My daughter (away in college) called me about a problem she has been experiencing since early Jan. Every time she starts up her Win7 notebook an MS Publisher file opens over her desktop! She didn't tell me about this sooner because other than this annoyance her system is working well. I got on her system with TeamViewer and checked out her startup folder as well as the startup entries in MSCONFIG and did not see anything related to her issue. I could not even find that document in her Documents folder!!! I then thought about rolling back her system to a prior System Restore point, but her SR points don't go back far enough. Both a Bitdefender scan and a MBAM scan found no infections. I'm out of ideas, so I'd appreciate it if you guys can provide some other troubleshooting things for me to do.
You can try using Autoruns and check autostart entries. It will show more autostart locations than msconfig. You can find it here: https://technet.microsoft.com/en-us/sysinternals/bb963902.aspx
Thanks Brian. Does 'Everything' also allow searching for a specified string (within the file contents)?
Thanks for confirming. Instead of 'Everything' I think I'll go for 'FileSeek' which, in addition, can search for specified file contents.
After much searching, the offending (Publisher) file is nowhere to be found - very very strange! I can't find anything responsible for this startup issue in any Startup Folder, nor does it show up in Autoruns or Scheduled Tasks. Searching for the file by name, extension, or contents doesn't find a thing! This problem has me totally perplexed.
Two more suggestions. While the file is still open run Process Exlorer (you can download it here: https://technet.microsoft.com/en-us/sysinternals/processexplorer.aspx) When Process explorer is open, check which process has launched Publisher executable: As you can see in my screenshot in my case explorer.exe launched Launchy.exe and Launchy.exe has run procexp.exe which then run procexp64.exe. You can do the same for publisher executable. Second: Hoover over publisher executable and you will get tooltip: In my case I hoovered over notepad.exe and in tooltip it is shows that T:\To_Do.txt file is open. This way you can find the location from which the file is open.
Thanks again Minimalist, but the Publisher file that opens upon system startup just remains open for several seconds and is gone (not minimized) by the time I'm able to run Process Explorer!
Might be worth having a read here http://www.sevenforums.com/tutorials/208799-programs-documents-run-user-logon.html
Thanks a lot guys. I won't get a chance to explore your ideas until this weekend, at which time I will follow through.
Hm, too bad. But for those situations Sysinternals has another goody. Process monitor: https://technet.microsoft.com/en-us/sysinternals/processmonitor.aspx You can run boot time logging as described here: https://www.msigeek.com/6231/how-to-enable-system-boot-time-logging-using-process-monitor-tool Since it monitors and logs "everything" you will most likely find out what's going on. With it's great filtering options it shouldn't take you too long to find out what's the reason of this startup issue.