Solved On boot up I get there is no file extension in "c:\users\**** "

[Moogera]

Hi,on boot up of my Windows 10 pc when I log in not only do I hear the windows log in sound but also another sound and on the desktop is a small rectangular box with the heading -Windows Script Host and in the box is - a red circle with a cross and There is no file extension in " C:\users\xxxx " ( my name)

It doesn't cause any problems,clicking on the X to shut the box down I don't see the error again until I boot up

The PC is up to date with Windows updates

I have run a full Antivirus scan and a full Malware Scan,nothing found

I ran the DISM exe,clean up and restore,it found some bad files and fixed them

I then ran SFC scannow and it found nothing wrong

I am out of ideas,would appreciate some help

Thanks

 

[Rustys]

Please post a screen shot of the error message.

EDIT:
If you happen to have a second user account if you log into that account does the same thing happen?

You may need to create a second user account for testing.

 

[Moogera]

Hi
Thanks I don't have a second user account but I will create one and report back
Thanks

 

[Malnutrition]

Something is starting up with the machine that should not be, let's have a look.

---

---

Download Autoruns and Autorunsc Unzip it to your desktop and then right click

Run as Admin.
After the scan is finished then click on File----Then click----Save
The default name will be autoruns.arn make sure to leave it this way.
Attach the file in your next reply.
If the file is too large, then use catbox.moe or Ufile.io and send the link in your next reply.

 

[Moogera]

Hi
I have uploaded the ARN file here.

I can't see anything blatantly obvious that is failing on start up.

Any help is appreciated.

 

[Moogera]

Hi

I have created a guest account and the error does not come up, what's strange is sometimes the error sound will be heard before I actually log in to my usual profile.

This is a screenshot of the error:

Cheers

 

[Bruce]

in Autoruns, on the Explorer tab, untick all the OneDrive overlay identifiers and see if that helps.

 

[Malnutrition]

Nothing jumps out at me, but it may be loading from a place not identified with autoruns. But I have something that it can not hide from.



Download KillEmAll to your desktop and unzip it there.
Reboot the machine and allow the pop-up to initialize.
DO not kill the pop up. We need to see what is listed with this tool.
Right click KillEmAll run as admin.
Click enter button.
Then click L
Then hit enter key on your keyboard.
A log file will appear.
Copy and paste that into your reply here.

 

[Moogera]

in Autoruns, on the Explorer tab, untick all the OneDrive overlay identifiers and see if that helps.

Done it ,but still get the same message
Thanks

 

[Moogera]

Hi, Log attached,interestingly,the popup disappeared when i ran killEmAll

 

[Malnutrition]

Yes. It was intended. I’ll look over the log once I return home, on my phone currently at work.

 

[Rustys]

Hi, Log attached,interestingly,the popup disappeared when i ran killEmAll

Should it come back here are some other places to look and things that may help narrow it down.

Under an Admin Command Prompt use the following command that will show us the programs that are loading during Start Up.
Will create a StartupApps.txt on the desktop you can attach or copy and paste the information in a post.

Using the Mouse, you can copy and paste the command.

wmic startup get caption,command >"%userprofile%\desktop\StartupApps.txt

You can also look at the Startup tap in Task Manager to see what is loading and right click on it if listed and select Disable.

Right Click on empty space of the Task Bar and select the Task Manager
Select the Start Up Tab


Look under the Service Tab for MSConfig

Press the Windows Key + R
type msconfig
press enter.
Select the Service Tab
Lowe left put a tic in the Hide Microsoft services.
look and see if it may be listed there.


Try a Clean Boot on the affected user see if that eliminates it.

How to perform a clean boot in Windows - Microsoft Support

Describes how to use the clean boot process to troubleshoot a problem in Windows 8.1, Windows 8, Windows 7, or Windows Vista.

support.microsoft.com

 

[Malnutrition]

Download Process EXplorer Unzip to your desktop. Reboot the machine. then do not kill the pop up, Right click PorcEx64 run as admin. and you can find out what is starting the popup by checking the c:\windows\system32\wscript.exe process. It is caused by an orphaned .VBS script that is loading without a file backing it. We can eliminate it with different tools if you are unable to with process explorer.

Right click the c:\windows\system32\wscript.exe process. And select properties, there you will find what initiated the Wscript process. If you need further help just ask.

You can search .vbs with the everything search engine, once you find the culprit.

Everything - voidtools

www.voidtools.com

 

[Malnutrition]

@Moogera

Within Process explorer to find what item initiated the c:\windows\system32\wscript.exe process.
Restart the machine, let the popup happen, do not close it.
Right click on c:\windows\system32\wscript.exe process.
Select properties.
Then go to image tab.
Then under the command line, you will find the culprit.
If you could screen shot that for me.
Or you can remove on your own if you feel confident.,

 

[Moogera]

Hi thanks,I can't get onto this until Saturday but I will come back to you,thanks

 

[Malnutrition]

Perfect. Thread will remain open.

 

[Malnutrition]

@Moogera when you get around to it, an update please.

 

[Moogera]

Hi hopefully tomorrow

 

[Malnutrition]

 

[Moogera]

Hi on running process explorer these are the results,i think im looking at the correct file,when opened and selecting the image tab as you can see it says "access denied"