Fix “Can not find script file C:\WINDOWS\run.vbs” at Logon

When you log on to your computer, the error “Can not find script file C:\WINDOWS\run.vbs” with Windows Script Host in the title is shown on a blank screen with a black background. This happens if malware has modified the Userinit registry value, replacing the Windows default value data with a VBScript filename.

Important #1: This post explains how to fix the Userinit value and thereby helps you get access to your user profile. At the same time, the malware that caused the problem in the first place might still be active and lurking in the system. And in this case, the problem seems to have been caused by a complex malware that adds core components to the system making the removal process difficult. So, it’s highly advisable to get your system professionally checked for malware and eliminate them entirely.

Fix the Run.vbs error by correcting the Userinit value

Note: If Task Manager doesn’t open due to DisableTaskMgr Policy enabled by the Malware, carry out the following procedure via Recovery Environment. Check out the article How to Edit the Registry Offline Using Windows Recovery Environment? for more information.

  1. After typing the login credentials, the system may stall at Preparing to the login screen. Press Ctrl + Alt + Del, and click Task Manager.
  2. When the above error message dialog is visible, dismiss the dialog and switch to the Task Manager window.
  3. The file referenced in the Userinit registry value is run even before the user interface loads. To start the Explorer shell, switch to the Task Manager window, click File, and select Run new task. Type explorer.exe and press ENTER.
  4. Start Registry Editor (Regedit.exe) and go to: 
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
  5. Double-click Userinit value and change the value data from: 
    wscript C:\WINDOWS\run.vbs,

    to the following: [Caution: Take special care when entering. You need to remove the wscript part.]

    C:\Windows\system32\userinit.exe,

    *Important #2*: If Windows is installed in a different drive than C:\, type the actual drive letter and path. Also, include the trailing comma (,) as shown above. Take extreme care when typing the Userinit value, as typing an incorrect filename or path will prevent you from logging on to any user account. I’m not responsible if you type a wrong path and lock yourself out of your user account.

  6. Exit the Registry Editor.
  7. Log off and login back in so that the Userinit.exe loads correctly and does the initialization or preliminary jobs like running logon scripts etc.


This fixes the run.vbs login error message. Although the Vbscript file run.vbs may have been deleted by your anti-virus software, running a thorough scan is still advisable.

One small request: If you liked this post, please share this?

One "tiny" share from you would seriously help a lot with the growth of this blog. Some great suggestions:
  • Pin it!
  • Share it to your favorite blog + Facebook, Reddit
  • Tweet it!
So thank you so much for your support. It won't take more than 10 seconds of your time. The share buttons are right below. :)
Tweet
Share71
Share1
72 Shares

Ramesh Srinivasan is passionate about Microsoft technologies and he has been a consecutive ten-time recipient of the Microsoft Most Valuable Professional award in the Windows Shell/Desktop Experience category, from 2003 to 2012. He loves to troubleshoot and write about Windows. Ramesh founded Winhelponline.com in 2005.

...

139 thoughts on “Fix “Can not find script file C:\WINDOWS\run.vbs” at Logon”

  12. Yes, I see “it’s still advisable to run a thorough scan.” but this is not so easy to remove especially rouge software called “MPC Cleaner” which is installed by this infection. I don’t think anti virus scan will remove it.
    It uses minifilter driver (MPCKpt.sys) to attach itself to hdd partition to prevent deletion of MPC Cleaner. Its practically impossible to remove it under normal mode in windows. But it can be easy deleted using WinRE or Linux Livecd.

    Reply

    • @Abdulla: Thanks for the note about the filter driver. I’ll add this note at the top, plus a link/redirect to an appropriate security forum.

  17. wooo amo a quien escribió esto , intente mil veces a que funcionara con otros vídeos y cosas . y solo esto fue la mejor ayuda, solo una palabra para que funcionara …. explorer.exe 🙂

    Reply

  19. Man, you really saved my day, tried a whole bunch of solutions prposed both from HP themself as well as a variety of forums.

    Reply

  21. Thank God I have two computers. Thank you sooo much!! This really works. I wouldn’t know what to do other than take the computer in for service which could cost me at least $50.00 or more. You made my day!! Now I need to run some kind of spyware software as this bug that was put into the computer cause this error.

    Reply

  24. Oh you really saved my computer, i thought it way dead!!! Thank you!!!
    Can you recomend any good malware cleaning programs?

    Reply

  27. BLOODY MASTERMIND YOU ARE!!!!!!!GOD BLESS YA FOR SHARING YOUR EXPERTISE AND KNOWLEDGE!! SUPERLY DUPERISHLY GRATEFUL!!!!!!!!!THANK YOU.!!!! MAY THA BENEFICIAL KARMA ANGELS ENSURE MULTIPLE BLESSINGS UPON YOU AND YOUR LIFE ? !AMEN!

