Windows script host pop up

Question

No matter the suggestions I cannot get this to go away.

Answer 1

That script popup usually indicates that malware has been removed from your PC and all that remains is a redundant registry value.

Click the link below to download a small free utility that does not require installation.

https://download.sysinternals.com/files/Autoruns.zip

When the file downloads, unzip it.

Run Autoruns64 as Administrator

1

Select the 'Logon' tab at the top of Autoruns.

Please provide a screenshot of all entries on that tab.

2

Select the 'Scheduled Tasks' tab at the top of Autoruns.

Please provide a screenshot of all entries on that tab.

Answer 2

The pop-up is caused by Windows Script Host trying to run a VBScript file (PiceVid.vbs) that no longer exists, typically from a leftover startup entry (often from adware or a fake “antivirus”/popup site).

Remove the startup entry and check for browser-based scam notifications or malware.

1. Disable the missing script from startup
   1. Press Ctrl + Shift + Esc to open Task Manager.
   2. Go to the Startup apps tab.
   3. Look for any suspicious or unknown entry (especially anything referencing PiceVid, .vbs, or a blank/unknown publisher) and set it to Disabled.
   4. Restart the PC and confirm whether the pop-up is gone.
2. Check Task Scheduler
   1. Press Win + R, type taskschd.msc, press Enter.
   2. In Task Scheduler Library, look through tasks for any unknown/suspicious name.
   3. For each suspicious task, open Properties and check the Actions tab for references to PiceVid.vbs or a .vbs file under your user profile.
   4. Delete any task that launches that missing script.
3. Clean up browser notification scams (common source of fake AV popups) These scams often start from malicious websites that were allowed to send notifications. In Microsoft Edge:
   1. Open Edge.
   2. Go to settings for Notifications (as described in the McAfee/Norton popup guidance): remove or block any strange sites in the Allow list.
   3. Remove any suspicious extensions.
   In Chrome (if installed):
   1. Open Chrome.
   2. Open Notifications settings and remove suspicious sites from Allowed to send notifications.
   3. Remove suspicious extensions.
4. Run security scans
   1. Open Windows Security → Virus & threat protection → Scan options → Full scan and let it complete.
   2. Optionally run Microsoft’s Safety Scanner as an additional check (see the malware-scan guidance in the referenced answer).
5. If a browser “lock” or fake virus alert appears again Use the methods described for closing scam pop-up pages:
   • Press Alt + F4 or Ctrl + Shift + Esc and end the browser task.
   • Restart the PC if needed and clear the browser cache.

After the startup entry and any scheduled task referencing PiceVid.vbs are removed, Windows Script Host will stop trying to load that missing file and the pop-up will no longer appear.

---

References:

• How can I remove McAfee Norton Pop Ups on Windows 11? It is not showing up on Apps or Task Manager. - Microsoft Q&A
• possible virus, computer locked - Microsoft Q&A