Escalated privilege file operation daemon

[davidhar]

When shutting down I noticed that shutdown was being prevented by escalatedprivilegefileoperationdaemon.exe. I've not seen this previously. A Malwarebytes Premium doesn't detect any threats

malwarebytes150921.txt

[AdvancedSetup]

Hello @davidhar

It looks to probably be a file from Adobe. It may have just been that someone from Adobe was still open or hadn't finished saving?

Please get me some logs and we'll review further.

 

To begin, please do the following so that we may take a closer look at your installation for troubleshooting:

NOTE: The tools and the information obtained are safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

• Download the Malwarebytes Support Tool
• In your Downloads folder, open the mb-support-x.x.x.xxx.exe file
• In the User Account Control pop-up window, click Yes to continue the installation
• Run the MBST Support Tool
• In the left navigation pane of the Malwarebytes Support Tool, click Advanced
• In the Advanced Options, click Gather Logs. A status diagram displays the tool is Getting logs from your machine
• A zip file named mbst-grab-results.zip will be saved to your desktop, please upload that file on your next reply

Thank you

 

[davidhar]

Thank you, logs file is attached.

mbst-grab-results.zip

[AdvancedSetup]

Please go to Control Panel, Programs, Programs and Features and uninstall the following

Bonjour

 

It also looks like you probably need to install the latest update from DropBox

Application errors:
==================
Error: (09/15/2021 07:00:17 PM) (Source: DbxSvc) (EventID: 281) (User: )
Description: CertFindCertificateInStore failed with: (-2146885628) Cannot find object or property.

 

It looks like Windows Defender found and removed an app that it did not like as well.

Date: 2021-09-15 15:13:39
Description:
Microsoft Defender Antivirus has detected malware or other potentially unwanted software.
For more information please see the following:
https://go.microsoft.com/fwlink/?linkid=37020&name=App:MyWebSearch&threatid=268626&enterprise=0
Name: App:MyWebSearch
Severity: Low
Category: Potentially Unwanted Software
Path: file:_J:\Downloads\Weather blink\WeatherBlink.exe
Detection Origin: Local machine
Detection Type: Concrete
Detection Source: User
Process Name: Unknown
Security intelligence Version: AV: 1.349.693.0, AS: 1.349.693.0, NIS: 1.349.693.0
Engine Version: AM: 1.1.18500.10, NIS: 1.1.18500.10

 

 

The Acronis CyberProtect is relatively new for Acronis and "might" be having some additional resource usage on the system 

 

Highly unlikely you're still getting updates from HP - probably best to remove this start up entry

HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard Company -> Hewlett-Packard)

Maybe review your system and uninstall any old programs you no longer use. Then look at clearing up your %TEMP% folders and run a disk check on the system

 

See if that helps and let me know. I don't see an obvious infection in the logs

 

 

 

[davidhar]

Thank you. I have followed those steps and so far so good, I haven't seen any sign of further problems.

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following for Tips to help protect from infection

Thank you