• Hi there and welcome to PC Help Forum (PCHF), a more effective way to get the Tech Support you need!
    We have Experts in all areas of Tech, including Malware Removal, Crash Fixing and BSOD's , Microsoft Windows, Computer DIY and PC Hardware, Networking, Gaming, Tablets and iPads, General and Specific Software Support and so much more.

    Why not Click Here To Sign Up and start enjoying great FREE Tech Support.

    This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Solved On boot up I get there is no file extension in "c:\users\**** "

Status
Not open for further replies.
M

Moogera

PCHF Member
Dec 10, 2023
18
2
61
#1
Hi,on boot up of my Windows 10 pc when I log in not only do I hear the windows log in sound but also another sound and on the desktop is a small rectangular box with the heading -Windows Script Host and in the box is - a red circle with a cross and There is no file extension in " C:\users\xxxx " ( my name)

It doesn't cause any problems,clicking on the X to shut the box down I don't see the error again until I boot up

The PC is up to date with Windows updates

I have run a full Antivirus scan and a full Malware Scan,nothing found

I ran the DISM exe,clean up and restore,it found some bad files and fixed them

I then ran SFC scannow and it found nothing wrong

I am out of ideas,would appreciate some help

Thanks
 
#4
Something is starting up with the machine that should not be, let's have a look.

Download Autoruns and Autorunsc Unzip it to your desktop and then right click
Capture.PNG
Run as Admin.
After the scan is finished then click on File----Then click----Save
The default name will be autoruns.arn make sure to leave it this way.
Attach the file in your next reply.
If the file is too large, then use catbox.moe or Ufile.io and send the link in your next reply.
 
#6
Hi

I have created a guest account and the error does not come up, what's strange is sometimes the error sound will be heard before I actually log in to my usual profile.

This is a screenshot of the error:
1702315834586.png


Cheers
 
#8
Nothing jumps out at me, but it may be loading from a place not identified with autoruns. But I have something that it can not hide from.



Download KillEmAll to your desktop and unzip it there.
Reboot the machine and allow the pop-up to initialize.
DO not kill the pop up. We need to see what is listed with this tool.
Right click KillEmAll run as admin.
Click enter button.
Then click L
Then hit enter key on your keyboard.
A log file will appear.
Copy and paste that into your reply here.
 
#12
Moogera said:
Hi, Log attached,interestingly,the popup disappeared when i ran killEmAll
Click to expand...

Should it come back here are some other places to look and things that may help narrow it down.

Under an Admin Command Prompt use the following command that will show us the programs that are loading during Start Up.
Will create a StartupApps.txt on the desktop you can attach or copy and paste the information in a post.

Using the Mouse, you can copy and paste the command.

wmic startup get caption,command >"%userprofile%\desktop\StartupApps.txt
Click to expand...

You can also look at the Startup tap in Task Manager to see what is loading and right click on it if listed and select Disable.

Right Click on empty space of the Task Bar and select the Task Manager
Select the Start Up Tab


Look under the Service Tab for MSConfig

Press the Windows Key + R
type msconfig
press enter.
Select the Service Tab
Lowe left put a tic in the Hide Microsoft services.
look and see if it may be listed there.


Try a Clean Boot on the affected user see if that eliminates it.

How to perform a clean boot in Windows - Microsoft Support

Describes how to use the clean boot process to troubleshoot a problem in Windows 8.1, Windows 8, Windows 7, or Windows Vista.
support.microsoft.com support.microsoft.com
 
Last edited:
#13
Download Process EXplorer Unzip to your desktop. Reboot the machine. then do not kill the pop up, Right click PorcEx64 run as admin. and you can find out what is starting the popup by checking the c:\windows\system32\wscript.exe process. It is caused by an orphaned .VBS script that is loading without a file backing it. We can eliminate it with different tools if you are unable to with process explorer.

Right click the c:\windows\system32\wscript.exe process. And select properties, there you will find what initiated the Wscript process. If you need further help just ask.

You can search .vbs with the everything search engine, once you find the culprit.

Everything - voidtools

www.voidtools.com www.voidtools.com
 
#14
@Moogera

Within Process explorer to find what item initiated the c:\windows\system32\wscript.exe process.
Restart the machine, let the popup happen, do not close it.
Right click on c:\windows\system32\wscript.exe process.
Select properties.
Then go to image tab.
Then under the command line, you will find the culprit.
If you could screen shot that for me.
Or you can remove on your own if you feel confident.,
 
#20
Hi on running process explorer these are the results,i think im looking at the correct file,when opened and selecting the image tab as you can see it says "access denied"
 

Attachments

  • process explorer 1.JPG
    process explorer 1.JPG
    211.9 KB · Views: 0
  • process explorer 2.JPG
    process explorer 2.JPG
    51.8 KB · Views: 0
Status
Not open for further replies.
Top Bottom
Back
Forums
Resources
Menu