Why Ww17?

Discussion in 'Malware Help (A Specialist Will Reply)' started by Chaos Annihilator, Jun 9, 2026.

Page 2 of 2
  1. Chaos Annihilator

    Chaos Annihilator Corporal

    Though I did just have a thought, if Avast was the only thing that could tell this file was locked, and the file really is locked, was Avast working better than everything else?
     
    Chaos Annihilator, Jun 17, 2026
    #51
  2. Oh My!

    Oh My! Malware Expert Staff Member

    My apologies once again. I changed my mind at the last minute and forgot I decided to uninstall Avast rather than do the Base Video steps, which we will need to do now.

    Yes, the Intel video drivers are locking the cache.dat file. Intel is able to access the file but access from other processes/programs is being denied. This is common, especially for system files.

    Here is a new set of instructions.

    ===================================================

    Using Base Video in Normal Mode

    --------------------
    • Click the Windows key + R at the same time
    • Type msconfig and hit Enter
    • Click the Boot tab
    • Place a check mark in Base video, then click OK
    • Restart your computer - Note: your screen resolution may change, that is normal.
    • Complete the next step
    ===================================================

    VirusTotal Online Virus Scanner

    --------------------
    • Please go to VirusTotal
    • Select Choose file
    • Navigate to the following file and double click on it

    C:Users\Mariah\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\EBWebView\GPUPersistentCache\DawnGraphiteCache\QFRPRRKRKWZNTFMPUJZIPW2HOZ5QE2WL\cache.db
    ​
    • Select Confirm upload
    • Once completed, highlight the information in the address bar and copy and paste the link in your reply
    • Reverse the Base Video step by unchecking it and restarting the computer
    ===================================================

    Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it.
    • Virustotal link
     
    Oh My!, Jun 17, 2026
    #52
    Chaos Annihilator likes this.
  3. Oh My!

    Oh My! Malware Expert Staff Member

    Sorry, I didn't see your post.

    I have a lengthy explanation I wrote out in anticipation of you wanting to reinstall Avast. It is complicated to try to explain which is why I asked if you plan on reinstalling it.

    My guess is Avast is not working better than the others but let's see what Virustotal says.
     
    Oh My!, Jun 17, 2026
    #53
  4. Chaos Annihilator

    Chaos Annihilator Corporal

    You're fine, I'm glad I'm not the only one.

    I followed the steps to change to the base video, restarted, then tried VirusTotal again. I still could not choose the correct file because "it is in use by anther program" it says. It did suggest I change the name, but I can't do that while it's still locked, right?

    I went back to msconfig and made sure I really checked Base Video (it's getting late, and I've been working too long) but it was really checked.

    I may just be too tired, I'll try again in the morning unless you think I did it right and have a new idea by then. Thanks!
     
    Chaos Annihilator, Jun 18, 2026
    #54
  5. Oh My!

    Oh My! Malware Expert Staff Member

    Why am I not surprised!

    Please do this.

    ===================================================

    Farbar Recovery Scan Tool Fix

    --------------------
    • Right click on the FRST64 icon and select Run as administrator
    • Highlight the below information then hit the Ctrl + C keys at the same time and the text will be copied
    • There is no need to paste the information anywhere, FRST64 will do it for you
    Code:
    Start::
Folder: C:\FRST\Quarantine\C
End::
    • Click Fix
    • When completed the tool will create a log on the desktop called Fixlog.txt. Please copy and paste the contents of the file in your reply.
    ===================================================

    Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it.
    • Fixlog
     
    Oh My!, Jun 18, 2026
    #55
  6. Chaos Annihilator

    Chaos Annihilator Corporal

    Wow, sorry! I can't believe I'm just now getting to this. I've spent the day arguing with nurses, receptionists, and doctors. You'd think if you finished healthcare training and remained unpleasant and uncaring, you wouldn't be able to graduate.

