WINDOWS/system32/killVBS.vbs script warning

[theplagy]

Hi all,

As the title suggested, this window script error message appears every time I start the window

it reads:

Cannot find script file "C:\WINDOWS\system32\killVBS.vbs"



I have no reason not to believe that this came from my infected flash drive. After googling to find some sort of way to fix this, this site came across. Therefore, I am here.

The symptoms I recognize is that the windows freezes randomly from time to time.

I am assuming that you would need a hijackthis log, so I did attach the log along.

I am new here, any suggestions and helps are greatly appreciated. Wish to find the cure soon!

Good day

 

[theplagy]

bump
really need the help

 

[RomulusJ]

Out of my current knowledge base but Give it a couple of hours its getting late North America (I'm off to bed) and early for the Euros.

There is a similar thread here

Notibly I would suggest you follow this post. That will help the more knowledgable people act faster.

 

[Jase123]

This doesn't sound like a virus.

Run a few scans and see if you find anything.

Regards Jase

 

[howard_hopkinso]

Hello and welcome to Techspot.

For you killVBS.vbs problem, try the following.

Download this TOOL. Extract it and run the Noob_kill.

Please download Flash_Disinfector.exe by sUBs and save it to your desktop:
Note: Please delete any existing copy of Flash Disinfector(if any) on your pc and download this one.

* Double-click Flash_Disinfector.exe to run it.
* Follow any prompts that may appear.
* Wait until the program has finished scanning, then please exit the program.
* Restart your computer and see if problem still persists.

Post a new Hijackthis log in your next reply please.

Regards Howard :wave: :wave:

This thread is for the use of theplagy only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[theplagy]

Ok I've followed the instruction and did everything.
The problem still occurs and here is the hijackthis log

 

[Jase123]

Please could you rename your hijackthis to Crusty.exe
This is because some form of malware can hide from Hijackthis.exe

Regards Jase

 

[howard_hopkinso]

Please do the following.

NEWdot.NET
Click Start/Control Panel/Add/Remove Programs and uninstall: Newdot.net Application or New.net Domains
If neither is listed, download and run this: www.new.net/support/uninstall6_38.exe

You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how HERE.

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE.

Go to add remove programmes in your control panel and uninstall anything to do with(if there).

FlashGet

Close control panel.

Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

Click on the processes tab and end process for(if there).

ALCMTR.EXE
ALCXMNTR.EXE

Close task manager.

Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)

O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - Startup: ~Disabled

O4 - Global Startup: ~Disabled

O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)

O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)

O10 - Broken Internet access because of LSP provider 'c:\program files\newdotnet\newdotnet7_22.dll' missing

O16 - DPF: {A959E4A5-0B3D-449E-9998-348705BD4092} (Desktop.Smdesk) - http://www.servicemagic.com/smod/smdesktop.CAB

O22 - SharedTaskScheduler: inscenation - {cfda6372-043c-48d2-ba3c-7bfe1cf71854} - (no file)

Click on the fix checked button.

Close HJT.

Locate and delete the following bold files and/or directories(if there).

C:\PROGRA~1\FlashGet
c:\program files\newdotnet
C:\windows\ALCMTR.EXE
C:\windows\ALCXMNTR.EXE

Reboot into normal mode and rehide your protected OS files.

Rename HJT as per these instructions.

Go and follow these instructions and post the requested files/results.

Regards Howard

This thread is for the use of theplagy only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[theplagy]

Hi, all

I did all of the following, for my sake it kept reappearing.

It gets worse because now my browser works for 10 secs and freezes for about 20 secs.

I find this annoying as hell so i'm bak assking for suggestion.

new logs attached

 

[howard_hopkinso]

Are you going to follow the instructions this time?

If you`re not, then there`s no point in trying to help you.

Go and read the Viruses/Spyware/Malware, preliminary removal instructions. Follow all the instructions exactly.

Post fresh HJT, AVG Antispyware and Combofix logs as Attachments into this thread, only after doing the above.

Also, let me know the results of the Panda Antirootkit scan.

Regards Howard

This thread is for the use of theplagy only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[theplagy]

Alrighty, I did all of the things you've said.

Did not find anything with Pandarootkits

My firefox browser still freezes every 10 secs for about 15 secs or so.

here are the logs

 

[howard_hopkinso]

All items in your AVG Antispyware log say "No Action Taken". That`s because you haven`t told AVG Antispyware to quarantine it`s results as per the instructions. See this pictorial guide.

