[sukrsa_2004]

I am getting uncommon problem in my laptop.

1. Command prompt opens suddenly and disappear in seconds. It happens anytime. “C:\Users\AppData\Roaming\SAQ\v2519\WDElua.exe” is written in the top (Screenshot attached).
2. There are two boxes appear in the desktop. One is written with “You Tube Home” and other is written with "YouTube". Even after restarting, those boxes return back. I have attached screenshot for better understanding.

Please help me to resolve the issues. Thanks.

 

[WndrWmn]

Is your hdd possibly made by western digital? If it is, which I believe it is the first item you are seeing is for the “End User Licensing Agreement” or “EULA”. Check your startup items for that or anything related to WD (Western Digital”. Here’s the instructions on how to access your startup folder (in case you don’t know):

Open Run command box by pressing Windows logo + R keys. In the Run command field, type shell: startup and then press Enter key to open Startup folder.

Still working on the YouTube issue for you…..One last question for you… Windows 10 or 11 or something else?

For the YouTube (YT) boxes are you able to click on them? Would it be possible for you to change you desktop wallpaper to something bright (temporarily for troubleshooting purposes) so that your desktop can truly be seen? It is hard, almost impossible to see anything with the wallpaper you currently have. Once you do that can you please post a new screenshot?

 

[sukrsa_2004]

Thanks for you reply.
I have HDD (Toshiba MQ01ABD100) and SDD (Kingston SA400M8240G). Start-up folder is shown as empty.
It is Windows 10. Those boxes cannot be clicked.

 

[Corday]

Have you recently replaced either the HD or SSD?

 

[sukrsa_2004]

Have you recently replaced either the HD or SSD?

No the SSD was included 10 months back.

 

[Corday]

The quick flash of the Command Prompt is normal, but shouldn't happen very often. Before I get too deeply into this, do you have your own UTube Channel?

 

[WndrWmn]

Curious question. Is the machine a secondhand machine or is it brand new as in you are the first owner? If it is a secondhand machine, did it possibly ever have a western digital hard drive?

another question is, did you find the start up folder using the method I provided or did you simply navigate manually to that folder? If you navigated to the start up folder manually, you may not have found the one that my method that I provided takes you to because it is a different one.

I was looking at the picture where you show the start up folder and the very first thing I see in the path to that store the folder you are showing says YouTube if you go up one level above that YouTube folder is there an actual YouTube folder that you can see? If yes, can you rate click on that particular folder and take a screenshot of the properties ? If my hunch is correct, there’s just some thing not right about that folder and you should be able to simply Move all of the items in the YouTube folder out of the YouTube folder, leaving the YouTube folder, empty, and everything moved into the folder that the YouTube folder sits in and then go ahead and delete the YouTube folder. Before you do all of that can you take a screenshot of the folder that the YouTube folder sits in as well as the requested properties for the YouTube folder?

I have personally seen crazy things like this happen on my own machine. Some sort of a ghost folder gets created and wacky. Things happen. I once experienced a weird sort of glitch that was driving me nuts where every time I would sign out of my iCloud control panel on my windows computer and sign back in. It would start creating ghost desktop folders and any time I would look at an explorer window, I would have to scroll through and close so many of these ghost desktop folders to clean up what I was looking at. It was beyond stupid. I worked with both Microsoft and Apple to try to figure it out. I even resorted to trying to tweak it out of the registry , and even that didn’t help very well. I wound up having to uninstall the iCloud control panel and reinstall it and not use the photos synchronization portion which I don’t use anyway. For some strange reason that was the crazy culprit. My life exists in the land of crazy .

 

[spunk.funk]

Try a Clean Boot. If this works, you can leave it this way, or you can add one Service or Startup Item at a time until the behavior returns, then you will know the culprit

 

[sukrsa_2004]

The quick flash of the Command Prompt is normal, but shouldn't happen very often. Before I get too deeply into this, do you have your own UTube Channel?

No I don't have my own Youtube channel.

 

[shangrilada]

I have this same exact issue except the WDElua.exe on mine shows it is running off the c:\user\iuser\appdata\local\WAAM\v2519\WDElua.exe location.

There's nothing else online that talks about this. I have ran multiple malware and virus scanners and nothing comes up.

I thought it was because I had installed minitools but even after uninstalling it, I am unable to stop this WDElua.exe from starting up and then giving me that "YouTube Home" icon on my desktop. It shows up and disappears and a bit later comes back on again. I also see for a second what seems to say "waiting for bing.com ..." , ":waiting for storagelive.com.." , waiting for asset.msn.com ..." etc etc

I had removed chrome and cleared all data and still getting this after I reinstall Chrome.

