Pop Ups While Windows Is Loading

Discussion in 'Malware Help (A Specialist Will Reply)' started by qbert79, Jul 13, 2026 at 10:40 AM.

  1. qbert79

    qbert79 Private E-2

    I am having an issue with my computer where there are a bunch of pop ups as windows is loading. They appear to be cmd windows but they open and close very fast before you can see what is on them. There are about 10 of them. It takes a while for windows to finish loading, the start menu and search window are blank while this process is going on.
     

    Attached Files:

    qbert79, Jul 13, 2026 at 10:40 AM
    #1
  2. Oh My!

    Oh My! Malware Expert Staff Member

    Greetings and :welcome: to Major Geeks Malware Forum.

    My name is Oh My! and I am here to help you! Now that we are "friends" please call me Gary.

    ===================================================

    Ground Rules:
    • First, please keep in mind most of us at Major Geeks volunteer our assistance for your benefit in your time of need. Please try to match our commitment to you with your patience toward us.
    • It is important to not run any tools or take any steps other than those I will provide for you.
    • Please perform all steps in the order they are listed. If things are not clear or you experience problems be sure to stop and let me know.
    • Please take special note in my instructions whether to copy and paste, attach, or upload reports or files requested in my instructions
    • When your computer is clean I will let you know, provide instructions to remove tools and reports, and offer you information about how you can combat future infections.
    ===================================================

    Now that I am assisting you, you can expect that I will be very responsive to your situation. If you are able, I would request you check this thread at least once per day so that we can try to resolve your issues effectively and efficiently. If you are going to be delayed please be considerate and let me know.

    Let's start with this.

    ===================================================

    Uninstalling Programs Using Revo Uninstaller Free Portable

    --------------------

    • Download Revo Uninstaller Free Portable and save it to your Desktop
    • Right click on the folder and select Extract All..., then click Extract
    • Double click on the RevoUninstaller-Portable folder
    • Right click on RevoUPort and select Run as administrator
    • Click OK on the License Agreement
    • From the list of programs double click on the listed program(s), or anything similar, to remove it (if it exists)
    Code:
    App Explorer
    • If the program's uninstaller appears work through the steps to remove the program(s)
    • Be sure the Advanced option is selected then click Scan
    • For each window that may appear identifying leftover items click Select All, Delete, then confirm the deletion
    • Once done click Finish
    • Reboot your computer
    ===================================================

