garioch7

@shadowwar Just finished scanning my computer again with MBAM. No detections. FP resolved. Thank you. Have a great day. Regards, Phil

@shadowwar I will scan again tomorrow after I have updating MBAM. Post back with results. Thank you, and have a great day. Regards, Phil

@Imacri This gets stranger and stranger. Tried executing the MiniToolBox.exe (MTB) version I had and MBAM threw an RTP detection on that version. Went and downloaded a fresh copy from BC (mine was dated 2017). Ran a scan and MBAM detected it again. Scan results attached. Tried to execute the "new" MTB and Smartscreen threw up a warning. I ignored the Smartscreen warning, and MTB launched, MBAM did not interfere. Logs attached. Regards, Phil MiniToolBox_lastest_version_detection.txt MiniToolBox_RTP_Detection.txt

I ran an MBAM scan today. MiniToolBox.exe is still being detected. Scan results attached. Thank you, and have a great day. Regards, -Phil mbam_scan_results.txt

@AdvancedSetup Thank you sincerely for all of your assistance. I learned a lot in the last week, almost like being back in Bleeping Computer Malware Removal Study Hall. Always so much to learn and retain. Your "Game On" comment prompted me to dig into this nuisance folder and I became determined to eliminate it. I can't find a way to mark this as resolved. Have a great day. Regards, Phil

@AdvancedSetup@Porthos@digmorcrusher I have the pleasure to report that the rogue folder "Galactic Static " in my Recycle Bin (was originally in my ProgramData folder) is terminated. 😁 I kept researching on the web for a solution and trying all manner of commands in an Admin Command Prompt and with Admin PowerShell. The command I used was: rd /s "\\?\c:\$Recycle.Bin\Galactic Static " I have attached the screensnip. It shows that I was first trying to find the 8.s "short" folder name, but there was no such entity. Thank you to all who worked so hard to assist me to remove this nuisance folder, especially @AdvancedSetup. Your assistance was appreciated so much. Have a great day. Regards, Phil

@AdvancedSetup I am trying to think outside the box. I can't see the C:\$Recycle.Bin folder in my latest Easeus Todo Backup Home image created on Friday. However, in my Macrium Reflect image from a week ago Friday, I can see my C:\$Recycle.Bin folder. "Galatic Static " is not in that folder, since it was moved there this past Friday afternoon after my backups. Would it be wise to try and get Macrium Reflect to restore just the C:\$Recycle.Bin folder? Will it encounter permission issues? If this approach were to work, then "Galactic Static " would be gone for good, because is gone from my ProgramData folder. Your advice would be appreciated. Thank you, and have a great day. Regards, Phil

@AdvancedSetup Sorry to hear that you are sick. I hope that you get better soon. I tried to replace the trailing hex 20 in the folder name with hex 61 ("a") using Active@Disk Editor. I got an Error Code 5. When I try to move the folder, it is reported as not found when using File Explorer. Two questions: 1. Did I download and burn the correct Ubuntu file to create a bootable Ubuntu USB flash drive? If I did, then I will do a low-level FAT32 format of the 16 GB Kingston Data Traveler and use Rufus again to try and create the Ubuntu USB boot disk. Perhaps the burn was corrupted? 2. Do I need to have Ubuntu installed on my computer? It is taking up 10 GB and I doubt it will be effective in removing the folder since Windows will be running. I can remove Ubuntu desktop if so. I have no use for it. I just need a bootable Linux USB flash drive. OpenFilesView by Nirsoft did not display the folder. Iobit Unlocker reported that the folder was unlocked. Unlock and Delete, Unlock and Move all failed. Uninstalling Iobit Unlocker. Get better soon and don't worry about Linux commands. I should be able to find out myself with Mr. Google's assistance. Have a great day. Regards, Phil

@AdvancedSetup Well I got the Ubuntu installed on my desktop and it has a nice LInux command prompt. I used Rufus to burn the following file to a 16 GB flash drive: ubuntu-22.04-desktop-amd64.iso. It was bootable, but I could not see hardly anything. All white with broken light blue small lettering. I could not locate a LINUX command prompt. It has installs for Firefox which I don't use, LibreOffice, etc. I presume that I burned the wrong Ubuntu file to my USB. 😞 Sorry for being such a newbie, but this Linux is a whole new world for me. I presume that the Ubuntu installed on my desktop is no good because Windows is up and running, even if I did know the correct Linux commands to locate and destroy the "Galactic Static " folder. Ubuntu is a complex beast for the uninitiated. So I guess our first step is to tell Phil which Ubuntu file he should download and burn to his USB flash drive to get a Linux command prompt. After that, Phil has some work to do to research the various Linux commands to finally eliminate that "Galactic Static" folder. This is turning out to be a major challenge, but the good news is that it is all a learning experience, so I would like to persevere with your assistance, if you agree. Thank you, and have a great day. Regards, Phil

