Fix “Can not find script file C:\WINDOWS\run.vbs” at Logon

When you logon to your computer, the error "Can not find script file C:\WINDOWS\run.vbs" with Windows Script Host in the title is shown, in a blank screen with black background. This happens if a malware has modified the Userinit registry value, replacing the Windows default value data with a Vbscript filename.

Important #1: This post just explains how to fix the Userinit value and thereby helps you get access to your user profile. Whereas the malware which caused the problem in the first place might still be active and lurking around in the system. And in this case, the problem seems to have been caused by a complex malware that adds core components to the system making the removal process difficult. So, it’s highly advisable to get your system professionally checked for malware and eliminating them completely.

Fixing the Userinit Value

Note: If Task Manager doesn’t open due to DisableTaskMgr Policy enabled by the Malware, carry out the following procedure via Recovery Environment. Check out article How to Edit the Registry Offline Using Windows Recovery Environment? for more information.

After typing the logon credentials, system may stall at Preparing to login screen. Press CTRL+ALT+DEL, and click Task Manager. When the above error message dialog is visible, dismiss the dialog and switch to the Task Manager window. The file referenced in the Userinit registry value is run even before the user interface loads. To start the Explorer shell, switch to the Task Manager window, click File, and select Run new task. Type explorer.exe and press ENTER.

Start Registry Editor (Regedit.exe) and go to:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Double-click Userinit value and change the value data from:

wscript C:\WINDOWS\run.vbs,

to the following: [Caution: Take special care when entering. You need to remove wscript part.]

C:\Windows\system32\userinit.exe,

*Important #2*: If Windows is installed in a different drive than C:\, type the actual drive-letter and path. Also, include the trailing comma (,) as shown above. Take extreme care when typing the Userinit value, as typing a incorrect file name or path will prevent you from logging on to any user account. I’m not responsible if you type a wrong path and lock your self  out of your user account.

Exit the Registry Editor.

Logoff and login back so that the Userinit.exe loads correctly and does the initialization or preliminary jobs like running logon scripts etc.

This fixes the run.vbs logon error message. Although the Vbscript file run.vbs may have been deleted by your anti-virus software, it’s still advisable to run a thorough scan.

Video Tutorial: Fix "Run.vbs" Error at Startup

About the author

Ramesh Srinivasan founded Winhelponline.com back in 2005. He is passionate about Microsoft technologies and has a vast experience in the ITeS industry — delivering support for Microsoft's consumer products. He has been a Microsoft MVP [2003 to 2012] who contributes to various Windows support forums.

136 thoughts on “Fix “Can not find script file C:\WINDOWS\run.vbs” at Logon

  1. I was already thinking of how to change firmware but with this I fixed it in no time without spending a dime. thanks a lot.
    You rock!

  2. Thank you so much
    Accept my sincere love and respect
    I went to the maintenance shop has no solution but to change Windows only
    The problem has been overhauled.

  3. Hello,
    I can not run the taskmanager . Have win 10.strg+win+entf. or win +x win +r no function
    Please help me.
    greetz from germany

  4. Georg: Thanks for the feedback. It’s strange how NOD32 or MBAM missed the run.vbs infection in the first place. Incidentally, I purchased a MBAM Premium license y’day. The web protection part is working fine as I see.

  5. It’s amazing since this is the ONLY actually working solution to the problem! I spent 4 hrs on my wife’s PC yesterday trying it to boot cleanly again after a malware infection and cleanup with malwarebytes and other virus checkers. The funny thing is that the infection was not even the problem (this could be solved relatively easily), the problem was the remaining “wscript” part instead of the userinit in the registry. (Which, after finding this post, I could correct in less than a minute).

    What’s “amazing” is that NO ONE on Microsoft tech forums or malwarebytes forum or anywhere else had a reply for fixing this.

    Instead, the malwarebytes forum and MS forum recommended entirely unnecessary things, like running “Defender offline” (which didn’t work at all since it cannot update definitions from the USB stick) or running “rogue killer” for scanning for root kits etc etc. which took me 90mins for a scan – but ALSO of course didn’t solve the problem since the wrong “wscript” entry was still in the registry preventing the PC from boot. (You can run virus checkers until you are blue in the face, they won’t correct the entry in the registry!)