    Farbar Recovery Scan Tool Fix

    --------------------
    • Right click on the FRST64 icon and select Run as administrator
    • Highlight the below information then hit the Ctrl + C keys at the same time and the text will be copied
    • There is no need to paste the information anywhere, FRST64 will do it for you
    Code:
    Start::
CreateRestorePoint:
CloseProcesses:
C:\Users\roymu\AppData\Local\Host App Service
Task: {C7B3AA7B-613F-4920-8467-3F97131089DF} - System32\Tasks\App Explorer => C:\Users\roymu\AppData\Local\Host App Service\Engine\HostAppServiceUpdater.exe [9793520 2025-06-30] (SweetLabs Inc -> SweetLabs, Inc) <==== ATTENTION 
HKLM\...\RunOnce: [msedge_cleanup_{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}] => C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.65\Installer\setup.exe [5379912 2026-07-11] (Microsoft Corporation -> Microsoft Corporation) 
HKU\S-1-5-21-4027671259-1547401243-1367816303-1002\...\RunOnce: [Delete Cached Update Binary] => C:\WINDOWS\system32\cmd.exe /q /c del /q "C:\Users\roymu\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe" [128938384 2026-07-11] (Microsoft Corporation -> Microsoft Corporation) 
HKU\S-1-5-21-4027671259-1547401243-1367816303-1002\...\RunOnce: [Uninstall 26.106.0603.0003] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\roymu\AppData\Local\Microsoft\OneDrive\26.106.0603.0003" [0 2026-07-07] 
HKU\S-1-5-21-4027671259-1547401243-1367816303-1002\...\RunOnce: [Delete Cached Standalone Update Binary] => C:\WINDOWS\system32\cmd.exe /q /c del /q "C:\Users\roymu\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe" (No File) 
Task: {E88D9B2C-DDEA-47B2-9582-085153004DB5} - System32\Tasks\Microsoft\Windows\Location\Notifications => %windir%\System32\LocationNotificationWindows.exe  (No File) 
Task: {CCDFC0B8-01A3-4E74-A820-4F13F51D269E} - System32\Tasks\Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser => %SystemRoot%\System32\MbaeParserTask.exe  (No File) 
Task: {CAB76809-EDC0-40D2-A888-AD9BEDF4E88A} - System32\Tasks\Microsoft\Windows\UNP\RunUpdateNotificationMgr => %windir%\System32\UNP\UpdateNotificationMgr.exe  (No File) 
Task: {F3E6E7ED-A196-4E44-8803-55FAB3AD4E29} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe  (No File) 
S3 MBVpnTunnelService; "C:\Program Files\Malwarebytes\Anti-Malware\tunnel\MBVpnTunnelService.exe" /service (No File) 
S3 usbscan; \SystemRoot\System32\DriverStore\FileRepository\sti.inf_amd64_971c769b103df369\usbscan.sys (No File) 
S0 WinSetupMon; system32\DRIVERS\WinSetupMon.sys (No File) 
FirewallRules: [{E7622026-9BE7-447D-B209-9D8BBC851552}] => (Allow) C:\Program Files\LogiOptionsPlus\logivoice\logioptionsplus_logivoice.exe => No File 
FirewallRules: [{7855D16F-F939-4AF8-9386-76FC38D16547}] => (Allow) C:\Program Files\LogiOptionsPlus\logivoice\logioptionsplus_logivoice.exe => No File 
AlternateDataStreams: C:\Users\Public\Shared Files:VersionCache [5178] 
AlternateDataStreams: C:\Users\roymu\Downloads\DiscordSetup (1).exe:MBAM.Zone.Identifier [155] 
AlternateDataStreams: C:\Users\roymu\Downloads\DuckDuckGo.Installer.exe:MBAM.Zone.Identifier [50] 
AlternateDataStreams: C:\Users\roymu\Downloads\EpicInstaller-18.8.1-1b00ecee989148de8accfae94e08db44.msi:MBAM.Zone.Identifier [269] 
AlternateDataStreams: C:\Users\roymu\Downloads\HandBrake-1.9.2-x86_64-Win_GUI.exe:MBAM.Zone.Identifier [566] 
AlternateDataStreams: C:\Users\roymu\Downloads\Setup_MakeMKV_v1.18.1.exe:MBAM.Zone.Identifier [132] 
AlternateDataStreams: C:\Users\roymu\Downloads\SteamSetup (1).exe:MBAM.Zone.Identifier [147] 
AlternateDataStreams: C:\Users\roymu\Downloads\windowsdesktop-runtime-8.0.16-win-x64.exe:MBAM.Zone.Identifier [185] 
cmd: sfc /scannow
cmd: DISM /Online /Cleanup-Image /CheckHealth
End::
    • Click Fix
    • When completed the tool will create a log on the desktop called Fixlog.txt. Please copy and paste the contents of the file in your reply.
    • Upon automatic reboot check for pop ups
    ===================================================

    Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it.
    • App Explorer removed?
    • Fixlog
    • Pop ups?
     