@AdvancedSetup Sorry to be late to my own party, but it was washing day here and some other chores. I did run UTF-8 fixlist to Unlock: C:\$Recycle.Bin. The unlock was successful, I could not delete the folder or move it with an Admin Command Prompt. It allegedly does not exist. I can't remember what command I tried, but at one point I got an "Access Denied" error - I think I was trying stuff in Active@Disk Editor. I have attached a hex printout of the "Galactic Static" entry in the $Recycle.Bin. There is definitely a space (Hex 20) and possibly some nulls at the end of the entry. Not sure how many nulls separate folder entries. I will move to exploring Ubuntu. Thank you for the link. Have a great day. Regards, Phil

@AdvancedSetup Would you please recommend a Linux distro? I am a completely newbie. "Galactic Static" is there in the root of the $Recycle.Bin$ folder. Have a great day. Regards, Phil

@AdvancedSetup, @Porthos I finished my updates, backups, and scans. Interestingly, I found that I could move the "Galactic Static" folder using File Explorer, to a different folder on my C: drive, and then to my D: drive, I decided to move "Galactic Static" to the $RecycleBin% where it now sits and won't move again or delete because Windows says it is not there. There is definitely a space or some invisible character at the end of the folder name, but I cannot rename it. I was hoping that emptying the Recycle Bin would get rid of the beast once and for all. I have attached a screen snip. I am open to suggestions as to how to purge it from there. If you think Linux is the best choice, then which Linux? Searching "Linux downloads" on Google returns an overwhelming number of results: 228 million! I am prepared to figure out how to use whichever Linux you recommend. I am also open to other suggestions, other than completely reinstalling Windows, my programs, and all of my data, and reconfiguring all of it to my satisfaction. That would take a week. For now, I am not seeing the folder because I re-enabled "Hide Protected Operating System" files, and my Recycle Bin shows empty on my desktop, even though at a system level the folder is still there. I agree that life is too short. I am pushing 70. This is a challenge though. I like to think that I have some control over what inhabits my computer rent-free. 😏 I don't like freeloaders that I did not invite. No rush to respond. This is a long weekend here, and I am going to enjoy. Thank you and have a great day. Regards, Phil

@AdvancedSetup, @Porthos Ran a Chkdsk /f this morning. Some unused security descriptors cleaned and the Bitmap was modified to correct issues. All normal. Tried to delete the "Galactic Static" folder using File Explorer. First and second time, no error was reported but the folder did not delete. On the third try, I got the usual error that the folder was not there. Tried Admin Command Prompt as well with the rd /s /q "Galactic Static", with and without spaces. Windows reported that the file was not found. Today is my update, backup, and scan day for my computers. Over the weekend, I study up on how to get Linux to remove a Windows folder. Will post back with my results in a few days. Thanks for all of your help and suggestions. Have a great weekend. Regards, Phil

I used Active@Disk Editor to examine the contents of a suspect file and sent you a screen snip of its contents earlier in this topic. I have had that program for many years now. It could not delete the "Galactic Static" folder because it did not exist! I suppose I could go down to disk level in hex and find the Program Data folder, and subsequently locate the "Galactic Static" folder and zero it out, but I have not done such low level disk editing since the ancient days (~1988) of "Norton Utilities" and his most excellent Disk Editor. I will run another CHKDSK /F. I have not run one in a few months. Perhaps the folder became corrupted since the last run, but I usually run a CHKDSK /f every few months just to clean up the Bitmap and make sure everything is hunky-dory. I never use a CHKDSK /r since my boot drive is an Intel NVMe SSD. While there are varying opinions as to whether the "/r" switch can safely be used on an SSD, I have tended towards the cautious, conservative approach. I do have a copy of Puppy Linux Finlandia 5.2.8. that dates back to 2017. I have only used it a couple of times in years past for clients trying to recover files when all else failed. My knowledge of Linux is very, VERY basic. I am receptive to trying another Linux version if someone will hold my hand to get at that persistent, nuisance folder. An ill-informed command in Linux can do a lot of damage so I treat Linux as if it were "nuclear." My thought is that amateurs should not mess with Linux, and I classify myself as a rank amateur. A pointer to a good tutorial on whatever Linux distro you believe to be best, would be helpful. I do believe in doing my own research, but I would rather check out what commands I planned to use with someone knowledgeable before borking my own computer. You @AdvancedSetup and @Porthos are both right. That darned folder has no business on MY computer. Time to terminate it. It will give me great satisfaction to see it gone! I am game to spend the time to learn some Linux and kill that folder. 😎 The question is how it got there in the first place? When Google cannot find anything about that folder, it is unusual to say the least. You've seen my logs. There is nothing unusual, pirated, or P2P on my computer, and there wasn't on 2019-10-26, ten days after I took delivery of my Dell desktop. I was just doing the final touchups to its programs and configuration. I will keep you posted. Thank you both for your interest in assisting me. It is so very much appreciated. Regards, Phil

