Wierd Startup Issue!

Discussion in 'other software & services' started by Cruise, Feb 3, 2016.

  1. Cruise

    Cruise Registered Member

    Joined:
    Jun 10, 2010
    Posts:
    1,024
    Location:
    USA
    My daughter (away in college) called me about a problem she has been experiencing since early Jan. Every time she starts up her Win7 notebook an MS Publisher file opens over her desktop! She didn't tell me about this sooner because other than this annoyance her system is working well.

    I got on her system with TeamViewer and checked out her startup folder as well as the startup entries in MSCONFIG and did not see anything related to her issue. I could not even find that document in her Documents folder!!! I then thought about rolling back her system to a prior System Restore point, but her SR points don't go back far enough. Both a Bitdefender scan and a MBAM scan found no infections.

    I'm out of ideas, so I'd appreciate it if you guys can provide some other troubleshooting things for me to do.
     
  2. Minimalist

    Minimalist Registered Member

    Joined:
    Jan 6, 2014
    Posts:
    5,078
  3. Brian K

    Brian K Imaging Specialist

    Joined:
    Jan 28, 2005
    Posts:
    8,647
    Location:
    NSW, Australia
  4. Cruise

    Cruise Registered Member

    Joined:
    Jun 10, 2010
    Posts:
    1,024
    Location:
    USA
  5. Cruise

    Cruise Registered Member

    Joined:
    Jun 10, 2010
    Posts:
    1,024
    Location:
    USA
    Thanks Brian. Does 'Everything' also allow searching for a specified string (within the file contents)?
     
  6. Brian K

    Brian K Imaging Specialist

    Joined:
    Jan 28, 2005
    Posts:
    8,647
    Location:
    NSW, Australia
    I don't think so.
     
  7. stapp

    stapp Global Moderator

    Joined:
    Jan 12, 2006
    Posts:
    7,293
    Location:
    England
    Just in case, also check the scheduled tasks.
     
  8. phalanaxus

    phalanaxus Registered Member

    Joined:
    Jan 19, 2011
    Posts:
    499
    You are correct. Everything only indexes and searches file names and address.
     
  9. Cruise

    Cruise Registered Member

    Joined:
    Jun 10, 2010
    Posts:
    1,024
    Location:
    USA
    Good idea stapp - I'll be sure to do that as well.
     
  10. Cruise

    Cruise Registered Member

    Joined:
    Jun 10, 2010
    Posts:
    1,024
    Location:
    USA
    Thanks for confirming. Instead of 'Everything' I think I'll go for 'FileSeek' which, in addition, can search for specified file contents.
     
  11. Cruise

    Cruise Registered Member

    Joined:
    Jun 10, 2010
    Posts:
    1,024
    Location:
    USA
    After much searching, the offending (Publisher) file is nowhere to be found - very very strange! I can't find anything responsible for this startup issue in any Startup Folder, nor does it show up in Autoruns or Scheduled Tasks. Searching for the file by name, extension, or contents doesn't find a thing! This problem has me totally perplexed. o_O
     
  12. Minimalist

    Minimalist Registered Member

    Joined:
    Jan 6, 2014
    Posts:
    5,078
    Two more suggestions. While the file is still open run Process Exlorer (you can download it here: https://technet.microsoft.com/en-us/sysinternals/processexplorer.aspx)
    When Process explorer is open, check which process has launched Publisher executable:

    upload_2016-2-5_6-48-2.png

    As you can see in my screenshot in my case explorer.exe launched Launchy.exe and Launchy.exe has run procexp.exe which then run procexp64.exe. You can do the same for publisher executable.

    Second:
    Hoover over publisher executable and you will get tooltip:

    upload_2016-2-5_6-48-24.png

    In my case I hoovered over notepad.exe and in tooltip it is shows that T:\To_Do.txt file is open. This way you can find the location from which the file is open.
     

    Attached Files:

  13. Cruise

    Cruise Registered Member

    Joined:
    Jun 10, 2010
    Posts:
    1,024
    Location:
    USA
    Thanks again Minimalist, but the Publisher file that opens upon system startup just remains open for several seconds and is gone (not minimized) by the time I'm able to run Process Explorer! :gack:
     
  14. phalanaxus

    phalanaxus Registered Member

    Joined:
    Jan 19, 2011
    Posts:
    499
    If you can send an autoruns log, I can have a look.
     
  15. stapp

    stapp Global Moderator

    Joined:
    Jan 12, 2006
    Posts:
    7,293
    Location:
    England
  16. Cruise

    Cruise Registered Member

    Joined:
    Jun 10, 2010
    Posts:
    1,024
    Location:
    USA
    Thanks a lot guys. I won't get a chance to explore your ideas until this weekend, at which time I will follow through.
     
  17. Minimalist

    Minimalist Registered Member

    Joined:
    Jan 6, 2014
    Posts:
    5,078
    Hm, too bad. But for those situations Sysinternals has another goody. Process monitor: https://technet.microsoft.com/en-us/sysinternals/processmonitor.aspx
    You can run boot time logging as described here: https://www.msigeek.com/6231/how-to-enable-system-boot-time-logging-using-process-monitor-tool
    Since it monitors and logs "everything" you will most likely find out what's going on. With it's great filtering options it shouldn't take you too long to find out what's the reason of this startup issue.
     
Loading...