Author Topic: Wscript.exe virus detected  (Read 10073 times)

0 Members and 1 Guest are viewing this topic.

LGVD

  • Guest
Wscript.exe virus detected
« on: March 24, 2014, 12:49:07 AM »
hi... yesterday i took my usb flashdrive to school and today i started gettin virus messages on my pc(yes i use my flash drive alot) they all accuse the file  Wscript.exe... it happens nonstop when i enter my desktop... i tried several online antiviruses and read about fixes on the avast forum.. nothing helped so far... i dont know what to do anymore  :'(

Offline Secondmineboy

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 3645
Re: Wscript.exe virus detected
« Reply #1 on: March 24, 2014, 12:50:32 AM »
Follow this guide and attach the requested logs: http://forum.avast.com/index.php?topic=53253.0

For USB Viruses i can recommend MCShield: mcshield.net
Windows 10 1909, 4 GB DDR3 RAM, 500 GB 5400 RPM HDD, 1366 by 768 LCD Screen, Intel Core i3 5010U Dual Core, Intel HD Graphics 5500
HUAWEI P30 Pro. Android 10

LGVD

  • Guest
Re: Wscript.exe virus detected
« Reply #2 on: March 24, 2014, 12:59:21 AM »
im sorry about the long time responses... my internet connection its 100 kb download speed only... but i will be posting at least 3 times a day... i already tried using mcshield and it didnt worked... my flashdrive its clean ( i dont know how) but my pc  still infected... im updating antiviruses right now and i will upload the Malwarebytes Anti-Malware log file soon as i finish the update

Offline Michael (alan1998)

  • Massive Poster
  • ****
  • Posts: 2768
  • Volunteer
Re: Wscript.exe virus detected
« Reply #3 on: March 24, 2014, 01:11:52 AM »
More then 1 AV is not recommended. It will slow your computer down.

Also, please also attach OTL, MCShield & Malwarebytes. Sometimes we can see what you don't. Thanks!
VOLUNTEER

Senior Security Analyst; Sys Admin (Linux); Forensics/Incident Response.

Security is a mindset, not an application. Think BEFORE you click.

LGVD

  • Guest
Re: Wscript.exe virus detected
« Reply #4 on: March 24, 2014, 01:22:15 AM »
 Malwarebytes just blocked the virus when i restarted...then the virus came back disabled malware and destroyed explorer.exe and my whole pc stoped working... now i have to use taskmanager to delete the virus as soon as i start and enter desktop... anyway here are the log files from  Malwarebytes and mcshield

EDIT: Just scanned using OTL... he stopped working while scanning firefox files... now i just found out that my firefox its not working... apparently whenever OTL scan his files i get a BSOD...
« Last Edit: March 24, 2014, 01:42:21 AM by LGVD »

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37578
  • Not a avast user
Re: Wscript.exe virus detected
« Reply #5 on: March 24, 2014, 02:44:24 AM »
try run OTL from safe mode.....


Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Wscript.exe virus detected
« Reply #6 on: March 24, 2014, 04:08:29 PM »
Try this programme instead

Please download Farbar Recovery Scan Tool and save it to your Desktop.
 
Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
 
  • Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will produce a log called FRST.txt in the same directory the tool is run from. 
  • Please copy and paste log back here.
  • The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.

LGVD

  • Guest
Re: Wscript.exe virus detected
« Reply #7 on: March 24, 2014, 08:28:06 PM »
here are the 2 logs from Farbar Recovery Scan Tool also OSL doesnt work even on safe mode...and i checked my firefox he freezes whenever i try to open any website( i will delete it using revo uninstaller),but im using google chrome so its not a big deal...

by the way my sister managed to use this pc while i was asleep... i think the other pc its starting to get some random wscript on taskmanager(2 of them) but avast or mcshield just scanned and nothing appeared...
« Last Edit: March 24, 2014, 08:32:10 PM by LGVD »

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Wscript.exe virus detected
« Reply #8 on: March 24, 2014, 08:53:13 PM »
I found it :)

Surprised that MCShield didn't though

Firefox is corrupt so do a full uninstall of that

Download the attached Fixlist.txt to the same location as FRST
Run FRST and press Fix
On completion a log will be generated please post that

LGVD

  • Guest
Re: Wscript.exe virus detected
« Reply #9 on: March 24, 2014, 08:58:12 PM »
just uninstalled firefox using revo... i cleaned even the registry leftovers

and here is your log   8)






Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Wscript.exe virus detected
« Reply #10 on: March 24, 2014, 09:25:28 PM »
how is the computer behaving now ?

LGVD

  • Guest
Re: Wscript.exe virus detected
« Reply #11 on: March 24, 2014, 09:35:37 PM »
just restarted the cpu... same thing... windows open... mc shield and avast block the virus... and then the whole pc freezes in the process... the only way to make it work again its restarting the cpu... im trying not to use any passwords or codes from emails,facebook,steam,hotmail and other things... :-\

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Wscript.exe virus detected
« Reply #12 on: March 24, 2014, 09:39:26 PM »
OK me use da big boy :)

Download and Install Combofix
 
Download ComboFix from one of the following locations:
Link 1
Link 2
 
VERY IMPORTANT !!! Save ComboFix.exe to your Desktop
 
* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
  • Double click on ComboFix.exe & follow the prompts.
  • Accept the disclaimer and allow to update if it asks




  • When finished, it shall produce a log for you.
  • Please include the C:\ComboFix.txt in your next reply.[/b]
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

3.  If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.


Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

LGVD

  • Guest
Re: Wscript.exe virus detected
« Reply #13 on: March 24, 2014, 10:14:19 PM »
ok so the combo fix program did his work until he restarted the system... after that it froze on  the " finishing report  please dont open or use any program while combo fix its doing his work" thing.. i waited like 15 mins and the cpu use was   2% only... i rebooted my cpu and now its back to normal... and he didnt saved any log

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Wscript.exe virus detected
« Reply #14 on: March 24, 2014, 10:15:33 PM »
OK could you now run OTL as it should work with firefox gone