    Thanks for bearing with me. Here is the log:

    Fix result of Farbar Recovery Scan Tool (x64) Version: 16-06-2026
    Ran by Mariah (18-06-2026 16:15:52) Run:6
    Running from C:\Users\Mariah\Desktop
    Loaded Profiles: Mariah
    Boot Mode: Normal
    ==============================================

    fixlist content:
    *****************
    Start::
    Folder: C:\FRST\Quarantine\C
    End::
    *****************


    ========================= Folder: C:\FRST\Quarantine\C ========================

    2026-06-10 12:43 - 2026-06-10 12:43 - 000191178 ____A [26FFE9C4C8E6E81D19A88DE9F35A8F3F] () C:\FRST\Quarantine\C\Firewall.reg.xBAD
    2026-06-17 12:49 - 2026-06-17 12:50 - 000000000 ____D [00000000000000000000000000000000] () C:\FRST\Quarantine\C\ProgramData
    2024-09-25 13:25 - 2026-06-16 23:38 - 000000000 ____D [00000000000000000000000000000000] () C:\FRST\Quarantine\C\ProgramData\Avast Software
    2026-06-17 12:49 - 2026-06-17 12:49 - 000000000 ____D [00000000000000000000000000000000] () C:\FRST\Quarantine\C\ProgramData\Intel
    2026-06-17 12:49 - 2026-06-17 12:49 - 000000000 ____D [00000000000000000000000000000000] () C:\FRST\Quarantine\C\ProgramData\Intel\ShaderCache
    2024-09-25 13:32 - 2024-09-25 13:32 - 000000000 ____A [D41D8CD98F00B204E9800998ECF8427E] () C:\FRST\Quarantine\C\ProgramData\Intel\ShaderCache\AvastUI_0.xBAD
    2024-09-25 13:32 - 2024-09-25 13:32 - 000000000 ____A [D41D8CD98F00B204E9800998ECF8427E] () C:\FRST\Quarantine\C\ProgramData\Intel\ShaderCache\AvastUI_1.xBAD
    2024-09-25 13:32 - 2024-09-25 13:32 - 000000000 ____A [D41D8CD98F00B204E9800998ECF8427E] () C:\FRST\Quarantine\C\ProgramData\Intel\ShaderCache\AvastUI_2.xBAD
    2026-06-14 22:40 - 2026-06-14 22:40 - 000000000 ____D [00000000000000000000000000000000] () C:\FRST\Quarantine\C\Users
    2026-06-14 22:40 - 2026-06-14 22:40 - 000000000 ____D [00000000000000000000000000000000] () C:\FRST\Quarantine\C\Users\Mariah
    2026-06-14 22:40 - 2026-06-17 12:50 - 000000000 ____D [00000000000000000000000000000000] () C:\FRST\Quarantine\C\Users\Mariah\AppData
    2026-06-14 22:40 - 2026-06-17 12:50 - 000000000 ____D [00000000000000000000000000000000] () C:\FRST\Quarantine\C\Users\Mariah\AppData\Local
    2026-06-14 22:40 - 2026-06-14 22:40 - 000000000 ____D [00000000000000000000000000000000] () C:\FRST\Quarantine\C\Users\Mariah\AppData\Local\Packages
    2026-06-14 22:40 - 2026-06-14 22:40 - 000000000 ____D [00000000000000000000000000000000] () C:\FRST\Quarantine\C\Users\Mariah\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy
    2026-06-14 22:40 - 2026-06-14 22:40 - 000000000 ____D [00000000000000000000000000000000] () C:\FRST\Quarantine\C\Users\Mariah\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState
    2026-06-14 22:40 - 2026-06-14 22:40 - 000000000 ____D [00000000000000000000000000000000] () C:\FRST\Quarantine\C\Users\Mariah\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\EBWebView
    2026-06-14 22:40 - 2026-06-14 22:40 - 000000000 ____D [00000000000000000000000000000000] () C:\FRST\Quarantine\C\Users\Mariah\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\EBWebView\GPUPersistentCache
    2026-06-09 10:10 - 2026-06-11 18:51 - 000000000 ____D [00000000000000000000000000000000] () C:\FRST\Quarantine\C\Users\Mariah\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\EBWebView\GPUPersistentCache\DawnGraphiteCache
    2026-06-11 18:51 - 2026-06-11 18:51 - 000000000 ____D [00000000000000000000000000000000] () C:\FRST\Quarantine\C\Users\Mariah\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\EBWebView\GPUPersistentCache\DawnGraphiteCache\QFRPRRKRKWZNTFMPUJZIPW2HOZ5QE2WL
    2026-06-11 18:51 - 2026-06-11 18:53 - 000004096 ____A [9807CFF50448B39728A29115945564B3] () C:\FRST\Quarantine\C\Users\Mariah\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\EBWebView\GPUPersistentCache\DawnGraphiteCache\QFRPRRKRKWZNTFMPUJZIPW2HOZ5QE2WL\cache.db
    2026-06-11 18:51 - 2026-06-11 18:53 - 000012392 ____A [77D0422CB79D7BCABA589C3C4F7B3931] () C:\FRST\Quarantine\C\Users\Mariah\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\EBWebView\GPUPersistentCache\DawnGraphiteCache\QFRPRRKRKWZNTFMPUJZIPW2HOZ5QE2WL\cache.db-wal
    2026-06-11 18:51 - 2026-06-11 18:53 - 000000000 ____A [D41D8CD98F00B204E9800998ECF8427E] () C:\FRST\Quarantine\C\Users\Mariah\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\EBWebView\GPUPersistentCache\DawnGraphiteCache\QFRPRRKRKWZNTFMPUJZIPW2HOZ5QE2WL\cache.journal