    Reply

  28. THANK YOU, you literally saved my life. Ahah ok not that extreme but I had loads of assignments to do. Thank youuu???? God bless

    Reply

  31. Thank you man, this was driving nuts! the malware that caused this was nimeckreelule, is the same NMCLOGSERVICE.EXE, which installed bunch of crap like badu, tencent QQ, yesplayer, yesbdn, uc browser, etc. God damn chinese crap.

    Reply

  32. Hi. I have the same problem, the thing is I cannot even open it. Everytime I turn it on, it asks me for a password then I put it in. After that, the message comes out (the same as on above). please help me… anyone?

    Reply

  35. //It won’t allow me to change the value since I am not using the admin login. But the admin login has vanished, so I can’t use my admin login.

    Reply

  36. What if the file isn’t there at all? ‘wscript C:\WINDOWS\run.vbs,’

    Is there a way to create a new one that does the same thing?

    Reply

  38. Really
    I donot know how can i thank you
    There are not words can explain this
    Because you saved me and my important files

    Thanks dear very much

    Reply

  44. Accolades to the dude that posted this solution. I had a nightmare run going from a PUP infected Win 8.1 to Windows 10. I cleaned all the virus crap from 8.1 but then was left with a Microsoft “Upgrade now” dialogue box but no way to close it. The options were “upgrade now’ or do it on one of the next four days. I bit the bullet and did it, and that’s when I hit this black screen with cursor and a minimised Windows Script error window. Anyhow, tried the above, and it got rid of the Win Script window, but I still had the black screen and cursor. After lots of agonising I reverted to Win 8.1 and performed the same steps as above. Cold booted, and all was well again. BTW when I looked at that UserInit setting in Regedit it showed a value of “wscript,” only. I haven’t tried upgrading to Windows 10 again, but if any of you dudes are game enough to give it a shot then I’d love to know how ya go. nb Mine is a Lenova laptop with NVidia.

    Reply

  52. Weird, I saw this prompt, then I launched “explorer.exe”, then my desktop just loaded.

    Guess this malware’s a puss.

    Reply

  54. I felt a huge weight go off my chest, Thanks to whoever wrote this you are a real life saver, The fact is i’m using my mother’s computer right now and she usually blames me for anything that happens to it so when i saw the error message i thought “My mom’s gonna kill me -_-“

    Reply

  57. My brothers . things he said was fine . But many of your laptops is not fixed right now also . so I can fix. it step 1- open any of your anti malware protection software like byte fence[ I handle my situation with this software only] and just scan your computer

    Reply

  61. I too have the same problem but want to know if it works
    with win 7, 64 bit? do i have to edit C:\Windows\system32\userinit.exe, to C:\Windows\system64\userinit.exe,?

    Reply

  62. THANK YOU!!! Was locked out of my computer, 3 hours later, after reading this article, the only article that worked!!!
    I’m up & running again!!!
    I’m reinstalling malwarebytes, it has found 152 detected objects, so far, still running.
    My computer totally fried after I started downloading an Obvious malware file, I tried to stop download. UGH. My mistake, I know better, but normally I can find, delete malware manually. Today, was totally locked out of my computer.
    Life Lesson.

    THANKS soooooooooo MUCH!
    Kim

    Reply

  72. Thanks Man !
    Everything was failed to run till I typed “explorer.exe” and run it , then everything came back to live ! Start Menu , Desktop , … etc. everything came back to live !
    Shukrann <3

    Reply

  77. Hi

    I just type “explorer.exe” , but what comes out is “C:\windows\system32\config\systemprofile\desktop refers for location that is unavailable…….”

    How to fix this? Thanks

    Reply

  82. 24 hrs headache had gone in no time. Your professional advise and well structured instruction had been key to get me out of trouble. It is really awesome. Thanks a million!

    Reply

  87. I did exactly what you said except I used system64 instead of system32 as I’m running Windows7 -64 and it rebooted all looking good at first but now I’m stuck with a completely black screen and now I have no computer at all. at least before I could use it, it was just real slow with that Error message.

    Reply

  91. Thank you very much! You are truely a genius! I downloaded some type a maliware/virus today and your step by step video worked! Thank you and god bless!

    Reply

  92. Thank a lot, i had many problem, and i fixed with your tutorial. Expert! Great man! Thank thank thank you so so so much! Good luck and all the best!

    Reply

  94. The file “run.vbs” isn’t missing for me. Thing is a malware was deleting it until i noticed some really suspicious activity in my background processes. I then manually killed that task, only to realize it was a malware. Luckily, none of my files got deleted. However, in run.vbs, a specific value was changed during the deletion process. I hope you can help me figure out what that value is. I already have VBS programming experience. Its only the value i’d like to know. Thank you and i hope you answer soon.

