On boot up I get there is no file extension in "c:\users\**** "

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • Moogera
    PCHF Member
    • Dec 2023
    • 18

    #1

    On boot up I get there is no file extension in "c:\users\**** "

    Hi,on boot up of my Windows 10 pc when I log in not only do I hear the windows log in sound but also another sound and on the desktop is a small rectangular box with the heading -Windows Script Host and in the box is - a red circle with a cross and There is no file extension in " C:\users\xxxx " ( my name)

    It doesn’t cause any problems,clicking on the X to shut the box down I don’t see the error again until I boot up

    The PC is up to date with Windows updates

    I have run a full Antivirus scan and a full Malware Scan,nothing found

    I ran the DISM exe,clean up and restore,it found some bad files and fixed them

    I then ran SFC scannow and it found nothing wrong

    I am out of ideas,would appreciate some help

    Thanks
  • Rustys
    PCHF Member
    • Jul 2016
    • 7862

    #2
    Please post a screen shot of the error message.

    EDIT:
    If you happen to have a second user account if you log into that account does the same thing happen?

    You may need to create a second user account for testing.

    Comment

    • Moogera
      PCHF Member
      • Dec 2023
      • 18

      #3
      Hi
      Thanks I don’t have a second user account but I will create one and report back
      Thanks

      Comment

      • Malnutrition
        PCHF Moderator
        • Jul 2016
        • 7041

        #4
        Something is starting up with the machine that should not be, let’s have a look.





        Download Autoruns and Autorunsc Unzip it to your desktop and then right click [IMG alt=“Capture.PNG”]https://pchelpforum.net/attachments/capture-png.9995/ Run as Admin.
        After the scan is finished then click on File----Then click----Save
        The default name will be autoruns.arn make sure to leave it this way.
        Attach the file in your next reply.
        If the file is too large, then use catbox.moe or Ufile.io and send the link in your next reply.[/IMG]

        Comment

        • Moogera
          PCHF Member
          • Dec 2023
          • 18

          #5
          Hi
          I have uploaded the ARN file here.

          I can’t see anything blatantly obvious that is failing on start up.

          Any help is appreciated.

          Comment

          • Moogera
            PCHF Member
            • Dec 2023
            • 18

            #6
            Hi

            I have created a guest account and the error does not come up, what’s strange is sometimes the error sound will be heard before I actually log in to my usual profile.

            This is a screenshot of the error:
            [ATTACH type=“full”]13097[/ATTACH]

            Cheers

            Comment

            • Bruce
              PCHF Moderator
              • Oct 2017
              • 10697

              #7
              in Autoruns, on the Explorer tab, untick all the OneDrive overlay identifiers and see if that helps.

              Comment

              • Malnutrition
                PCHF Moderator
                • Jul 2016
                • 7041

                #8
                Nothing jumps out at me, but it may be loading from a place not identified with autoruns. But I have something that it can not hide from.

                Download KillEmAll to your desktop and unzip it there.
                Reboot the machine and allow the pop-up to initialize.
                DO not kill the pop up. We need to see what is listed with this tool.
                Right click KillEmAll run as admin.
                Click enter button.
                Then click L
                Then hit enter key on your keyboard.
                A log file will appear.
                Copy and paste that into your reply here.

                Comment

                • Moogera
                  PCHF Member
                  • Dec 2023
                  • 18

                  #9
                  Originally posted by Bruce
                  in Autoruns, on the Explorer tab, untick all the OneDrive overlay identifiers and see if that helps.
                  Done it ,but still get the same message
                  Thanks

                  Comment

                  • Moogera
                    PCHF Member
                    • Dec 2023
                    • 18

                    #10
                    Hi, Log attached,interestingly,the popup disappeared when i ran killEmAll

                    Comment

                    • Malnutrition
                      PCHF Moderator
                      • Jul 2016
                      • 7041

                      #11
                      Yes. It was intended. I’ll look over the log once I return home, on my phone currently at work.

                      Comment

                      • Rustys
                        PCHF Member
                        • Jul 2016
                        • 7862

                        #12
                        Originally posted by Moogera
                        Hi, Log attached,interestingly,the popup disappeared when i ran killEmAll
                        Should it come back here are some other places to look and things that may help narrow it down.

                        Under an Admin Command Prompt use the following command that will show us the programs that are loading during Start Up.
                        Will create a StartupApps.txt on the desktop you can attach or copy and paste the information in a post.

                        Using the Mouse, you can copy and paste the command.
                        wmic startup get caption,command >"%userprofile%\desktop\StartupApps.txt

                        You can also look at the Startup tap in Task Manager to see what is loading and right click on it if listed and select Disable.

                        Right Click on empty space of the Task Bar and select the Task Manager
                        Select the Start Up Tab

                        Look under the Service Tab for MSConfig

                        Press the Windows Key + R
                        type msconfig
                        press enter.
                        Select the Service Tab
                        Lowe left put a tic in the Hide Microsoft services.
                        look and see if it may be listed there.

                        Try a Clean Boot on the affected user see if that eliminates it.

                        Comment

                        • Malnutrition
                          PCHF Moderator
                          • Jul 2016
                          • 7041

                          #13
                          Download Process EXplorer Unzip to your desktop. Reboot the machine. then do not kill the pop up, Right[COLOR=rgb(41, 105, 176)] click PorcEx64 run as admin. and you can find out what is starting the popup by checking the [COLOR=rgb(184, 49, 47)]c:\windows\system32\wscript.exe process. It is caused by an orphaned .VBS script that is loading without a file backing it. We can eliminate it with different tools if you are unable to with process explorer.

                          Right click the [COLOR=rgb(184, 49, 47)]c:\windows\system32\wscript.exe process. And select properties, there you will find what initiated the Wscript process. If you need further help just ask.

                          You can search .vbs with the everything search engine, once you find the culprit.

                          https://www.voidtools.com/support/everything/[/COLOR][/COLOR][/COLOR]

                          Comment

                          • Malnutrition
                            PCHF Moderator
                            • Jul 2016
                            • 7041

                            #14
                            @Moogera

                            Within Process explorer to find what item initiated the [COLOR=rgb(184, 49, 47)] [COLOR=rgb(184, 49, 47)]c:\windows\system32\wscript.exe process.
                            Restart the machine, let the popup happen, do not close it.
                            Right click on [COLOR=rgb(184, 49, 47)]c:\windows\system32\wscript.exe process.
                            Select properties.
                            Then go to image tab.
                            Then under the command line, you will find the culprit.
                            If you could screen shot that for me.
                            Or you can remove on your own if you feel confident.,[/COLOR][/COLOR][/COLOR]

                            Comment

                            • Moogera
                              PCHF Member
                              • Dec 2023
                              • 18

                              #15
                              Hi thanks,I can’t get onto this until Saturday but I will come back to you,thanks

                              Comment

                              Working...