    2026-06-17 12:50 - 2026-06-17 12:50 - 000000000 ____D [00000000000000000000000000000000] () C:\FRST\Quarantine\C\Users\Mariah\AppData\Local\Temp
    2026-06-10 13:56 - 2026-06-14 15:26 - 000000000 ____D [00000000000000000000000000000000] () C:\FRST\Quarantine\C\Users\Mariah\AppData\Local\Temp\_avast_
    2026-06-10 13:56 - 2026-06-10 13:56 - 000000000 ____D [00000000000000000000000000000000] () C:\FRST\Quarantine\C\Users\Mariah\AppData\Local\Temp\_avast_\unp_low
    2026-06-17 12:50 - 2026-06-17 12:50 - 000000000 ____D [00000000000000000000000000000000] () C:\FRST\Quarantine\C\Users\Mariah\AppData\Roaming
    2026-06-17 12:50 - 2026-06-17 12:50 - 000000000 ____D [00000000000000000000000000000000] () C:\FRST\Quarantine\C\Users\Mariah\AppData\Roaming\Mozilla
    2026-06-17 12:50 - 2026-06-17 12:50 - 000000000 ____D [00000000000000000000000000000000] () C:\FRST\Quarantine\C\Users\Mariah\AppData\Roaming\Mozilla\Firefox
    2026-06-17 12:50 - 2026-06-17 12:50 - 000000000 ____D [00000000000000000000000000000000] () C:\FRST\Quarantine\C\Users\Mariah\AppData\Roaming\Mozilla\Firefox\Profiles
    2026-06-17 12:50 - 2026-06-17 12:50 - 000000000 ____D [00000000000000000000000000000000] () C:\FRST\Quarantine\C\Users\Mariah\AppData\Roaming\Mozilla\Firefox\Profiles\h7vtrih6.default
    2026-06-17 12:50 - 2026-06-17 12:50 - 000000000 ____D [00000000000000000000000000000000] () C:\FRST\Quarantine\C\Users\Mariah\AppData\Roaming\Mozilla\Firefox\Profiles\h7vtrih6.default\storage
    2026-06-17 12:50 - 2026-06-17 12:50 - 000000000 ____D [00000000000000000000000000000000] () C:\FRST\Quarantine\C\Users\Mariah\AppData\Roaming\Mozilla\Firefox\Profiles\h7vtrih6.default\storage\default
    2026-06-13 13:53 - 2026-06-13 14:14 - 000000000 ____D [00000000000000000000000000000000] () C:\FRST\Quarantine\C\Users\Mariah\AppData\Roaming\Mozilla\Firefox\Profiles\h7vtrih6.default\storage\default\https+++www.avast.com
    2026-06-13 14:14 - 2026-06-13 16:57 - 000000084 ____A [BA4D69CE7311F2E7B5E9AD3860409990] () C:\FRST\Quarantine\C\Users\Mariah\AppData\Roaming\Mozilla\Firefox\Profiles\h7vtrih6.default\storage\default\https+++www.avast.com\.metadata-v2
    2026-06-13 13:53 - 2026-06-13 13:53 - 000000000 ____D [00000000000000000000000000000000] () C:\FRST\Quarantine\C\Users\Mariah\AppData\Roaming\Mozilla\Firefox\Profiles\h7vtrih6.default\storage\default\https+++www.avast.com\ls
    2026-06-13 13:53 - 2026-06-13 13:53 - 000006144 ____A [6CE3B83A5FB1AA605B3B20A7C4CC2795] () C:\FRST\Quarantine\C\Users\Mariah\AppData\Roaming\Mozilla\Firefox\Profiles\h7vtrih6.default\storage\default\https+++www.avast.com\ls\data.sqlite
    2026-06-13 13:53 - 2026-06-13 13:53 - 000000012 ____A [02211010EBB26D975F6B4DD39724B067] () C:\FRST\Quarantine\C\Users\Mariah\AppData\Roaming\Mozilla\Firefox\Profiles\h7vtrih6.default\storage\default\https+++www.avast.com\ls\usage
    2026-06-10 12:43 - 2026-06-17 12:49 - 000000000 ____D [00000000000000000000000000000000] () C:\FRST\Quarantine\C\Windows
    2026-06-10 12:43 - 2026-06-10 12:43 - 000000000 ____D [00000000000000000000000000000000] () C:\FRST\Quarantine\C\Windows\System32
    2026-06-10 12:43 - 2026-06-10 12:43 - 000000000 ____D [00000000000000000000000000000000] () C:\FRST\Quarantine\C\Windows\System32\Drivers
    2026-06-10 12:43 - 2026-06-10 13:45 - 000000000 ____D [00000000000000000000000000000000] () C:\FRST\Quarantine\C\Windows\System32\Drivers\etc
    2018-11-29 18:57 - 2025-10-02 12:00 - 000454626 ____A [F2B6821FD304AF1F2AF2222D82519671] () C:\FRST\Quarantine\C\Windows\System32\Drivers\etc\hosts.xBAD
    2026-06-17 12:49 - 2026-06-17 12:49 - 000000000 ____D [00000000000000000000000000000000] () C:\FRST\Quarantine\C\Windows\Temp
    2026-06-13 14:02 - 2026-06-16 22:34 - 000000000 ____D [00000000000000000000000000000000] () C:\FRST\Quarantine\C\Windows\Temp\_avast_
    2026-06-13 14:33 - 2026-06-13 14:33 - 000000000 ____D [00000000000000000000000000000000] () C:\FRST\Quarantine\C\Windows\Temp\_avast_\TEMP~TUBC
    2026-06-13 14:33 - 2026-06-13 14:33 - 000000000 ____D [00000000000000000000000000000000] () C:\FRST\Quarantine\C\Windows\Temp\_avast_\TEMP~TUBC\Firefox
    2026-06-13 14:33 - 2026-06-13 14:33 - 000000000 ____D [00000000000000000000000000000000] () C:\FRST\Quarantine\C\Windows\Temp\_avast_\TEMP~TUBC\MSEdge
    2026-06-13 14:02 - 2026-06-16 22:34 - 000000000 ____D [00000000000000000000000000000000] () C:\FRST\Quarantine\C\Windows\Temp\_avast_\unp_low

