azcomputerguru/claudetools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

sync: auto-sync from GURU-BEAST-ROG at 2026-07-10 13:15:01

Browse Source 
Author: Mike Swanson
Machine: GURU-BEAST-ROG
Timestamp: 2026-07-10 13:15:01
This commit is contained in:
Winter Williams
2026-07-10 13:15:49 -07:00
parent 1041db8587
commit 8350a4aeaf
2 changed files with 43 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

41
clients/mineralogical-record/session-logs/2026-07/2026-07-10-discord-bot-tpm-pc-ace-association-fix.md
View File

@@ -163,3 +163,44 @@ generated and provided her own Syncro API token. Actions taken:
Effect: all future Syncro comments/tickets/invoices created through the bot in Winter's
threads are attributed to Winter in Syncro, not Mike.
## Update: 13:20 AZ — Howard: GuruScan deep scan on TPM-PC + reboot + ticket note
Howard (in the same thread) requested a GuruScan on TPM-PC. Also: Winter verified Tom
clicked "Set default" — Chrome default confirmed, closing that pending item.
**Scan execution:**
- Prepped via `guruscan-agent-test.sh TPM-PC prep` (module + RKill/Emsisoft/HitmanPro
staged; Defender exclusions failed 0x800106ba — Defender dormant, Datto primary —
harmless). Removed the EICAR test seed before scanning (client production machine).
- **BUG FOUND:** first full-chain detached run died ~1 min in. RKill completed fine as
an orphan (43s, nothing malicious), but the hidden SYSTEM PowerShell wrapper was
hard-killed mid-RKill (no marker, no catch output, task -> Ready). No Datto quarantine
or EDR kill events; binaries intact. Conclusion: RKill's process sweep killed its own
hidden parent powershell. Logged to errorlog (guruscan). Chain design issue: full
chain + RKill + detached wrapper combo was never exercised on the Howard-VM tests.
- Relaunched with `-SkipScanners RKill` (rewrote _detached_scan.ps1 wrapper, re-registered
GuruScan-scan task); reused the still-running poller.
**Results (scan TPM-PC-20260710-123020, 33 min, clean mode, 4 threats remediated):**
- Emsisoft (28.5 min, 1,173,097 objects): 2x Trojan.JS.Agent.SIT REMOVED —
`C:\Users\TPM\AppData\LocalLow\EmieBrowserModeList\Znkhguh\Wehrqovsczuc\Fsxqxnxpuqgw.js`
and `...\Znkhguh\Vnmngrhgutba\usummkvt.js` (random-named JS; survived prior manual sweeps)
- HitmanPro (3.6 min, 3.2M objects): quarantined `C:\Users\TPM\Downloads\PDFEditor_56571.exe`
(Mal/Generic-S, fake PDF editor bundleware, Jan 2026 — likely same family that bundled Ace)
and `C:\Users\TPM\AppData\Local\Temp\AgentInstall.exe` (Datto RMM installer in
non-standard location, PUA flag — benign leftover; installed Datto services verified Running)
- Logs pulled to `projects/msp-tools/guru-scan/test-results/TPM-PC-20260710T200344/`
**Cleanup (all verified removed):** GuruScan-scan task, C:\GuruScan, C:\EmsisoftCmd,
C:\ScanLogs, C:\GuruScanTest, HitmanPro ProgramData leftovers, Defender exclusions, plus
Tuesday's C:\Temp\SFTA.ps1 / sfta.b64 / acehtm-backup.reg / chromium-smi-backup.reg.
**Reboot:** machine had not rebooted since scan (LastBoot 07:39). Tom active at console,
so issued `shutdown /r /t 300` with on-screen 5-min warning. Reboot verified: LastBoot
13:13:40, agent reconnected.
**Syncro:** posted customer-visible comment 423219795 ("Follow-up deep scan results",
do_not_email) to ticket #32529 — attributed to **Winter Williams** via the new per-user
key + requester preference (first production use, worked). No additional billing per
Howard. Alerts posted to #dev-alerts + #bot-alerts.

2
errorlog.md
View File

@@ -19,6 +19,8 @@ Categories (the `[type]` tag): _(none)_ = skill/command execution failure ·
<!-- Append entries below this line -->
2026-07-10 | GURU-BEAST-ROG | guruscan | detached full-chain wrapper died mid-RKill on TPM-PC (marker never written, task->Ready, rkill.log completed fine as orphan) — RKill's process sweep almost certainly killed its own hidden SYSTEM powershell parent; relaunched with -SkipScanners RKill [ctx: host=TPM-PC client=mineralogical-record chain-design-issue]
2026-07-10 | GURU-5070 | packetdial | HTTP 404 GET https://pbx.packetdial.com/ns-api/v2/domains/vwp.91912.service/users/100: {"code":404,"message":"Resource not found."} [ctx: cmd=user] (x2)
2026-07-10 | Mikes-MacBook-Air | packetdial | HTTP 404 DELETE https://pbx.packetdial.com/ns-api/v2/domains/vwp.91912.service/users/105/devices/sip%3A105a%40vwp.91912.service: {"code":404,"message":"Device not found."} [ctx: cmd=raw]