1. Joined : Sep 2016
    Posts : 3
    Windows 10
       05 Sep 2016 #1

    Windows cannot find: C:\Users\Default\AppData\Local\AutoUpDate\AutoUpd


    This weekend I downloaded a Pdf and also received unknown to me also got a virus, I was able to remove the virus and the PC works fine except I keep getting a pop-up saying Windows cannot find C:\Users\Default\AppData\Local\AutoUpDate\AutoUpdate.exe.
    My question is how can I stop these pop ups?. If I don't delete them they accumulate on the screen (as I type this I have four of them on the screen.Click image for larger version. 

Name:	Pop up.jpeg 
Views:	6 
Size:	357.2 KB 
ID:	100041
      My System SpecsSystem Spec


  2. Joined : Jan 2015
    UK, Midlands
    Posts : 6,548
    Win 10 Pro (1607)
       06 Sep 2016 #2

    Something is being launched (periodically)? that is opening a command prompt window. Maybe a bat file from the syntax.

    If this occurs at regular intervals, it could be a scheduled task.

    You could try using Systernals Procmon (free) to create a log of activity, note the times at which the popup appears, and check the (extensive but filterable log) around that time. You could try searching for .bat or .cmd files.

    You could also try a clean boot, and see if the same occurs. If it does not, then there's something starting up that opens these. Autoruns (free) could help you manage startup entries for analysis.

    However, that may be a rather superficial approach- there must be leftovers related to your virus, so there could be other registry entries or files. Do you recall the name of the virus you found?

    You could be well advised to run other scanners.

    A quite different approach - do you have any system restore points before you acquired the virus?
      My System SpecsSystem Spec


  3. Joined : Oct 2013
    Penns Forrest
    Posts : 3,506
    Win_8.1-Pro, Win_10.1607-Pro, Mint_17.3
       06 Sep 2016 #3

    First, make sure that no unwanted programs are loaded when your machine starts:




    Please download and run the following two tools

    1. Download Temp File Cleaner (TFC) by Oldtimer

      1. Save your work and close all open windows.

      2. Restart your machine in case there are any system operations pending

      3. Navigate to your Downloads folder
        Right click on TFC
        Select Run as administrator

      4. Press the start button in the TFC window
        TFC begins cleaning up temporary files and folders.

        !!!!! Do not work on other things while TFC is running !!!!!
        Most applications use some sort of temporary files

      5. Restart your machine immediately after TFC completes




    2. Download AdwCleaner by Xplode

      1. Save your work and close all open windows.

      2. Navigate to your Downloads folder
        Right click AdwCleaner
        Pick Run as administrator

      3. Click on the Scan button.

        • AdwCleaner begins scanning your system. It might take some time to complete.

        • Review the detected objects grouped under each of the tabs.
          <!> If there is something you KNOW should NOT be cleaned, clear the checkbox next to the object.
          <!> If you're not sure about an object, paste the scan logfile (AdwCleaner[S#].txt) in a new post

          Otherwise, go to the next step.

      4. After the scan has finished and you have reviewed the objects to be cleaned, click on the Clean button.

        • Answer OK to the close all programs prompt, then follow the onscreen prompts.
        • Answer OK to the restart the computer prompt to complete the removal process.
          The AdwCleaner log file is opened in your default Text editor when the machine has restarted.
          Each time AdwCleaner runs, the log file number [#] is incremented, the highest number is the most recent. There are two log files, one for the scan (AdwCleaner[S#].txt) and one for the clean (AdwCleaner[C#].txt).

        • Paste the entire clean logfile (AdwCleaner[C#].txt) in your next post.
          <!> AdwCleaner logs are located in C:\AdwCleaner



    The tools above address certain types of malware, but are not Anti-Virus programs

    Run Windows Defender Offline Scan from Settings


    An additional check for malware:

      My System SpecsSystem Spec


  4. Joined : Sep 2016
    Posts : 1
    Windows 10
       06 Sep 2016 #4

    I have run into the exact same problem problem, i have also noticed that every 20 minutes, my browser opens to videostalking.com then redirects to youtube.com. I have run adw, malwarebytes, JRT, eset online scanner, and HitmanPro. All of which say i am clean. However, i also ran RougeKiller, and i got this:

    RogueKiller V12.6.1.0 (x64) [Sep 6 2016] (Free) by Adlice Software
    mail : Contact - Adlice Software
    Feedback : Adlice forum
    Website : RogueKiller Anti-Malware Free Download - Official Website
    Blog : Adlice Software - Anti-malware and analysis tools