    ====== End of Folder: ======


    ==== End of Fixlog 16:15:53 ====
     
    Chaos Annihilator, Jun 18, 2026
    #56
  7. Oh My!

    Oh My! Malware Expert Staff Member

    So much for bedside manners.

    I woke up in the middle of the night thinking about things and something struck me.

    In the Fixlist from Post #25 I included a command to delete the DawnGraphiteCache folder. In doing that everything else down the line in the file path would be removed, including the cache.dat file. The Fixlog showed the folder was successfully removed, however when you ran an Avast Scan very soon after the deletion Avast detected the file again. I assumed the file wasn't removed even though the Fixlog said the folder (and file) was removed. That happens on occasion where FRST indicates something was successful when it was not.

    What struck me last night is the FRST Quarantine folder should have evidence of the file removal if the folder (and file) was truly removed successfully. If that happened a brand new file was created upon reboot immediately after the Fixlist processed. What that would mean is Avast would be detecting a newly created cache.dat file we know would be clean and locked, with clean being the important consideration.

    I had you run the last Fixlist to examine the contents of the FRST Quarantine folder which contains items removed by FRST during the running of the Fixlist. This confirms what I had suspected was the case. For some reason Avast flags that particular locked file even though I am certain it examines other locked files and doesn't comment on them.

    The newly created file is clean so the issue has to be Avast. If I had to guess, I would say it was something having to do with state of Avast on your system. I would bet on a corruption since I have not had other topics where Avast commented on the same file. At least nobody has expressed a similar concern. The only way to determine if it is Avast in general or the (corrupted?) state of Avast on your system prior to removal would be to reinstall the program and run a scan.

    If you want to install Avast, test the scan, then leave it or remove it again we can repeat the 2 step cleaning process to remove the program and all the remnants left behind.