I just went back into RE. My boot drive turned out to be D:. As usual, I could see the "Galactic Static" folder, and as usual, I could not delete (remove) it. Windows states that the "file" is not found, using RD /S /Q "Galactic Static", with spaces, without, ASCII 255 blanks, or without. I can't take permissions under Properties because Windows reports that the file cannot be found or the security information cannot be displayed. It is a stubborn puppy. If you have any other ideas, short of reinstalling Windows and all of programs and data, I am open to suggested solutions. I did encounter a "server" issue updating MBP this morning, but on the second try it updated. I did so again about ten minutes ago, and it worked fine. To me, that is not an issue. Your programmers will eventually terminate that nuisance bug. Thank you and have a great day. Regards, Phil

File Assassin uninstalled with Revo Uninstaller Pro. Malwarebytes Premium (MBP) reinstalled. Configured all of Bitdefender Total Security "Allowed" folders. Turned off the Scheduled Scan. Ran a scan - clean. Disabled MBP from registering with the Windows Security Center. In RE, there were no folders listed under X:\ProgramData. Rebooted into Safe Mode Command Prompt. The "Galactic Static" folder "seen" by the dir command. Tried deleting it using your recommended command without a space, with a space, and with an ASCII 255 "blank." All unsuccessful since the folder does not exist according to Windows 11 although it is displaying it in File Explorer and using the dir command in both Safe and Normal boot modes. To me, eliminating the "Galactic Static" folder is not worth any more effort. It takes virtually no space on my computer. The "Printers" file that it contained has been deleted and buried, so it is just a recalcitrant empty nuisance folder that loves residing on my boot drive in the ProgramData folder. I was one of those customers who had intermittent problems, for a couple of weeks before all of this started, with MBP reporting "server" issues when I initiated manual updates. On the second or third try, the update would succeed. Nothing wrong with my Internet so I assumed it was a problem on your end that you would resolve. So far, so good. MBP is responding normally and I like having my supplementary "deflector shield" up and running. Thank you, Captain. 🙂 I have manually deleted the contents of the .../temp folder in the past, but now I rely on System Ninja. It seems to do a great job and I run it every Friday along with Windows Cleanup. As you can see from my fixlog.txt, FRST only found about 158 MB to delete. System Ninja normally finds around 1 GB of junk to delete on Fridays, despite me clearing my Google and Edge caches daily. I am not using SQL. So where to now? I presume that we have come to the end of our journey with respect to the topic. Have a great day. I do sincerely thank you for your professional and comprehensive analysis of my desktop computer. Best Regards, Phil

Tried to edit my post but it would not save. I installed File Assassin and tried it, but File Assassin could not find the folder/file.

Thank you for your patience, Captain. ...\Roaming\Grapher appears in the new FRST.txt log. I subsequently manually deleted it. That file is gone now. Not so lucky with the empty "C:\ProgramData\Galactic Static" folder. Windows 11 keeps saying it is not found. It does have an invisible character at the end of the folder name that I noted when I tried to rename it, but when I tried that it said the file was not found. The properties show that I have been messing with it (Modified Date today). I have tried using an Administrative Command Prompt and rmdir with wildcards, without, with spaces, without, etc. In brief I have tried everything that I can think of, but you can't do anything with a folder that Windows 11 says does not exist, though the properties show it was created on 2019-10-27 12:25. It is not taking up much space so it might not be worth the bother of trying to delete it. If you have any suggestions, I am willing to try them. I have run many "Chkdsk /f" on my drive C: over the years, so if it was a problem folder, CHKDSK would have fixed it by now, or should have, so I did not run it again. As you will see in the fixlog.txt, FRST could not find that folder either. I googled "what is the "C:\ProgramData\Galactic Static" folder?" and got no results. I have attached a zip file that contains the fixlog.txt, and the new FRST scan logs. Awaiting instructions, sir. Thank you and have a great day. Best Regards, Phil garioch7_new_logs.zip

