The other day i accidentally deleted "c:/ProgramData/document/cdocumentc.vbs" now it keeps showing can not find script file "c:/ProgramData/document/cdocumentc.vbs"

Question

The other day i accidentally deleted "c:/ProgramData/document/cdocumentc.vbs" now it keeps showing can not find script file "c:/ProgramData/document/cdocumentc.vbs"

Anne 0

User's image

I permenently deleted that file accidentally and didn't think much of it. but now I'm getting worried, i tried downloading autoruns and it did not work so if you have any more answers please tell me.

MotoX80 36,401 Reputation points

2023-10-09T16:57:22.17+00:00

i tried downloading autoruns and it did not work

What error did you get? What exactly did not work?

Are there any other files in C:\ProgramData\document? Do you know where that folder came from? Is it related to some software that you installed?
Anne 0 Reputation points

2023-10-09T18:47:00.38+00:00

can not find script file "c:/ProgramData/document/cdocumentc.vbs" is the error. I tried using Autoruns (I got it from another resource) I'm pretty sure that C:\ProgramData\document is from the script files for my laptop.
MotoX80 36,401 Reputation points

2023-10-09T19:40:19.18+00:00

No, I meant the error with Autoruns. You said that it did not work.

Something has to be launching wscript.exe in order to generate that script error. I would expect autoruns to point out a scheduled task or something in a startup folder.

Are there other files in that folder? Open some of them up with notepad and see if they contain comments that indicate where they came from.

What did cdocumentc.vbs do? What prompted you to delete it?

Scroll through all of the autoruns entries and look for cdocumentc.vbs at the bottom of the screen.

If you don't find anything, then download and run Process Explorer.

https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer

Click and hold on the target icon and drag and drop it onto the script window. That will highlight the process.

The process column will be indented by parent/child processes. Look at the parent to see if you can identify the bat file being called.
MotoX80 36,401 Reputation points

2023-10-10T11:40:28.5233333+00:00

Did you check the recycle bin to see if the file is in there? Just restore it if it is.
Anne 0 Reputation points

2023-10-28T20:34:19.7533333+00:00

it was flagged as harm in my anti virus, so I deleted it. i checked my recycle bin if it was there and it was not. i used autoruns again. i typed "vbs" inside of the quick filter box and this is what it showed

now I don't know what else to do
MotoX80 36,401 Reputation points

2023-10-29T00:51:57.5833333+00:00

If your AV flagged it as harmful, it would be real nice to know what malware/vulnerability/virus it detected. You really need to determine if this is a false positive, or if you have something on your pc that is scanning for your credit card numbers.

Back on Oct 9, I asked this question.

Are there other files in that folder? Open some of them up with notepad and see if they contain comments that indicate where they came from.

Based on the image that you posted, there is a commands.vbs file in that folder. What is in it? Use notepad to open it. Are there other files in that folder? What is in them? Can you track them back to some legitimate software that you installed?

If you don't know how to interpret VB script code, then post the contents, or share an image of what you find.

Using the Windows explorer, you may have to type in "C:\ProgramData" in order to see the folder contents. It's a hidden folder.
Anne 0 Reputation points

2023-10-29T10:24:47.6266667+00:00

Is this what you are asking for? (The commands.vbs file)
MotoX80 36,401 Reputation points

2023-10-29T12:14:44.0633333+00:00

Yes, the commands.vbs file. But you circled Windows\System32. That's not where the file is.

Run notepad and do a file/open. Type in C:\programdata and hit enter. Its hidden so it won't show up for you to click on it.

You will see folders from MS and your PC manufacturer. Look for the document folder and open it. If it is also hidden and you don't see it, type it in. Take a screen snapshot of the files that are in that folder. Find the .vbs file and open it.

If you don't recognize the contents or don't know how to interpret the code, then do a file/save and save it as a .txt file on your desktop. Use the paperclip icon and post it to the forum.
Anne 0 Reputation points

2023-10-30T17:03:57.6+00:00

it said no items match your search. What do I do?
MotoX80 36,401 Reputation points

2023-10-30T17:11:44.11+00:00

I didn't say to do a search. I said to run notepad, do a file/open and type in C:\ProgramData. It is a hidden folder.
Anne 0 Reputation points

2023-10-30T17:28:59.32+00:00

what next?
MotoX80 36,401 Reputation points

2023-10-30T17:32:54.23+00:00

Double click on the document folder. Are there any other files besides commands.vbs in it?

Then open commands.vbs. What's in it?
Anne 0 Reputation points

2023-10-30T17:38:18.79+00:00

what do i type in?
MotoX80 36,401 Reputation points

2023-10-30T17:44:25.93+00:00

Change this to All Files.
Anne 0 Reputation points

2023-10-30T17:48:05.2366667+00:00

there is no command.vbs
MotoX80 36,401 Reputation points

2023-10-30T18:02:52.9166667+00:00

Does August 11 ring any bells? What were you doing around 7:24 PM?

Open up all of those files with notepad. Let' see what's in them.

Basically, I want to get an idea if they are malicious or not. Or somehow track them back to something legitimate that you were doing.

Then we will run a full antivirus scan and a MRT scan.

I've helped some other forum users who got impacted with crypto mining malware. In their case it did not appear that they had exposed any personal data. So they deleted the files but had to install MalwareBytes because Windows Defender did not detect the files as malicious.

You might have to do that too. But we don't just want to delete those files without first understanding what risk, if any, they present to your personal data.