"Cannot find C:\Documents" on startup.

 Courtney -

I've been experiencing a problem after accidentally installing a Trojan on my machine.
I have no removed the Trojan from my computer but it seems to have left something behind that tell my PC to when it starts up to look for "C:\Documents"... but this file doesn't exist and its kinda annoying to see the message all the time or to see the "Documents" folder I created to try and stop the message.

I am unable to find a Registry Key referring to C:\Documents on startup. Has anyone had this problem and know how to fix it?


ps. this has nothing to do with the problem concerning Adobe Manager.exe as I do no have this executable on my PC

9 replies

I tried every search in the registry for C:\documents and found nothing. Then msconfig to check startup programs and processes, nothing. Autoruns gave more detail but still nothing that remotely looked like the culprit until I knew what to look for..

BTW, Symantec Endpoint found the trojan which apparently put a file called "lsass.exe" in the dir " C:\documents and settuings\administrator\application data\** " and an associated registry entry to run the executable.

I deleted the file/registry entry via Autoruns and that solved the problem. Apparantly Endpoint had deleted everything else that the trojan did but this leftover dialog box at every boot was getting annoying.

You can download Autoruns here : https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns

It's a free program that when you run, you'll see the registry entry for lsass.exe pretty close to the top.
Good luck and I hope it works for you as well ! Let me know, Frank

**P.S. the "application" dir is hidden so you have to set your file options to show hidden files and directories. I also noticed that the date of lsass.exe was the same date that I got the trojan !
Thank you

A few words of thanks would be greatly appreciated. Add comment

CCM 2942 users have said thank you to us this month

i've done how u said.....but after i've done a refresh in autoruns and the file it's still there......it doesnt want to dissapear.........any ideas...???plss...
Go to regedit and press F3 key. Then type in C:\Documents and Settings\<username>\Application Data\lsass.exe and find. Delete all whatever you find and the error will go away. If you still can't resolve the problem, try to focus on Local Settings and Temp folders underneath <username> folder
hey it worked for me!! Thanks a lot bro.

Thanx It worked
Thank you. This got rid of the GeniusBox remnants that have been plaguing my machine.
I resolve this error
Here is instructions for resolving this problem step-by-step:

1. Open Regedit (Start -> Run -> type 'regedit')
3. Open dir SOFTWARE
4. Open dir Microsoft
5. Open dir Windows NT
6. Open CurrentVersion
7. Open Winlogon
8. Find Shell
9. Double-click on it (or right click and Edit)
10. Edit second input from Explorer.exe C:\....Isass.exe to just Explorer.exe
11. So entry has to be only Explorer.exe, without C:\...
Thanks a lot Mr.Matej

The Autoruns solution does work; it pinpointed a few areas where the lsass.exe file had created some paths to itself in my registry so I could delete them. I no longer have that annoying little box come up when the computer starts.

If you check task manager, the lsass.exe process should be under the user name "SYSTEM". If it is anywhere else, then it probably doesn't belong there.

I'm not sure if this makes a difference, but you might want to check Data Execution Prevention if you have processes excluded under DEP. Right click My Computer in the Start menu, go to Properties, Advanced tab, click 'Settings' under Performance - Data Execution Prevention [if you have "Turn on DEP for all programs and services except those I select:," then click on lsass.exe (if it's there), and hit the Remove button.]
that worked perfectly!

I did however, find that I had to delete 3 startup entries before the problem was fixed.

all 3 has "file not found" in their description so I deleted those 3, when I restarted my PC the C:\Documents was still trying to be found so, I ran Autoruns again and it then found a C:\Documents file in startup, I deleted that restarted, and problem solved :)

thanks alot for the nice fix Frank!

Much appreciated.
I don't know if you found a solution to this but I had the same problem as a result of a trojan.
If you need an answer, let me know and I'll repond w/the details
yep, I am still I need of a solution for this, much appreciated if you can respond with a nice little fix.

ok run auto runs delete isaac.exe in everthing close.
fix reg errors in jv 16 power tools. run atf cleaner.
use cleanup . whbam everything is fine.
Are you tierd to get this message:windows cannot find C:documents every time you start you Computer than trie this method.

Do this check that you didnt change the name of you Document folder if you have than change it back to the original like this: My Documents. after that run Ad-Aware and scan you Computer and delite the files that Ad-Aware vill find. Now Rebot you Computer and you are don. I hope this will help
DOCUMENT FILE was on desktop at startup .
tried many solutions to remove it .
Then I found a file HyItPvYfTa.exe
This file reffered to document file I didnt know why
so I took a chance and remove it.

went to regedit in run box
removed hyitpvfta.exe