Windows 10: Windows cannot find: C:\Users\Default\AppData\Local\AutoUpDate\AutoUpd

This weekend I downloaded a Pdf and also received unknown to me also got a virus, I was able to remove the virus and the PC works fine except I keep getting a pop-up saying Windows cannot find C:\Users\Default\AppData\Local\AutoUpDate\AutoUpdate.exe.
My question is how can I stop these pop ups?. If I don't delete them they accumulate on the screen (as I type this I have four of them on the screen.



:)

 

File Explorer crash when creating new folder

I tried clean boot but it still crashing.

I also tried safe mod and it still crashing.

I debug explorer.exe with visual studio and this is the output window content:

--------------------------------------------

'explorer.exe' (Win32): Loaded 'C:\Windows\System32\msftedit.dll'. Cannot find or open the PDB file.

'explorer.exe' (Win32): Loaded 'C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll'. Cannot find or open the PDB file.

'explorer.exe' (Win32): Loaded 'C:\Windows\System32\UIRibbon.dll'. Cannot find or open the PDB file.

The thread 0x17b0 has exited with code 0 (0x0).

The thread 0x120c has exited with code 0 (0x0).

'explorer.exe' (Win32): Loaded 'C:\Windows\System32\WorkFoldersShell.dll'. Cannot find or open the PDB file.

'explorer.exe' (Win32): Loaded 'C:\Windows\System32\nvshext.dll'. Cannot find or open the PDB file.

'explorer.exe' (Win32): Loaded 'C:\Program Files\NVIDIA Corporation\Display\nvui.dll'. Cannot find or open the PDB file.

'explorer.exe' (Win32): Loaded 'C:\Windows\System32\comdlg32.dll'. Cannot find or open the PDB file.

'explorer.exe' (Win32): Loaded 'C:\Windows\System32\winspool.drv'. Cannot find or open the PDB file.

'explorer.exe' (Win32): Loaded 'C:\Windows\System32\msimg32.dll'. Cannot find or open the PDB file.

'explorer.exe' (Win32): Unloaded 'C:\Windows\System32\globinputhost.dll'

'explorer.exe' (Win32): Unloaded 'C:\Windows\System32\Windows.Globalization.dll'

'explorer.exe' (Win32): Unloaded 'C:\Windows\System32\Windows.Storage.Search.dll'

'explorer.exe' (Win32): Unloaded 'C:\Windows\System32\samcli.dll'

'explorer.exe' (Win32): Unloaded 'C:\Windows\System32\credui.dll'

'explorer.exe' (Win32): Unloaded 'C:\Windows\System32\oobe\UserOOBE.dll'

'explorer.exe' (Win32): Unloaded 'C:\Windows\System32\UserMgrProxy.dll'

'explorer.exe' (Win32): Unloaded 'C:\Windows\System32\WorkFoldersShell.dll'

'explorer.exe' (Win32): Unloaded 'C:\Windows\System32\smartscreenps.dll'

'explorer.exe' (Win32): Unloaded 'C:\Windows\System32\OneCoreUAPCommonProxyStub.dll'

'explorer.exe' (Win32): Unloaded 'C:\Windows\System32\CloudExperienceHostCommon.dll'

'explorer.exe' (Win32): Unloaded 'C:\Windows\System32\msimg32.dll'

'explorer.exe' (Win32): Unloaded 'C:\Windows\System32\comdlg32.dll'

'explorer.exe' (Win32): Unloaded 'C:\Windows\System32\winspool.drv'

'explorer.exe' (Win32): Unloaded 'C:\Program Files\NVIDIA Corporation\Display\nvui.dll'

'explorer.exe' (Win32): Loaded 'C:\Windows\System32\igfxDTCM.dll'. Module was built without symbols.

'explorer.exe' (Win32): Loaded 'C:\Windows\System32\samcli.dll'. Cannot find or open the PDB file.

'explorer.exe' (Win32): Loaded 'C:\Windows\System32\igfxDH.dll'. Module was built without symbols.

'explorer.exe' (Win32): Loaded 'C:\Windows\System32\igfxLHM.dll'. Module was built without symbols.

