Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Windows cannot find error message


  • Please log in to reply
23 replies to this topic

#1 peanutsnana

peanutsnana

  • Members
  • 57 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:03:06 AM

Posted 05 March 2014 - 04:25 PM

About 2 weeks ago I encountered a very nasty virus.  It was the "FBI" virus. The one that says your computer has been locked.  I did a search online while in safe mode and found the topic on one of your pages.  Downloaded the program to fix it and then ran the Secunia PSI program.  Got rid of the virus, Thank You so much.

 

But since then, when I start my computer and it boots up I get an alert that "Windows cannot find 'C:\users\Sherry\AppData\Local\Temp\cs

.exe"

 

Tells me to make sure I typed the name correctly and try again.  I didn't type anything in and have no clue how to check.  I have run the Malware program and occasionally come up with malicious files.  But it doesn't get rid of this issue.

 

Can you help?

 

Thanx!

 

Sherry

 



BC AdBot (Login to Remove)

 


m

#2 Alex&Vanko

Alex&Vanko

  • Banned
  • 1,394 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:10:06 AM

Posted 05 March 2014 - 05:06 PM

Hi! Which program have you used to fix it?



#3 hamluis

hamluis

    Moderator


  • Moderator
  • 54,839 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:02:06 AM

Posted 05 March 2014 - 05:23 PM

Removal of malware will often leave orphan files behind, particularly as startups.

 

Me...I would simply do a search of both the registry and the files for a file with "cs.exe" as part of it.

 

Or...use a decent Startup Manager to look at startup items which relate to the named file...then remove such.

 

My choice of startup managers is AutoRuns for Windows - http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx .  You can choose to either download/install it...or run it online via the Run AutoRuns Now button at the top right of the webpage.  In any case, typical startrup items will be reflected on the LOGON tab of the generated data.

 

Louis



#4 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 50,582 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:03:06 AM

Posted 05 March 2014 - 09:14 PM

The FBI Cybercrime Division Ransomware Removal Guide instructs to use HitmanPro Kickstart USB drive.

It is not uncommon to encounter errors or issues with programs attempting to open when booting into Windows after a related file that was set to run at startup or as scheduled task in the registry has been deleted. Windows is trying to load this file but cannot locate it since the file may have been removed inadvertently, during the uninstallation of a program or after performing a scan with security tools. However, an associated orphaned registry entry (value) still exists and is telling Windows to load the file when you boot up. Since the file no longer exists, Windows will display an error message. You need to remove this registry entry so Windows stops searching for the file when it loads.

hamluis's suggestion to use Autoruns to find and remove the remnant generally resolves this issue.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#5 peanutsnana

peanutsnana
  • Topic Starter

  • Members
  • 57 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:03:06 AM

Posted 06 March 2014 - 04:51 PM

Found out a couple weeks ago I had a nasty virus.  Looked on your site, and once again you guys were wonderful with info. to clean it up. 

 

I ran the Emisoft program and then downloaded and ran the Secunia PSI program.  Everything seemed to be fine, until I booted up a couple days later.

 

Now, as soon as the computer boots up all the way I get an alert that pops up.  This is what it says:

 

"Windows cannot find 'C:\users\Sherry\AppData\Local\Temp\cs25.exe"

"Make sure you typed the name correctly, and then try again."

 

Thing is, I never typed it in.  Do I have another virus that I'm not finding or another kind of error?  It's diving me buggy:)

 



#6 Alex&Vanko

Alex&Vanko

  • Banned
  • 1,394 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:10:06 AM

Posted 06 March 2014 - 04:56 PM

Do you use a optimization program to increase the speed of your computer?



#7 Ant.Man

Ant.Man

  • Members
  • 129 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Just left of DC
  • Local time:03:06 AM

Posted 06 March 2014 - 06:13 PM

Please clarify:

  1. I ran the Emisoft program and then...
  2. ran the Secunia PSI program.
  3. Everything seemed to be fine,
  4. until I booted up a couple days later.

Was the PC restarted at least once between:

item 1 and item 2?

item 2 and item 3?

 

How many times was the PC restarted after item 3 "Everything seemed to be fine"?


This is not my signature.


