Windows cannot find: C:\Users\Default\AppData\Local\AutoUpDate\AutoUpd


  1. Posts : 3
    Windows 10
       #1

    Windows cannot find: C:\Users\Default\AppData\Local\AutoUpDate\AutoUpd


    This weekend I downloaded a Pdf and also received unknown to me also got a virus, I was able to remove the virus and the PC works fine except I keep getting a pop-up saying Windows cannot find C:\Users\Default\AppData\Local\AutoUpDate\AutoUpdate.exe.
    My question is how can I stop these pop ups?. If I don't delete them they accumulate on the screen (as I type this I have four of them on the screen.Windows cannot find: C:\Users\Default\AppData\Local\AutoUpDate\AutoUpd-pop-up.jpeg
      My Computer


  2. Posts : 42,734
    Win 10 Pro (22H2) (2nd PC is 22H2)
       #2

    Something is being launched (periodically)? that is opening a command prompt window. Maybe a bat file from the syntax.

    If this occurs at regular intervals, it could be a scheduled task.

    You could try using Systernals Procmon (free) to create a log of activity, note the times at which the popup appears, and check the (extensive but filterable log) around that time. You could try searching for .bat or .cmd files.

    You could also try a clean boot, and see if the same occurs. If it does not, then there's something starting up that opens these. Autoruns (free) could help you manage startup entries for analysis.

    However, that may be a rather superficial approach- there must be leftovers related to your virus, so there could be other registry entries or files. Do you recall the name of the virus you found?

    You could be well advised to run other scanners.

    A quite different approach - do you have any system restore points before you acquired the virus?
      My Computers


  3. Posts : 3,502
    Win_8.1-Pro, Win_10.1607-Pro, Mint_17.3
       #3

    First, make sure that no unwanted programs are loaded when your machine starts:




    Please download and run the following two tools

    1. Download Temp File Cleaner (TFC) by Oldtimer

      1. Save your work and close all open windows.

      2. Restart your machine in case there are any system operations pending

      3. Navigate to your Downloads folder
        Right click on TFC
        Select Run as administrator

      4. Press the start button in the TFC window
        TFC begins cleaning up temporary files and folders.

        !!!!! Do not work on other things while TFC is running !!!!!
        Most applications use some sort of temporary files

      5. Restart your machine immediately after TFC completes




    2. Download AdwCleaner by Xplode

      1. Save your work and close all open windows.

      2. Navigate to your Downloads folder
        Right click AdwCleaner
        Pick Run as administrator

      3. Click on the Scan button.

        • AdwCleaner begins scanning your system. It might take some time to complete.

        • Review the detected objects grouped under each of the tabs.
          <!> If there is something you KNOW should NOT be cleaned, clear the checkbox next to the object.
          <!> If you're not sure about an object, paste the scan logfile (AdwCleaner[S#].txt) in a new post

          Otherwise, go to the next step.

      4. After the scan has finished and you have reviewed the objects to be cleaned, click on the Clean button.

        • Answer OK to the close all programs prompt, then follow the onscreen prompts.
        • Answer OK to the restart the computer prompt to complete the removal process.
          The AdwCleaner log file is opened in your default Text editor when the machine has restarted.
          Each time AdwCleaner runs, the log file number [#] is incremented, the highest number is the most recent. There are two log files, one for the scan (AdwCleaner[S#].txt) and one for the clean (AdwCleaner[C#].txt).

        • Paste the entire clean logfile (AdwCleaner[C#].txt) in your next post.
          <!> AdwCleaner logs are located in C:\AdwCleaner



    The tools above address certain types of malware, but are not Anti-Virus programs

    Run Windows Defender Offline Scan from Settings


    An additional check for malware:

      My Computer


  4. Posts : 1
    Windows 10
       #4

    I have run into the exact same problem problem, i have also noticed that every 20 minutes, my browser opens to videostalking.com then redirects to youtube.com. I have run adw, malwarebytes, JRT, eset online scanner, and HitmanPro. All of which say i am clean. However, i also ran RougeKiller, and i got this:

    RogueKiller V12.6.1.0 (x64) [Sep 6 2016] (Free) by Adlice Software
    mail : Contact - Adlice Software
    Feedback : Adlice forum
    Website : RogueKiller Anti-Malware Free Download - Official Website
    Blog : Adlice Software - Anti-malware and analysis tools

    Operating System : Windows 10 (10.0.10586) 64 bits version
    Started in : Normal mode
    User : Sean [Administrator]
    Started from : C:\Program Files\RogueKiller\RogueKiller64.exe
    Mode : Delete -- Date : 09/06/2016 15:36:17 (Duration : 00:11:07)

    ¤¤¤ Processes : 0 ¤¤¤

    ¤¤¤ Registry : 4 ¤¤¤
    [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters | DhcpNameServer : 216.254.141.2 24.226.1.94 216.254.141.13 ([-][-][Canada]) -> Not selected
    [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 216.254.141.2 24.226.1.94 216.254.141.13 ([-][-][Canada]) -> Not selected
    [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{bdcd083b-5fe6-4453-b414-6192c80965c1} | DhcpNameServer : 216.254.141.2 24.226.1.94 216.254.141.13 ([-][-][Canada]) -> Not selected
    [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{bdcd083b-5fe6-4453-b414-6192c80965c1} | DhcpNameServer : 216.254.141.2 24.226.1.94 216.254.141.13 ([-][-][Canada]) -> Not selected

    ¤¤¤ Tasks : 1 ¤¤¤
    [Suspicious.Path] \e02c4bd5-54d5-4470-9ea0-a68d88112c00 -- C:\Users\Sean\AppData\Roaming\QuickCleaner\QuickCleanerCSUS.exe (789902332HADB31378B2323) -> Not selected

