[Resolved] can't find file

[jaymes101]

My daughter left for college after winter break (finally) and left our computer with a message that popsup during start up: Can't find script file... I just close it and move on but I'd like to eliminate the message. I think that I read about this a year or so ago but I can't find it or come up eith the right search to find a remedy. Thanks in advance for any help!

 

[Endemix]

To correct this error

1. Check the path given and correct it.

2. Make sure that the file is actually there

 

[Rollin' Rog]

Let us see a copy of your startup configuration using the StartupList application from the site below. Just download, unzip and run it, then copy/paste the results to a reply.

http://www.lurkhere.com/~nicefiles/

Script files trying to run on startup, even when they are not there, may indicate some installed "nasties".

 

[jaymes101]

Thanks Rollin' Rog. I went to the site tried to unzip the program but I was told that "StartupList" was not a file that Quick Time recognized.

 

[Rollin' Rog]

Were you able to download the zipped program to a folder on the hard drive and only got that message when trying to unzip it?

Do you have an installed zip program such as Winzip?

Here is another program that can be used to display startups, it's not as thorough as the first one, but the link here is for a direct download and it is not zipped. Once you have saved it, just double click it to run. Then copy/paste the Startup.Log (but not stubpaths.txt) to a reply

http://home.earthlink.net/~rmbox/Reticulated/4IE_Only/StartLog.com

 

[jaymes101]

I don't have Winzip I have Netzip. But I did a regedit, found the line in local machine or current user (can't remember). Here is my Startup log from the other site that you posted:


StartUp Log Index

1. HKLM Run
2. HKCU Run
3. HKLM RunOnce
4. HKCU RunOnce
5. HKLM RunServices
6. HKLM RunServicesOnce
7. WIN.INI file
8. SYSTEM.INI file
9. AUTOEXEC.BAT file
10. StartUp folder
11. All Users StartUp
12. Misc. StartUp Configurations

 

[Rollin' Rog]

You only posted the first part of it. With the file open, click Edit>Select All>Edit>Copy and then right click on the reply box here and paste it.

 

[jaymes101]

I also failed to mention that I deleted the line in regedit: local/current user. Here's the rest of it"

TEMP=C:\windows\TEMP
winbootdir=C:\WINDOWS
COMSPEC=C:\WINDOWS\COMMAND.COM
PATH=C:\WINDOWS;c:\windows;c:\windows\COMMAND;C:\CPQS\SAVEREST;C:\CPQS\TOOLS
LOG=NUL
ZIPD=D:
DSHD=C:
D12=D:
HP1=OK
HP2=OK
EN=EN
LANG=EN
DUAL=ENEN
windir=C:\WINDOWS

File - c:\windows\Wininit.bak

 

[Rollin' Rog]

Nope you are still not getting the whole file. This time you just got the end of it.

Remember the entire open text of the Startup.log must be highlighted before you "copy" it. Then you should see it all pasted to the reply window here when you select 'paste' compare the two before sending to make sure it was copy/pasted correctly.

 

[jaymes101]

Sorry - I think I got it this time:

StartUp Log Index

1. HKLM Run
2. HKCU Run
3. HKLM RunOnce
4. HKCU RunOnce
5. HKLM RunServices
6. HKLM RunServicesOnce
7. WIN.INI file
8. SYSTEM.INI file
9. AUTOEXEC.BAT file
10. StartUp folder
11. All Users StartUp
12. Misc. StartUp Configurations

__________________________________________________________________________
__________________________________________________________________________

The following is a list of your current Start-Ups
__________________________________________________________________________
__________________________________________________________________________

1. HKLM Run - Registry

[RegPath]
"StartUp"


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ScanRegistry"="c:\\windows\\scanregw.exe /autorun"
"SystemTray"="SysTray.Exe"
"LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme"
"SXGDSENU"="SXGDSENU.exe"
"SystemBoot"="C:\\WINDOWS\\wer.exe"
"TkBellExe"="C:\\Program Files\\Common Files\\Real\\Update_OB\\evntsvc.exe -osboot"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"


==========================================================================
__________________________________________________________________________

2. HKCU Run - Registry

[RegPath]
"StartUp"