#8 Ant.Man

Ant.Man

  • Members
  • 129 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Just left of DC
  • Local time:03:06 AM

Posted 06 March 2014 - 06:31 PM

If more than one, please report to member jntkwx HERE.

 

Otherwise,

  • IF the PC was restarted only one time after you ran secunia (received instruction here)
  • IF the PC was restarted only one time after you ran filehippo update checker (you have not confirmed this action)

THEN:

You may be looking at a rogue startup entry, left over from the malware grinder that jntkwx put your PC through.

 

There are a few different, and easy, ways to correct this.  The target exe file is not launching anyway, so you may be under no threat.

 

You are best advised to report to jntkwx HERE in either case.


Edited by Ant.Man, 06 March 2014 - 06:40 PM.

This is not my signature.


#9 hamluis

hamluis

    Moderator


  • Moderator
  • 54,839 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:02:06 AM

Posted 06 March 2014 - 08:00 PM

Well...removal of malware typically may leave orphan startup entries...which trigger the reported error message.

 

I suggest taking a look at your startup itmes via AutoRuns for Windows - http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx .  Typical startup items appear on the Logon tab displayed by AutoRuns.  You can either download/install it...or simply run it online via the Run AutoRuns now... link which is at the upper right of the AutoRuns webpage.

 

Look for any items related to the files which are asserted as missing...delete said items and the error messages should cease.

 

Louis



#10 Ant.Man

Ant.Man

  • Members
  • 129 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Just left of DC
  • Local time:03:06 AM

Posted 06 March 2014 - 11:54 PM

OP reports via PM:

 

I restarted the computer once between items 1&2. I received an alert that I must restart to make sure everything was clean. After Item 2 the computer ran good with no pop-up errors. I have restarted the computer once daily for about a week now and every time I restart I get the error message.

 

A:  This condition should have been reported to jntkwx HERE.  Communication is key.

 

B:  AutoRuns is likely the best tool to correct this condition.  Please review the guidance hamluis offered above.

 

AutoRuns is easy to use.  Run As Administrator.  Everything reported in AutoRuns is a 'startup item'.  [Logon] tab = user, [WinLogon] tab = all users.  Changes are immediate, save not required, changes reflected on next boot.

 

DO NOT TOUCH the [Drivers] tab.


Edited by Ant.Man, 07 March 2014 - 08:21 AM.

This is not my signature.


#11 peanutsnana

peanutsnana
  • Topic Starter

  • Members
  • 57 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:03:06 AM

Posted 10 March 2014 - 01:00 PM

Reported to jntkwx as instructed.  Have no responses as yet.

 

Used AutoRuns as instructed. Deleted files that said "not found".

 

Rebooted computer, still getting the error message.

 

Did Not Touch the Drivers tab.

 

Thank You!



#12 Ant.Man

Ant.Man

  • Members
  • 129 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Just left of DC
  • Local time:03:06 AM

Posted 10 March 2014 - 01:08 PM

Open AutoRuns.

Allow the scan to finish.

Click, File, Save

 

File type will be ARN

Save to a convenient location.

 

ZIP the ARN file.  Attach that zipped ARN file to this post.

 

Or, examine Autoruns line items under [Logon] and [WinLogon] tabs.

Look for cs.exe

If not found, examine [Scheduled Tasks] and [Services].


Edited by Ant.Man, 10 March 2014 - 01:09 PM.

This is not my signature.


#13 peanutsnana

peanutsnana
  • Topic Starter

  • Members
  • 57 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:03:06 AM

Posted 27 March 2014 - 12:11 PM

Ran AutoRuns.

 

Tried to attach file to you, but was told the file is too big.

 

What do I try next?

 



#14 Ant.Man

Ant.Man

  • Members
  • 129 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Just left of DC
  • Local time:03:06 AM

Posted 27 March 2014 - 11:02 PM

ZIP the ARN file.  Attach that zipped ARN file to this post.

 

http://www.7-zip.org/


This is not my signature.


#15 peanutsnana

peanutsnana
  • Topic Starter

  • Members
  • 57 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:03:06 AM

Posted 03 April 2014 - 05:37 PM

Hope this works

Attached Files






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users