sync: auto-sync from GURU-BEAST-ROG at 2026-07-10 13:15:01

Author: Mike Swanson
Machine: GURU-BEAST-ROG
Timestamp: 2026-07-10 13:15:01

clients/mineralogical-record/session-logs/2026-07/2026-07-10-discord-bot-tpm-pc-ace-association-fix.md

@@ -163,3 +163,44 @@ generated and provided her own Syncro API token. Actions taken:
 
 Effect: all future Syncro comments/tickets/invoices created through the bot in Winter's
 threads are attributed to Winter in Syncro, not Mike.
+
+## Update: 13:20 AZ — Howard: GuruScan deep scan on TPM-PC + reboot + ticket note
+
+Howard (in the same thread) requested a GuruScan on TPM-PC. Also: Winter verified Tom
+clicked "Set default" — Chrome default confirmed, closing that pending item.
+
+**Scan execution:**
+- Prepped via `guruscan-agent-test.sh TPM-PC prep` (module + RKill/Emsisoft/HitmanPro
+  staged; Defender exclusions failed 0x800106ba — Defender dormant, Datto primary —
+  harmless). Removed the EICAR test seed before scanning (client production machine).
+- **BUG FOUND:** first full-chain detached run died ~1 min in. RKill completed fine as
+  an orphan (43s, nothing malicious), but the hidden SYSTEM PowerShell wrapper was
+  hard-killed mid-RKill (no marker, no catch output, task -> Ready). No Datto quarantine
+  or EDR kill events; binaries intact. Conclusion: RKill's process sweep killed its own
+  hidden parent powershell. Logged to errorlog (guruscan). Chain design issue: full
+  chain + RKill + detached wrapper combo was never exercised on the Howard-VM tests.
+- Relaunched with `-SkipScanners RKill` (rewrote _detached_scan.ps1 wrapper, re-registered
+  GuruScan-scan task); reused the still-running poller.
+
+**Results (scan TPM-PC-20260710-123020, 33 min, clean mode, 4 threats remediated):**
+- Emsisoft (28.5 min, 1,173,097 objects): 2x Trojan.JS.Agent.SIT REMOVED —
+  `C:\Users\TPM\AppData\LocalLow\EmieBrowserModeList\Znkhguh\Wehrqovsczuc\Fsxqxnxpuqgw.js`
+  and `...\Znkhguh\Vnmngrhgutba\usummkvt.js` (random-named JS; survived prior manual sweeps)
+- HitmanPro (3.6 min, 3.2M objects): quarantined `C:\Users\TPM\Downloads\PDFEditor_56571.exe`
+  (Mal/Generic-S, fake PDF editor bundleware, Jan 2026 — likely same family that bundled Ace)
+  and `C:\Users\TPM\AppData\Local\Temp\AgentInstall.exe` (Datto RMM installer in
+  non-standard location, PUA flag — benign leftover; installed Datto services verified Running)
+- Logs pulled to `projects/msp-tools/guru-scan/test-results/TPM-PC-20260710T200344/`
+
+**Cleanup (all verified removed):** GuruScan-scan task, C:\GuruScan, C:\EmsisoftCmd,
+C:\ScanLogs, C:\GuruScanTest, HitmanPro ProgramData leftovers, Defender exclusions, plus
+Tuesday's C:\Temp\SFTA.ps1 / sfta.b64 / acehtm-backup.reg / chromium-smi-backup.reg.
+
+**Reboot:** machine had not rebooted since scan (LastBoot 07:39). Tom active at console,
+so issued `shutdown /r /t 300` with on-screen 5-min warning. Reboot verified: LastBoot
+13:13:40, agent reconnected.
+
+**Syncro:** posted customer-visible comment 423219795 ("Follow-up deep scan results",
+do_not_email) to ticket #32529 — attributed to **Winter Williams** via the new per-user
+key + requester preference (first production use, worked). No additional billing per
+Howard. Alerts posted to #dev-alerts + #bot-alerts.

errorlog.md

@@ -19,6 +19,8 @@ Categories (the `[type]` tag): _(none)_ = skill/command execution failure ·
 
 <!-- Append entries below this line -->
 
+2026-07-10 | GURU-BEAST-ROG | guruscan | detached full-chain wrapper died mid-RKill on TPM-PC (marker never written, task->Ready, rkill.log completed fine as orphan) — RKill's process sweep almost certainly killed its own hidden SYSTEM powershell parent; relaunched with -SkipScanners RKill [ctx: host=TPM-PC client=mineralogical-record chain-design-issue]
+
 2026-07-10 | GURU-5070 | packetdial | HTTP 404 GET https://pbx.packetdial.com/ns-api/v2/domains/vwp.91912.service/users/100: {"code":404,"message":"Resource not found."} [ctx: cmd=user] (x2)
 
 2026-07-10 | Mikes-MacBook-Air | packetdial | HTTP 404 DELETE https://pbx.packetdial.com/ns-api/v2/domains/vwp.91912.service/users/105/devices/sip%3A105a%40vwp.91912.service: {"code":404,"message":"Device not found."} [ctx: cmd=raw]