{"id":54263,"date":"2023-06-17T21:12:25","date_gmt":"2023-06-17T15:42:25","guid":{"rendered":"http:\/\/198.58.113.91\/blog\/?p=54263"},"modified":"2023-07-15T16:01:07","modified_gmt":"2023-07-15T10:31:07","slug":"windows-script-host-error-run-vbs","status":"publish","type":"post","link":"https:\/\/www.winhelponline.com\/blog\/windows-script-host-error-run-vbs\/","title":{"rendered":"Windows Script Host error in AppData\\Local\\Updates\\Run.vbs. The System cannot find the file specified"},"content":{"rendered":"

When you login to your account,\u00a0you may see a Windows Script Host error similar to the following:<\/p>\n

Windows Script Host<\/strong>\r\n\r\nScript:\tC:\\Users\\{username}\\AppData\\Local\\Updates\\Run.vbs\r\nLine:\t31\r\nChar:\t1\r\nError:\tThe system cannot find the file specified. \r\nCode:\t80070002\r\nSource: (null)<\/pre>\n
\"programdata<\/p>\n
Additionally, on some systems, you may see a WindowsService.exe<\/code> popup window that appears briefly at logon.<\/p>\n
\"windowsservice.exe<\/p>\n
Cause<\/h2>\n
The Run.vbs script and WindowsService.exe (VT analysis<\/a>) are components of a crypto-miner that has infected your computer. The miner disables Microsoft Defender Antivirus and Firewall. It also deletes the Microsoft Defender executables\/platform folder completely. The Run.vbs script and WindowsService.exe run as scheduled tasks with the highest privileges.<\/p>\n
Resolution<\/h2>\n
**First, download Malwarebytes Antimalware and run a thorough scan. Eliminate every item it finds.**<\/strong><\/p>\n
Malwarebytes will removes most of the crypto-malware files, but its scheduled task and the run.vbs script file may remain. There are many ways to delete the offending scheduled task and remove it. One of the easiest ways is to use Autoruns.<\/p>\n
(Autoruns is an advanced startup management tool from Microsoft, which is covered in detail in the article Clean Boot Windows Using the Autoruns Utility<\/a>.)<\/i><\/p>\n
    \n
  1. Download Autoruns<\/a> and run it as administrator.\u00a0Wait for the entries to populate.<\/li>\n
  2. Use the “Quick Filter” box at the top to find the offending entry quickly. For example, type the script file name (e.g., run.vbs) in the Quick Filter box.\n
    Note:<\/strong> If the item is not listed in the Scheduled Tasks tab, select the “Everything” tab.<\/em><\/li>\n
  3. The Run.vbs entry is usually triggered by a rogue task named “\\Window Update<\/strong>“.\n
    \"programdata<\/p>\n
    (Click on the offending entry and look at the details section at the bottom. It shows the full command-line or the arguments used by that entry.)<\/em><\/li>\n
  4. Right-click on the task and choose Delete.<\/li>\n
  5. Next, look for a task named “Windows Service Task” pointing to the executable “WindowsService.exe”, delete<\/strong> the task.<\/li>\n
  6. Delete the\u00a0corresponding files, Run.vbs<\/strong> and WindowsService.exe<\/strong> manually. The files will be located in the following folder:\n
    C:\\Users\\%username%\\AppData\\Local\\Updates\\<\/pre>\n<\/li>\n
  7. Exit Autoruns.<\/li>\n<\/ol>\n
    \n
    Using Command-line<\/h4>\n
    To accomplish the above using command-line, open admin Command Prompt and run:<\/p>\n
    del \"%LocalAppData%\\Updates\\Run.vbs\" \/a\r\nschtasks \/delete \/tn \"\\Window Update\" \/f\r\n<\/pre>\n
    \"programdata<\/p>\n
    Also, run:<\/p>\n
    schtasks \/delete \/tn \"\\Windows Service Task\" \/f\r\nrd \/s \/q \"%LocalAppData%\\Updates\"\r\n<\/pre>\n<\/div>\n
    Important<\/h3>\n
      \n
    1. Clear the Microsoft Defender Antivirus exclusions. The Run.vbs malware may have added entries to the exclusions.<\/li>\n
    2. Delete all Microsoft Defender policies added by the malware. To clear the policies, see instructions in the article Microsoft Defender “Managed by your administrator”<\/a><\/li>\n
    3. For a thorough inspection, run the Farbar Scanner<\/a> tool and inspect FRST.txt and Addition.txt logs.<\/li>\n
    4. If Microsoft Defender Antivirus files are deleted and you’re unable to launch<\/a> Microsoft Defender Antivirus service and Windows Security, do an in-place upgrade (repair installation) by downloading the Media Creation Tool or ISO.<\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"
      When you login to your account,\u00a0you may see a Windows Script Host error similar to the following: Windows Script Host Script: C:\\Users\\{username}\\AppData\\Local\\Updates\\Run.vbs Line: 31 Char: 1 Error: The system cannot find the file specified. Code: 80070002 Source: (null) Additionally, on some systems, you may see a WindowsService.exe popup window that appears briefly at logon. Cause … Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[8,869],"tags":[191,963],"class_list":["post-54263","post","type-post","status-publish","format-standard","hentry","category-windows-10","category-windows-11","tag-error-messages","tag-malware"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":1666,"url":"https:\/\/www.winhelponline.com\/blog\/cannot-find-script-run-vbs-logon\/","url_meta":{"origin":54263,"position":0},"title":"Fix “Can not find script file C:\\WINDOWS\\run.vbs” at Logon","author":"Ramesh","date":"February 20, 2016","format":false,"excerpt":"When you log on to your computer, the error \"Can not find script file C:\\WINDOWS\\run.vbs\" with Windows Script Host in the title is shown on a blank screen with a black background. This happens if malware has modified the Userinit registry value, replacing the Windows default value data with a\u2026","rel":"","context":"In "Windows"","block_context":{"text":"Windows","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/w10\/run_vbs_err-1.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/w10\/run_vbs_err-1.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/w10\/run_vbs_err-1.