Go to add remove programmes in your control panel and uninstall anything to do with(if there).

BoontyGames
viewpoint

Close control panel.

Download this TOOL. Extract it and run the Noob_kill.

Make sure you connect any flash drives to your system, so that they can be cleaned as well.

Please download Flash_Disinfector.exe by sUBs and save it to your desktop:
Note: Please delete any existing copy of Flash Disinfector(if any) on your pc and download this one.

* Double-click Flash_Disinfector.exe to run it.
* Follow any prompts that may appear.
* Wait until the program has finished scanning, then please exit the program.
* Restart your computer.

Open notepad and copy/paste the text in the code box below into it:
NOTE* make sure to only highlight and copy what is inside the quote box nothing out side of it.
Also ..

Pay particular attention to this :-

Make sure the word File:: is on the first line of the text file you save (no blank line above it, & no space in front of it)
Code:

Folder::
C:\Program Files\BoontyGames
C:\qoobox
C:\Program Files\Viewpoint

Save this as CFScript.txt

Then drag the CFScript.txt into ComboFix.exe as you see in the screenshot below.

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a fresh HJT and AVG Antispyware log.

Regards Howard

This thread is for the use of theplagy only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[theplagy]

Sorry for not being very through following your directions.

here are the logs

Thank you for you patience,

Good Day

 

[howard_hopkinso]

Delete all files in AVG Antispyware quarantine.

Open notepad and copy/paste the text in the code box below into it:
NOTE* make sure to only highlight and copy what is inside the quote box nothing out side of it.
Also ..

Pay particular attention to this :-

Make sure the word File:: is on the first line of the text file you save (no blank line above it, & no space in front of it)
Code:

File::
C:\windows\system32\wscript.exe
C:\windows\system32\killVBS.vbs
N:\wd_windows_tools\setup.exe
N:\LaunchU3.exe
Folder::
C:\qoobox
Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1c95f8f2-5519-11dc-b634-0011d82ea530}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{225d54bd-702b-11dc-b658-a638b88629b0}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{225d54be-702b-11dc-b658-a638b88629b0}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{46dd4537-a579-11db-b5ab-0011d82ea530}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{86c0839d-6ae3-11dc-b650-0060b30c142a}]

Save this as CFScript.txt

Then drag the CFScript.txt into ComboFix.exe as you see in the screenshot below.

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a fresh HJT log.

Regards Howard

This thread is for the use of theplagy only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[theplagy]

combofix log attached.

[CENTER][CENTER][/CENTER][/CENTER]

 

[howard_hopkinso]

I requested a fresh HJT log as well.

You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how HERE.

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE.

Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

Click on the processes tab and end process for(if there).

wscript.exe
killVBS.vbs
setup.exe
LaunchU3.exe

Close task manager.

Click start/run and type regedit into the run box and hit the enter key.

Navigate to the following regkeys and delete the bold portion.

HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\m ountpoints2\{1c95f8f2-5519-11dc-b634-0011d82ea530}

HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\m ountpoints2\{225d54bd-702b-11dc-b658-a638b88629b0}

HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\m ountpoints2\{225d54be-702b-11dc-b658-a638b88629b0}

HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\m ountpoints2\{46dd4537-a579-11db-b5ab-0011d82ea530}

HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\m ountpoints2\{86c0839d-6ae3-11dc-b650-0060b30c142a}

Close regedit.

Locate and delete the following bold files and/or folders(if there).

C:\windows\system32\wscript.exe
C:\windows\system32\killvbs.vbs
N:\LaunchU3.exe
N:\wd_windows_tools\setup.exe

Reboot into normal mode and rehide your protected OS files.

Post fresh Combofix and HJT logs.

Regards Howard

This thread is for the use of theplagy only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[theplagy]

Alright

Here are the new logs.
I notice that the error box of killvbs stops showing now when i start up the computer.

 

[howard_hopkinso]

All clean.

Delete the following folder.

C:\qoobox

Turn off system restore.(XP/ME only) See how HERE.

Now, turn system restore back on. This will have deleted all your old restore points and any nasties that are in them. It will also have created a new, clean restore point.


If you have any further virus/spyware problems, please post in this thread.

Regards Howard

This thread is for the use of theplagy only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.