At random times "Open with" dialog box pops up please help

[plugs1957]

A no fixed interval or startup that I can discern I get the "Open with" Dialog box for a File c:\Pete with no extension. SFC is clean. I have tried tracking this down and the program that's trying to open it is rundll and the command line points to the shell32. I cannot track down what kicks this off. Would appreciate any help and its a bit annoying to say the least.

I have also used autoruns and looked at task scheduler and nothing is obvious

 

[samuria]

does it run during boot is so its in msconfig if after its a schedule

 

[plugs1957]

Happens very infrequently during a boot , 90% of the time it is inbetween boots. Even if it is something to do with scheduled tasks, how does one trace these to see what is causing the issue. I have good PD/PSI skills but not so much in windows and how to trace events like this. Normally I use msconfig to disable programs to try and find a culprit but this is really only effective for hard faults. Intermittent issues like this mean I cannot run in that mode for extended times.

 

[Megahertz07]

Schedule a check disk. On Explorer, right click on C: - Properties - Tools tab - Error check - Check now- Schedule for next boot.

It looks for a file at C:\ named Pete. Do you have a file named Pete on c:\ ?

 

[plugs1957]

Yes whatever this program is it does create a file called Pete in c:\Users . If I open the file with Notepad this is what I see :

Usage : fsutil behavior query <option>

<option>

AllowExtChar
BugcheckOnCorrupt
Disable8dot3 [<Volume Path>]
DisableCompression
DisableEncryption
DisableLastAccess
EncryptPagingFile
MftZone
MemoryUsage
QuotaNotify
SymlinkEvaluation
DisableDeleteNotify

Please use "fsutil 8dot3name query /?" for more information.

 

[plugs1957]

Any thoughts anyone ?

 

[Megahertz07]

It is related to Fsutil. Can you tell when it began to show up?
Seems like a configuration list.
Fsutil 8dot3name

Download and install SUPERAntiSpyware - Downloading File

 

[plugs1957]

From the file I posted I can only guess that it could be. Hence the post. But as to what is running this ..... no idea. Its been happening for about 3 months or so and I thought I would get to the bottom of it. But try as I might it eludes me.

 

[Megahertz07]

To find where it is being launched:
Run msconfig to see if is launched by one of the start up programs.
Look at task scheduler (%windir%\system32\taskschd.msc /s)

 

[plugs1957]

As I said earlier I have tried both these options extensively when I can . Trouble is as its only 2 or three times a day I cant run my work machine in a restrictive mode for extended periods to hone in on what is actually doing this. So I have been approaching with Handles and wait chains , but cant seem to get any further with these. I was hoping someone would have a debugging technique I have not come across ...

 

[Megahertz07]

Try this Process Explorer - Windows Sysinternals | Microsoft Docs

 

[plugs1957]

Been there done that , thats how I was looking for handles

 

[torchwood]

Hi Plugs,

going back to our thread, you mentioned software companies help, by any chance did they ask you to run or install any troubleshooting tools.

Roy

 

[plugs1957]

Hi Roy, the only help I got on my previous issue was guys here and especially you. I haven't got any help from anywhere else. I have installed SW myself to try and clean up when I was trying to fix that SFC problem. I was hoping this one was part of that, but it wasnt . I have run in the past Advanced System Care, CCleaner, Spybot and Malwarebytes. Thinks that's about it as I am nervous about any of these.

 

[torchwood]

Hi plugs,

navigate to your main drive (C) then users, in the top right search option type txt.

Any files you dont recognize

Roy

 

[Ranger4]

Advanced System Care has been responsible for a lot of computer problems. Have you uninstalled it using their uninstall utility. In some cases ASC has been so troublesome that a reinstall of Windows has been the only complete cure.

Have you tried disabling your Symantec AV program. Sometimes there are extra features that some AV program install that cause odd computer problems.

What is Symantec Encryption Desktop? & could this be the cause of your problem.

 

[plugs1957]

Hi Roy nothing of any merit see pic ....

 

[torchwood]

Hi Pete,

should look like this, note check all drives

Roy

 

[plugs1957]

Hi Roy sory I have not responded very rude. I was in hospital. So I did the search you requested but it came back with 1019 files and didnt want to post a list of all those. But to give you an idea this pic is the beginning of the results. Not sure what I should really be looking for. I have played extensively with msconfig and cant get near the problem.

 

[torchwood]

Hi Plugs,

Hope your getting better.

Back to the problem

Its a slog exercise,

but you need to look at the title, anything with >> ONLY <<

c\user or c\user\pete

Hmmm Farbar (FRST) might find it
Downloading Farbar Recovery Scan Tool
post the 2 logs

Roy