    Oh My!, Jul 13, 2026 at 2:31 PM
    #2
  3. qbert79

    qbert79 Private E-2

    App Explorer appears to be removed

    the fixlog:
    Fix result of Farbar Recovery Scan Tool (x64) Version: 12-07-2026 01
    Ran by roymu (13-07-2026 15:59:38) Run:1
    Running from C:\Users\roymu\OneDrive\Desktop
    Loaded Profiles: roymu
    Boot Mode: Normal
    ==============================================
    fixlist content:
    *****************
    Start::
    CreateRestorePoint:
    CloseProcesses:
    C:\Users\roymu\AppData\Local\Host App Service
    Task: {C7B3AA7B-613F-4920-8467-3F97131089DF} - System32\Tasks\App Explorer => C:\Users\roymu\AppData\Local\Host App Service\Engine\HostAppServiceUpdater.exe [9793520 2025-06-30] (SweetLabs Inc -> SweetLabs, Inc) <==== ATTENTION
    HKLM\...\RunOnce: [msedge_cleanup_{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}] => C:\Program Files (x86)\Microsoft\EdgeWebView\Application\150.0.4078.65\Installer\setup.exe [5379912 2026-07-11] (Microsoft Corporation -> Microsoft Corporation)
    HKU\S-1-5-21-4027671259-1547401243-1367816303-1002\...\RunOnce: [Delete Cached Update Binary] => C:\WINDOWS\system32\cmd.exe /q /c del /q "C:\Users\roymu\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe" [128938384 2026-07-11] (Microsoft Corporation -> Microsoft Corporation)
    HKU\S-1-5-21-4027671259-1547401243-1367816303-1002\...\RunOnce: [Uninstall 26.106.0603.0003] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\roymu\AppData\Local\Microsoft\OneDrive\26.106.0603.0003" [0 2026-07-07]
    HKU\S-1-5-21-4027671259-1547401243-1367816303-1002\...\RunOnce: [Delete Cached Standalone Update Binary] => C:\WINDOWS\system32\cmd.exe /q /c del /q "C:\Users\roymu\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe" (No File)
    Task: {E88D9B2C-DDEA-47B2-9582-085153004DB5} - System32\Tasks\Microsoft\Windows\Location\Notifications => %windir%\System32\LocationNotificationWindows.exe (No File)
    Task: {CCDFC0B8-01A3-4E74-A820-4F13F51D269E} - System32\Tasks\Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser => %SystemRoot%\System32\MbaeParserTask.exe (No File)
    Task: {CAB76809-EDC0-40D2-A888-AD9BEDF4E88A} - System32\Tasks\Microsoft\Windows\UNP\RunUpdateNotificationMgr => %windir%\System32\UNP\UpdateNotificationMgr.exe (No File)
    Task: {F3E6E7ED-A196-4E44-8803-55FAB3AD4E29} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe (No File)
    S3 MBVpnTunnelService; "C:\Program Files\Malwarebytes\Anti-Malware\tunnel\MBVpnTunnelService.exe" /service (No File)
    S3 usbscan; \SystemRoot\System32\DriverStore\FileRepository\sti.inf_amd64_971c769b103df369\usbscan.sys (No File)
    S0 WinSetupMon; system32\DRIVERS\WinSetupMon.sys (No File)
    FirewallRules: [{E7622026-9BE7-447D-B209-9D8BBC851552}] => (Allow) C:\Program Files\LogiOptionsPlus\logivoice\logioptionsplus_logivoice.exe => No File
    FirewallRules: [{7855D16F-F939-4AF8-9386-76FC38D16547}] => (Allow) C:\Program Files\LogiOptionsPlus\logivoice\logioptionsplus_logivoice.exe => No File
    AlternateDataStreams: C:\Users\Public\Shared Files:VersionCache [5178]
    AlternateDataStreams: C:\Users\roymu\Downloads\DiscordSetup (1).exe:MBAM.Zone.Identifier [155]
    AlternateDataStreams: C:\Users\roymu\Downloads\DuckDuckGo.Installer.exe:MBAM.Zone.Identifier [50]
    AlternateDataStreams: C:\Users\roymu\Downloads\EpicInstaller-18.8.1-1b00ecee989148de8accfae94e08db44.msi:MBAM.Zone.Identifier [269]
    AlternateDataStreams: C:\Users\roymu\Downloads\HandBrake-1.9.2-x86_64-Win_GUI.exe:MBAM.Zone.Identifier [566]
    AlternateDataStreams: C:\Users\roymu\Downloads\Setup_MakeMKV_v1.18.1.exe:MBAM.Zone.Identifier [132]
    AlternateDataStreams: C:\Users\roymu\Downloads\SteamSetup (1).exe:MBAM.Zone.Identifier [147]
    AlternateDataStreams: C:\Users\roymu\Downloads\windowsdesktop-runtime-8.0.16-win-x64.exe:MBAM.Zone.Identifier [185]
    cmd: sfc /scannow
    cmd: DISM /Online /Cleanup-Image /CheckHealth
    End::
    *****************
    Restore point was successfully created.
    Processes closed successfully.
    "C:\Users\roymu\AppData\Local\Host App Service" => not found
    "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C7B3AA7B-613F-4920-8467-3F97131089DF}" => not found
    "C:\WINDOWS\System32\Tasks\App Explorer" => not found
    "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\App Explorer" => not found
    "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\\msedge_cleanup_{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" => not found
    "HKU\S-1-5-21-4027671259-1547401243-1367816303-1002\Software\Microsoft\Windows\CurrentVersion\RunOnce\\Delete Cached Update Binary" => not found
    "HKU\S-1-5-21-4027671259-1547401243-1367816303-1002\Software\Microsoft\Windows\CurrentVersion\RunOnce\\Uninstall 26.106.0603.0003" => not found
