wscript.exe infected?

[REDACTED]

Two days with no problems! Thank you!

[essexboy]

Subject to no further problems   

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems 

Now the best part of the day ----- Your log now appears clean  :thumbsup:

A good workman always cleans up after himself so..The following will implement some cleanup procedures as well as reset  System Restore points:

Remove tools

Download and run Delfix



Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

CryptoPrevent install this programme to lock down and prevent crypto ransome ware



Malwarebytes.

Update and run weekly to keep your system clean

Unchecky

Click on the link above to be taken to Unchecky.com
click the very large Download button.
click Save
Click Open folder
Right click on the Unchecky_setup and choose to Run as Administrator
Once open click the Install button.
Then click on Finish
Unchecky is now installed and will help you keep unwanted check boxes unchecked, this is a fire and forget programme 

It is critical to have both a firewall and anti virus to protect your system and to keep them updated.

To learn more about how to protect yourself while on the internet read this little guide  Best security practices Keep safe  :wave:

[REDACTED]

Unfortunately, it looks as though the malware that was affecting me before has returned.  I have not installed any new programs or extensions, and have not added any new usb drives to my computer, so it seems as though whatever is causing the problem never left my computer, but just remained hidden/dormant for a week (if that is possible?!?).

Anyway, I re-scanned and the logs are attached.

Two things to note:

1) Malwarebytes was unable to load the Anti-Rootkit Driver (Error Code 20026), so I had to run the scan without anti-rootkit support.
2) I have never been able to run an aswMBR scan to completion. The active option buttons always say "STOP" and "SAVE LOG" or "EXIT".  I would have expected it to return to have "START" as an option if the scan was fuily completed, but that never happens.  This time I only let it stall for an extra 10 minutes, but I  have tried to let it run for over an hour once with the same result. Does this mean it isn't scanning my entire computer?  I can let it run overnight and see if that makes a difference.

Any further assistance you can provide would be most appreciated as always!

Thanks,
Cory

[essexboy]

ClickOff is a program which does a daily and very annoying task for you: klick Buttons on useless notification and error-messages. So software is very easy to use:
If a message like "Are you sure you want to exit the program" shows up, you start the window-detection of clickoff and then point on the button you want to be clicked if the message shows up again, in this case this would be "Yes".
ClickOff then waits in the system-tray next to your clock until one of its target windows shows up and then clicks the desired button after. ClickOff does not need a lot of system-resources, it will only use 1 MB of memory and 0.1% of you CPU time.

  This is not an ideal piece of software to use, as the useless buttons may be "do you want to install my nice toolbar/adware/sality/vbs file"

I notice that you synch your files, are they held in the cloud, and did you synch prior to this ?

CAUTION :  This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:
 

CreateRestorePoint:
Startup: C:\Users\Cory\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windowsshell.vbs ()
2015-01-20 14:09 - 2015-01-21 12:45 - 00000000 __SHD () C:\Users\Deborah\AppData\Local\EmieUserList
2015-01-20 14:09 - 2015-01-21 12:45 - 00000000 __SHD () C:\Users\Deborah\AppData\Local\EmieSiteList
EmptyTemp:
CMD: bitsadmin /reset /allusers

 
Save this as fixlist.txt, in the same location as FRST.exe

Run FRST and press Fix
On completion a log will be generated please post that

THEN

Download  Anti VBS/VBE to your desktop

• download the appropriate version (32 bit or 64 bit) and double click the file to run it.
• After a couple of seconds (might also take a whole minute if the machine is heavily infected and/or slow) a report will open in Notepad.
• Post that report

Be aware this is a very new programme and as such is not recognised by any Antivirus or Windows, it is safe so allow it to run

[REDACTED]

Log files are attached.

I ran anti VBS/VBE immediately after running the FRST script, and it looks like the windowsshell.vbs came back in between...  Is that the malware that is causing my problems? If so, is there a way to find out where it is coming from?

[essexboy]

Could you now run a fresh FRST scan please to see if it has returned

[REDACTED]

FRST logs attached.

Thanks again!

[essexboy]

Can't see it any more

[REDACTED]

Great.  Hopefully it is gone for good.

Thanks for all your help and your patience!

[essexboy]

Monitor it for a day or so though