    ¤¤¤ Files : 0 ¤¤¤

    ¤¤¤ WMI : 0 ¤¤¤

    ¤¤¤ Hosts File : 0 ¤¤¤

    ¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤

    ¤¤¤ Web browsers : 0 ¤¤¤

    ¤¤¤ MBR Check : ¤¤¤
    +++++ PhysicalDrive0: ST1000LM024 HN-M101MBB +++++
    --- User ---
    [MBR] 637fd3555498d8dc09fdc9c4618167c6
    [BSP] 189aa3f00435ada876addd2ee920acab : Empty|VT.Unknown MBR Code
    Partition table:
    0 - [MAN-MOUNT] EFI system partition | Offset (sectors): 2048 | Size: 100 MB
    1 - [SYSTEM][MAN-MOUNT] Basic data partition | Offset (sectors): 206848 | Size: 900 MB
    2 - [MAN-MOUNT] Microsoft reserved partition | Offset (sectors): 2050048 | Size: 128 MB
    3 - Basic data partition | Offset (sectors): 2312192 | Size: 381546 MB
    4 - Basic data partition | Offset (sectors): 783718400 | Size: 550704 MB
    5 - [SYSTEM][MAN-MOUNT] Basic data partition | Offset (sectors): 1911560192 | Size: 20490 MB
    User = LL1 ... OK
    User = LL2 ... OK

    +++++ PhysicalDrive1: HGST HTS541010A9E680 +++++
    --- User ---
    [MBR] 8370555c76032b9bbbf1c0a89c301a85
    [BSP] 3065e6ddd6cccacb97383b5597ce2ead : Windows Vista/7/8|VT.Unknown MBR Code
    Partition table:
    0 - Microsoft reserved partition | Offset (sectors): 34 | Size: 128 MB
    1 - Basic data partition | Offset (sectors): 264192 | Size: 99100 MB
    2 - [SYSTEM][MAN-MOUNT] | Offset (sectors): 203220992 | Size: 450 MB
    3 - [SYSTEM][MAN-MOUNT] | Offset (sectors): 204142592 | Size: 450 MB
    4 - Basic data partition | Offset (sectors): 205064192 | Size: 853740 MB
    User = LL1 ... OK
    User = LL2 ... OK

    +++++ PhysicalDrive2: Generic STORAGE DEVICE USB Device +++++
    --- User ---
    [MBR] 56f7fd06e486eb4d7b77162db1ba1249
    [BSP] 7208b105e661849d4a48c279d3177d8d : Legit.Unknown MBR Code
    Partition table:
    0 - [XXXXXX] FAT16 (0x6) [VISIBLE] Offset (sectors): 249 | Size: 1938 MB
    User = LL1 ... OK
    Error reading LL2 MBR! ([32] The request is not supported. )
      My Computer


  5. Posts : 3
    Windows 10
    Thread Starter
       #5

    dalchina said:
    Something is being launched (periodically)? that is opening a command prompt window. Maybe a bat file from the syntax.

    If this occurs at regular intervals, it could be a scheduled task.

    You could try using Systernals Procmon (free) to create a log of activity, note the times at which the popup appears, and check the (extensive but filterable log) around that time. You could try searching for .bat or .cmd files.


    Thanks for the reply. Today they started popping up at 10:30am local time it is 3pm now and they are still showing. At the moment I am trying different virus checkers that have been suggested. Will keep updating as I progress.
    Last edited by Brink; 06 Sep 2016 at 17:28. Reason: fixed quote box
      My Computer


  6. Posts : 7,128
    Windows 10 Pro Insider
       #6

    IMHO, Unless you have a known clean image to restore from I would do a clean install and start over. There is a guide on this forum on how to this.
      My Computers


  7. Posts : 3
    Windows 10
    Thread Starter
       #7

    Rogric said:
    This weekend I downloaded a Pdf and also received unknown to me also got a virus, I was able to remove the virus and the PC works fine except I keep getting a pop-up saying Windows cannot find C:\Users\Default\AppData\Local\AutoUpDate\AutoUpdate.exe.
    My question is how can I stop these pop ups?. If I don't delete them they accumulate on the screen (as I type this I have four of them on the screen)

    I checked the location and sure enough the file is missing, silly question why can't I replace the missing file?
    Last edited by Brink; 06 Sep 2016 at 17:29. Reason: fixed quote box
      My Computer


  8. Posts : 3,502
    Win_8.1-Pro, Win_10.1607-Pro, Mint_17.3
       #8

    sean255 said:
    I have run into the exact same problem problem, i have also noticed that every 20 minutes, my browser opens to videostalking.com then redirects to youtube.com. I have run adw, malwarebytes, JRT, eset online scanner, and HitmanPro. All of which say i am clean. However, i also ran RougeKiller, and i got this:
    Sean,

    Please start a new thread for your issue. It is very difficult to troubleshoot more than one machine in a thread.

    Thanks
      My Computer


  9. Posts : 3,502
    Win_8.1-Pro, Win_10.1607-Pro, Mint_17.3
       #9

    Rogric said:
    I checked the location and sure enough the file is missing, silly question why can't I replace the missing file?
    If it were a legitimate file, replacing it might be an option.

    It is a very generic name which makes researching it harder. I've found malware references and valid file references.
    IObit Advanced Care and O&O Shutup (I think) were two I recall (although I wouldn't have either on a machine - they cause known issues on some machines)

    See post# 3 to determine if malware is on your machine. The steps might also resolve the issue by cleaning up any malware remnants.
      My Computer


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 04:40.
Find Us




Windows 10 Forums