 

[WndrWmn]

I owe you an apology. I miss seeing the L in the file name for the box that comes up for you. I googled the file name it’s self and came up with. It is related to something called the WD elusion service. All I can find is one clandestine reference on the site Called Glarysoft

shorturl.at/hzGKQ I must admit this is definitely a mystery for me.

 

[MPR]

This is interesting.

SAQ\v2519\WDElua.exe
WAAM\v2519\WDElua.exe

There is only one reference to the file that I can find and it only appears in this company's software.

WD Elusion Service - WDElua.exe - Startup programs - Glarysoft

Description of windows startup items: WD Elusion Service, WDElua.exe. As well as user ratings, user reviews. You can use this information to decide whether to allow this startup item to start automatically when windows starts.

www.glarysoft.com

"WD Elusion Service" appears once more in this website.

https://www.elektroda.com/

 

[shangrilada]

I suspect Glarysoft is not a reliable site - for all we know they could be the culprit behind this issue and are selling their services this way...

from Google..."Glarysoft has a consumer rating of 1.8 stars from 5 reviews indicating that most customers are generally dissatisfied with their purchases. Glarysoft ranks 469th among Software Other sites."
Glarysoft Reviews - 5 Reviews of Glaryutilities.com - Sitejabber

I did performed a windows system safe boot with debugging and after looking at the nbt log file I can not find any instances of the WDElua.exe being registered. It seems like this WDElua.exe file is being executed only when something else triggers it after windows is already loaded.

 

[MPR]

https://www.elektroda.pl/rtvforum/topic3945258.html

Task: {D82F6C40-4BB3-4119-8E6E-FE92F8AE90FB} - System32\Tasks\WD Elusion Service => C:\Users\PC\AppData\Local\WAAM\v2519\WDElua.exe [351616 2022-12-28] (APTX Software -> ) [Brak podpisu cyfrowego]

translate:

No digital signature

Masz inna infekcje od pozostalych piszacych w tym dziale, u Ciebie okno cmd to tylko efekt poboczny.

translate:

You have a different infection than the others writing in this section, your cmd window is just a side effect.

 

[shangrilada]

translate:

You have a different infection than the others writing in this section, your cmd window is just a side effect.

So it seems like this WDElua.exe file is being executed only when something else triggers it after windows is already loaded... so WDElua.exe isnt the virus but whatever virus/PuP/malware that is triggering this is the real problem. Like I said, I have run multiple antivirus scans but none detect anything suspicious. Even ran an online virus scan and a USB boot rescue disk from AVAST- to avoid performing a scan from within Windows.

Now the strange thing is, after multiple windows reboot (while i was trouble shooting) and despite that WDElua.exe script running like usual, I have yet to see the "YouTube Home" or "www.youtube.com" notification appear on my desktop. It's been 20+ minutes. It's almost as if this "virus" knows I am hunting it down and it's staying incognito for a while.

 

[MPR]

It's almost as if this "virus" knows I am hunting it down and it's staying incognito for a while.

I think that this has perhaps gone beyond a strictly Windows 10 issue. Why don't you post a query in the malware removal sub-forum and have our security analysts look into it?

Malware Removal Help Posting Instructions

Welcome to Tech Support Forum Virus/Trojan/Spyware Removal Help (formerly Hijackthis Log Help) * DO NOT FIX ANY ENTRIES OR DELETE ANY FILES YOURSELF. Do not run any specialized tools that you see being used in other threads without direct supervision from one of our trained analysts...

www.techsupportforum.com

 

[sukrsa_2004]

"Curious question. Is the machine a secondhand machine or is it brand new as in you are the first owner? If it is a secondhand machine, did it possibly ever have a western digital hard drive? "
Reply: I am the 1st owner of the Laptop. So, there were no western digital hard drive.

"Did you find the start up folder using the method I provided or did you simply navigate manually to that folder?"
Reply: I have opened start up folder using your method.

"I was looking at the picture where you show the start up folder and the very first thing I see in the path to that store the folder you are showing says YouTube if you go up one level above that YouTube folder is there an actual YouTube folder that you can see?"
Reply: That is the box written with “You Tube Home”. It appears in the desktop. As a result it comes in the screenshot. Please see it below.

 

[Corday]

The Clean Boot Spunk recommended would be my next suggestion. How to perform a clean boot in Windows - Microsoft Support

 

[Red Raspberry]

FWIW I've used Glarysoft for years on my computers with few issues. Usually run a scan when I shut down. I use the free version though.

 

[djbillyd]

I'm not sure if I missed it or not, but have you done a malware scan yet? I would start there. If that doesn't remove it, I would open a cmd prompt with admin rights. Then I would do sfc /scannow. Let that process complete, restart and look for any changes. If none, open a cmd prompt w/admin. Type gpupdate, after it runs, restart and look for a difference.

Are you comfortable working within the registry? There are a couple of things there too. Reply back if none of the above works.