'explorer.exe' (Win32): Unloaded 'C:\Windows\System32\shacct.dll'

The thread 0x1b14 has exited with code 0 (0x0).

'explorer.exe' (Win32): Loaded 'C:\Windows\System32\igfxDI.dll'. Module was built without symbols.

'explorer.exe' (Win32): Loaded 'C:\Windows\System32\d3d10_1.dll'. Cannot find or open the PDB file.

'explorer.exe' (Win32): Loaded 'C:\Windows\System32\opengl32.dll'. Cannot find or open the PDB file.

'explorer.exe' (Win32): Loaded 'C:\Windows\System32\d3d10_1core.dll'. Cannot find or open the PDB file.

'explorer.exe' (Win32): Loaded 'C:\Windows\System32\glu32.dll'. Cannot find or open the PDB file.

'explorer.exe' (Win32): Loaded 'C:\Windows\System32\ddraw.dll'. Cannot find or open the PDB file.

'explorer.exe' (Win32): Loaded 'C:\Windows\System32\dciman32.dll'. Cannot find or open the PDB file.

The thread 0x1684 has exited with code 0 (0x0).

The thread 0x1588 has exited with code 0 (0x0).

'explorer.exe' (Win32): Loaded 'C:\Windows\System32\wscinterop.dll'. Cannot find or open the PDB file.

'explorer.exe' (Win32): Loaded 'C:\Windows\System32\wscapi.dll'. Cannot find or open the PDB file.

'explorer.exe' (Win32): Loaded 'C:\Windows\System32\wscui.cpl'. Cannot find or open the PDB file.

'explorer.exe' (Win32): Loaded 'C:\Windows\System32\werconcpl.dll'. Cannot find or open the PDB file.

'explorer.exe' (Win32): Loaded 'C:\Windows\System32\framedynos.dll'. Cannot find or open the PDB file.

'explorer.exe' (Win32): Loaded 'C:\Windows\System32\wer.dll'. Cannot find or open the PDB file.

'explorer.exe' (Win32): Loaded 'C:\Windows\System32\hcproviders.dll'. Cannot find or open the PDB file.

'explorer.exe' (Win32): Loaded 'C:\Windows\System32\Windows.System.Launcher.dll'. Cannot find or open the PDB file.

'explorer.exe' (Win32): Loaded 'C:\Windows\System32\WpPortingLibrary.dll'. Cannot find or open the PDB file.

'explorer.exe' (Win32): Loaded 'C:\Windows\System32\dsclient.dll'. Cannot find or open the PDB file.

Exception thrown at 0x00007FFC8B409FDF (windows.storage.dll) in explorer.exe: 0xC00000FD: Stack overflow (parameters: 0x0000000000000001, 0x0000000004E83E60).

Unhandled exception at 0x00007FFC8B409FDF (windows.storage.dll) in explorer.exe: 0xC00000FD: Stack overflow (parameters: 0x0000000000000001, 0x0000000004E83E60).

Exception thrown at 0x00007FFC8B409FDF (windows.storage.dll) in explorer.exe: 0xC0000005: Access violation writing location 0x0000000004E80EF0.

Unhandled exception at 0x00007FFC8B409FDF (windows.storage.dll) in explorer.exe: 0xC0000005: Access violation writing location 0x0000000004E80EF0.

The program '[8892] explorer.exe' has exited with code 0 (0x0).

----------------------------------

I think file explorer freezes because of that Stack overflow error

 

Command Prompt opens/closes randomly

On rare occasions it will stop for a few seconds. I was able to copy this:

FINDSTR: Cannot open c:\ProgramData\acer\updater2\updater2.xml

The system cannot find the path specified.

Cannot access file C:\Program Files\DriverSetupUtility\FUB\+

FINDSTR: Cannot open c:\ProgramData\packard bell\updater2\updater2.xml

The system cannot find the path specified.

Cannot access file C:\Program Files\DriverSetupUtility\FUB\+

FINDSTR: Cannot open c:\ProgramData\gateway\updater2\updater2.xml

The system cannot find the path specified.