    Operating System : Windows 10 (10.0.10586) 64 bits version
    Started in : Normal mode
    User : Sean [Administrator]
    Started from : C:\Program Files\RogueKiller\RogueKiller64.exe
    Mode : Delete -- Date : 09/06/2016 15:36:17 (Duration : 00:11:07)

    ¤¤¤ Processes : 0 ¤¤¤

    ¤¤¤ Registry : 4 ¤¤¤
    [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters | DhcpNameServer : 216.254.141.2 24.226.1.94 216.254.141.13 ([-][-][Canada]) -> Not selected
    [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 216.254.141.2 24.226.1.94 216.254.141.13 ([-][-][Canada]) -> Not selected
    [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{bdcd083b-5fe6-4453-b414-6192c80965c1} | DhcpNameServer : 216.254.141.2 24.226.1.94 216.254.141.13 ([-][-][Canada]) -> Not selected
    [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{bdcd083b-5fe6-4453-b414-6192c80965c1} | DhcpNameServer : 216.254.141.2 24.226.1.94 216.254.141.13 ([-][-][Canada]) -> Not selected

    ¤¤¤ Tasks : 1 ¤¤¤
    [Suspicious.Path] \e02c4bd5-54d5-4470-9ea0-a68d88112c00 -- C:\Users\Sean\AppData\Roaming\QuickCleaner\QuickCleanerCSUS.exe (789902332HADB31378B2323) -> Not selected

    ¤¤¤ Files : 0 ¤¤¤

    ¤¤¤ WMI : 0 ¤¤¤

    ¤¤¤ Hosts File : 0 ¤¤¤

    ¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤

    ¤¤¤ Web browsers : 0 ¤¤¤

    ¤¤¤ MBR Check : ¤¤¤
    +++++ PhysicalDrive0: ST1000LM024 HN-M101MBB +++++
    --- User ---
    [MBR] 637fd3555498d8dc09fdc9c4618167c6
    [BSP] 189aa3f00435ada876addd2ee920acab : Empty|VT.Unknown MBR Code
    Partition table:
    0 - [MAN-MOUNT] EFI system partition | Offset (sectors): 2048 | Size: 100 MB
    1 - [SYSTEM][MAN-MOUNT] Basic data partition | Offset (sectors): 206848 | Size: 900 MB
    2 - [MAN-MOUNT] Microsoft reserved partition | Offset (sectors): 2050048 | Size: 128 MB
    3 - Basic data partition | Offset (sectors): 2312192 | Size: 381546 MB
    4 - Basic data partition | Offset (sectors): 783718400 | Size: 550704 MB
    5 - [SYSTEM][MAN-MOUNT] Basic data partition | Offset (sectors): 1911560192 | Size: 20490 MB
    User = LL1 ... OK
    User = LL2 ... OK

    +++++ PhysicalDrive1: HGST HTS541010A9E680 +++++
    --- User ---
    [MBR] 8370555c76032b9bbbf1c0a89c301a85
    [BSP] 3065e6ddd6cccacb97383b5597ce2ead : Windows Vista/7/8|VT.Unknown MBR Code
    Partition table:
    0 - Microsoft reserved partition | Offset (sectors): 34 | Size: 128 MB
    1 - Basic data partition | Offset (sectors): 264192 | Size: 99100 MB
    2 - [SYSTEM][MAN-MOUNT] | Offset (sectors): 203220992 | Size: 450 MB
    3 - [SYSTEM][MAN-MOUNT] | Offset (sectors): 204142592 | Size: 450 MB
    4 - Basic data partition | Offset (sectors): 205064192 | Size: 853740 MB
    User = LL1 ... OK
    User = LL2 ... OK

    +++++ PhysicalDrive2: Generic STORAGE DEVICE USB Device +++++
    --- User ---
    [MBR] 56f7fd06e486eb4d7b77162db1ba1249
    [BSP] 7208b105e661849d4a48c279d3177d8d : Legit.Unknown MBR Code
    Partition table:
    0 - [XXXXXX] FAT16 (0x6) [VISIBLE] Offset (sectors): 249 | Size: 1938 MB
    User = LL1 ... OK
    Error reading LL2 MBR! ([32] The request is not supported. )
      My System SpecsSystem Spec


  5. Joined : Sep 2016
    Posts : 3
    Windows 10
       06 Sep 2016 #5

    dalchina said: View Post
    Something is being launched (periodically)? that is opening a command prompt window. Maybe a bat file from the syntax.

