Possible Wscript Usb Url Viri?

Discussion in 'Malware Help (A Specialist Will Reply)' started by 7.62mm, Apr 9, 2016.

  1. 7.62mm

    7.62mm Private E-2

    Hello there fellow Major Geeks, It's me again!, I did it once again unfortunately due to my own arrogance, So i am here at the mercy of the more experienced geeks here as i ask you all for help.

    So Symptoms! Page file is used up, like 60 of 60 gigs used and 14/12 of 16 physical ram is used up and this happens randomly, no way to fix it beyond restarting system, I used Process explorer to try and divulge the secrets of this usage being that when i brought the issue to the task manager there was absolutely nothing AWRY, which was a lie!. Process explorer also failed to bring up anything, I know it was not a misrepresentation because the system was Faltering in Stride, as if under heavy Duress!

    I have a suspicion that the issue is related to wscript and a virus of some sort, Possibly Usb related, There is a temp_setup.VBS file that keeps appearing in startup menu and will re-add itself if i manually delete it. There are entries in MSCONFIG startup which i can not identify their usage/Origin. Says its mircosoft R, 'wscript.exe //B "C:\Users\admin\AppDate\Roaming\Temp_setup.vbs"

    I use no storage drives beyond a usb creative muvo mp3 player tho and i was under the impression this hit thumb/external drives only or is it all usb peripherals?

    that being said i have run some traditional tools already, Rkill in safe mode, Combofix, adwcleaner, I am in the process of completing the Geeks standard List for malware, but i have a gut feeling i will be back!.

    Thank you for your time!!!!.

    combo fix log
     
    7.62mm, Apr 9, 2016
    #1
  2. 7.62mm

    7.62mm Private E-2

    Ok, So no Luck,

    Here are the logs from the geeks startup removal guide post,
     

    Attached Files:

    7.62mm, Apr 9, 2016
    #2
  3. 7.62mm

    7.62mm Private E-2

    New Combofix log and rkill log aswell, sorry could only hold 5 max files on the post, so i made another one here for the other logs.
     

    Attached Files:

    7.62mm, Apr 9, 2016
    #3
  4. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    SystemLook

    Please download SystemLook from one of the links below appropriate for your operating system and save it to your Desktop.
    Download 32 Bit
    Download 64 Bit
    • Double-click SystemLook.exe to run it.
    • Copy the content of the following codebox into the main textfield:
      Code:
      :filefind
temp_setup.vbs
:regfind
temp_setup.vbs
    • Click the Look button to start the scan.
    • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
    Note: The log can also be found on your Desktop entitled SystemLook.txt



    Please download the latest version of Farbar Recovery Scan Tool and save it to your desktop.

    Note: Make sure you download the correct version for your PC. Only the correct version will work.
    • Double-click to run it. When the tool opens click Yes to disclaimer.
    • Press Scan button.
    • It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your next reply.
    • The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
     
    Kestrel13!, Apr 9, 2016
    #4
  5. 7.62mm

    7.62mm Private E-2

    Ok kestrel13 here we go, Lemme know what else you need!.
     

    Attached Files:

    7.62mm, Apr 9, 2016
    #5
  6. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Did you install this at some point?

    2016-04-09 16:01 - 2016-04-09 16:01 - 00000000 ____D C:\Program Files (x86)\Vbsedit

    (By Adersoft)

    http://www.vbsedit.com/

    I think this is why you are seeing those temp_setup.vbs files. Let me know.
     
    Kestrel13!, