Windows Anytime Upgrade keeps popping up and it doesn't look right

[jmunjr]

Hi, I am new. Happy to be here.

My buddy has a Windows 7 Home Premium system that started popping up the Windows Anytime Upgrade window, but it's odd in that it is missing text in the window but still shows the arrows and button, just no text in the button. The arrows and button are active and work as they should. Interestingly, if I run the Windows Anytime Upgrade manually everything looks fine.

I thought maybe I was being shown a bogus window from malware but when I disable Windows Anytime Upgrade I still get the popup, but the window changes to the one saying Windows Anytime Upgrade is disabled, but it is missing the text as well. So the window keeps popping whether it's enabled or not. If I close it it will pop up again. If I leave it then there are no more popups.

Before this he did have a virus of some sort that I cleaned. I also had a Sophos standalone antivirus tool I had to manually uninstall which require some registry deletions that were only Sophos related, and this specifically I think may be the issue, but not sure why. I've done those kinds of edits for 20+ years with no issues.

So I just want to stop these popups. Not sure about the text missing.

Attached are a couple screen shots. Any help is appreciated.

 

[SIW2]

system32\en-US\windowsanytimeupgradeui.exe.mui

has that sort of info. But you say it is fine when run manually.

 

[TechnoMage2016]

Note!
If it comes up on your screen, it had to be put there by some "Program". Eh?

Find that program and KILL it!

Sorry, if that's an over-simplification, but that's how I'd do it.

Good Luck,
TM
PS: Is it trying to up-grade you to a later version of Win-7 or to Win-10?
Have you ever run a program like "Never Ten"?

 

[jmunjr]

Thanks guys. I searched the registry for that file and found an entry to a file named that in the Macromedia Flash folder inside appdata. It's been scanned by a half dozen tools so it probably isn't a virus itself, though perhaps it would open a virus elsewhere when any of the buttons were clicked.

C:\Users\xxxxx\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\APV567VZ\admin.brightcove.com\[[IMPORT]]\static.chartbeat.com\swf\YxGLwSaw2j\WindowsAnytimeUpgradeui.exe

What's odd is this wasn't opening before, so not sure why it started. Maybe it only opens if the virus isn't active?

I had removed Flash last week anyway and told my buddy not to run it. Funny how that was the culprit.

Thanks again.