unasked for pop-up "Windows cannot find 'C:\Program Files (x86)\Search Extensions\Client.exe'"

Question

Almost a week ago a window started popping up when my computer first loads. It's a black rectangular window labeled taskeng.exe, but there is nothing in it. Almost immediately after a prompt comes up that says "Windows cannot find 'C:\Program Files (x86)\Search Extensions\Client.exe'. Make sure you typed the name correctly, and then try again." It opens at the very beginning, before I have typed or even clicked on anything yet.  When I click "OK" it closes and my computer runs normally, just a little slower than usual. It doesn't seem to be causing any problems, but I know there could still be something wrong that I can't see or know anything about.

I looked up taskeng.exe and I understand that it is a task manager, but that it could be linked to malware or a virus when it keeps popping up. I did a full C Drive scan with Malwarebytes and, thankfully, it said that I have no malware to delete. I do not understand why it started coming up. I did a System Restore, but nothing changed. 

Can anyone help me understand what this is and how to safely stop it from happening? 

Thank you, Kateri

Answer 1

What has happened is that your antivirus or antimalware software has properly identified client.exe as an unwanted program and removed it.  When this happens, however, there are often remnants of the malware left behind that attempt to start the now-missing malware executable.

In your case, it seems that there is a scheduled task that is attempting to start client.exe.

• Click the Start Orb, type the following into the Search box and press Enter

    Task Scheduler

• When the Task Scheduler window opens, click on "Task Scheduler (local)" in the left pane
• Use the scroll bar at the right to scroll down to "Active Tasks"
• Use the inner scroll bar to scroll through the list of Active Tasks to find the one that is attempting to start Client.exe.  Look for "C:\Program Files (x86)\Search Extensions in the "Location" field

• When you find the entry that has Search Extensions in the Location field, double click it.
• In the right pane ("Actions") find "Delete" near the bottom of the list and click it.
• Close the Task Scheduler and reboot
• You shouldn't get the popup any more

If that doesn't work, or if you can't find the correct task to delete, download Autoruns --> http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx

• Run Autoruns and after it completes scanning, confirm that the "Everything" tab is selected (it should default to that) then click File > Find and search for client.exe
• If a line with client.exe is found, confirm that the "Image Path" shows C:\Program Files (x86)\Search Extensions and then clear the checkbox at the left end of the line
• Press F3 to search for other instances of client.exe (I don't expect there to be any)
• Close autoruns and reboot
• You shouldn't get the popup anymore

If you used autoruns, once you are satisfied that the problem has been corrected and no other problem has been introduced, you can re-run autoruns and this time "Delete" the line with client.exe in it.

I suggest also using Windows Explorer to go to C:\Program Files (x86) and checking the contents of the Search Extensions folder.  If it is empty, delete the entire folder.  If files remain, they too are likely remnants of malware, but I don't want to tell you to delete them without knowing what they are.  If there are any exe files, use your favorite search engine to research the file names (or post the list back here).

Answer 2

I have run autoruns and deleted the client.exe entry but still I am getting the error on reboot.

Looks like you have similar situation like I had just several days ago.

In my case, I had a malicious program called Rocket Tab deleted just a day or so ago by my anti-virus.

I had nothing called client.exe in my computer, but using the Autoruns I found a thing with the Rocket Tab in the file name.

So my tip (though I'm an IT lame) would be you have some other file among the tasks, which is causing the window to pop up. It may be something with the malware name in the file name.

I would recommend you going one by one through all those yellow marked tasks in Autoruns (you'll also clean your computer of lots of rubbish, if you're so messy like me ;) my computer seems to be a bit faster after start up now) and delete everything that you think shouldn't be there.

Good luck!

Answer 3

I found an app that corrected the problem immediately: Piriform/CCleaner/Tools/Startup/Scheduled tasks - disable rocketab - like: ' Task RocketTab Microsoft Corporation cmd.exe /C start "" "C:\Program Files (x86)\Search Extensions\Client.exe" /Preferred=true etc.

All the best

Valentin

Answer 4

Download and run AdwCleaner from here

http://www.bleepingcomputer.com/download/adwcleaner/

This is a dedicated browser cleanup tool that does not require installing but runs standalone. Scan the system, review the results and clean the drive.

Run MSConfig and select the Startup tab. This shows all applications that are loaded during the computer startup process. Most entries will be identifiable but look for ones that reflect the error message. Disable it and restart the computer to see if the message is still shown.

Answer 5

Thank you very much for your help!  It seems to have solved the problem.

However, I am still not able to download Chrome again.  It says that I should whitelist Google update exe in fire wall, but it isn't listed there.  Are you able to help?

Sharon