sync: auto-sync from GURU-BEAST-ROG at 2026-07-10 09:58:26
Author: Mike Swanson Machine: GURU-BEAST-ROG Timestamp: 2026-07-10 09:58:26
This commit is contained in:
Winter Williams
committed by
ClaudeTools Bot
ClaudeTools Bot
parent
f95809cd9d
commit
3286a47090
@@ -0,0 +1,139 @@
|
||||
# Session Log — TPM-PC Broken Link Handler Fix + Adware Sweep (Ace PUP follow-up)
|
||||
|
||||
## User
|
||||
- **Executed by:** ClaudeTools Discord Bot (GURU-BEAST-ROG)
|
||||
- **Requested by:** Winter Williams (@winterguru, via Discord) - tech
|
||||
- **Role:** automation (acting on the requester's behalf)
|
||||
|
||||
## Session Summary
|
||||
|
||||
Winter reported (Discord #tech-department, thread 1525175952261382354) that Tom Moore at
|
||||
Mineralogical Record was getting an error when clicking links on TPM-PC saying he needed
|
||||
to download an app. This is a direct follow-up to the 2026-07-07 session (see
|
||||
`2026-07-07-discord-bot-tpm-pc-ace-pup-removal.md`): that session removed the Ace PUP
|
||||
browser's files, run keys, and scheduled task — but the Windows default-handler
|
||||
registrations survived, leaving http/https/.html/.pdf pointing at the now-deleted
|
||||
`C:\Users\TPM\AppData\Local\Ace\Ace\Application\ace.exe`. Every link click tried to launch
|
||||
the ghost exe, producing the Store "you need a new app to open this" prompt.
|
||||
|
||||
Located TPM-PC in GuruRMM (agent `03322f46-42b8-432d-a103-bdcae244ab55`, online, Windows 11
|
||||
24H2 build 26100, user `tpm` at console). Diagnostics confirmed UserChoice ProgId
|
||||
`AceHTM.Y7MX532PR2LX3GQE3ZGPQFQCF4` on http/https/.html plus a stale phantom
|
||||
"Chromium.Y7MX532PR2LX3GQE3ZGPQFQCF4" StartMenuInternet registration. Chrome, Edge, and
|
||||
Firefox all installed and healthy; Chrome is Tom's primary browser (15 MB history, active
|
||||
same-day).
|
||||
|
||||
Remediation (registry exports backed up to C:\Temp on TPM-PC first): deleted the dead
|
||||
AceHTM and AcePDF class keys from the user-classes hive, the HKLM StartMenuInternet
|
||||
Chromium entry, and the RegisteredApplications value; cleared the broken .html/.htm
|
||||
UserChoice keys. The http/https UserChoice keys could NOT be removed or rewritten — Windows
|
||||
11 24H2's UCPD (User Choice Protection Driver) blocks all script/registry paths, even as
|
||||
SYSTEM and even via SFTA-style hash writes in the user session (verified: staged
|
||||
DanysysTeam PS-SFTA to C:\Temp\SFTA.ps1 via chunked base64 upload, Set-PTA threw "Write Reg
|
||||
Protocol UserChoice FAILED"). With the AceHTM class deleted the Store prompt is gone;
|
||||
finalizing Chrome as default requires one user click. Opened Settings deep-linked to
|
||||
`ms-settings:defaultapps?registeredAppUser=Google Chrome` on Tom's screen — he clicks
|
||||
"Set default".
|
||||
|
||||
Winter then requested a full adware sweep. Results: persistence clean (all non-Microsoft
|
||||
scheduled tasks and Run keys legit — Adobe, Epson, Carbonite, Datto EDR, CentraStage,
|
||||
Google/Mozilla updaters), no services from AppData/Temp, proxy clean, hosts file clean, no
|
||||
Chrome policy hijacks, Chrome search engine default (no hijack), Edge extensions all legit
|
||||
(Google Docs Offline, Adblock Plus, uBlock Origin, Edge internal). Found and removed a
|
||||
leftover **"Ace AI Assistant" Chrome extension** (`epmgebdnnndkfangenlfacdlkekinpkl`,
|
||||
removed while Chrome was not running) and an ancient junk folder
|
||||
`C:\Users\TPM\AppData\Local\Eption` (2016). PDF association verified correct
|
||||
(Acrobat.Document.DC).