    "HKU\S-1-5-21-4027671259-1547401243-1367816303-1002\Software\Microsoft\Windows\CurrentVersion\RunOnce\\Delete Cached Standalone Update Binary" => not found
    "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{E88D9B2C-DDEA-47B2-9582-085153004DB5}" => removed successfully
    "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E88D9B2C-DDEA-47B2-9582-085153004DB5}" => removed successfully
    C:\WINDOWS\System32\Tasks\Microsoft\Windows\Location\Notifications => moved successfully
    "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Location\Notifications" => removed successfully
    "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{CCDFC0B8-01A3-4E74-A820-4F13F51D269E}" => removed successfully
    "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CCDFC0B8-01A3-4E74-A820-4F13F51D269E}" => removed successfully
    C:\WINDOWS\System32\Tasks\Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser => moved successfully
    "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser" => removed successfully
    "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{CAB76809-EDC0-40D2-A888-AD9BEDF4E88A}" => removed successfully
    "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CAB76809-EDC0-40D2-A888-AD9BEDF4E88A}" => removed successfully
    C:\WINDOWS\System32\Tasks\Microsoft\Windows\UNP\RunUpdateNotificationMgr => moved successfully
    "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UNP\RunUpdateNotificationMgr" => removed successfully
    "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{F3E6E7ED-A196-4E44-8803-55FAB3AD4E29}" => removed successfully
    "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F3E6E7ED-A196-4E44-8803-55FAB3AD4E29}" => removed successfully
    C:\WINDOWS\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => moved successfully
    "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker" => removed successfully
    HKLM\System\CurrentControlSet\Services\MBVpnTunnelService => could not remove, key could be protected
    HKLM\System\CurrentControlSet\Services\usbscan => removed successfully
    usbscan => service removed successfully
    HKLM\System\CurrentControlSet\Services\WinSetupMon => removed successfully
    WinSetupMon => service removed successfully
    "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{E7622026-9BE7-447D-B209-9D8BBC851552}" => removed successfully
    "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{7855D16F-F939-4AF8-9386-76FC38D16547}" => removed successfully
    C:\Users\Public\Shared Files => ":VersionCache" ADS removed successfully
    C:\Users\roymu\Downloads\DiscordSetup (1).exe => ":MBAM.Zone.Identifier" ADS removed successfully
    C:\Users\roymu\Downloads\DuckDuckGo.Installer.exe => ":MBAM.Zone.Identifier" ADS removed successfully
    C:\Users\roymu\Downloads\EpicInstaller-18.8.1-1b00ecee989148de8accfae94e08db44.msi => ":MBAM.Zone.Identifier" ADS removed successfully
    C:\Users\roymu\Downloads\HandBrake-1.9.2-x86_64-Win_GUI.exe => ":MBAM.Zone.Identifier" ADS removed successfully
    C:\Users\roymu\Downloads\Setup_MakeMKV_v1.18.1.exe => ":MBAM.Zone.Identifier" ADS removed successfully
    C:\Users\roymu\Downloads\SteamSetup (1).exe => ":MBAM.Zone.Identifier" ADS removed successfully
    C:\Users\roymu\Downloads\windowsdesktop-runtime-8.0.16-win-x64.exe => ":MBAM.Zone.Identifier" ADS removed successfully
    ========= sfc /scannow =========
    Beginning system scan. This process will take some time.
    Beginning verification phase of system scan.
    Verification 0% complete.
    Verification 1% complete.
    Verification 1% complete.
    Verification 2% complete.
    Verification 2% complete.
    Verification 3% complete.
    Verification 4% complete.
    Verification 4% complete.
    Verification 5% complete.
    Verification 5% complete.
    Verification 6% complete.
    Verification 6% complete.
    Verification 7% complete.
    Verification 8% complete.
    Verification 8% complete.
    Verification 9% complete.
    Verification 9% complete.
    Verification 10% complete.
    Verification 10% complete.
    Verification 11% complete.
    Verification 12% complete.
    Verification 12% complete.
    Verification 13% complete.
    Verification 13% complete.
    Verification 14% complete.
    Verification 14% complete.
    Verification 15% complete.
    Verification 16% complete.
    Verification 16% complete.
    Verification 17% complete.
    Verification 17% complete.
    Verification 18% complete.
    Verification 18% complete.
    Verification 19% complete.
    Verification 20% complete.
    Verification 20% complete.
    Verification 21% complete.
    Verification 21% complete.
    Verification 22% complete.
    Verification 22% complete.
    Verification 23% complete.
    Verification 24% complete.
    Verification 24% complete.
    Verification 25% complete.
    Verification 25% complete.
    Verification 26% complete.
    Verification 26% complete.
