sync: auto-sync from GURU-BEAST-ROG at 2026-07-10 14:03:06

Author: Mike Swanson
Machine: GURU-BEAST-ROG
Timestamp: 2026-07-10 14:03:06

clients/mineralogical-record/session-logs/2026-07/2026-07-10-discord-bot-tpm-pc-ace-association-fix.md

@@ -204,3 +204,20 @@ so issued `shutdown /r /t 300` with on-screen 5-min warning. Reboot verified: La
 do_not_email) to ticket #32529 — attributed to **Winter Williams** via the new per-user
 key + requester preference (first production use, worked). No additional billing per
 Howard. Alerts posted to #dev-alerts + #bot-alerts.
+
+## Update: 14:55 AZ — Winter: origin forensics for today's scan findings
+
+Winter asked whether the origin of today's 4 scan findings could be determined and whether it linked to ticket #32511 (Ace). Ran two recon passes on TPM-PC via RMM (`ps-encoded.sh`, agent 03322f46-42b8-432d-a103-bdcae244ab55): NTFS creation timestamps, Prefetch, Downloads Zone.Identifier ADS, and a raw URL extraction from a copied Chrome History file.
+
+**Findings:**
+- **JS trojans (EmieBrowserModeList\Znkhguh) — unrelated to #32511.** Tree created 2014-12-11 (root 2014-11-13), contains a bundled fake Chrome 36.0.1985.143 payload. 11-year-old dormant remnants; only modified today by Emsisoft's removal.
+- **Ace — malvertising.** Chrome History: `get.ace.ai/AceSetup.exe?...utm_source=adx` (ad-exchange delivery). Prefetch ACESETUP.EXE run 2026-06-26 10:16. AceSetup.exe no longer on disk.
+- **PDFEditor_56571.exe — paid ad campaign.** `cleareditpdfdd.com/PDFEditor.exe?campaign_id=23228291019&adgroup_id=6629007750` (fake PDF-editor site), downloaded 2026-01-29.
+- **Browsing habit:** 2026-06-09 12:39-12:42 burst — Fortect.exe (cloud.fortect.com, "Repair & Update PC Sound Drivers" banner) + 4x Driver_Updater_setup.exe (cdn.pchelpsoft.com, Bing search-ad landing pages keyword=speakers / Windows-11 Audio). Tom searches for audio/driver fixes and clicks sponsored results.
+- This morning's 07:52 "ADOBE INSTALLER.EXE"/SETUP.EXE prefetch entries = benign Adobe Photoshop 2026 install via Creative Cloud.
+
+**Syncro:** comment 423226885 added to #32529 (id 113703284) — "Root cause - origin of adware findings", items 2+3 only (JS trojans excluded per Winter), hidden:false, do_not_email:false (emails Tom). Tech attribution: Winter Williams (her vaulted key via CLAUDETOOLS_REQUESTER_USER). No billing added. Bot alert posted.
+
+**Recommendation delivered:** avoid sponsored search results for software/fix tools; consider ad-blocking on Tom's browser profile.
+
+Scratch scripts .origin1-3.ps1 created and deleted from repo root.