Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Weird file opens on startup reporting a successful ping


  • Please log in to reply
12 replies to this topic

#1 Muirsa

Muirsa

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:03:34 AM

Posted 04 October 2017 - 09:11 AM

On startup, before I've clicked a single button other than signing in, Windows gives me a prompt to pick which program I want to open a file with. If I pick a text editor like Notepad or Notepad++, it'll result in the attached text file, which seems to report a ping.

Part of the file says "C:\Program Files (x86)\Nox\" which is a leftover file after I uninstalled a program called Nox. I've since deleted that file, but the mystery file still pops up.

 

I found someone with a similar problem on the Microsoft Answer forums, but they never seem to have found a solution.

Attached Files


Edited by Muirsa, 04 October 2017 - 09:12 AM.


BC AdBot (Login to Remove)

 


#2 FreeBooter

FreeBooter

  • Members
  • 3,137 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Turkey - Adana
  • Local time:10:34 AM

Posted 04 October 2017 - 09:50 AM

Scan with Autoruns

Please download Autoruns by Sysinternals and save the file to your desktop.

  • Right-click on the AutoRuns.exe icon and select Run as Administrator to start the tool.
  • It is important that you do not use your machine while the tool is running.
  • Wait patiently until the tool finishes its scanning. You will be notified with the Ready message in the lower left corner upon completion.
  • Go to File menu and select Save.
  • Make sure that the Save as type option is set to AutoRuns Data (*.arn) and the place to save will be your desktop. Name it somehow that you'll be able to identify it.

Please attach the file to your next post.
To attach it:
  • After typing in your message, click More reply options instead of Post.
  • below the post preview and the post editor, you should be able to see Attach files option - please click Choose file.
  • in the pop-up window navigate to the desktop. Choose the one previously mentioned and attach it.

If the file will be to big to attach it (it may happen), then please host it on a Dropbox account or a site like mediafire.com, providing me the link to the uploaded file.



Share your knowledge. Its a way to achieve immortality.
- Dalai Lama

 

 


#3 Muirsa

Muirsa
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:03:34 AM

Posted 04 October 2017 - 12:56 PM

Thanks! I've attached them here! 

This one I saved after restarting the system and not starting any other programs. 

https://drive.google.com/file/d/0B7OqBs1x4sHFVEhNU3JYZElyU1E/view?usp=sharing

 

This one I saved without restarting the computer, just closing all programs and letting it be. 

https://drive.google.com/file/d/0B7OqBs1x4sHFZ0c4T3J5NGl3dHM/view?usp=sharing



#4 FreeBooter

FreeBooter

  • Members
  • 3,137 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Turkey - Adana
  • Local time:10:34 AM

Posted 04 October 2017 - 04:12 PM

Hi Muirsa,

 

There is no indication which program causing that log can you check and see issue resolves within Safe Mode.



Share your knowledge. Its a way to achieve immortality.
- Dalai Lama

 

 


#5 jenae

jenae

  • Members
  • 382 posts
  • OFFLINE
  •  
  • Local time:05:34 PM

Posted 04 October 2017 - 05:17 PM

Hi, open file explorer , click on "view" then "options" select change folder and search options, under "view' put a check in "show hidden files and folders" (don't forget to undo when finished).

 

Navigate to :- C:\Users\YourUsername\AppData\Roaming look for a file from nox and delete. Should be there, if not look under c:\users it is a left over from the Nox program.



#6 Muirsa

Muirsa
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:03:34 AM

Posted 04 October 2017 - 07:22 PM

I didn't find any of the folders you suggested, jenae -- but I did find a lot of files from nox secretly hiding in odd places on my computer. I thought I got all of them when I uninstalled but apparently not! 

I'll restart and let you know how it goes. 

FreeBooter, thanks for the suggestion -- I'll try that as well! 

Thank you both! 



#7 Muirsa

Muirsa
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:03:34 AM

Posted 04 October 2017 - 10:51 PM

So despite deleting all files with any ties to "nox" whatsoever, I'm still getting that log. I haven't yet been able to start in safe mode but I'll try that soon. 



#8 opera

opera

  • Members
  • 948 posts
  • ONLINE
  •  
  • Gender:Not Telling
  • Local time:08:34 AM

Posted 05 October 2017 - 01:48 AM

Look in Windows Task Scheduler for a task from nox running at boot and delete it..



