HP_Smart | Win10 (| both) deleted Printer Icons in Devices & Printers

To All,

=>Could you all disconnect completely your Win10/11 machines from the internet so that Windows Update and the Store are not reachable anymore.

=>Then, perform a System Restore to a point in time taken BEFORE 28 November, or restore with a System Image taken before 28 Nov. and see what the printer icons are doing in the [Devices and Printers] pane. Do they keep their original icon? Remember, do NOT connect to the internet.

=>A few days ago I restored to a restore point taken before 28 Nov. and for a second or so all printer icons were the original icons, but then they changed right in front of my eyes into the HP icons. I took a while to realize that Windows downloads the malware right after any restore/repair operation. I probably will not have the time today to do any restoring or testing.

Thanks to all for the effort.

My first Win10 machine in now undergoing a restore operation, and that takes time....

That registry key you just showed is likely "The Key" to be turned off (zero) to avoid any hassle in the future. Good work Bree! I'll check that key too once my Win10 machine is back up.

About HP Smart, I've developed second thoughts about its role in the printers icons removal or reset to the HP icon.

From Win10 behavior (the self-installation) I was under the impression that there is something deeper in Win10 that contacts Windows servers for emergency intervention to retract bad Store apps that have been installed in Windows in order to protect the OS. Macs, iPhones and iPads have it too, and Google is also working on something similar; I think Google's retract might be already operational.

So I assume some emergency procedure was called in by Windows to download something about HP printer drivers update, only this time Windows downloaded an HP "haywire" driver that removed ALL printer icons, in stead of just doing the update of HP M101-106.

So an emergency procedure to protect the OS was actually reversed and used to harm the OS, all because of bug or wrong settings in the HP update instructions.

Basically any malware, even the most malicious, could be downloaded into Windows if one could just trick Windows into kickstarting the emergency procedure download.

Believe it or not but millions and millions of user worldwide are actually exposed to malware that way, if at least the malware gets first into the Store.

I'll report back later after restore has finished.

- - - Updated - - -

The restore finished a few minutes ago, the original icons appeared for a second or so and were then again replaced by the HP icon. I was not fast enough turning off the WiFi of the laptop. Damn you MicroSoft and HP!!!

- - - Updated - - -

Hi,

I think I finally solved the issue on the two Win10 laptops that I maintain; all original printer icons are back and stable, thanks to Bree who provided us with the crucial info about the \SilentInstalledAppsEnabled registry key. Both Win10 laptops are back in their original state AND online without any HP printer icons, see image:



The procedure I adhered is as follows:

1) Disconnect the computer from the internet, and make sure it stays disconnected from the internet. Turn OFF the router all together, remove the computer from the router's white list or put it on the blacklist. In any case, do NOT let the computer go back to the internet after a restore operation.

2) Perform a restore operation using a System Restore Point (or System Image) taken at a time before the HP printer icon corruption, that is, before mid Nov.2023 or even earlier.

3) Once the system is restored, do NOT let the computer go to the internet. If the computer sneaks up on you and does go to the internet, then it is likely it will stealth-download HP's malware, destroy your genuine printer icons AGAIN and put the HP's printer icon M101-106 back.

4) In your user account (standard user mode, administrator mode) open RegEdit.exe (registry editor) in Local User mode, NOT administrator mode, go to the reg key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\SilentInstalledAp psEnabled and put the value of \SilentInstalledAppsEnabled on Zero (0), then exit. Open again regedit and check if the value is really ZERO!

5) Repeat step 4) for ALL user accounts, also the accounts in administrator mode; that is: Sign in, open RegEdit.exe (registry editor) in Local User mode and proceed as in step 4).

6) I also did this in the hidden Super Administrator account, just to be sure.... Go into the ordinary admin-mode account, open elevated CMD in administrator mode, then type >net user administrator /active:yes (do not make syntax mistakes!!!). A new user called 'Administrator' will popup; sign into that.

7) Repeat step 4) in the Super Administrator account (maybe not needed, but I did it anyhow, just to be sure).

8) Then, de-activate the Super Administrator account: Sign back into your ordinary account, open elevated CMD, then type >net user administrator /active:no (do not make any syntax errors!!!) and restart computer. Administrator sign-in should be gone.

9) Reboot a few times and see if the genuine printer icons are holding on, and not being replaced by HP icons.

10) Now open up the internet connection (WiFi), perform System and Store updates and see if the HP icons keep away. If yes, you're done. If no, then repeat from step 1) onwards but with an earlier Restore Point or earlier System Image.

NOTE
1) Setting the key \SilentInstalledAppsEnabled to ZERO, may invoke a new option in Windows Update called: 'Get the latest updates as soon as they're available. Be among.... .... roll out', see image. Well, I left it OFF. Putting it 'on' may download HP's malware again.



2) Prior to taking a System Restore Point or a System Image, it is really advisable to turn OFF in Windows all internet connectivity and let Windows FORGET all WiFi passwords. That way one can avoid Windows going to the internet right after a restore operation thereby avoiding intake or stealth-download of malware. I had that with the HP Smart and other malware; got intake of it right after a restore operation because WiFi was on.

Hope this post is of some use.
Thanks

Load of vastly over complex stuff.

I have had the HP Smart App installer appear on my Windows 11 Laptop.
It is as I said, just an installer, just uninstall it.

If you do actually run it you get the usual warning prompts about making changes to your PC etc, i.e. installing, well say No, simple.

At least an ordinary consumer will have little problems with that.

As I mentioned earlier in my post #14, I have my doubts that HP Smart is the culprit that removed the original printer icons and replaced them with that one of HP M101-106. Probably, but not sure, the installation of HP Smart is a side effect of something deeper, directly related to printer drivers from HP. The main problem was the annihilation of the genuine printer icons of non-HP printers, and its replacement with HP icons. I'm still searching on the internet to find more details about the culprit (code).
ddb

- - - Updated - - -

Finally I found something. Likely that João Marcelo Cesar has found the culprit and the mechanism used that deleted my printers' icons, see link below image.



https://answers.microsoft.com/en-us/...1d7e8f5?page=2

Hi Bree, my apologies for my mistake. Thanks for correcting. It struck me that the toggle switch popped up right after I set the \SilentInstalledAppsEnabled reg key to zero on both the Win10 laptops; I felt that was suspicious and I didn't had the time to go researching the internet. Considering that so many people read this and considering the urgency and annoyance of HP's malware, I figured I'd better not take the risk and sent out the advise to keep the switch on OFF, just to be sure... I'm leaving the toggle switch on OFF anyhow for still quite a while because one never knows ....

- - - Updated - - -

See following link:
Windows Update accidentally renames all printers to HP M101-M106 on Windows 11, Windows 10

Lesson to be learnt by MicroSoft: consider metadata as any other data and scrutinize it ALL as a potential threat!