I am gratefully providing you with this update. My floors are clean. I got through your FRST.txt analysis after cleaning the floors. My assessments of, and responses to, your outstanding questions are listed below. Regrettably I will not have time today to analyze my Addition.txt file and finalize my fixlist script. I do find the Nikon Message Centre software to be helpful. I am prepared to absorb the resources required to keep it running and notify me when there are new Nikon software updates. As you can see from my logs, my desktop is very capable, having been equipped to handle HD video editing which is very resource-intensive. I turned off the auto-run of Sandboxie within the Sandboxie program and the icon is no longer appearing in my tray, so I did not include it in my fixlist. We will see if it appears in the next set of FRST logs. Chrome was uninstalled and reinstalled. The folder "C:\ProgramData\Galactic Static" does appear on my computer. It contains a 1 KB file called "Printers". Active@Disk Editor crashed when I tried to have it open the file (never got to specifying the filename). I downloaded Active@Disk Editor again and installed over the crashing version, and it works now. The "Printers" file is 12 bytes of gibberish and dates from about a week to ten days after I purchased the computer. I have no knowledge of "Galactic Static" and a Google search came up negative. I have attached Active@Disk Editor report of the file contents. I will be deleting the folder. If it turns out I need it for some unknown reason, I will recover it from the FRST Quarantine. I could also just recreate the file using Active@Disk Editor. The two files that you referenced in the ...\Roaming folder: 5.1.03 might be related to xplorer2 which is my main file manager or it might possibly be related to Galactic Static though I doubt that because the file dates are years apart. Grapher is probably related to Galactic Static. I will remove Grapher via the fixlist script, but I am going to leave 5.1.0.3 because it might be related to xplorer2. MbaeparserTask.exe does not exist on my computer. Deleting the task. I have saved your clean up "fixlist" script. Thank you. I will run it after you declare my computer is stable and reasonably clean. I use System Ninja and Windows Cleanup weekly, so I don't think there is too much junk on my computer that is accumulating. I also have a batch file that I run every week - credit to JohnC_21 over at Bleeping Computer. Neither System Ninja nor Windows Cleanup deal with the innumerable temporary folders that Window 11 creates in the :\Windows\System32\config\systemprofile\AppData\Local\ folder. I can send you the batch file zipped because I doubt that the Forum accepts .bat files as attachments. I run both Easeus Todo Backup Home (ETBH) and Macrium Reflect as system imaging programs, alternating weekly. Macrium is by far the better program for speed and performance, but the interface is a little overwhelming for newbie users. One of my main priorities, as a computer support person here in the community, is to encourage people to perform regular backups, thus I use ETBH myself to ensure that I am fully conversant with the program (I hate the "eye candy" in the newest version). I normally recommend ETBH to my clients who are not really knowledgeable and comfortable with complicated program UIs. Also, I do not like to put my trust in a single backup program. I got burned a about 10 years ago when I was using Acronis. They issued an update that borked both of my computers. Ironically I had to boot from the Acronis Rescue disk to revert my computers. That particular update removed a file that was essential to booting, but did not remove the registry loading point declaring it to be essential to boot. It was quite a sensation at the time and cost Acronis a lot of customers, yours truly included. I uninstalled Acronis and went to ETBH, and then a few years later found Macrium, which I like better. The VHStoDVD patch file I deleted from my user profile folder. There was already a copy in the Honestech VHStoDVD folder, which is a now defunct program that I used for converting VHS tapes to .mpg files so that I could create DVDs. I still have the last version that was released and it works great, but the Honestech company went belly up Going back to that strange error you saw in April, I believe that was when I wiped out File History. It was not working correctly and the Forums were full of unresolved complaints about its many bugs. I was only using it as a redundant backup source. I image weekly and copy all created or modified data files to my D: drive, so I really didn't need it, and I cannot abide software that doesn't work. On top of that, I run SyncToy everyday on my boot drive which copies all new and modified files to my D: drive. Unlike some, I prefer to have all of my progams and data on my boot drive. It is a 1 TB drive and has lots of room. The 2 TB "spinner" D: drive has copies of all of my data, plus images, which I also copy to an external hard drive, only connected to perform the copy operations. Overkill, perhaps, but you can never have too many backups! My plan is to analyze my Additon.txt file tomorrow and finalize my fixlist script. I will run it, provide you with the fixlog.txt and a new set of FRST scan logs. I am guessing that you prefer the FRST logs to be attached, rather than copied into posts? At BC, we prefer logs copied, but when in Rome, ... Please let me know your preference. I am reminded every time I log into my computer that MBAM is not there. My habit is always to initiate manual updates to BDTS, MBAM, and Windows Defender before I do anything else. While I am not concerned, as the good Captain, you will appreciate that I am prudently concerned about a missing "deflector shield." :) I presume your support tool deactivated my lifetime license on this computer? If not, I will go to my account and deactivate it so I can reinstall it when you so direct me. As I have stated previously, I very much appreciate your comprehensive and professional review of my FRST logs. You may not recall but it was the MBAM Forums and you personally who recommended that I consider taking malware removal training back in 2014. The rest, as they say, is history. Have a great day and I will post tomorrow, God willing and the devil not caring. Best Regards, Phil