|
||||
|
||||
Per Winter: posted the work narrative to Syncro ticket #32529 (customer-visible, emailed),
|
||||
billed 0.5 hr Labor - Remote Business @ $150 credited to Winter (user_id 1737), created
|
||||
invoice #68025 ($75.00, no prepaid block), set the block-rate upsell invoice note, marked
|
||||
the ticket Invoiced. Bot alerts posted to #dev-alerts (RMM dispatches/remediation) and
|
||||
#bot-alerts (billing).
|
||||
|
||||
## Key Decisions
|
||||
|
||||
- Root-caused before touching anything: the "download an app" error is the signature of a
|
||||
UserChoice ProgId whose class/exe no longer exists — a leftover of the 7/7 file-level
|
||||
Ace removal, not a new infection.
|
||||
- Backed up (reg export to C:\Temp) before deleting any registry keys.
|
||||
- Chose Chrome as the target default based on usage evidence (15 MB history, same-day use)
|
||||
and Winter's explicit instruction.
|
||||
- Did not fight UCPD: on 24H2 the supported path for default-browser change is a
|
||||
Microsoft-signed UI (Settings). Deep-linked Settings to the Chrome entry on the user's
|
||||
active session rather than disabling the UCPD driver (which would need a reboot).
|
||||
- Removed the Ace AI Assistant Chrome extension by folder deletion only after confirming
|
||||
Chrome was not running.
|
||||
- Billing gated on a dollar-figure preview; Winter confirmed 0.5h remote.
|
||||
|
||||
## Problems Encountered
|
||||
|
||||
- `ps-encoded.sh` refused the combined fix script (>6000 encoded chars) — split into two
|
||||
dispatches.
|
||||
- Heredoc JSON dispatch with `\\` escapes failed server-side JSON parse ("invalid escape")
|
||||
— switched to `jq -n --arg` payload construction, which worked.
|
||||
- Dot-sourcing C:\Temp\SFTA.ps1 in user_session hit ExecutionPolicy restriction — bypassed
|
||||
with `Invoke-Expression (Get-Content -Raw)`.
|
||||
- SFTA Set-PTA failed with "Write Reg Protocol UserChoice FAILED" — UCPD block, expected on
|
||||
24H2; fell back to the Settings deep-link + one user click.
|
||||
- Sweep-A diagnostic exited 1 despite full output (trailing Get-Process on nonexistent
|
||||
process names) — cosmetic, output complete.
|
||||
|
||||
## Configuration Changes
|
||||
|
||||
On TPM-PC (Mineralogical Record):
|
||||
- Deleted registry: `HKU\<SID>_Classes\AceHTM.Y7MX532PR2LX3GQE3ZGPQFQCF4`,
|
||||
`HKU\<SID>_Classes\AcePDF.Y7MX532PR2LX3GQE3ZGPQFQCF4`,
|
||||
`HKLM\SOFTWARE\Clients\StartMenuInternet\Chromium.Y7MX532PR2LX3GQE3ZGPQFQCF4`,
|
||||
RegisteredApplications value `Chromium.Y7MX532PR2LX3GQE3ZGPQFQCF4`,
|
||||
`.html`/`.htm` UserChoice keys (SID `S-1-5-21-2859265824-3766688748-477818468-1001`)
|
||||
- Backups: `C:\Temp\acehtm-backup.reg`, `C:\Temp\chromium-smi-backup.reg` (on TPM-PC)
|
||||
- Deleted: `C:\Users\TPM\AppData\Local\Google\Chrome\User Data\Default\Extensions\epmgebdnnndkfangenlfacdlkekinpkl`
|
||||
(Ace AI Assistant), `C:\Users\TPM\AppData\Local\Eption` (2016 junk)
|
||||
- Staged (left in place): `C:\Temp\SFTA.ps1`, `C:\Temp\sfta.b64` on TPM-PC
|
||||
- Repo: no file changes beyond this session log (scratch scripts cleaned up)
|
||||
|
||||
## Credentials & Secrets
|
||||
|
||||
- None created or discovered. Vault reads: GuruRMM API admin creds
|
||||
(`infrastructure/gururmm-server.sops.yaml`) via rmm-auth.sh.
