Someone plugged an infected USB drive into my Windows PC. Windows Defender detected and removed the threats, and I followed up with a full scan, an offline scan, and a Malwarebytes scan. None of them found anything else.
However, I now get a popup saying Windows can't find "C:UsersUserAppDataRoamingUSBDrive.vbs". I searched for the script and tried the usual cleanup steps, but the file isn't present. I created a blank text file with that name to stop the popup, which seems to work temporarily. I also removed a registry entry, but the message returned after restarting, and I can't find anything obvious in Task Manager startup items, Task Scheduler, or Autoruns.
Does this mean the virus is still on my PC, or is Windows simply trying to launch a file that was already deleted? Do I need to reinstall Windows to be safe?
3 Answers
A clean Defender offline scan plus a Malwarebytes scan is reassuring, and a full Windows reinstall usually isn't necessary for one leftover script reference. Before considering that, inspect Autoruns carefully and search the registry for the full path or “wscript.exe,” not just the filename. If suspicious popups, unknown processes, disabled security tools, or other symptoms continue, back up personal documents—not programs or scripts—and then consider a clean reinstall as the most certain option.
The missing-file message usually means the malware file was removed, but something that launched it—such as a registry entry, scheduled task, startup item, or shortcut—was left behind. The popup is evidence of a leftover startup trigger, but it doesn't necessarily mean the malicious file is still present.
Back up important files first, then check Task Scheduler and the Startup tab in Task Manager. Microsoft Sysinternals Autoruns is especially useful: run it as administrator, search for “USBDrive” or “wscript,” and delete only entries that clearly point to that missing script. Be careful when editing the registry and make a backup beforehand.
Creating a blank text file with the script's name only hides or changes the error; it doesn't remove the startup instruction, so it isn't a real fix. If all scans are clean and the file is genuinely missing, this may just be a broken reference left behind by the cleanup. Keep Windows and your security software updated, avoid opening files from that USB drive, and scan any other removable drives you used.
I removed the registry entry, but the popup came back after restarting. I also checked Task Manager, Task Scheduler, and Autoruns and couldn't find anything named USBDrive or anything that obviously launches a script. Could the malware be gone even though the popup appeared again?