[Fix] Error “Cannot find Script file” in C:\ProgramData Folder

When you log in to your computer, the following error or a similar one may appear every time.

Can not find script file C:\ProgramData\{793391F4-29B5-4072-9833-30F048B1E37E}\1.9.3.1\rolo.txt

Or you may see a Run.vbs error similar to the following:

Windows Script Host

Script:	C:\Users\Ramesh\AppData\Local\Updates\Run.vbs
Line:	31
Char:	1
Error:	The system cannot find the file specified. 
Code:	80070002
Source: (null)

This entry was added by malware, where the {GUID} string and the script file names are random and vary for each system. In the aftermath of malware removal, the above error appears when you log on to your user account. The Startup entry or Scheduled Task still exists, pointing to the missing file.

Resolution

There are many ways to identify the offending task and remove it. One of the easiest ways is to use Autoruns.

Autoruns is an advanced startup management tool from Microsoft, which is covered in detail in the article Clean Boot Windows Using the Autoruns Utility. You may want to take a glance at that article before proceeding.

Download Autoruns and run it as administrator. Wait for the entries to populate.

Use the “Quick Filter” box at the top to find the offending entry quickly. For example, type the script file name (e.g., run.vbs) in the Quick Filter box.

Note: If the item is not listed in the Scheduled Tasks tab, select the “Everything” tab.

The Run.vbs entry is usually triggered by a rogue task named “\Window Update“.

(Click on the offending entry and look at the details section at the bottom. It shows the full command-line or the arguments used by that entry.)

Right-click on the task and choose Delete.

Once done, delete the offending script file (e.g., Run.vbs) manually.

del "%LocalAppData%\Updates\Run.vbs"
schtasks /delete /tn "\Window Update"

schtasks /delete /tn "\Windows Service Task"
rd /s /q "%LocalAppData%\Updates"

Follow up with a thorough scan using Malwarebytes. You should no longer get the script error message referencing “ProgramData” at startup.