    Reply

  106. I can’t fix these problem cause,there s after disabling the error msg I cant open explorer.exe file in the task even I typed with browsing file

    Reply

  108. I have got this issue for more than a week in my Asus R558u notebook. I was installing Kaspersky Antivirus and some files are downloading at that time. But suddenly it start opening explorer tabs and some other things. I tried to close it, shutdown my Pc, But nothing helped the desktop is freezed. So i shutted it down from the power key by pressing it for some time.
    And after that when i turned it on, after filling the password of Windows, the Black Screen with cursor welcoming me with this Script Host Error thing. Now its showing cannot find the vbs file and all.
    I am unable to open the task manager. But from the cmd i opened regedit and done as you have said but the value is right there, nothing about vbs.
    On entering safe mode after it, the Windows start the Blue Screen Loop and restarting again and again.
    Please help, what should i do.

    Reply

  112. It’s amazing since this is the ONLY actually working solution to the problem! I spent 4 hrs on my wife’s PC yesterday trying it to boot cleanly again after a malware infection and cleanup with malwarebytes and other virus checkers. The funny thing is that the infection was not even the problem (this could be solved relatively easily), the problem was the remaining “wscript” part instead of the userinit in the registry. (Which, after finding this post, I could correct in less than a minute).

    What’s “amazing” is that NO ONE on Microsoft tech forums or malwarebytes forum or anywhere else had a reply for fixing this.

    Instead, the malwarebytes forum and MS forum recommended entirely unnecessary things, like running “Defender offline” (which didn’t work at all since it cannot update definitions from the USB stick) or running “rogue killer” for scanning for root kits etc etc. which took me 90mins for a scan – but ALSO of course didn’t solve the problem since the wrong “wscript” entry was still in the registry preventing the PC from boot. (You can run virus checkers until you are blue in the face, they won’t correct the entry in the registry!)

    What’s “funny” is also that no run of malwarebytes or NOD32 or whatever actually SPOTTED the problem and advised to correct it, and even worse (and even more bizarre) a system restore to last Friday before I had the infection (and then also booting from “Last Good Configuration”) did not restore the computer for a proper boot, the corrupt registry entry was *still* there and giving black screen on boot. (Which baffles me since I could’ve sworn that taking “last good configuration” or a system restore would actually use a registry backup).

    The funny part is that it was at some point very obvious that the PC *was* actually cleaned from all malware and that the PC “in principle” worked since you could enter CMD shell from the black screen and then run “explorer” to start windows. It was very clear that “something” still tried to run script (wscript), but that the dangerous script was removed and that the PC “hung” because of this remaining entry in the registry. (Simply describing to someone “black screen with wscript error after removal of malware with malwarebytes” should *immediately* bring someone to *THIS* solution, and not to entirely useless and incompetent blahblah which has nothing at all to do with actual problem – since the issue and fix are NOW actually obvious, once you learn what the issue was)

    Let me just estimate that hundreds of people who possibly run into the same problem after an infection “solved” this by having to entirely reinstall their PC…which is a joke seeing that the fix was a matter of seconds which could have saved them re-installing their PCs. And all the “experts””giving advice” on the internet…if you mention to them that this is a wscript error before boot and they instead just tell you to scan your computer again [pointless, since the malware was already removed] from safe mode or recovery console..it’s very clear these people have no clue whatsoever what they’re even talking about. In particular since this seems to be rather common after infection and cleanup with malwarebytes)

    Anyway I want to thank you very much since you not only helped me to make the PC bootable again…I also learned something valuable which can help me the next time should I run into this. Sorry for the long rant..I was just angry to read all the “experts” yesterday which served only that I wasted many pointless hours yesterday at night UNTIL I came across your post!! THANKS!!!

    Reply

    • Georg: Thanks for the feedback. It’s strange how NOD32 or MBAM missed the run.vbs infection in the first place. Incidentally, I purchased a MBAM Premium license y’day. The web protection part is working fine as I see.

  113. Hello,
    I can not run the taskmanager . Have win 10.strg+win+entf. or win +x win +r no function
    Please help me.
    greetz from germany

    Reply

  114. Thank you so much
    Accept my sincere love and respect
    I went to the maintenance shop has no solution but to change Windows only
    The problem has been overhauled.

    Reply

  116. I was already thinking of how to change firmware but with this I fixed it in no time without spending a dime. thanks a lot.
    You rock!

    Reply

  131. I tried to change a name on a file under users registry, now it will olny let me log in to a temp profile
    I get this message
    ‘an app caused a problem with the default app settings for MS-xb1-3d8b930f files”
    how would I fix this?

    Reply

Leave a Reply