    If this occurs at regular intervals, it could be a scheduled task.

    You could try using Systernals Procmon (free) to create a log of activity, note the times at which the popup appears, and check the (extensive but filterable log) around that time. You could try searching for .bat or .cmd files.


    Thanks for the reply. Today they started popping up at 10:30am local time it is 3pm now and they are still showing. At the moment I am trying different virus checkers that have been suggested. Will keep updating as I progress.
    Last edited by Brink; 06 Sep 2016 at 17:28. Reason: fixed quote box
      My System SpecsSystem Spec


  6. Joined : Jun 2014
    Posts : 4,447
    Windows 10 Pro
       06 Sep 2016 #6

    IMHO, Unless you have a known clean image to restore from I would do a clean install and start over. There is a guide on this forum on how to this.
      My System SpecsSystem Spec


  7. Joined : Sep 2016
    Posts : 3
    Windows 10
       06 Sep 2016 #7

    Rogric said: View Post
    This weekend I downloaded a Pdf and also received unknown to me also got a virus, I was able to remove the virus and the PC works fine except I keep getting a pop-up saying Windows cannot find C:\Users\Default\AppData\Local\AutoUpDate\AutoUpdate.exe.
    My question is how can I stop these pop ups?. If I don't delete them they accumulate on the screen (as I type this I have four of them on the screen)

    I checked the location and sure enough the file is missing, silly question why can't I replace the missing file?
    Last edited by Brink; 06 Sep 2016 at 17:29. Reason: fixed quote box
      My System SpecsSystem Spec


  8. Joined : Oct 2013
    Penns Forrest
    Posts : 3,506
    Win_8.1-Pro, Win_10.1607-Pro, Mint_17.3
       06 Sep 2016 #8

    sean255 said: View Post
    I have run into the exact same problem problem, i have also noticed that every 20 minutes, my browser opens to videostalking.com then redirects to youtube.com. I have run adw, malwarebytes, JRT, eset online scanner, and HitmanPro. All of which say i am clean. However, i also ran RougeKiller, and i got this:
    Sean,

    Please start a new thread for your issue. It is very difficult to troubleshoot more than one machine in a thread.

    Thanks
      My System SpecsSystem Spec


  9. Joined : Oct 2013
    Penns Forrest
    Posts : 3,506
    Win_8.1-Pro, Win_10.1607-Pro, Mint_17.3
       06 Sep 2016 #9

    Rogric said: View Post
    I checked the location and sure enough the file is missing, silly question why can't I replace the missing file?
    If it were a legitimate file, replacing it might be an option.

    It is a very generic name which makes researching it harder. I've found malware references and valid file references.
    IObit Advanced Care and O&O Shutup (I think) were two I recall (although I wouldn't have either on a machine - they cause known issues on some machines)

    See post# 3 to determine if malware is on your machine. The steps might also resolve the issue by cleaning up any malware remnants.
      My System SpecsSystem Spec


 


Similar Threads
Thread Forum
AppData/Local/Temp getting filled up with many copies of same folder
I have a PC with a 250GB SSD on C: and a 1TB HD on D: For some reason, there is a single folder full of .dll files that keeps being copied into C:\Users\\AppData\Local\Temp. Each folder is a hexadecimal name like...
General Support
Solved Trying to transfer data files from salvaged HDD Cant find AppData
My 5 year old old laptop broke and I have salvaged its HDD with the folders. ( pictured below.) The HDD showed a recovery partition which was empty, and a Data Partition containing 7 folders The AppData and Contacts folders on the...
Installation and Setup
SearchUI.exe stop working when move AppData/local
Hello! Months ago I moved my user folder C:\Users\<my_user_folder> to a new location using a director junction. First of all I created a new user I copied the user folder with xcopy to E:\C_DRIVE\Users\<my_user_folder> I created a directory...
General Support
Solved unable to create the directory "C:\users\tom\appdata\local\temp\*.tmp
trying to install visual studio code and this message pops up immediately. "Setup was unable to create the directory "C:\users\tom\appdata\local\temp\*.tmp" error 5 access is denied I tried taking ownership at appdata point but still no go....
Software and Apps
Possible to access data no longer stored in AppData/Local/Temp?
A few months ago I downloaded data somewhere and it was stored in C:/Users/mke48/AppData/Local/Temp. However it is no longer there as only files up to a few months ago are listed there. Is there any way at all I can access data stored there prior to...
General Support
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd

All times are GMT -5. The time now is 10:06.
Find Us
Twitter Facebook Google+



Windows 10 Forums