    Verification 27% complete.
    Verification 28% complete.
    Verification 28% complete.
    Verification 29% complete.
    Verification 29% complete.
    Verification 30% complete.
    Verification 30% complete.
    Verification 31% complete.
    Verification 32% complete.
    Verification 32% complete.
    Verification 33% complete.
    Verification 33% complete.
    Verification 34% complete.
    Verification 34% complete.
    Verification 35% complete.
    Verification 36% complete.
    Verification 36% complete.
    Verification 37% complete.
    Verification 37% complete.
    Verification 38% complete.
    Verification 39% complete.
    Verification 39% complete.
    Verification 40% complete.
    Verification 40% complete.
    Verification 41% complete.
    Verification 41% complete.
    Verification 42% complete.
    Verification 43% complete.
    Verification 43% complete.
    Verification 44% complete.
    Verification 44% complete.
    Verification 45% complete.
    Verification 45% complete.
    Verification 46% complete.
    Verification 47% complete.
    Verification 47% complete.
    Verification 48% complete.
    Verification 48% complete.
    Verification 49% complete.
    Verification 49% complete.
    Verification 50% complete.
    Verification 51% complete.
    Verification 51% complete.
    Verification 52% complete.
    Verification 52% complete.
    Verification 53% complete.
    Verification 53% complete.
    Verification 54% complete.
    Verification 55% complete.
    Verification 55% complete.
    Verification 56% complete.
    Verification 56% complete.
    Verification 57% complete.
    Verification 57% complete.
    Verification 58% complete.
    Verification 59% complete.
    Verification 59% complete.
    Verification 60% complete.
    Verification 60% complete.
    Verification 61% complete.
    Verification 61% complete.
    Verification 62% complete.
    Verification 63% complete.
    Verification 63% complete.
    Verification 64% complete.
    Verification 64% complete.
    Verification 65% complete.
    Verification 65% complete.
    Verification 66% complete.
    Verification 67% complete.
    Verification 67% complete.
    Verification 68% complete.
    Verification 68% complete.
    Verification 69% complete.
    Verification 69% complete.
    Verification 70% complete.
    Verification 71% complete.
    Verification 71% complete.
    Verification 72% complete.
    Verification 72% complete.
    Verification 73% complete.
    Verification 73% complete.
    Verification 74% complete.
    Verification 75% complete.
    Verification 75% complete.
    Verification 76% complete.
    Verification 76% complete.
    Verification 77% complete.
    Verification 78% complete.
    Verification 78% complete.
    Verification 79% complete.
    Verification 79% complete.
    Verification 80% complete.
    Verification 80% complete.
    Verification 81% complete.
    Verification 82% complete.
    Verification 82% complete.
    Verification 83% complete.
    Verification 83% complete.
    Verification 84% complete.
    Verification 84% complete.
    Verification 85% complete.
    Verification 86% complete.
    Verification 86% complete.
    Verification 87% complete.
    Verification 87% complete.
    Verification 88% complete.
    Verification 88% complete.
    Verification 89% complete.
    Verification 90% complete.
    Verification 90% complete.
    Verification 91% complete.
    Verification 91% complete.
    Verification 92% complete.
    Verification 92% complete.
    Verification 93% complete.
    Verification 94% complete.
    Verification 94% complete.
    Verification 95% complete.
    Verification 95% complete.
    Verification 96% complete.
    Verification 96% complete.
    Verification 97% complete.
    Verification 98% complete.
    Verification 98% complete.
    Verification 99% complete.
    Verification 99% complete.
    Verification 100% complete.
    Windows Resource Protection found corrupt files and successfully repaired them.
    For online repairs, details are included in the CBS log file located at
    windir\Logs\CBS\CBS.log. For example C:\Windows\Logs\CBS\CBS.log. For offline
    repairs, details are included in the log file provided by the /OFFLOGFILE flag.
    ========= End of CMD: =========
    ========= DISM /Online /Cleanup-Image /CheckHealth =========
    Deployment Image Servicing and Management tool
    Version: 10.0.26100.8521
    Image Version: 10.0.26200.8655
    The component store is repairable.
    The operation completed successfully.
    ========= End of CMD: =========
    Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 13-07-2026 16:02:43)
    Result of scheduled keys to remove after reboot:
    HKLM\System\CurrentControlSet\Services\MBVpnTunnelService => could not remove, key could be protected
    ==== End of Fixlog 16:02:43 ====


