs, normal certificates began to be replaced in the browser with some AtomParks. Struggled repeatedly with this removal of the files described in the uninstall64.cmd file:

NtControlSvc.exe /Unregserver
registerlsp -q "Network Proxy System"
TIMEOUT /T 3
TASKKILL /F /IM NtControlSvc.exe
DEL "%systemroot%\System32\NtControlSvc.ini"
DEL "%systemroot%\System32\NtControlSvcOff.ini"
DEL "%WinDir%\Temp\NtControlSvc.log"
DEL "%WinDir%\Temp\NtControlSvcr.log"
DEL .\NetSpy_ErrorLog.txt
DEL .\Debug_Proxy.log

, and also manually disabled the service in processes.
But the trouble is that after a while she suddenly turns back on herself and starts doing the same dirt.
Who faced and how to remove it completely and irrevocably?

Answer 1

Put a staff and remove agents through his admin face. Well, or find a place where it is installed. The staff does NOT work remotely, its server must be on the local network, for monitoring you need to log in via VPN. Another thing is that if this was done not at the direction of the management, but on someone's stupid initiative, the staff server may no longer exist :)
I won't say anything about NtControlSvc, I haven't used it. But the general principle is this - there is an agent, it hangs somewhere and checks for the presence of its files, if it does not find it, it pulls it up again. Check ALL services and all places where the program can store data - ProgramData for example.

Answer 2

Network in a domain? Check your domain policies for the presence of auto-deployment/auto-start programs.