My phone tells me it "wash floors" day. Being single with a puppy, I have to look after everything in this old two-story house. My time is seldom my own. I have decided that I want to fully investigate the FRST logs that I ran yesterday to look for "orphans" and possible other junk that has accumulated on this computer since its purchase in October 2019. I will try to get an hour after floor cleaning and before making supper to review my logs and add any appropriate items to my fixlist script. I started with WordPerfect 4.2 back in 2009. I have had every version since. The worst thing that ever happened to WordPerfect was being purchased by Corel Corporation. The product is not being actively supported and enhanced these days. This is the first year (2022) there has not been a new version, but in the later years, the "enhancements" were mostly cosmetic. The good programmers are gone. I will leave the WordPerfect QuickFinder active. It performs functions in the WordPerfect Office Suite, and for old times sake. With respect to the HP and Corel programs that you mentioned, I did update the HP printer driver as you recommended and those ancient HP files are still appearing in my new FRST.txt file that was created after the HP printer driver package was updated. As for the Corel PDF Creator files, as I have stated, Corel has not been actively updating WordPerfect Office in many a year. I guess that they don't, or can't, fix what isn't broken. Thank you for your patience. It may be tomorrow before I post again. Have a great day. Best Regards, Phil

I am shutting down for the night. I have created a fixlist script to deal with the Run entries and I will run it tomorrow. Thank you for sharing your script for cleaning computers. I will comment on that tomorrow as well. I will use the EmptyTemp: directive, though I will also comment on that tomorrow. I will share with you my "fixlog.txt" tomorrow after I run my "fixlist" script and I will investigate the files you have questioned at the end of your analysis post. Hopefully we can finish our work tomorrow. Have a great evening, Ron, and thanks again. Best Regards, Phil

Thank you for your post. The contractors have been and gone. I am having the bathroom remodeled by Bath Fitter, and their "test tub" was not a match. To be continued. I have installed the latest HP full driver package for my12-year-old HP LaserJet Pro CM1415fnw printer, which is my default printer. All is good there. I downloaded the latest driver package for my Epson Artisan 50 from the Epson website. I keep all of my installation programs and drivers packages. The "new" driver package file was "epson13417.exe." The old driver package file had the same name and the same size. I did an "fc" on both files, after renaming the new one, and "No differences encountered." I conclude that I have the latest driver package for that 10-year-old printer. I still use that printer and it performs flawlessly. It is a great printer, not that I use it that much these days. The Dell 8930 SE desktop was purchased on 2019-10-16. It has had at least eight BIOS updates since I got it originally. I go to the Dell preboot environment and use their BIOS Flash Utility to do the BIOS updates. Dell SupportAssist, in particular, is known to brick computers doing BIOS updates, and I have little more confidence in Dell Update. I removed both programs from my computer using Revo Uninstaller Pro in the last year. I check the Dell website each week before imaging my two Dell computers and manually search for new drivers. Looking at all of your suggestions, I decided the most efficient approach for me would be to prepare my own "fixlist" script rather than bungle about with Regedit. I downloaded FRST64.exe and ran it. I will go through my logs and remove what I determine should be removed. For instance, I do like UCheck. I have UCheck Premium and it finds and installs updates by itself once you tell it do so. I have used it for four years now and I am completely satisfied. There are no advertisements in the Premium version and the cost is very reasonable. I am going to keep it, but I thank you for your suggestion. I will look into those files that you questioned towards the end of your post, but my first priority now is to craft a fixlist script to remove the Run entries that you pointed out are not needed. I concur. If there is some program(s) I want to keep running, I will let you which one(s) and why. As I have stated already, I am very, very grateful for your assistance. I never thought to run FRST on my own computer because I knew it was not infected, it was performing normally (everyone experiences the occasional glitch), and it was has no issues that SFC or DISM could detect and rectify. Those scans were all coming back normal. I am quite happy to hold off reinstalling MBAM until we have completed our work here. MBAM has only ever detected the occasional false positive over the many years that I have used it on both of my computers. As you will know, I have three legitimate lifetime licenses, purchased directly from Malwarebytes when customers were notified that lifetime licenses were going to be discontinued. Thank you again for sharing your time and expertise. It is very much appreciated. Best Regards, Phil

