TechSpot

WINDOWS/system32/killVBS.vbs script warning

By theplagy
Sep 25, 2007
  1. Hi all,

    As the title suggested, this window script error message appears every time I start the window

    it reads:

    Cannot find script file "C:\WINDOWS\system32\killVBS.vbs"



    I have no reason not to believe that this came from my infected flash drive. After googling to find some sort of way to fix this, this site came across. Therefore, I am here. :)

    The symptoms I recognize is that the windows freezes randomly from time to time.

    I am assuming that you would need a hijackthis log, so I did attach the log along.

    I am new here, any suggestions and helps are greatly appreciated. Wish to find the cure soon!

    Good day:D
     

    Attached Files:

  2. theplagy

    theplagy TS Rookie Topic Starter

    bump
    really need the help
     
  3. RomulusJ

    RomulusJ TS Rookie Posts: 22

    Out of my current knowledge base but Give it a couple of hours its getting late North America (I'm off to bed) and early for the Euros.

    There is a similar thread here

    Notibly I would suggest you follow this post. That will help the more knowledgable people act faster.
     
  4. Jase123

    Jase123 Banned Posts: 1,012

    This doesn't sound like a virus.

    Run a few scans and see if you find anything.

    Regards Jase :)
     
  5. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Hello and welcome to Techspot.

    For you killVBS.vbs problem, try the following.

    Download this TOOL. Extract it and run the Noob_kill.

    Please download Flash_Disinfector.exe by sUBs and save it to your desktop:
    Note: Please delete any existing copy of Flash Disinfector(if any) on your pc and download this one.

    * Double-click Flash_Disinfector.exe to run it.
    * Follow any prompts that may appear.
    * Wait until the program has finished scanning, then please exit the program.
    * Restart your computer and see if problem still persists.

    Post a new Hijackthis log in your next reply please.

    Regards Howard :wave: :wave:

    This thread is for the use of theplagy only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  6. theplagy

    theplagy TS Rookie Topic Starter

    Ok I've followed the instruction and did everything.
    The problem still occurs and here is the hijackthis log
     

    Attached Files:

  7. Jase123

    Jase123 Banned Posts: 1,012

    Please could you rename your hijackthis to Crusty.exe
    This is because some form of malware can hide from Hijackthis.exe

    Regards Jase :)
     
  8. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Please do the following.

    NEWdot.NET
    Click Start/Control Panel/Add/Remove Programs and uninstall: Newdot.net Application or New.net Domains
    If neither is listed, download and run this: www.new.net/support/uninstall6_38.exe

    You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

    Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how HERE.

    In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE.

    Go to add remove programmes in your control panel and uninstall anything to do with(if there).

    FlashGet

    Close control panel.

    Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

    Click on the processes tab and end process for(if there).

    ALCMTR.EXE
    ALCXMNTR.EXE

    Close task manager.

    Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

    O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)

    O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE

    O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

    O4 - Startup: ~Disabled

    O4 - Global Startup: ~Disabled

    O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)

    O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)

    O10 - Broken Internet access because of LSP provider 'c:\program files\newdotnet\newdotnet7_22.dll' missing

    O16 - DPF: {A959E4A5-0B3D-449E-9998-348705BD4092} (Desktop.Smdesk) - http://www.servicemagic.com/smod/smdesktop.CAB

    O22 - SharedTaskScheduler: inscenation - {cfda6372-043c-48d2-ba3c-7bfe1cf71854} - (no file)

    Click on the fix checked button.

    Close HJT.

    Locate and delete the following bold files and/or directories(if there).

    C:\PROGRA~1\FlashGet
    c:\program files\newdotnet
    C:\windows\ALCMTR.EXE
    C:\windows\ALCXMNTR.EXE

    Reboot into normal mode and rehide your protected OS files.

    Rename HJT as per these instructions.

    Go and follow these instructions and post the requested files/results.

    Regards Howard :)

    This thread is for the use of theplagy only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  9. theplagy

    theplagy TS Rookie Topic Starter

    Hi, all

    I did all of the following, for my sake it kept reappearing.

    It gets worse because now my browser works for 10 secs and freezes for about 20 secs.

    I find this annoying as hell so i'm bak assking for suggestion.

    new logs attached
     
  10. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Are you going to follow the instructions this time?

    If you`re not, then there`s no point in trying to help you.

    Go and read the Viruses/Spyware/Malware, preliminary removal instructions. Follow all the instructions exactly.