[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]


==========================================================================
__________________________________________________________________________

3. HKLM RunOnce - Registry

[RegPath]
"StartUp"


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]


==========================================================================
__________________________________________________________________________

4. HKCU RunOnce - Registry

[RegPath]
"StartUp"


[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]


==========================================================================
__________________________________________________________________________

5. HKLM RunServices - Registry

[RegPath]
"StartUp"


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme"


==========================================================================
__________________________________________________________________________

6. HKLM RunServicesOnce - Registry

[RegPath]
"StartUp"


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]


==========================================================================
__________________________________________________________________________

7. WIN.INI File - (c:\windows\win.ini)

Your win.ini run/load lines should look like run= and load= exclusively.
There should be nothing to the right of the equal signs.


These are the run and load lines in your WIN.INI file

run=

load=

==========================================================================
__________________________________________________________________________

8. SYSTEM.INI File - (c:\windows\system.ini)

Your system.ini shell line should look like shell=Explorer.exe exclusively.
You should only see Explorer.exe following the equal sign.


This is the shell line in your SYSTEM.INI file

shell=Explorer.exe

==========================================================================
__________________________________________________________________________

9. AUTOEXEC.BAT File - (c:\autoexec.bat)

(Some trojans have been known to start from this file)


These are your program startups and set paths in your autoexec.bat file

@ECHO OFF
SET PATH=C:\CPQS\SAVEREST;C:\CPQS\TOOLS
IF EXIST \HIBERNAT\NEW_HIB.BAT CALL \HIBERNAT\NEW_HIB.BAT AUTO

C:\PROGRA~1\MCAFEE\VIRUSS~1\SCANPM.EXE C:\ /NOEXPIRE
IF ERRORLEVEL 1 PAUSE


IF EXIST \CPQS\SAVEREST\QRSETUP.BAT CALL \CPQS\SAVEREST\QRSETUP.BAT /MFG C:
IF EXIST \CPQS\BACKWEB\BWSETUP CALL \CPQS\BACKWEB\BWSETUP

IF EXIST \PIPOST.BAT CALL \PIPOST.BAT
IF EXIST \PIPOST.BAT DEL \PIPOST.BAT

C:\essolo.com

==========================================================================
__________________________________________________________________________

10. StartUp Folder - (c:\windows\start menu\programs\startup)

Shortcuts to any program will automatically start when placed here.


These are the shortcuts located in your StartUp folder

C:\WINDOWS\Start Menu\Programs\StartUp\HP OfficeJet Series 600 StartUp.lnk
C:\WINDOWS\Start Menu\Programs\StartUp\Webshots.lnk

==========================================================================
__________________________________________________________________________

11. All Users Folder - (c:\windows\all users\start menu\programs\startup)

Shortcuts to any program will automatically start when placed here.


These are the shortcuts located in your All Users StartUp folder


*(No start-ups found)*

==========================================================================
__________________________________________________________________________

12. Miscellaneous StartUp Configurations

-============================-
Registry StartUp Directories
-============================-

Should show the Start Menu StartUp and All Users StartUp directories

.....................................................................

[1] HKCU - Shell Folders

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

"Startup"="C:\\WINDOWS\\Start Menu\\Programs\\StartUp"

.....................................................................

[2] HKCU - User Shell Folders

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders


.....................................................................

[3] HKLM - Shell Folders

HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\Shell Folders

"Common Startup"="C:\\WINDOWS\\All Users\\Start Menu\\Programs\\StartUp"

.....................................................................

[4] HKLM - User Shell Folders

HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\User Shell Folders


.....................................................................