    Your call.
     
    Oh My!, Jun 18, 2026
    #57
  8. Chaos Annihilator

    Chaos Annihilator Corporal

    You really are a geek! Figuring all of that out in the middle of the night, and making it amazingly easy to understand (and rather exciting and compelling, too). Your brain is an amazing thing...

    Okay, I'm convinced the file is clean. Sure, let's reinstall Avast and see what happens.

    I don't know if it had to do with the corruption or not, but when I'd installed Avast free from their website, it looked different than a few days ago when I got Avast off of Major Geeks. It seems the free Avast here calls itself Avast One? I don't know which one is "right" or newest, do you have a preference as to where I download it from?
     
    Chaos Annihilator, Jun 18, 2026
    #58
  9. Oh My!

    Oh My! Malware Expert Staff Member

    Thanks.

    Go directly to Avast that way there will be no question whatsoever. It will be interesting to see what happens.
     
    Oh My!, Jun 19, 2026
    #59
  10. Chaos Annihilator

    Chaos Annihilator Corporal

    Hello, I'm still here. Our internet went out early Friday morning, and we didn't get it back up and running until yesterday afternoon!

    I had no idea I was so reliant on it. Four and a half days without was very enlightening....

    I'm heading to Avast now, I'll run the scan tonight and we'll see how it goes!
     
    Chaos Annihilator, Jun 24, 2026
    #60
  11. Oh My!

    Oh My! Malware Expert Staff Member

    How are we doing?
     
    Oh My!, Jul 3, 2026
    #61
  12. Chaos Annihilator

    Chaos Annihilator Corporal

    I'm sorry I kept you waiting so long, I finally had a chance to post tonight. Happy 4th of July!

    I ran the Avast scan the night of my last post, and it had the same issue with the same file. I realized my computer was still having some issues connecting to the internet, so after that was fixed I ran it again a couple of nights ago. Still the same problem, the log will follow. So I guess Avast is still having problems...any ideas? I wonder if I should ask Avast about it? They don't like to talk to me since I use the free version. Do you still think the problem lies with Avast?

    Thanks for checking back instead of giving up on me. On the way to an appointment our car broke down, I feel like I've been away from home for a week.

    *
    * Avast Scan Report
    * This file is generated automatically
    *
    * Scan name: Full Virus Scan
    * Started on: Friday, June 26, 2026 12:30:34 AM
    * VPS: 260625-4, 6/25/2026
    *

    C:\Users\Mariah\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\EBWebView\GPUPersistentCache\DawnGraphiteCache\WAYLUSJ7BONJ44JCR3QBYGU7DQX7EQ7H\cache.db [E] The process cannot access the file because another process has locked a portion of the file (33)
    Infected files: 0
    Total files: 1660022
    Total folders: 129411
    Total size: 326.9 GB

    *
    * Scan stopped: Friday, June 26, 2026 3:49:11 AM
    * Run-time was 3 hour(s), 18 minute(s), 37 second(s)
    *

    *
    * Avast Scan Report
    * This file is generated automatically
    *
    * Scan name: Full Virus Scan
    * Started on: Thursday, July 2, 2026 2:38:03 AM
    * VPS: 260701-6, 7/1/2026
    *

    C:\Users\Mariah\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\EBWebView\GPUPersistentCache\DawnGraphiteCache\4NKVHR4EC6BINKNWJV25JYUXV4UNF3DT\cache.db [E] The process cannot access the file because another process has locked a portion of the file (33)
    Infected files: 0
    Total files: 1709297
    Total folders: 131431
    Total size: 339.7 GB

    *
    * Scan stopped: Thursday, July 2, 2026 6:19:22 AM
    * Run-time was 3 hour(s), 41 minute(s), 19 second(s)
    *
     
    Chaos Annihilator, Jul 4, 2026 at 2:52 AM
    #62
  13. Oh My!

    Oh My! Malware Expert Staff Member

    Thanks for the update.

    This is an Avast issue, presumably because of the criteria they use to examine files. Avast doesn't like the file because it is partially locked. I thought I had determined what was locking the file but now I am not sure. Either way, it is not being flagged because it is malicious.

    Another idea, please do this.