    I haven't seen any popups since the last restart
     
    qbert79, Jul 13, 2026 at 4:11 PM
    #3
  4. Oh My!

    Oh My! Malware Expert Staff Member

    Very good.

    While we monitor things please do this.

    ===================================================

    DISM RestoreHealth from Administrator Command Prompt

    --------------------
    • Press the Windows Key, type cmd, then select Run as administrator
    • Copy and paste DISM /Online /Cleanup-Image /RestoreHealth after the command prompt then hit Enter
    • When completed report whether the process was successful or an error occurred
    ===================================================

    Things I would like to see in your next reply.
    • Results?
     
    Oh My!, Jul 13, 2026 at 4:33 PM
    #4
  5. qbert79

    qbert79 Private E-2

    The operation completed successfully
     
    qbert79, Jul 13, 2026 at 5:11 PM
    #5
  6. Oh My!

    Oh My! Malware Expert Staff Member

    Perfect, thanks.

    Let's monitor things for a day. Touch base tomorrow, or sooner if you notice something of concern.
     
    Oh My!, Jul 13, 2026 at 5:16 PM
    #6
  7. qbert79

    qbert79 Private E-2

    So far so good. Everything seems to be working normally.
     
    qbert79, Jul 15, 2026 at 8:36 AM
    #7
  8. Oh My!

    Oh My! Malware Expert Staff Member

    Great.

    Are there any remaining questions or concerns you might have before I post some tool/log clean up instructions and other information for you to consider going forward?
     
    Oh My!, Jul 15, 2026 at 10:15 AM
    #8
  9. qbert79

    qbert79 Private E-2

    No questions at this point
     
    qbert79, Jul 15, 2026 at 11:19 AM
    #9
  10. Oh My!

    Oh My! Malware Expert Staff Member

    Very good.

    Here is our final step and some additional information to consider.

    ===================================================

    KpRm by Kernel-panik

    --------------
    • Download KpRm and save it to your Desktop (see here if you must use Chrome)
    • Note: If the file is detected as malware it is not and it is safe to download. The detection is a false positive.
    • Right click on the icon and select Run as administrator
    • Click Yes on the Disclaimer
    • Place a check mark in Delete Tools, Create Restore Point, and Delete in 7 days
    • Click Run
    • Click OK on All operations are completed
    • KpRm will delete itself from you Desktop and you can either save or remove the report that is generated
    • You are free to remove any other tools/reports still remaining
    ===================================================

    All Clean!

    --------------

    Your computer is now clean. Please consider this going forward.

    Thank you for placing your trust in Major Geeks. It was a pleasure serving you.
     
    Oh My!, Jul 15, 2026 at 12:46 PM
    #10
  11. qbert79

    qbert79 Private E-2

    thank you so much for everything
     
    qbert79, Jul 15, 2026 at 2:11 PM
    #11
  12. Oh My!

    Oh My! Malware Expert Staff Member

    My pleasure, you are always welcome here.
     
    Oh My!, Jul 15, 2026 at 2:14 PM
    #12

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds