PclPcl

Hello, thanks for asking. "Offline work" has got in the way, however when I can I will try following the procedures you suggested (in the links you posted) to end the loop, as despite your kind assistance (thanks again) I still get the same error 0x80070002 message. Will let you know.

Hi, no, I don't mean I stopped the actual update process while rebooting and downloading the update: I stopped the "check for updates" there while at 0% (on the Windows Update page as per first screenshot above). I did it because I was not sure it was the right step as I had received no command to do so yet. I guess must be very tired and should go to bed now. Anyway, tried to restart and it still repeats the same "installing updates, automatic restart, deleting installed updates" loop. And if I go back to the Windows Update page again it still shows that error 0x80070002. I must add that apart from this pc is not showing any other issue.

just checking it's the right section because of language difference: (see pic) If I click on "verifica disponibilità aggiornamenti" 3 downloads were starting. I stopped them, now if I go back there it gives me the option to start them again and reboot (second picture)

So, here you go with the 2 new FRST logs. About Acronis: Tried running it again (because I'd accidentally misread one of your suggestions). Now it does not show any issue in the VSS Shadow Storages area. It does show some event log errors (see screenshot and I've also included a .txt) About the restore point: followed the same control panel/system safety etc... path, there chose "Create a restore point", there I entered a random name and after a while it said creation was successful. So what did I just do with this dumb action? Can I undo that? I just entered a random name. Addition.txt FRST.txt AcronisVSSDoctorReport_2021-03-29-23-27-55.txt

Hi, went to control panel, found "AVG Update Helper" and was able to remove it. I ran both the Acronis and Macrium tools: while running Acronis I got one issue (VSS Shadow Storage Status), see picture attached. Should I select "Yes" to the message that came up? Ran Macrium without any special message. After restarting the pc, I have new FRST logs: (attached) About system restore: I followed the instructions contained in the last link of your post (control panel-system-system protection-protection settings) and see that C/System is listed as "On", so on paper it should be alright? If I go to "configure" I see that "Turn on system protection" is selected. Current use is 290,28 MB. Max. Usage is 10%. Addition.txt FRST.txt

Here you are :) thanks again for the excellent service Addition.txt FRST.txt

Hello and thanks again, I have followed the steps, hopefully correctly, and here is the log file attached Thanks again Fixlog.txt

Thanks for the reply Sorry again, but a doubt about the "place the fixlist.txt" in the same place where FRST is.. So far I've operated FRST through MB Support Tool which is placed in a folder, however there is no trace of anything named FRST inside that folder, the only thing called "FRST" is a folder in another path (C:) So which of the two is the right path for the fixlist.txt file? thanks again

Hello, thanks will try. Two quick questions: a) I already uninstalled CC Cleaner. I guess that uninstalling Teams Machine Installer will only delete the installer programme, and Microsoft Teams should continue working? I need it for my job b) when you say "Then stop "app X" from starting and loading" you mean turning off the "always start this app at pc start" function? because I can't find this option on this Windows version thanks again

Hello Porthos. Apologies: I haven't been feeling well last few days. Anyway, I uninstalled AVG as suggested and in the attchment you can find the new log. I have downloaded and run MediaCreationTool, selected "Upgrade this pc" from there, I let it check everything, then it said "ready to install Windows 10", chose the "keep personal data and apps" option. It downloaded the updates, but after the reboot the same writing appeared again "deleting the changes applied to the computer" When the pc restarted, I got this message: (I've also attached a screenshot of this as well) "0x8007001F - 0x20006 installation did not succeed in the SAFE_OS phase with error during the REPLICATE_OC operation" mbst-grab-results.zip

Hello, I have deleted several garbage/unused files, and here is the new log: I should now have abou 48 gb free mbst-grab-results.zip

So when I try to shut the pc down and the system wants to automatically update, what should I do?

I Will try deleting some unnecessary apps over the weekend and see what happens. Games mainly, I guess. Is there anything else I can do besides that? Thanks for your help. The fact that you are doing it as volunteer in your spare time is admirable. May you have a nice weekend. All the best!

Sure, here you are Thanks for your help! mbst-grab-results.zip

Hello all, just a question regarding an apparently endless loop of Windows updates: I've been having this issue for about one week: when I close the system it says the usual "before shutting down, an update will be installed etc.." (I'm translating from another language, so words are not exactly the same but you get the gist). When closing, it says "configuring update".. When I turn the pc on again it starts working on the updates (with the message "the pc will reboot multiple times"), it reaches about 15% and reboots. After rebooting, a black screen displays the message saying something like "deleting the changes applied to the computer" ("Annullamento delle modifiche apportate al computer in corso" in my language) and then the pc loads as normal. But when after some hours I turn it off, the whole thing starts again in an endless loop. So I don't know: 1) what it's trying to do? 2) whether it's really not managing to install it? 3) how to stop this circle? I've scanned the pc with MalwareBytes, AVG and MB Anti-Rootkit, but found no malwares. When using ProcessExplorer I sometimes find TrustedInstaller.exe with a score of 1/69 on VirusTotal, detected only by SecureAgeApex. Don't know if relevant. By the way, what should I do with the information VirusTotal provides in the "Relations > execution parents" section? (see image attached) It links to a file with a 67/72 dectection score. I understand it's a file that might have generated the files I was searching...but should I be worried or not. Sorry for requesting your help here, I would normally go to a local expert but I'm currently in "red zone" due to Covid which means I can't go out :( Thanks for your valuable time and help!

please let me know if that image is not safe to have here (I don't think it shares important information?)

Sorry, the screen is no more. Anyway, the processes were: MicrosoftEdgeSH.exe MicrosoftEdgeCP.exe sihost.exe (this was under "svchost.exe")

Hello all, just curious...I was running Process Explorer today and noticed three "Microsoft Corporation" processes had a red "1/74" warning on VirusTotal It's the first time I notice that. All 3 of them are detected by the same antivirus, "BKav Pro" which I'd never heard of. It lists all of them as "W32.AIDetect.malware1" Here you can see the Process Explorer screen: https://ibb.co/0XQKZWf At first glance they seem all legit objects, but how do I verify the haven't been infected? Best regards and thanks everyone in this very helpful board.

No, the email isn't there anymore it seems. I tried searching by filename, and then tried finding all the pdf attachments but no result. I'll try submitting it to ViruTotal later. thanks again

Also, I am afraid I do not completely understand what you mean here?.. if anything, the fact that I wasn't expecting that file from the sender makes it more suspicious? :)

Thanks for your reply Porthos. So just to confirm: are you really sure that even if this PDF file is really a malware, I can safely restore/extract it (without opening it) to submit it to VT?

Hello, one question: I used to use AVG antivirus (yes, I know it's not the best and will probably uninstall after I've solved this) it once found a malware labelled as "Trojan" and I want to send it to VirusTotal for anylisis. The file is still in VAG Quarantine (it's a PDF apparently). How do I take it from there SAFELY to send it to VirusTotal? I've tried looking for the folder directory, but the file is not there anymore. It's just in the AVG Quarantine. The options there are (of course "delete", "restore"..) and "Extract"...but will it be dangerous to extract it to say, desktop in order to be able to send it? I can't see how I can send it to VirusTotal. Many thanks! hope the forum subfolder is the right one.

Hello everyone here, it's my first post. Hopefully it's the right section. My simple question is: is it possible to retrieve accidentally deleted scan reports/logs? I want to see the results of the first scan I did with MalwareBytes Anti-Malware, but in the I accidentally deleted the report in the programme. Is it saved somewhere? Can I still find it? Thanks to all the community, and to the staff at MalwareBytes for their excellent program.