    ===================================================

    Autoruns

    --------------------
    • Please download Autoruns and save it to your Desktop
    • Right click on the autoruns64 icon on your Desktop and select Run as administrator
    • Wait until the lower left hand corner of the window shows Ready
    • Hit the Ctrl + S key at the same time
    • Save the file onto your Desktop using the default File name:
    • Please zip and attach the file to your reply]
    ===================================================

    Things I would like to see in your next reply.
    • Attached file
     
    Oh My!, Jul 5, 2026 at 9:48 AM
    #63
  14. Chaos Annihilator

    Chaos Annihilator Corporal

    Is this file not normally locked by windows? The zip folder is attached. Thanks!
     

    Attached Files:

    Chaos Annihilator, Jul 5, 2026 at 4:23 PM
    #64
  15. Oh My!

    Oh My! Malware Expert Staff Member

    That file was locked on my computer.

    Please do this.

    ===================================================

    Process Monitor Boot Log

    --------------------
    • Download Process Monitor and save it to your Desktop
    • Right click on Procmon and select Run as administrator
    • Agree to any permission requests
    • Hit Ctrl + E to stop capturing events
    • Hit Ctrl + X at the same time to clear the display
    • Click Options then Enable Boot Logging
    • Place a check mark in Generate thread profiling events
    • Click OK
    • Close Process Monitor
    • Close any open programs and shut down your computer
    • Start your computer and allow the boot up process to complete, including logging in if you use a password
    • Wait 15 minutes before doing anything further
    • Right click on Process Monitor and select Run as administrator
    • Click Yes on the next window that appears and save the boot-time activity log onto your desktop using the default name
    • Please zip and upload the file to GoFile or the file hosting site of your choice and send me a Personal Message with the download link
    ===================================================

    Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it.
    • Download link via Personal Message
     
    Oh My!, Jul 5, 2026 at 7:41 PM
    #65
  16. Chaos Annihilator

    Chaos Annihilator Corporal

    Okay, I'll run the process monitor later tonight. What did the Autoruns file tell you? I couldn't even figure out how to read it...

    So then it seems normal that the file is locked, but not normal that this is causing it to show up during virus scans, is that right?
     
    Chaos Annihilator, Jul 5, 2026 at 8:38 PM
    #66
  17. Oh My!

    Oh My! Malware Expert Staff Member

    Exactly correct, for some reason Avast isn't happy with the file when other antivirus programs don't have an issue with it. At this point we are trying to figure out what is locking a portion of the file. Not that it changes anything other than satisfying our curiosity. However, there is much to be learned going through the process.

    The autoruns report didn't point to what app or program is interacting with that cache.db file. I am hoping the bootlog will give us information.
     
    Oh My!, Jul 5, 2026 at 8:52 PM
    #67
    Chaos Annihilator likes this.
  18. Oh My!

    Oh My! Malware Expert Staff Member

    Thank you for Bootlog link. We are still doing battle.

    Please run this.

    ===================================================

    Running Windows Powershell Script

    --------------------

    • Click Start, type Powershell, then select Windows Powershell - Run as administrator
    • Copy and paste the below after the command prompt then hit Enter
    Powershell "Get-CimInstance Win32_Process | Select-Object Name, ProcessId, ParentProcessId | Sort-Object ParentProcessId" | Out-File -FilePath C:\Users\Mariah\Desktop\Output.txt​
    • When completed an output.txt report will be placed on the Desktop
    • Copy and paste the contents of the report in your reply
    ===================================================

    Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it.
    • Output.txt report
     
    Oh My!, Jul 7, 2026 at 10:05 AM
    #68
  19. Chaos Annihilator

    Chaos Annihilator Corporal

    Powershell is ready to battle, too: it seems it wants to argue about whether quotation marks belong in our command...? There was no output.txt report, and apparently it wants us to argue back. Here's what I got:

    Windows PowerShell
    Copyright (C) Microsoft Corporation. All rights reserved.

    Install the latest PowerShell for new features and improvements! https://aka.ms/PSWindows

    PS C:\WINDOWS\system32> Powershell "Get-CimInstance Win32_Process | Select-Object Name, ProcessId, ParentProcessId | Sort-Object ParentProcessId" | Out-File -FilePath "C:\Users\Mariah\Desktop\Output.txt"
    Out-File : Cannot validate argument on parameter 'Encoding'. The argument "" does not belong to the set
    "unknown,string,unicode,bigendianunicode,utf8,utf7,utf32,ascii,default,oem" specified by the ValidateSet attribute.
    Supply an argument that is in the set and then try the command again.
    At line:1 char:180
    + ... ProcessId" | Out-File -FilePath "C:\Users\Mariah\Desktop\Output.txt"
    + ~
    + CategoryInfo : InvalidData: :)) [Out-File], ParameterBindingValidationException
    + FullyQualifiedErrorId : ParameterArgumentValidationError,Microsoft.PowerShell.Commands.OutFileCommand

    PS C:\WINDOWS\system32>
     
    Chaos Annihilator, Jul 8, 2026 at 3:09 AM
    #69
  20. Oh My!

