Wierd Startup Issue!

My daughter (away in college) called me about a problem she has been experiencing since early Jan. Every time she starts up her Win7 notebook an MS Publisher file opens over her desktop! She didn't tell me about this sooner because other than this annoyance her system is working well.

I got on her system with TeamViewer and checked out her startup folder as well as the startup entries in MSCONFIG and did not see anything related to her issue. I could not even find that document in her Documents folder!!! I then thought about rolling back her system to a prior System Restore point, but her SR points don't go back far enough. Both a Bitdefender scan and a MBAM scan found no infections.

I'm out of ideas, so I'd appreciate it if you guys can provide some other troubleshooting things for me to do.

 

You can try using Autoruns and check autostart entries. It will show more autostart locations than msconfig. You can find it here:

https://technet.microsoft.com/en-us/sysinternals/bb963902.aspx

 

Cruise,

You can search for *.pub with "Everything"

http://www.voidtools.com/

Then move/delete/rename

 

Minimalist, thanks for the suggestion.

 

Thanks Brian. Does 'Everything' also allow searching for a specified string (within the file contents)?

 

I don't think so.

 

You are correct. Everything only indexes and searches file names and address.

 

Good idea stapp - I'll be sure to do that as well.

 

Thanks for confirming. Instead of 'Everything' I think I'll go for 'FileSeek' which, in addition, can search for specified file contents.

 

After much searching, the offending (Publisher) file is nowhere to be found - very very strange! I can't find anything responsible for this startup issue in any Startup Folder, nor does it show up in Autoruns or Scheduled Tasks. Searching for the file by name, extension, or contents doesn't find a thing! This problem has me totally perplexed.

 

Two more suggestions. While the file is still open run Process Exlorer (you can download it here: https://technet.microsoft.com/en-us/sysinternals/processexplorer.aspx)
When Process explorer is open, check which process has launched Publisher executable:



As you can see in my screenshot in my case explorer.exe launched Launchy.exe and Launchy.exe has run procexp.exe which then run procexp64.exe. You can do the same for publisher executable.

Second:
Hoover over publisher executable and you will get tooltip:



In my case I hoovered over notepad.exe and in tooltip it is shows that T:\To_Do.txt file is open. This way you can find the location from which the file is open.

 

Thanks again Minimalist, but the Publisher file that opens upon system startup just remains open for several seconds and is gone (not minimized) by the time I'm able to run Process Explorer!

 

If you can send an autoruns log, I can have a look.

 

Thanks a lot guys. I won't get a chance to explore your ideas until this weekend, at which time I will follow through.

 

Hm, too bad. But for those situations Sysinternals has another goody. Process monitor: https://technet.microsoft.com/en-us/sysinternals/processmonitor.aspx
You can run boot time logging as described here: https://www.msigeek.com/6231/how-to-enable-system-boot-time-logging-using-process-monitor-tool
Since it monitors and logs "everything" you will most likely find out what's going on. With it's great filtering options it shouldn't take you too long to find out what's the reason of this startup issue.