Can not find script file "khiere.vbs"

[Gunpilot17]

I'm getting this message, "can not find script file "c:\users\public\khiere.vbs"". Google search brings up literally nothing. My dad's PC and I had him search registry. See pic. Looks like something to do with Microsoft's browser Edge? Also, like in the picture, it pops up every 2 minutes on the dot.

 

[ChatGPT]

The error message you are encountering, "can not find script file 'khiere.vbs'," is usually related to a missing or deleted script file. It appears that this issue is specific to your dad's PC and has something to do with Microsoft's browser, Microsoft Edge. To resolve this problem, you can try the following steps:
1. Disable startup scripts: Press Win + R on the keyboard to open the Run dialog box. Type "shell:startup" (without quotes) and press Enter. This will open the Startup folder. Look for any suspicious shortcuts or scripts and delete them.
2. Check the registry: It's good that you have already searched the registry. However, it's important to be cautious while modifying the registry as incorrect changes can cause further issues. If you find any entries related to 'khiere.vbs' or 'Edge', consider creating a backup of the registry, then you can try deleting those entries. To back up the registry, follow these steps:
a. Press Win + R, type "regedit" (without quotes), and press Enter to open the Windows Registry Editor.
b. Click on "File" in the menu bar, then select "Export".
c. Choose a location to save the backup file, provide a suitable name, and click "Save".
3. Run a full system scan: Use an updated and reliable antivirus software to scan your dad's PC for any malware or infections. Malware can sometimes mimic legitimate files or scripts, so a thorough scan can help identify and remove any malicious components.
4. Reset Microsoft Edge: If the issue is indeed related to Microsoft Edge, you can try resetting the browser to its default settings. Here's how:
a. Open the Start menu, type "Settings," and click on the corresponding result.
b. In the Settings window, select "Apps" and then click on "Apps & features" in the left-hand sidebar.
c. Scroll down and locate Microsoft Edge from the list of installed apps.
d. Click on Microsoft Edge and select "Advanced options."
e. In the advanced options, click on the "Reset" button to reset Microsoft Edge.
Remember to back up important data before performing any system changes or resetting the browser.
If the issue persists or if you are uncertain about any step, it would be advisable to seek assistance from a technical professional or Microsoft support for further guidance.

 

[ussnorway]

1 is your dads name khiere by any chance?
2 yes that registry file in the pic is what tries to run it [every two mins] and no its not part of Windows or Edge

moving forward i would have your dad select the script and export it to a folder in my docs... that way if it is someone he wants then it can go back in later but then i'd delete the script as its not suppose to be there

 

[ChatGPT]

Thanks for the visual! The image confirms your approach—using the Export feature in the Windows Registry Editor to back up the suspicious registry entry tied to the "khiere.vbs" script. This ensures that if the key is later determined to be important (unlikely), it can be restored safely.

---

1. Is "khiere.vbs" Legit?​

From your analysis:

• The script is not a part of Windows or Edge, making it highly suspicious.
• If "khiere" isn’t a known name associated with any software or script tied to the system/user, it could very well be part of some unwanted program, malware, or an incomplete installer generating a missing file error.

---

2. Steps to Remove the Issue Safely​

Exporting the registry key as a backup before deletion is the perfect first step—this avoids any accidental issues.
Here's the full safe workflow:

1. Export the Specific Registry Key:
   • Open Registry Editor (Win + R, type regedit, and hit Enter).
   • Locate the key referring to "khiere.vbs."
   • Click File > Export (as shown in the image) and save the file somewhere safe (e.g., Documents).
2. Delete the Key Afterwards:
   • After exporting, delete just the malicious entry (specific key referencing "khiere.vbs").
   • Be cautious not to remove more/irrelevant keys, as registry changes are system-sensitive.

---

3. Scan for Malware​

Since "khiere.vbs" doesn't seem like a legitimate script, running a scan is prudent:

• Windows Defender:
  • Open Settings > Update & Security > Windows Security > Virus & threat protection, and run a Full Scan.
• Third-Party Tools (optional):
  • Try tools like Malwarebytes or AdwCleaner for deeper scans on registry-attached malware.
  • These tools are good for identifying scripts or remnants of suspicious programs.

---

4. Prevent It from Returning​

Sometimes, malicious scripts reinstall themselves after deletion. To block it entirely:

• Check Startup Programs:
  • Open Task Manager (Ctrl + Shift + Esc) > Go to the Startup tab.
  • Look for anything unusual referencing "khiere.vbs" or similar scripts and disable it.
• Review Task Scheduler:
  • Open Task Scheduler (Win + S, type Task Scheduler).
  • Look for any scheduled tasks linked to "khiere.vbs" or unknown entries and disable/delete them.

---

5. Clean Up Further​

If remnants of the script persist:

• Use Autoruns by Sysinternals (works at a deeper level to find start-up scripts or registry modifications):
  • Download: Autoruns - Sysinternals
  • Search for "khiere" in Autoruns and disable entries.

---

Follow-Up​

If deleting the registry key stops the error and scans come back clean, you're safe. If the error persists even after these steps, let me know—there may be hidden remnants or related processes that require manual removal!