    Oh My! Malware Expert Staff Member

    Download the latest version of Powershell.

    I modified the script. Please attempt it again.
     
    Oh My!, Jul 8, 2026 at 9:17 AM
    #70
  21. Chaos Annihilator

    Chaos Annihilator Corporal

    Sure, I'll try again. The update article is to complex for me at 2 a.m., I'll get it this afternoon. Thanks!
     
    Chaos Annihilator, Jul 9, 2026 at 3:25 AM
    #71
  22. Oh My!

    Oh My! Malware Expert Staff Member

    Don’t worry about the update the modified script should work anyway.
     
    Oh My!, Jul 9, 2026 at 10:17 AM
    #72
  23. Chaos Annihilator

    Chaos Annihilator Corporal

    I expected this to be a bigger deal than it was. I put in the script and waited forever for something to happen before decided to see if it made the report.
    Here it is:


    Name ProcessId ParentProcessId
    ---- --------- ---------------
    System 4 0
    System Idle Process 0 0
    smss.exe 624 4
    Memory Compression 2748 4
    Secure System 92 4
    Registry 132 4
    fontdrvhost.exe 1236 360
    dwm.exe 1484 360
    bgsvc.exe 5092 608
    svchost.exe 2348 608
    LMS.exe 3812 608
    HPPrintScanDoctorService.exe 5084 608
    AdminService.exe 4936 608
    DriverUpdSvc.exe 4948 608
    TuneupSvc.exe 5024 608
    svchost.exe 5456 608
    svchost.exe 5728 608
    RstMwService.exe 4804 608
    svchost.exe 5260 608
    IntelCpHeciSvc.exe 1704 608
    svchost.exe 2684 608
    jhi_service.exe 5228 608
    QcomWlanSrvx64.exe 4904 608
    svchost.exe 4496 608
    svchost.exe 4532 608
    svchost.exe 4296 608
    svchost.exe 4472 608
    svchost.exe 4340 608
    PnkBstrB.exe 4452 608
    PnkBstrA.exe 4460 608
    IntelCpHDCPSvc.exe 4580 608
    svchost.exe 4280 608
    CptService.exe 4888 608
    svchost.exe 4284 608
    svchost.exe 4548 608
    svchost.exe 4564 608
    svchost.exe 4572 608
    SecurityHealthService.exe 11892 608
    svchost.exe 6024 608
    svchost.exe 9012 608
    SearchIndexer.exe 7160 608
    svchost.exe 7996 608
    aswidsagent.exe 8116 608
    svchost.exe 11204 608
    svchost.exe 15132 608
    svchost.exe 6400 608
    svchost.exe 10156 608
    svchost.exe 15324 608
    svchost.exe 3868 608
    svchost.exe 12076 608
    svchost.exe 9904 608
    svchost.exe 7336 608
    svchost.exe 6760 608
    svchost.exe 7056 608
    svchost.exe 7664 608
    svchost.exe 6616 608
    svchost.exe 6200 608
    svchost.exe 6480 608
    svchost.exe 6588 608
    svchost.exe 5708 608
    svchost.exe 5200 608
    svchost.exe 8840 608
    Lenovo.Modern.ImController.exe 4244 608
    svchost.exe 7224 608
    svchost.exe 8036 608
    DolbyDAX2API.exe 7344 608
    svchost.exe 2604 608
    svchost.exe 2612 608
    ETDService.exe 2620 608
    svchost.exe 2108 608
    svchost.exe 2436 608
    svchost.exe 2564 608
    igfxCUIService.exe 2868 608
    svchost.exe 2948 608
    svchost.exe 2956 608
    svchost.exe 2628 608
    wsc_proxy.exe 2640 608
    svchost.exe 2832 608
    svchost.exe 1052 608
    svchost.exe 1396 608
    svchost.exe 1580 608
    svchost.exe 1604 608
    svchost.exe 1172 608
    WUDFHost.exe 1216 608
    svchost.exe 1300 608
    svchost.exe 1848 608
    svchost.exe 1908 608
    svchost.exe 2012 608
    svchost.exe 1748 608
    svchost.exe 1768 608
    svchost.exe 1792 608
    svchost.exe 3040 608
    svchost.exe 3660 608
