This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(310.4, 40%, 40%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EDW%3C/text%3E%3C/svg%3E)
857f36f8-f331-4c7a-84a3-b948b6dd9ebd.jpgHello pop up continues to persist on user's machine. Unable to find any solution to stop this . Please assist
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 8%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
It may be the work of some sort of malware. You may be able to locate it using this tool.
https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
--please don't forget to upvote and Accept as answer if the reply is helpful--
Just checking if there's any progress or updates?
--please don't forget to upvote and Accept as answer if the reply is helpful--
Thanks for your response Dave. The machine in question here is not mine but another employee under the company I work for. As it stands now she is not available. I do look forward to trying this once she does become available. Thanks again
Sounds good, in the mean time you could close up the thread here by marking answer.
Just checking if there's any progress or updates?
--please don't forget to upvote and Accept as answer if the reply is helpful--
Hey Dave after checking out users machine I was able to run Autoruns. I did remove a couple that it was unable to find however after checking the file validity nothing is coming back as malware via VT. Please advise on anything else you would like to try.
Looks like the user may have subscribed to something called bluesombrero. May need to ask the user or contact the service provider for assistance.
--please don't forget to upvote and Accept as answer if the reply is helpful--
User unaware of this service.
Ok, sounds good then it's most likely some sort of malware. A work-around may be to delete the user's local profile, then when they next logon a new profile will be created from \default user.
--please don't forget to upvote and Accept as answer if the reply is helpful--
Just checking if there's any progress or updates?
--please don't forget to upvote and Accept as answer if the reply is helpful--
Yes issue was solved with registry update.
Glad to hear, please don't forget to close up the thread here by marking answer.
Please don't forget to close up the thread here by marking answer.
Registry update on microsoft policy