Cannot access file C:\Program Files\DriverSetupUtility\FUB\+

FINDSTR: Cannot open c:\ProgramData\founder\updater2\updater2.xml

The system cannot find the path specified.

 

Something is being launched (periodically)? that is opening a command prompt window. Maybe a bat file from the syntax.

If this occurs at regular intervals, it could be a scheduled task.

You could try using Systernals Procmon (free) to create a log of activity, note the times at which the popup appears, and check the (extensive but filterable log) around that time. You could try searching for .bat or .cmd files.

You could also try a clean boot, and see if the same occurs. If it does not, then there's something starting up that opens these. Autoruns (free) could help you manage startup entries for analysis.

However, that may be a rather superficial approach- there must be leftovers related to your virus, so there could be other registry entries or files. Do you recall the name of the virus you found?

You could be well advised to run other scanners.

A quite different approach - do you have any system restore points before you acquired the virus?

 

First, make sure that no unwanted programs are loaded when your machine starts:

Perform a Clean Boot in Windows 10

Please download and run the following two tools

• Download Temp File Cleaner (TFC) by Oldtimer
  
  • Save your work and close all open windows.
    
    
  • Restart your machine in case there are any system operations pending
    
    
  • Navigate to your Downloads folder
    Right click on TFC
    Select Run as administrator
    
    
  • Press the start button in the TFC window
    TFC begins cleaning up temporary files and folders.
    
    !!!!! Do not work on other things while TFC is running !!!!!
    Most applications use some sort of temporary files
    
  • Restart your machine immediately after TFC completes
  
  
  
• Download AdwCleaner by Xplode
  
  • Save your work and close all open windows.
    
    
  • Navigate to your Downloads folder
    Right click AdwCleaner
    Pick Run as administrator
    
    
  • Click on the Scan button.
    
    • AdwCleaner begins scanning your system. It might take some time to complete.
      
      
    • Review the detected objects grouped under each of the tabs.
      <!> If there is something you KNOW should NOT be cleaned, clear the checkbox
      
      next to the object.
      <!> If you're not sure about an object, paste the scan logfile (AdwCleaner[S#].txt) in a new post
      
      Otherwise, go to the next step.
  • After the scan has finished and you have reviewed the objects to be cleaned, click on the Clean button.
    
    • Answer OK to the close all programs prompt, then follow the onscreen prompts.
    • Answer OK to the restart the computer prompt to complete the removal process.
      The AdwCleaner log file is opened in your default Text editor when the machine has restarted.
      Each time AdwCleaner runs, the log file number [#] is incremented, the highest number is the most recent. There are two log files, one for the scan (AdwCleaner[S#].txt) and one for the clean (AdwCleaner[C#].txt).
      
      
    • Paste the entire clean logfile (AdwCleaner[C#].txt) in your next post.
      <!> AdwCleaner logs are located in C:\AdwCleaner

The tools above address certain types of malware, but are not Anti-Virus programs

Run Windows Defender Offline Scan from Settings

An additional check for malware:

Malwarebytes Anti-Malware Free

 

I have run into the exact same problem problem, i have also noticed that every 20 minutes, my browser opens to videostalking.com then redirects to youtube.com. I have run adw, malwarebytes, JRT, eset online scanner, and HitmanPro. All of which say i am clean. However, i also ran RougeKiller, and i got this:

RogueKiller V12.6.1.0 (x64) [Sep 6 2016] (Free) by Adlice Software
mail : Contact - Adlice Software
Feedback : Adlice forum
Website : RogueKiller Anti-Malware Free Download - Official Website
Blog : Adlice Software - Anti-malware and analysis tools

Operating System : Windows 10 (10.0.10586) 64 bits version
Started in : Normal mode
User : Sean [Administrator]
Started from : C:\Program Files\RogueKiller\RogueKiller64.exe
Mode : Delete -- Date : 09/06/2016 15:36:17 (Duration : 00:11:07)