    svchost.exe 3712 608
    svchost.exe 3772 608
    spoolsv.exe 3596 608
    svchost.exe 3264 608
    AvastSvc.exe 3328 608
    aswToolsSvc.exe 3408 608
    svchost.exe 3872 608
    svchost.exe 4256 608
    svchost.exe 4264 608
    svchost.exe 4272 608
    svchost.exe 3964 608
    svchost.exe 3980 608
    svchost.exe 4080 608
    afwServ.exe 2556 608
    svchost.exe 2500 608
    svchost.exe 3124 608
    svchost.exe 3228 608
    svchost.exe 2268 608
    RtkAudioService64.exe 2084 608
    svchost.exe 2256 608
    svchost.exe 3256 608
    svchost.exe 2088 608
    svchost.exe 3064 608
    csrss.exe 876 860
    wininit.exe 956 860
    csrss.exe 964 948
    winlogon.exe 360 948
    fontdrvhost.exe 1240 956
    services.exe 608 956
    LsaIso.exe 880 956
    lsass.exe 1032 956
    UserOOBEBroker.exe 9692 1172
    SearchHost.exe 11416 1172
    RuntimeBroker.exe 10848 1172
    unsecapp.exe 11368 1172
    WmiPrvSE.exe 7156 1172
    WmiPrvSE.exe 12352 1172
    smartscreen.exe 9800 1172
    Widgets.exe 14900 1172
    StartMenuExperienceHost.exe 3244 1172
    TextInputHost.exe 7924 1172
    msedgewebview2.exe 12100 1460
    msedgewebview2.exe 6968 1460
    msedgewebview2.exe 6568 1460
    msedgewebview2.exe 9336 1460
    msedgewebview2.exe 10712 1460
    ETDTouch.exe 6840 1780
    taskhostw.exe 6948 1792
    RAVBg64.exe 7940 1792
    RAVBg64.exe 7948 1792
    sihost.exe 6296 1908
    RAVBg64.exe 5472 2084
    ctfmon.exe 7864 2088
    ETDCtrlHelper.exe 3992 2620
    ETDCtrl.exe 1780 2620
    audiodg.exe 11356 3040
    aswEngSrv.exe 10516 3328
    dasHost.exe 13792 4264
    dasHost.exe 4720 4264
    AggregatorHost.exe 5808 4272
    ShellHost.exe 7880 6296
    CrossDeviceResume.exe 6676 6296
    utility.exe 10260 6296
    explorer.exe 7932 7372
    RAVCpl64.exe 3428 7932
    flux.exe 7364 7932
    bgapp.exe 3276 7932
    powershell.exe 14748 7932
    igfxEM.exe 8488 8356
    AvastUI.exe 12852 9288
    AvastUI.exe 6076 9288
    AvastUI.exe 14996 9288
    AvastUI.exe 9288 9600
    msedgewebview2.exe 1460 11416
    firefox.exe 13500 13356
    firefox.exe 7108 13500
    firefox.exe 10336 13500
    firefox.exe 12864 13500
    firefox.exe 1968 13500
    crashhelper.exe 13408 13500
    firefox.exe 7652 13500
    firefox.exe 14680 13500
    firefox.exe 2784 13500
    firefox.exe 12356 13500
    firefox.exe 7244 13500
    firefox.exe 11560 13500
    conhost.exe 11424 14748
    powershell.exe 11040 14748
     
    Chaos Annihilator, Jul 9, 2026 at 3:41 PM
    #73
  24. Oh My!

    Oh My! Malware Expert Staff Member

    Thank you for the report.

    Please do this.

    ===================================================

    Administrator Command Prompt

    --------------------
    • Click Start and type cmd then select Run as administrator
    • Copy and paste the following after the command prompt then hit Enter
    sc config WSearch start= disabled​
    • Confirm [SC] ChangeServiceConfig SUCCESS is reported. If not, stop and let me know
    • Close all windows, reboot your computer, then run an Avast scan
    • Report the results in your reply
    ===================================================

    Things I would like to see in your next reply.
    • Results?
     
    Oh My!, Jul 9, 2026 at 4:26 PM
    #74
Page 2 of 2

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds