[SOLVED] Unknown program briefly appears in taskbar upon signing in after bootup

[MovableAdam]

Everytime I boot up my computer running Windows 10 Home x64 (2004), and sign in to my account, an icon briefly appears in the taskbar. It's only there for a fraction of a second, and I can hear my secondary HDD -- not the boot-drive (an SSD) -- making sounds.

It looks like an RGB cube with two projecting extremities, vaguely resembling lamps of some sort. Does anyone know what this might be? Guess I'm a little anxious that it might be malware.

Photo of the program: Weird icon

 

[gardenman]

Hi, welcome to the forums.

It's some type of script. See "wscript.exe" in your C:\Windows\System32 folder. It has that icon.

It could be a virus. Try doing a full scan with Malwarebytes.

If that doesn't help, download AutoRuns and look for anything that might be calling up wscript.exe. Be careful with AutoRuns and don't randomly disable anything that you don't know what it is. If you're not sure, ask first.

 

[MovableAdam]

So I've done full system scans with both Malwarebytes & Bitdefender, none of which found anything malicious.

I've also tried booting in Safe Mode, whereby the icon doesn't appear. Moreover, the icon that appears seems to be "upside down" relative to wscript.exe's icon.

Autorun didn't give me anything either, but then of course I am not familiar with the program, and didn't dare messing around too much with it.

 

[gardenman]

I didn't notice that the icon is upside down. I just did a quick search of my PC and seen that there is a cscript.exe which uses that icon.

Here's a bit more about the cscript host:
https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/cscript

In AutoRuns at the top you'll see a Filter box. Type in cscript there and press Enter. See if you get any results. Also do 3 more searches for:
.wsf
.js
and
.vbs
files in AutoRuns. If you see any of those, take a screen shot and save it. Upload the image to imgur.com and post a link to it here. Like I said before, don't just disable anything that you see.

Also have you recently installed any new software which could have done this?

 

[Ralston18]

Seconding @gardenman

I will add the suggestion to look in Task Manager > Startup for anything you do not recognize being launched at startup.

Also take a look in Task Scheduler - not as straightforward to figure out but my sense is that more and more things are getting "added in" there to eventually trigger and do something.

 

[MovableAdam]

Thank you for your tips, very much appreciated! Unfortunately though, they all proved unsuccessful. Couldn't find anything in Autorun nor in the Task Scheduler relating to the script. Even did a clean boot per support.microsoft.com to no avail.

However, as the issue didn't happen in another user nor in Safe Mode, I drew the conclusion that it must have something to do with a program. After some extensive and rather frantic googling, I managed to find the culprit thanks to my peers at the Asus ROG forum (I happen to have a custom built-PC with mainly Asus ROG-components.) Link to the thread.

Turned out there was a program called Asus Framework Service that was causing the cscript to be executed at startup, so nothing malicious there!
I uninstalled the service and it worked like a charm. This software was apparently included in a bundle called ArmouryCrate which I downloaded a couple of weeks ago, and this is actually the second inconvenience the bundle has caused me: It also installed an audio driver which conflicted with the on-screen keyboard, rendering the OSK-app unusable until uninstalled.

Anyway, thank you again for taking your time.

// MovableAdam