[JPowell]

Started today.  Operating system Win11, HP Pavillion.  Square appears on upper screen about center, cursor in square dancing.  Various menus appearing and disappearing.  Cannot initiate any actions on that computer.  Am posting from a correctly working laptop.  

[Advertisements]

Hello.
 
Can you take a photo of the strange square appeared as well as of the unwanted menus, and attach it for us to check? 
 
What happens if you try to start in Safe mode?

• Press the Windows icon on the keyboard together with the letter I, to get into the Settings.
• Choose Windows update.
• From the menu at the left, choose Advanced options and then Recovery (under Additional options).
• Next to Advanced startup option, click Restart now.
• From the window that will appear choose Troubleshoot and then Advanced options.
• Choose Startup Settings and then Restart.
• Press number 5, for choosing Safe mode with networking.
• You will know that you are in Safe mode, if the background is black and Safe mode is written at the four corners of the screen.

[DR M]

Hello.
 
Can you take a photo of the strange square appeared as well as of the unwanted menus, and attach it for us to check? 
 
What happens if you try to start in Safe mode?

• Press the Windows icon on the keyboard together with the letter I, to get into the Settings.
• Choose Windows update.
• From the menu at the left, choose Advanced options and then Recovery (under Additional options).
• Next to Advanced startup option, click Restart now.
• From the window that will appear choose Troubleshoot and then Advanced options.
• Choose Startup Settings and then Restart.
• Press number 5, for choosing Safe mode with networking.
• You will know that you are in Safe mode, if the background is black and Safe mode is written at the four corners of the screen.

[JPowell]

Dr M,

I'm not having this issue today.  Seems strange, but there it is.  Will send the photo if the issue occurs again.  Thank you for your interest.

[DR M]

Since the computer runs without issues now, you may consider having us check your computer for malware. In order to do that, we need a couple of logs:

Download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

If your antivirus software detects the tool as malicious, it's safe to allow FRST to run. It is a false-positive detection.

If English is not your primary language, right click on FRST.exe/FRST64.exe and rename to FRSTEnglish.exe/FRST64English.exe

• Double-click the FRST icon to run the tool. When the tool opens click Yes to disclaimer.
• Press Scan button and wait for a while.
• The scanner will produced two logs on your Desktop: FRST.txt and Addition.txt.
• Please attach the two logs in your next reply.

[JPowell]

Dr M, Still having no problems today.  Appreciate your interest.  Have attached the FRST scan results.

Attached Files

•  FRST.txt   26.75KB   109 downloads
•  Addition.txt   49.87KB   104 downloads

[DR M]

Thank you. I'll review your logs, but I'll need some time.
 
In the meantime, please go through the basic guidelines below:

1. Always ask before acting. Do not continue if you are not sure, or if something unexpected happens!

2. Do not run any tools unless instructed to do so. Also, do not uninstall or install any software during the procedure, unless I ask you to do so.

3. Cracked or pirated programs are not only illegal, but also can make your computer a malware target. Having such programs installed, is the easiest way to get infected. Thus, no need to clean the computer, since, soon or later, it will get infected again. If you have such programs, please uninstall them now, before we start the cleaning procedure.

4. If your computer seems to start working normally, don't abandon the topic. Even if your system is behaving normally, there may still be some malware remnants left over. Additionally, malware can re-infect the computer if some remnants are left. Therefore, please complete all requested steps to make sure any malware is successfully eradicated from your PC.

5. You have to reply to my posts within 3 days. If you need some additional time, just let me know. Otherwise, I will leave the topic due to lack of feedback. If you are able, I would request you to check this thread at least once per day so that we can resolve your issues effectively and efficiently.

6. Logs from malware diagnostic or removal programs can take some time to get analyzed. Also, have in mind that all the experts here are volunteers and may not be available to assist when you post. Please, be patient, while I analyze your logs.

[JPowell]

Dr M, I've attended to your suggestions and await your interpretation of the reports I sent.

[DR M]

Hi, JPowel.
 
Your logs are clean.
 
The suggested fix will do some maintenance and check for/fix any system corruptions:

 

 

FRST fix

Please do the following to run a FRST fix.

NOTICE: This script was written specifically for this user. Running it on another machine may cause damage to your operating system

• Select the entire contents of the code box below, from the "Start::" line to "End::", including both lines. Right-click and select "Copy ". No need to paste anything to anywhere.