Thank you for your emails. I will not reinstall MBAM until directed. There is no such Paradox folder under Program Files. I have attached an "Everything" search snip. I also checked using File Explorer and the folder is simply not there. I have contractors coming to the house today, so I might not make any progress on your list today, but yesterday evening I surprisingly found an update (May 2022)at the HP site for my LaserJet Pro, which I purchased in 2010! I will install it when I get a chance. The Epson Artisan 50 printer was purchased in 2012. I procured it for printing on blank, printable DVDs and BDs. I was doing a lot of videography in those days and VHS to DVD conversions. I will check for an update on the Epson site when I get a chance. I don't print much any more, maybe 50 pages a year, so I have seen no reason to purchase a new printer. The old ones do just fine for me. Thank you again and I will be back in touch. Best Regards, Phil

I really appreciate the time that you have devoted to analyzing my desktop. 1. I have changed my DNS to Google. 2. PdxRegCl probably belonged to Corel Paradox, a database program that I uninstalled about six months after the desktop was purchased. The program was no longer being maintained and it was buggy. It was a part of the Corel WordPerfect Office Suite Pro. There was no registry cleaner in that Suite. I deleted that registry Value Name from my registry. Unfortunately, I did so before I went to look for the file. I cannot find it on my computer. Would you check my log, and let me know where I can find the actual .exe file or its name? If I run FRST now, the Run32 file associated with PdxRegCl won't be found. I would like to remove the file as well. I have not used a registry cleaner since 2014, well before the 2019-10-16 purchase date of this computer. Like you, I advise everyone to stay away from Registry Cleaners. I borked one of my old computers with a WISE program registry cleaner. I think that the explorer.exe program fault occurred when I was trying the find the mbam-grab-results.zip file. I had to cut that from my desktop and paste it into the Downloads folder. File Explorer could not "see" that file. I am busy today and your analysis is very thorough. I plan to take time this coming week to go through each and every item that you have listed. You have gone to a great deal of work. I very much appreciate that. Too often when we are helping people, they just abandon us and we have to conclude the topic as unresolved. That is a waste of our time. I will post regular updates this coming week as I work through your comprehensive suggestions and observations. Thank you again, most sincerely. Best Regards, Phil PS: Can I reinstall Malwarebytes Premium again; or, would you prefer that I wait until we have cleaned up my computer?

Just in from mowing. When I fired up my desktop, Windows Update informed me that KB5015732 (Preview Cumulative Update for Net Framework 3.5 and 4.8) was available. I tried the update with MBP active and it succeeded. I ran the Clean twice. The computer did not reboot after the first time. It just returned to the Advanced Settings screen. So I exited the Support Tool, rebooted, and ran Clean again. Same thing. No auto-reboot or message that MBP was successfully uninstalled. I did not activate Windows Defender. My security solution is Bitdefender Total Security (BDTS). Windows Defender is in passive mode performing periodic scanning. I presume that instruction is just a part of your "canned" since the FRST logs would have shown you that BDTS is my anti-virus solution. MBP was set not to register in the Windows Security Center. I did not touch BDTS. It remained, and remains, active. I have attached the latest logs. Both yesterday and today, File Explorer and xplorer2 did not see the MBAM files on my Desktop. I could see them on my Desktop, but they could not, even with the selection *.* I cut the file directly from my Desktop, and pasted it to my Downloads folder and was thus able to attach the mbst-grab-results.zip file to this post and yesterday's post. Once again, thank you for your assistance. Regards, Phil mbst-grab-results.zip