I have one Windows 7 machine where the process UI0Detect.exe pops up with the following suspicious message:
A program running on this computer is trying to display a message.
Show program details, gives the following (translated from Norwegian):
Message tittle: Java Setup - Welcome Program path: C:iWindows\TEMP\jdsXXXXX.tmp\jre-8u101-windows-i586.exe
XXXX = numbers, varies after removal and when showing up again after restart.
When installing the latest Java, and restarting the machine, Java is gone in the Control Panel list of installations.
There is also a desktop background picture, which I cannot completely remove. Downloaded by the user from somewhere he cannot remember.
Both the folder and this picture reappears after permanently deleting them (SHIFT + DELETE) when running computer in Safe Mode.
The same picture reappears after removal, but located in different folders and with different names:
C:\Users\USER NAME\AppData\Roaming\Microsoft\Windows Photo Viewer\Bakgrunn for Windows Fotovisning.jpg
C:\Users\ USER NAME\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
I have scanned with Microsoft Removal Tool (MRT), Windows Defender (only scanned the Windows folder) and the Anti Virus software, but there is nothing there.