#9 Muirsa

Muirsa
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:03:34 AM

Posted 05 October 2017 - 11:16 AM

The file doesn't pop up in safe mode, but I don't know how to transfer that knowledge into something I can use. I suppose the logical thing to do would be to disable startup tasks and enable them one by one, but I don't know which ones are safe to disable??

opera, there aren't any tools from nox_unload running at boot in the task scheduler.

These are the files that open up in task scheduler: All the "NV" ones are from Nvidia.

Optimize Start Menu Cache Files

NvTmMon

NvTmRepOnLogon

NvNodeLauncher

NvProfileUpdaterOnLogon

CLMLSvc_P2GB

CLVDLauncher

Norton WSC Integration

GoogleUpdateTaskMachineCore

Synaptics TouchPad Enhancements

Adobe Flash Player Updater

Google UpdateTaskMachineUA



#10 FreeBooter

FreeBooter

  • Members
  • 3,137 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Turkey - Adana
  • Local time:10:34 AM

Posted 05 October 2017 - 05:30 PM

I would like to have you run a Clean Boot.

How to perform a Clean Boot.

Warning: Disabling items in Services or Startup may leave your anitivirus disabled until the process is ended. For this reason I would suggest that you perform this process off line.

Press the 7W6b39o.png keys to open Run, then type msconfig in the search box. This will open System Configuration.

If you are prompted for an administrator password or for confirmation, you should enter the password or provide confirmation.

(1) Click/tap on the General tab.

(2) Click/tap on the Selective startup option.

(3) Remove the check mark in the Load startup items check box.

0JgaJnG.png

4. Click on the Services tab.

5. Place a check mark in the Hide all Microsoft services check box, this will remove the Microsoft Services from the list but will still be running.

6. Click Disable all, this will remove all of the check marks in the Services list.

yIKrmLs.png

7. Click on Apply then OK

ljHR4ZW.png

Click on Restart in the window that opens.

When the computer is restarted it will boot normally.

If the problem does not continue after the restart please do the following.

8.  Divide the number of these services by two and you place checks in the first half of these, then restart the computer.
 
9.  If the problem doesn't return in those services remove the checks and place checks in the remaining services and restart the computer.

10.  When you find which half the service is in go on to the next step. 

11. The half which has the service causing this problem remove half of the checks as you did previously to see which half has this service.  Restart the computer. 

12.  If it isn't in the first half of these services, do the same with the last half of the services.

13.  Once you have narrowed it down to the last three or four services remove the checks one at a time till you find the service at fault.

Once you have found the service post it in your topic.  Do not take any action until I suggest the next step.



Share your knowledge. Its a way to achieve immortality.
- Dalai Lama

 

 


#11 Muirsa

Muirsa
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:03:34 AM

Posted 05 October 2017 - 05:52 PM

Hi! I tried to run a clean boot. I was able to disable all the non-microsoft services, but despite un-checking the "Load startup items" box, the checkmark returns every time I restart the system. 

Under these conditions, even after disabling the non-microsoft services, the weird file popup still happens. 



#12 jenae

jenae

  • Members
  • 382 posts
  • OFFLINE
  •  
  • Local time:05:34 PM

Posted 06 October 2017 - 02:44 AM

Hi, well you could find this in the registry, it could take some doing, unless you are experienced here I would caution against plowing in.

 

This script is used by many, it has only recently been upgraded to work on win 10, it is called silent runners and you should find your problem here. It is quite long, opens in notepad (you might be surprised to see all the unknown items that start with your computer). TIP :- you can use the ctrl +f keys to get a search box, try Nox.

 

It is a vbs script so will not load on forums, I have put it into a .zip file, open the attached .zip file it returns silent runners.vbs, save to desktop and run, the notepad output will also appear on your desktop, you could attach it here if you have trouble

Attached Files



#13 Muirsa

Muirsa
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:03:34 AM

Posted 26 October 2017 - 05:21 PM

Hi everyone! So I did a bunch of googling and came across some reddit threads that said this could result from some random files in C:/users ... and I sure did find a file with the same name as my computer's name, but with no file extension. I deleted it, and it's gone for good!

Turns out nothing was showing in startup or the log because it was just a file with an unknown type opening.


Edited by Muirsa, 26 October 2017 - 05:21 PM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users