|
||||
|
||||
## Infrastructure & Servers
|
||||
|
||||
- TPM-PC: GuruRMM agent `03322f46-42b8-432d-a103-bdcae244ab55`, Mineralogical Record /
|
||||
Main, Windows 11 Pro 24H2 build 26100, user `tpm`, SID
|
||||
`S-1-5-21-2859265824-3766688748-477818468-1001`
|
||||
- Browsers on TPM-PC: Chrome (primary), Edge (in use), Firefox (rarely used)
|
||||
- GuruRMM API: http://172.16.3.30:3001
|
||||
|
||||
## Commands & Outputs
|
||||
|
||||
- Diagnostics/remediation via `ps-encoded.sh rmm` dispatches: 61fc7d8a (assoc recon),
|
||||
33381deb (Ace ProgId deep-dive), 150d8587 (browser usage), d9dcccb8 (registry cleanup),
|
||||
76affcce (UserChoice clear — http/https blocked by UCPD, .html/.htm removed),
|
||||
55b083b8 (sweep A), efc6a711 (sweep B), 17618dab (sweep C + extension removal),
|
||||
780c5801 (SFTA attempt — UCPD blocked), 45c71567 + final deep-link (Settings opened)
|
||||
- SFTA staging: chunked base64 upload (9 sequential Add-Content dispatches, 5000-char
|
||||
chunks) then `[IO.File]::WriteAllBytes` decode — pattern works for >7KB payloads
|
||||
- Key error: `Write Reg Protocol UserChoice FAILED` = UCPD on 24H2; scripted default-browser
|
||||
changes are dead on 24H2, plan for user-click or reboot+driver-disable
|
||||
|
||||
## Pending / Incomplete Tasks
|
||||
|
||||
- Tom must click "Set default" on Google Chrome in the Settings window opened on his screen
|
||||
(or pick Chrome + "Always" at the next link-click picker). Not yet verified done.
|
||||
- Optional: delete C:\Temp\SFTA.ps1 / sfta.b64 / *.reg backups from TPM-PC after
|
||||
confirmation (harmless to leave).
|
||||
- Winter declined/didn't answer the Defender full-scan offer — machine swept clean manually,
|
||||
no indicators remaining.
|
||||
|
||||
## Reference Information
|
||||
|
||||
- Syncro ticket #32529 (id 113703284): https://computerguru.syncromsp.com/tickets/113703284
|
||||
— comment 423181784, line item 43220054 (0.5h @ $150, user_id 1737), invoice #68025
|
||||
(id 1651008874, $75.00), status Invoiced
|
||||
- Customer: Mineralogical Record (207770), no prepay block
|
||||
- Prior session: clients/mineralogical-record/session-logs/2026-07/2026-07-07-discord-bot-tpm-pc-ace-pup-removal.md
|
||||
(ticket #32511, invoice #67997 — original Ace file-level removal)
|
||||
- Discord thread: 1525175952261382354 (#tech-department)
|
||||
- SFTA tool: https://github.com/DanysysTeam/PS-SFTA
|
||||
1
session-logs/bot/2026-07/2026-07-09-bot-activity.md
Normal file
1
session-logs/bot/2026-07/2026-07-09-bot-activity.md
Normal file
@@ -0,0 +1 @@
|
||||
21:26 AZ - Winter - Glaztech M365 license availability check (Graph subscribedSkus, read-only) - reported avail counts in thread 1524889292722409654
|
||||
Reference in New Issue
Block a user