    What’s “funny” is also that no run of malwarebytes or NOD32 or whatever actually SPOTTED the problem and advised to correct it, and even worse (and even more bizarre) a system restore to last Friday before I had the infection (and then also booting from “Last Good Configuration”) did not restore the computer for a proper boot, the corrupt registry entry was *still* there and giving black screen on boot. (Which baffles me since I could’ve sworn that taking “last good configuration” or a system restore would actually use a registry backup).

    The funny part is that it was at some point very obvious that the PC *was* actually cleaned from all malware and that the PC “in principle” worked since you could enter CMD shell from the black screen and then run “explorer” to start windows. It was very clear that “something” still tried to run script (wscript), but that the dangerous script was removed and that the PC “hung” because of this remaining entry in the registry. (Simply describing to someone “black screen with wscript error after removal of malware with malwarebytes” should *immediately* bring someone to *THIS* solution, and not to entirely useless and incompetent blahblah which has nothing at all to do with actual problem – since the issue and fix are NOW actually obvious, once you learn what the issue was)

    Let me just estimate that hundreds of people who possibly run into the same problem after an infection “solved” this by having to entirely reinstall their PC…which is a joke seeing that the fix was a matter of seconds which could have saved them re-installing their PCs. And all the “experts””giving advice” on the internet…if you mention to them that this is a wscript error before boot and they instead just tell you to scan your computer again [pointless, since the malware was already removed] from safe mode or recovery console..it’s very clear these people have no clue whatsoever what they’re even talking about. In particular since this seems to be rather common after infection and cleanup with malwarebytes)

    Anyway I want to thank you very much since you not only helped me to make the PC bootable again…I also learned something valuable which can help me the next time should I run into this. Sorry for the long rant..I was just angry to read all the “experts” yesterday which served only that I wasted many pointless hours yesterday at night UNTIL I came across your post!! THANKS!!!

  6. I have got this issue for more than a week in my Asus R558u notebook. I was installing Kaspersky Antivirus and some files are downloading at that time. But suddenly it start opening explorer tabs and some other things. I tried to close it, shutdown my Pc, But nothing helped the desktop is freezed. So i shutted it down from the power key by pressing it for some time.
    And after that when i turned it on, after filling the password of Windows, the Black Screen with cursor welcoming me with this Script Host Error thing. Now its showing cannot find the vbs file and all.
    I am unable to open the task manager. But from the cmd i opened regedit and done as you have said but the value is right there, nothing about vbs.
    On entering safe mode after it, the Windows start the Blue Screen Loop and restarting again and again.
    Please help, what should i do.

  7. I can’t fix these problem cause,there s after disabling the error msg I cant open explorer.exe file in the task even I typed with browsing file

  8. The file “run.vbs” isn’t missing for me. Thing is a malware was deleting it until i noticed some really suspicious activity in my background processes. I then manually killed that task, only to realize it was a malware. Luckily, none of my files got deleted. However, in run.vbs, a specific value was changed during the deletion process. I hope you can help me figure out what that value is. I already have VBS programming experience. Its only the value i’d like to know. Thank you and i hope you answer soon.

  9. Thank a lot, i had many problem, and i fixed with your tutorial. Expert! Great man! Thank thank thank you so so so much! Good luck and all the best!

  10. Thank you very much! You are truely a genius! I downloaded some type a maliware/virus today and your step by step video worked! Thank you and god bless!

  11. I did exactly what you said except I used system64 instead of system32 as I’m running Windows7 -64 and it rebooted all looking good at first but now I’m stuck with a completely black screen and now I have no computer at all. at least before I could use it, it was just real slow with that Error message.

  12. 24 hrs headache had gone in no time. Your professional advise and well structured instruction had been key to get me out of trouble. It is really awesome. Thanks a million!

  13. Omg this post helped couldn’t think of one to use and I just fired the gun and tried it, it actually worked, God bless u. :)

  14. Hi

    I just type “explorer.exe” , but what comes out is “C:\windows\system32\config\systemprofile\desktop refers for location that is unavailable…….”

    How to fix this? Thanks

  15. Thanks Man !
    Everything was failed to run till I typed “explorer.exe” and run it , then everything came back to live ! Start Menu , Desktop , … etc. everything came back to live !
    Shukrann <3

  16. THANK YOU!!! Was locked out of my computer, 3 hours later, after reading this article, the only article that worked!!!
    I’m up & running again!!!
    I’m reinstalling malwarebytes, it has found 152 detected objects, so far, still running.
    My computer totally fried after I started downloading an Obvious malware file, I tried to stop download. UGH. My mistake, I know better, but normally I can find, delete malware manually. Today, was totally locked out of my computer.
    Life Lesson.

