RedLightPumpkin Posted October 12, 2021 ID:1483702 Share Posted October 12, 2021 Hello, I recently noticed that a program called "Escalated privilege file operation daemon" is stopping my pc from shutting down. I did read that it's related to Adobe CC, but seeing as my photoshop and premiere were activated "not really legit" I'm kinda worried if it also activated some less wanted application. I uninstalled anything to do with CC now but I would still like to check if there's anything remaining since superantispyware and malwarebytes didn't check anything. Link to post Share on other sites More sharing options...
kevinf80 Posted October 12, 2021 ID:1483705 Share Posted October 12, 2021 Hello RedLightPumpkin and welcome to Malwarebytes, Please NOTE: The tools we use and the information obtained are safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system. Download the Malwarebytes Support Tool from here: https://downloads.malwarebytes.com/file/mbst In your Downloads folder, open the mb-support-x.x.x.xxx.exe file In the User Account Control pop-up window, click Yes to continue the installation Run the MBST Support Tool In the left navigation pane of the Malwarebytes Support Tool, click Advanced In the Advanced Options, click Gather Logs. A status diagram displays the tool is Getting logs from your machine A zip file named mbst-grab-results.zip will be saved to your desktop, please upload that file on your next reply Thank you, Kevin Link to post Share on other sites More sharing options...
RedLightPumpkin Posted October 12, 2021 Author ID:1483708 Share Posted October 12, 2021 mbst-grab-results.zipHere you go Link to post Share on other sites More sharing options...
kevinf80 Posted October 12, 2021 ID:1483711 Share Posted October 12, 2021 I see you have FRST d/l, renamed to FRSTEnglish in your downloads folder. Can you run and post produced logs... Run FRSTEnglish, ensure all boxes are checkmarked under "Whitelist" but only Addition.txt under "Optional scan" Select scan, when done post the new logs. "FRST.txt" and "Addition.txt" Link to post Share on other sites More sharing options...
RedLightPumpkin Posted October 12, 2021 Author ID:1483713 Share Posted October 12, 2021 Addition.txt FRST.txt Link to post Share on other sites More sharing options...
Solution kevinf80 Posted October 12, 2021 Solution ID:1483717 Share Posted October 12, 2021 Hiya RedLightPumpkin, Thanks for those logs, continue: Set windows up for "Clean Boot" mode, full instructions here: https://support.microsoft.com/en-gb/kb/929135 Basically all none MS services are disabled, reboot to that mode. Shutdown from clean boot and see if the issue clears... Thank you, Kevin Link to post Share on other sites More sharing options...
RedLightPumpkin Posted October 12, 2021 Author ID:1483718 Share Posted October 12, 2021 Just to be clear, I have to set windows to clean boot, reboot in that mode and then reboot back to normality Link to post Share on other sites More sharing options...
kevinf80 Posted October 12, 2021 ID:1483720 Share Posted October 12, 2021 reboot twice in cleanboot mode, does the issue clear or remain..? Link to post Share on other sites More sharing options...
RedLightPumpkin Posted October 12, 2021 Author ID:1483721 Share Posted October 12, 2021 Haven't done it yet, starting the whole process now Link to post Share on other sites More sharing options...
kevinf80 Posted October 12, 2021 ID:1483722 Share Posted October 12, 2021 Ok... Link to post Share on other sites More sharing options...
RedLightPumpkin Posted October 12, 2021 Author ID:1483725 Share Posted October 12, 2021 Restarted twice, returned to normal boot mode, the app didn't show in any of the shut down screens. I would guess that counts as fixed Link to post Share on other sites More sharing options...
kevinf80 Posted October 12, 2021 ID:1483726 Share Posted October 12, 2021 Does it not show in normal boot...? Link to post Share on other sites More sharing options...
kevinf80 Posted October 12, 2021 ID:1483730 Share Posted October 12, 2021 Hello RedLightPumpkin, If the issue has definitely cleared continue to finish up... Right click on FRST here: C:\Users\kubac\Downloads\FRSTEnglish.exe and rename uninstall.exe when complete right click on uninstall.exe and select "Run as Administrator" If you do not see the .exe appended that is because file extensions are hidden, in that case just rename FRSTEnglish to uninstall That action will remove FRST and all created files and folders... Next, Consider the following: Disable Remote Desktop: https://www.tenforums.com/tutorials/92433-enable-disable-remote-desktop-connections-windows-10-pc.html Disable Windows Telemetry: https://helpdeskgeek.com/windows-10/how-to-disable-windows-10-telemetry/ Malwarebytes Browser Guard (Free) for Firefox: https://addons.mozilla.org/en-GB/firefox/addon/malwarebytes/ Malwarebytes Browser Guard (Free) for Chrome: https://chrome.google.com/webstore/detail/malwarebytes-browser-guar/ihcjicgdanjaechkgeegckofjjedodee Will also work for Opera and Edge.. PatchMyPC, keep all your software upto date - https://patchmypc.com/home-updater#download From there you should be good to go... Next, Read the following links to fully understand PC Security and Best Practices, you may find them useful....Answers to Common Security Questions and best PracticesDo I need a Registry Cleaner? Take care and surf safe Kevin... Link to post Share on other sites More sharing options...
RedLightPumpkin Posted October 12, 2021 Author ID:1483734 Share Posted October 12, 2021 Cheers! Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted October 12, 2021 Root Admin ID:1483735 Share Posted October 12, 2021 Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Please review the following for Tips to help protect from infection Thank you Link to post Share on other sites More sharing options...
Recommended Posts