    Post fresh HJT, AVG Antispyware and Combofix logs as Attachments into this thread, only after doing the above.

    Also, let me know the results of the Panda Antirootkit scan.

    Regards Howard :)

    This thread is for the use of theplagy only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  11. theplagy

    theplagy TS Rookie Topic Starter

    Alrighty, I did all of the things you've said.

    Did not find anything with Pandarootkits

    My firefox browser still freezes every 10 secs for about 15 secs or so.

    here are the logs
     
  12. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    All items in your AVG Antispyware log say "No Action Taken". That`s because you haven`t told AVG Antispyware to quarantine it`s results as per the instructions. See this pictorial guide.

    Go to add remove programmes in your control panel and uninstall anything to do with(if there).

    BoontyGames
    viewpoint

    Close control panel.

    Download this TOOL. Extract it and run the Noob_kill.

    Make sure you connect any flash drives to your system, so that they can be cleaned as well.

    Please download Flash_Disinfector.exe by sUBs and save it to your desktop:
    Note: Please delete any existing copy of Flash Disinfector(if any) on your pc and download this one.

    * Double-click Flash_Disinfector.exe to run it.
    * Follow any prompts that may appear.
    * Wait until the program has finished scanning, then please exit the program.
    * Restart your computer.

    Open notepad and copy/paste the text in the code box below into it:
    NOTE* make sure to only highlight and copy what is inside the quote box nothing out side of it.
    Also ..

    Pay particular attention to this :-

    Make sure the word File:: is on the first line of the text file you save (no blank line above it, & no space in front of it)
    Code:

    Save this as CFScript.txt

    Then drag the CFScript.txt into ComboFix.exe as you see in the screenshot below.

    [​IMG]

    This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a fresh HJT and AVG Antispyware log.

    Regards Howard :)

    This thread is for the use of theplagy only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  13. theplagy

    theplagy TS Rookie Topic Starter

    Sorry for not being very through following your directions.

    here are the logs

    Thank you for you patience, :D

    Good Day
     
  14. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Delete all files in AVG Antispyware quarantine.

    Open notepad and copy/paste the text in the code box below into it:
    NOTE* make sure to only highlight and copy what is inside the quote box nothing out side of it.
    Also ..

    Pay particular attention to this :-

    Make sure the word File:: is on the first line of the text file you save (no blank line above it, & no space in front of it)
    Code:



    Save this as CFScript.txt

    Then drag the CFScript.txt into ComboFix.exe as you see in the screenshot below.

    [​IMG]

    This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a fresh HJT log.

    Regards Howard :)

    This thread is for the use of theplagy only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  15. theplagy

    theplagy TS Rookie Topic Starter

    combofix log attached.

     
  16. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    I requested a fresh HJT log as well.

    You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

    Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how HERE.

    In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE.

    Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

    Click on the processes tab and end process for(if there).

    wscript.exe
    killVBS.vbs
    setup.exe
    LaunchU3.exe

    Close task manager.

    Click start/run and type regedit into the run box and hit the enter key.

    Navigate to the following regkeys and delete the bold portion.

    HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\m ountpoints2\{1c95f8f2-5519-11dc-b634-0011d82ea530}

    HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\m ountpoints2\{225d54bd-702b-11dc-b658-a638b88629b0}

    HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\m ountpoints2\{225d54be-702b-11dc-b658-a638b88629b0}

    HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\m ountpoints2\{46dd4537-a579-11db-b5ab-0011d82ea530}

    HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\m ountpoints2\{86c0839d-6ae3-11dc-b650-0060b30c142a}

    Close regedit.

    Locate and delete the following bold files and/or folders(if there).

    C:\windows\system32\wscript.exe
    C:\windows\system32\killvbs.vbs
    N:\LaunchU3.exe
    N:\wd_windows_tools\setup.exe

    Reboot into normal mode and rehide your protected OS files.

    Post fresh Combofix and HJT logs.

    Regards Howard :)

    This thread is for the use of theplagy only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  17. theplagy

    theplagy TS Rookie Topic Starter

    Alright

    Here are the new logs.
    I notice that the error box of killvbs stops showing now when i start up the computer.
     
  18. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    All clean.

    Delete the following folder.

    C:\qoobox

    Turn off system restore.(XP/ME only) See how HERE.

    Now, turn system restore back on. This will have deleted all your old restore points and any nasties that are in them. It will also have created a new, clean restore point.


    If you have any further virus/spyware problems, please post in this thread.

    Regards Howard :)

    This thread is for the use of theplagy only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...