-=======================-
Registry Shell Spawning
-=======================-

Open Commands for Executable File Types

@="\"%1\" %*"
(.exe file - RegPath = HKCR\exefile\shell\open\command)

@="\"%1\" %*"
(.com file - RegPath = HKCR\comfile\shell\open\command)

@="\"%1\" /S"
(.scr file - RegPath = HKCR\scrfile\shell\open\command)

@="\"%1\" %*"
(.bat file - RegPath = HKCR\batfile\shell\open\command)

@="\"%1\" %*"
(.pif file - RegPath = HKCR\piffile\shell\open\command)

@="C:\\WINDOWS\\SYSTEM\\MSHTA.EXE \"%1\" %*"
(.hta file - RegPath = HKCR\htafile\shell\open\command)

-=========================-
HKLM RunOnceEx - Registry
-=========================-


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx]


-=========================-
HKU (.Default) Run - Registry
-=========================-


[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Run]


-==============================-
HKU (.Default) RunOnce - Registry
-==============================-


[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\RunOnce]


-================================-
StubPaths - Registry (Partial Listing)
-================================-

(Please see the StubPath.txt on your desktop for complete listing)

HKLM\Software\Microsoft\Active Setup\Installed Components


"OldStubPath"="c:\\windows\\SYSTEM\\ie4uinit.exe"
"RealStubPath"="C:\\WINDOWS\\SYSTEM\\IE4UINIT.EXE"
"StubPath"="c:\\windows\\COMMAND\\sulfnbk.exe /L"
"RealStubPath"="\"C:\\PROGRA~1\\OUTLOO~1\\setup50.exe\" /APP:OE /CALLER:IE50 /user /install"
"StubPath"=""
"StubPath"="\"C:\\PROGRA~1\\OUTLOO~1\\setup50.exe\" /APP:WAB /CALLER:IE50 /user /install"
"StubPath"=""
"RealStubPath"="\"C:\\PROGRA~1\\OUTLOO~1\\setup50.exe\" /APP:OE /CALLER:IE50 /user /uninstall"

-=================-
DOSSTART.BAT File - (c:\windows\dosstart.bat)
-=================-

@echo off

LH C:\WINDOWS\COMMAND\MSCDEX.EXE /D:IDECD001 /M:12
c:\mouse\mouse.exe
C:\essolo.com


-=================-
WININIT.BAK File - (c:\windows\wininit.bak)
(name) (type) (size)(modified)(time)
wininit bak 50 01-06-03 9:03p
-=================-



[Rename]
NUL=C:\PROGRA~1\OUTLOO~1\MSOERES.DLL-=====================-
Screen Saver Settings (Possible system.ini start-up)
-=====================-

scrnsave.exe=C:\PROGRA~1\MCAFEE\VIRUSS~1\SCRSCAN.EXE

==========================================================================
__________________________________________________________________________

- Supplemental Environment Information -

TMP=c:\windows\TEMP
TEMP=C:\windows\TEMP
winbootdir=C:\WINDOWS
COMSPEC=C:\WINDOWS\COMMAND.COM
PATH=C:\WINDOWS;c:\windows;c:\windows\COMMAND;C:\CPQS\SAVEREST;C:\CPQS\TOOLS
LOG=NUL
ZIPD=D:
DSHD=C:
D12=D:
HP1=OK
HP2=OK
EN=EN
LANG=EN
DUAL=ENEN
windir=C:\WINDOWS

File - c:\windows\Wininit.bak

==========================================================================
__________________________________________________________________________

- End -

 

[Rollin' Rog]

Well, other than this enigna:

"SystemBoot"="C:\\WINDOWS\\wer.exe"

There is nothing unusual there. Any idea what it is? I can't find anything which explains it. You could do a Find Files for wer.exe and then right click and select Properties > Version to see if there is any copyright info.

I'd run msconfig and uncheck it under the startup tab at the very least. Then if it doesn't seem to relate to anything, run regedit and navigate to

Hkey_Local_Machine
Software
Microsoft
Windows
CurrentVersion
Run- (where the Unchecked entry will be)

and right click on it and delete it from the right hand pane

 

[jaymes101]

Thanks Rollin' Rog. Ran a Find File - nothing came up. Unchecked it from Startup and then deleted it. Strange. Thanks for all the help. We'll consider this thread resolved. Until next time! Have a great new year. This site is awesome!!!!

 

[Rollin' Rog]

You're welcome for the help, and I will mark it "resolved"; the file should be there though, or you would have been getting a "can't find..." message; If it is "hidden" Find Files will miss it unless "show all files" is checked in Folder Options> View. But no matter, as long as it is gone from the registry it can't be doing anything, whatever it is.