There was still a .ecr file in one of the subfolders of the user account partition drive. And ther are a a few …lnl.vir and TRZ…tmp files remaining in the external memories after the MCShield clean up.