    THANKS soooooooooo MUCH!
    Kim

  17. I too have the same problem but want to know if it works
    with win 7, 64 bit? do i have to edit C:\Windows\system32\userinit.exe, to C:\Windows\system64\userinit.exe,?

  18. My brothers . things he said was fine . But many of your laptops is not fixed right now also . so I can fix. it step 1- open any of your anti malware protection software like byte fence[ I handle my situation with this software only] and just scan your computer

  19. I felt a huge weight go off my chest, Thanks to whoever wrote this you are a real life saver, The fact is i’m using my mother’s computer right now and she usually blames me for anything that happens to it so when i saw the error message i thought “My mom’s gonna kill me -_-“

  20. Weird, I saw this prompt, then I launched “explorer.exe”, then my desktop just loaded.

    Guess this malware’s a puss.

  21. Accolades to the dude that posted this solution. I had a nightmare run going from a PUP infected Win 8.1 to Windows 10. I cleaned all the virus crap from 8.1 but then was left with a Microsoft “Upgrade now” dialogue box but no way to close it. The options were “upgrade now’ or do it on one of the next four days. I bit the bullet and did it, and that’s when I hit this black screen with cursor and a minimised Windows Script error window. Anyhow, tried the above, and it got rid of the Win Script window, but I still had the black screen and cursor. After lots of agonising I reverted to Win 8.1 and performed the same steps as above. Cold booted, and all was well again. BTW when I looked at that UserInit setting in Regedit it showed a value of “wscript,” only. I haven’t tried upgrading to Windows 10 again, but if any of you dudes are game enough to give it a shot then I’d love to know how ya go. nb Mine is a Lenova laptop with NVidia.

  22. Really
    I donot know how can i thank you
    There are not words can explain this
    Because you saved me and my important files

    Thanks dear very much

  23. What if the file isn’t there at all? ‘wscript C:\WINDOWS\run.vbs,’

    Is there a way to create a new one that does the same thing?

  24. //It won’t allow me to change the value since I am not using the admin login. But the admin login has vanished, so I can’t use my admin login.

  25. Hi. I have the same problem, the thing is I cannot even open it. Everytime I turn it on, it asks me for a password then I put it in. After that, the message comes out (the same as on above). please help me… anyone?

  26. Thank you man, this was driving nuts! the malware that caused this was nimeckreelule, is the same NMCLOGSERVICE.EXE, which installed bunch of crap like badu, tencent QQ, yesplayer, yesbdn, uc browser, etc. God damn chinese crap.

  27. THANK YOU, you literally saved my life. Ahah ok not that extreme but I had loads of assignments to do. Thank youuu???? God bless

  28. BLOODY MASTERMIND YOU ARE!!!!!!!GOD BLESS YA FOR SHARING YOUR EXPERTISE AND KNOWLEDGE!! SUPERLY DUPERISHLY GRATEFUL!!!!!!!!!THANK YOU.!!!! MAY THA BENEFICIAL KARMA ANGELS ENSURE MULTIPLE BLESSINGS UPON YOU AND YOUR LIFE ? !AMEN!

  29. Oh you really saved my computer, i thought it way dead!!! Thank you!!!
    Can you recomend any good malware cleaning programs?

  30. Thank God I have two computers. Thank you sooo much!! This really works. I wouldn’t know what to do other than take the computer in for service which could cost me at least $50.00 or more. You made my day!! Now I need to run some kind of spyware software as this bug that was put into the computer cause this error.

  31. Man, you really saved my day, tried a whole bunch of solutions prposed both from HP themself as well as a variety of forums.

  32. wooo amo a quien escribió esto , intente mil veces a que funcionara con otros vídeos y cosas . y solo esto fue la mejor ayuda, solo una palabra para que funcionara …. explorer.exe :)

  33. @Abdulla: Thanks for the note about the filter driver. I’ll add this note at the top, plus a link/redirect to an appropriate security forum.

  34. Yes, I see “it’s still advisable to run a thorough scan.” but this is not so easy to remove especially rouge software called “MPC Cleaner” which is installed by this infection. I don’t think anti virus scan will remove it.
    It uses minifilter driver (MPCKpt.sys) to attach itself to hdd partition to prevent deletion of MPC Cleaner. Its practically impossible to remove it under normal mode in windows. But it can be easy deleted using WinRE or Linux Livecd.

Comments are closed.