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":18890,"url":"https:\/\/www.winhelponline.com\/blog\/windows-defender-service-missing-security-page-empty\/","url_meta":{"origin":54263,"position":1},"title":"Windows Defender Service Missing; Security at a glance page is Empty","author":"Ramesh","date":"September 26, 2020","format":false,"excerpt":"In the aftermath of malware infection, when you open the Services MMC on a Windows 10 or 11 computer, you may find that the Windows Defender (\"Microsoft Defender Antivirus Service\") service is missing from the Services MMC. The Windows Security settings \"Security at a glance\" page may show up empty\u2026","rel":"","context":"In "Windows 10"","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"advancedrun start regedit.exe","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/09\/advancedrun-start-regedit.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/09\/advancedrun-start-regedit.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/09\/advancedrun-start-regedit.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":8664,"url":"https:\/\/www.winhelponline.com\/blog\/error-specified-file-not-registry-script-cannot-import-file-regedit\/","url_meta":{"origin":54263,"position":2},"title":"[Fix] Cannot import file: The specified file is not a registry script","author":"Ramesh","date":"April 15, 2019","format":false,"excerpt":"When you try to import a registry file (.reg) by double-clicking it or by using the Import option from within the Registry Editor, the following error occurs. As a result, the .reg file is not imported. Registry Editor Cannot import filename.reg: The specified file is not a registry script. You\u2026","rel":"","context":"In "Windows"","block_context":{"text":"Windows","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/"},"img":{"alt_text":"specified file is not a registry script","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/04\/regedit-import-error-binary-files-blank-space.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/04\/regedit-import-error-binary-files-blank-space.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/04\/regedit-import-error-binary-files-blank-space.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/04\/regedit-import-error-binary-files-blank-space.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":3152,"url":"https:\/\/www.winhelponline.com\/blog\/windows-script-host-disabled-machine-contact-administator\/","url_meta":{"origin":54263,"position":3},"title":"[Fix] Windows Script Host Access is Disabled on this Machine","author":"Ramesh","date":"May 24, 2016","format":false,"excerpt":"When you run a Windows script using wscript.exe or cscript.exe, error Windows Script Host access is disabled on this machine may pop-up. However, in systems affected by malware, the error appears at regular intervals, without any script invocation by the user. So the key questions are: Which script is being\u2026","rel":"","context":"In "Windows"","block_context":{"text":"Windows","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/"},"img":{"alt_text":"regedit icon","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2018\/07\/regedit-icon-small.png?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]},{"id":5488,"url":"https:\/\/www.winhelponline.com\/blog\/xdgaudio-vbs-80070002-malware\/","url_meta":{"origin":54263,"position":4},"title":"Error 80070002 xdgaudio.vbs cannot find the file specified?","author":"Ramesh","date":"October 12, 2017","format":false,"excerpt":"If you're receiving the following error message related to \"xdgaudio.vbs\" in your system, then your computer is most likely infected. Script:\u00a0\u00a0\u00a0 C:\\windows\\xdgaudio.vbs Line:\u00a0\u00a0\u00a0 3 Char:\u00a0\u00a0\u00a0 1 Error:\u00a0\u00a0\u00a0 The system cannot find the file specified. Code:\u00a0\u00a0\u00a0 80070002 Source:\u00a0\u00a0\u00a0\u00a0 (null) When edited with Notepad, the script may contain lines such as below:\u2026","rel":"","context":"In "Windows"","block_context":{"text":"Windows","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/"},"img":{"alt_text":"xdgaudio.vbs error malware","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/10\/xdgaudio-error-1.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/10\/xdgaudio-error-1.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/10\/xdgaudio-error-1.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":8771,"url":"https:\/\/www.winhelponline.com\/blog\/find-and-delete-empty-folders-windows\/","url_meta":{"origin":54263,"position":5},"title":"How to Find and Remove Empty Folders in Windows","author":"Ramesh","date":"April 21, 2019","format":false,"excerpt":"Over time, hundreds of empty folders and junk files may take up your hard disk. While the junk files occupy disk space and can be cleaned up using Disk Cleanup or Storage settings, the empty directories remain. The empty folders don't take up disk space, but to organize your data\u2026","rel":"","context":"In "Utilities"","block_context":{"text":"Utilities","link":"https:\/\/www.winhelponline.com\/blog\/category\/utilities\/"},"img":{"alt_text":"find and delete empty directories using searchmyfiles utility","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/04\/searchmyfiles_find_empty_folders_1.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/04\/searchmyfiles_find_empty_folders_1.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/04\/searchmyfiles_find_empty_folders_1.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]}],"_links":{"self":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts\/54263","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/comments?post=54263"}],"version-history":[{"count":0,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts\/54263\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/media?parent=54263"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/categories?post=54263"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/tags?post=54263"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}