Start::
CreateRestorePoint:
CloseProcesses:
AS: McAfee VirusScan (Disabled - Up to date) {30AC4D1E-F45E-3AA6-6448-D23DAB3B5501}
ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} =>  -> No File
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} =>  -> No File
FirewallRules: [{571DE5A5-51BD-4AF7-A17C-5B0FFAE6B405}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.77.97.0_x86__kzf8qxf38zg5c\Skype\Skype.exe => No File
FirewallRules: [{7EB53DFB-3CAA-4329-822D-B2379B56AB21}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.77.97.0_x86__kzf8qxf38zg5c\Skype\Skype.exe => No File
FirewallRules: [{44185EF5-CA23-494C-A1C7-19B55857E517}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.77.97.0_x86__kzf8qxf38zg5c\Skype\Skype.exe => No File
FirewallRules: [{A550D1BD-E1BB-4911-B2F1-283807BAEC20}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.77.97.0_x86__kzf8qxf38zg5c\Skype\Skype.exe => No File
FirewallRules: [{B4BC1A6C-D341-4031-BF25-69BCC48EF972}] => (Allow) C:\Users\lynnh\AppData\Local\Temp\7zS40A5\HPDiagnosticCoreUI.exe => No File
FirewallRules: [{36B016B4-6318-4FCD-AE30-A489B6750FED}] => (Allow) C:\Users\lynnh\AppData\Local\Temp\7zS40A5\HPDiagnosticCoreUI.exe => No File
FirewallRules: [{C124F1F7-4FF9-4D5B-90A2-71CCCD72EBDF}] => (Allow) C:\Users\lynnh\AppData\Local\Temp\7zS5879\HPDiagnosticCoreUI.exe => No File
FirewallRules: [{7577FC24-5C3E-4D38-9EE3-26FDD44D8196}] => (Allow) C:\Users\lynnh\AppData\Local\Temp\7zS5879\HPDiagnosticCoreUI.exe => No File
FirewallRules: [{59EBBBB8-D947-4494-8020-302F5CB2741F}] => (Allow) C:\Users\lynnh\AppData\Local\Temp\7zS64AB\HPDiagnosticCoreUI.exe => No File
FirewallRules: [{BFBD63B3-0208-4489-AD77-E260B491B492}] => (Allow) C:\Users\lynnh\AppData\Local\Temp\7zS64AB\HPDiagnosticCoreUI.exe => No File
FirewallRules: [{54C6E86E-A197-4A81-92E0-DEAF5199DA6E}] => (Allow) C:\Users\lynnh\AppData\Local\Temp\7zS183F\EasyInst64.exe => No File
FirewallRules: [{204F9343-EE4F-4634-BB20-62ADA967895D}] => (Allow) C:\Users\lynnh\AppData\Local\Temp\7zS183F\EasyInst64.exe => No File
FirewallRules: [{C249B94C-B0D5-44C8-9FF0-1B3D3016294F}] => (Allow) C:\Program Files\Common Files\McAfee\MMSSHost\MMSSHost.exe => No File
FirewallRules: [{319631E8-A64B-49CD-BD61-D7BEB6A489E9}] => (Allow) C:\Program Files (x86)\Common Files\Mcafee\MMSSHost\MMSSHost.exe => No File
FirewallRules: [{74863AD4-48CD-4BB7-843E-F1ED23CD2C12}] => (Allow) C:\Program Files\WindowsApps\Microsoft.Office.Desktop.Outlook_16010.9126.2116.0_x86__8wekyb3d8bbwe\Office16\OUTLOOK.exe => No File
FirewallRules: [{2EC80453-E83A-4942-A6D4-5D0979E8BED9}] => (Allow) C:\Users\lynnh\AppData\Roaming\Zoom\bin\airhost.exe => No File
HKLM-x32\...\Run: [HPUsageTrackingLEDM] => "C:\Program Files (x86)\HP\HP UT LEDM\bin\hppusg.exe" "C:\Program Files (x86)\HP\HP UT LEDM\" (No File)
HKLM\Software\...\Authentication\Credential Providers: [{C885AA15-1764-4293-B82A-0586ADD46B35}] -> 
Task: {51499070-2F7A-461B-9E38-A18701847D1F} - System32\Tasks\S-1-5-21-3714477290-3168749888-1815816112-1001\DataSenseLiveTileTask => C:\WINDOWS\System32\DataUsageLiveTileTask.exe (No File)
Task: {7FDB885A-3623-4252-8EDA-8CDCE8F3736F} - System32\Tasks\OneDrive Standalone Update Task v2 => C:\Users\jcpow.DESKTOP-M8HV5LP\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe (No File)
Task: {CCDFC0B8-01A3-4E74-A820-4F13F51D269E} - System32\Tasks\Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser => C:\WINDOWS\System32\MbaeParserTask.exe (No File)
S1 WinSetupMon; system32\DRIVERS\WinSetupMon.sys [X]
CMD: DISM /Online /Cleanup-Image /RestoreHealth
CMD: type C:\Windows\Logs\DISM
CMD: SFC /scannow
VirusTotal: C:\WINDOWS\system32\Drivers\CxSfPt.DAT
EmptyTemp:
End::

• Right-click on FRST64 on your Desktop, to run it as administrator. When the tool opens, click "yes" to the disclaimer.
• Press the Fix button once and wait.
• FRST will process fixlist.txt
• When finished, it will produce a log fixlog.txt on your Desktop.
• Post the log in your next reply.

[JPowell]

Dr M, Have attached the Fixlog.txt file.  Will wait for further instructions. Jpowell

Attached Files

•  Fixlog.txt   7.96KB   102 downloads

[DR M]

Hi, JPowel.

 

It seems that the attached file is not complete.

 

If something happened to the file on your Desktop, you can find it also here: C:\FRST\Logs\fixlog.txt

 

Please attach it for me to check. 

[JPowell]

Dr M, The file Fixlog.txt is not in the logs subdirectory but it is still on my desktop.  Should I try the process again to see if I get a different result?

[DR M]

Is the file on your Desktop the same as the one you posted?

[JPowell]

Dr M,  Yes file on desktop is same as posted.

[DR M]

Then, I would like you to repeat the procedure here, so I can make sure that the fix ran successfully.

[JPowell]

Dr. M, Ran again.  This time the file Fixlog.txt is in the logs subdirectory.  It is attached.  Will not be in communication again until tomorrow. JPowell

Attached Files

•  Fixlog_03-11-2022 16.41.46.txt   28.29KB   103 downloads