¤¤¤ Processes : 0 ¤¤¤

¤¤¤ Registry : 4 ¤¤¤
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters | DhcpNameServer : 216.254.141.2 24.226.1.94 216.254.141.13 ([-][-][Canada]) -> Not selected
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 216.254.141.2 24.226.1.94 216.254.141.13 ([-][-][Canada]) -> Not selected
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{bdcd083b-5fe6-4453-b414-6192c80965c1} | DhcpNameServer : 216.254.141.2 24.226.1.94 216.254.141.13 ([-][-][Canada]) -> Not selected
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{bdcd083b-5fe6-4453-b414-6192c80965c1} | DhcpNameServer : 216.254.141.2 24.226.1.94 216.254.141.13 ([-][-][Canada]) -> Not selected

¤¤¤ Tasks : 1 ¤¤¤
[Suspicious.Path] \e02c4bd5-54d5-4470-9ea0-a68d88112c00 -- C:\Users\Sean\AppData\Roaming\QuickCleaner\QuickCleanerCSUS.exe (789902332HADB31378B2323) -> Not selected

¤¤¤ Files : 0 ¤¤¤

¤¤¤ WMI : 0 ¤¤¤

¤¤¤ Hosts File : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: ST1000LM024 HN-M101MBB +++++
--- User ---
[MBR] 637fd3555498d8dc09fdc9c4618167c6
[BSP] 189aa3f00435ada876addd2ee920acab : Empty|VT.Unknown MBR Code
Partition table:
0 - [MAN-MOUNT] EFI system partition | Offset (sectors): 2048 | Size: 100 MB
1 - [SYSTEM][MAN-MOUNT] Basic data partition | Offset (sectors): 206848 | Size: 900 MB
2 - [MAN-MOUNT] Microsoft reserved partition | Offset (sectors): 2050048 | Size: 128 MB
3 - Basic data partition | Offset (sectors): 2312192 | Size: 381546 MB
4 - Basic data partition | Offset (sectors): 783718400 | Size: 550704 MB
5 - [SYSTEM][MAN-MOUNT] Basic data partition | Offset (sectors): 1911560192 | Size: 20490 MB
User = LL1 ... OK
User = LL2 ... OK

+++++ PhysicalDrive1: HGST HTS541010A9E680 +++++
--- User ---
[MBR] 8370555c76032b9bbbf1c0a89c301a85
[BSP] 3065e6ddd6cccacb97383b5597ce2ead : Windows Vista/7/8|VT.Unknown MBR Code
Partition table:
0 - Microsoft reserved partition | Offset (sectors): 34 | Size: 128 MB
1 - Basic data partition | Offset (sectors): 264192 | Size: 99100 MB
2 - [SYSTEM][MAN-MOUNT] | Offset (sectors): 203220992 | Size: 450 MB
3 - [SYSTEM][MAN-MOUNT] | Offset (sectors): 204142592 | Size: 450 MB
4 - Basic data partition | Offset (sectors): 205064192 | Size: 853740 MB
User = LL1 ... OK
User = LL2 ... OK

+++++ PhysicalDrive2: Generic STORAGE DEVICE USB Device +++++
--- User ---
[MBR] 56f7fd06e486eb4d7b77162db1ba1249
[BSP] 7208b105e661849d4a48c279d3177d8d : Legit.Unknown MBR Code
Partition table:
0 - [XXXXXX] FAT16 (0x6) [VISIBLE] Offset (sectors): 249 | Size: 1938 MB
User = LL1 ... OK
Error reading LL2 MBR! ([32] The request is not supported. )

 

Thanks for the reply. Today they started popping up at 10:30am local time it is 3pm now and they are still showing. At the moment I am trying different virus checkers that have been suggested. Will keep updating as I progress.

 

IMHO, Unless you have a known clean image to restore from I would do a clean install and start over. There is a guide on this forum on how to this.

 

I checked the location and sure enough the file is missing, silly question why can't I replace the missing file?

 

Sean,

Please start a new thread for your issue. It is very difficult to troubleshoot more than one machine in a thread.

Thanks

 

If it were a legitimate file, replacing it might be an option.

It is a very generic name which makes researching it harder. I've found malware references and valid file references.
IObit Advanced Care and O&O Shutup (I think) were two I recall (although I wouldn't have either on a machine - they cause known issues on some machines)

See post# 3 to determine if malware is on your machine. The steps might also resolve the issue by cleaning up any malware remnants.