Seif1993

Hello, I read on another thread, https://www.bleepingcomputer.com/forums/t/688212/another-360-safe-popup-issue-on-every-reboot/page-3 , that upgrading to Windows 10 1809 solved the issue for the OP. I decided to upgrade from 1803 to 1809 and the pop-up has not appeared in the past two reboots. Feels too good to be true to be honest....

Is there an explanation as to why the pop-up, along with it's temp files, do not appear post starting up my PC from a long period of it being shut down?

I upgraded to Windows 10 from Windows 8.1. SETB9F4.zip

Please ignore my last comment, I researched and understood what needs to be done. UnsignedFiles.txt UnsignedFilesSysWOW64.txt

Hello, I am not quite sure what you mean by "change directory to C:\Admin\Utils\Sysinternals from an elevated admin command prompt". I created the folder C:\Admin\Utils\Sysinternals and extracted all the Sysinternals Utilities from the download to that folder. Not sure what I need to do with regards to changing the directory.

Appreciate the detailed explanation. Just to add to that, the pop-up also does not appear in safe mode with networking on, and in normal mode with internet disabled. MyScheduledTasks.txt

I've uninstalled my iObit softwares before and it made no difference. I've had these programs for years now and never had an issue. I have around 5 iObit related softwares so uninstalling them once again would be tedious and it hasn't solved the issue before. There is a similar thread over on BleepingComputer, https://www.bleepingcomputer.com/forums/t/687511/360-safe-popup-after-reboot/page-5; in the last comment the OP explained that he was able to edit the host file which prevented the pop-up from happening. I am not quite sure what that means, can you care to explain?

Pop-up appeared post reboot. Once again, when the PC was shut for several hours, it did not appear on startup. Fixlog.txt

Once again, I left my PC shut off for around 8 hours and after powering it back on, the pop-up did not appear.

Hello Ron, appreciate your time and effort into helping me resolve this issue. The logs requested are attached. The scans were all run with the pop-up present and .tmp files not deleted. SHELBY.zip MalbytesLog.txt AdwCleanerLog.txt Addition.txt FRST.txt

Yeah my younger brother had this genius idea of downloading a file from a piracy website which came with this AutoKMS thing, my windows and office are already activated... It is exactly AutoKMS spico which caused this pop-up.

The scan was run with the pop-up open and .tmp files present. Most of the results were files and folders that existed on my PC way before this pop-up issue ever occurred. SUPERAntiSpyware Scan Log - 12-15-2018 - 00-50-16.log

I am not aware of the default PW and ID at the moment. I did a router reset a few months back and ended up having my ISP's technician come out because of the weird protocols that they have when setting up a router. I would rather keep that as a last ditch effort. Is there a way to isolate services that are internet dependent?

Also, right before the popup appears I can see my mouse flickering indicating that there is a process going on which is then followed up by the pop up appearing.

Resetting the router would not be ideal for me as ill have to call out a tech from my ISP to do the initial setup. I flushed the DNS and changed to Google's DNS and still got the pop-up on reboot. Is there a way to isolate services that are internet dependent? It would narrow down our search by quite abit.

I rebooted twice without internet and it didn't pop up, I rebooted again with internet and it popped up. Atleast now we know it is internet dependent.

Earlier this morning when I first opened my PC the popup did not appear, it's becoming a trend where If i leave my PC shut off for a long time then power it back on, the pop-up doesn't seem to appear on the first startup but re-appears after restarting, does this tell us anything?

I had an automatic recovery point configured on Dec 3 or 4 but I cannot find it now. These are the only ones available.

https://www.virustotal.com/#/file/8c0743aef7aa497cb1091c9e93e6a2f45e5377434b2bdd5d2a424a53b39ad23d/detection I had this since before the pop-up occurring.

I had an automatic system restore point created a day or two before creating this thread, but I didn't go that route thinking it would be a relatively easy fix. I have a manual one created now which I reverted back to after uninstalling the software with no success of terminating the pop-up. Is there a way to find old system restore files? I cannot find any of the older ones other than the manual one I created.

That registry backup is extremely old... I really don't want to take that route if there is any other way to tackle this.

I ended up installing the software then going into safe mode and deleting every last god damn file related to the app and it seemed all clear. I restarted and it STILL pops up... How is this even possible?

But what about all the registries related to programs that have been installed since?

I was actually considering just that, and I even made a restore point and have a folder on my hard drive titled 360 Trial Install but didn't go through with it. My hard drive is basically a backup drive and no windows, would installing it there be ideal and less invasive? Also, what are the possible risks of doing a registry restore?

Still popped up. My god this thing is relentless.... Fixlog.txt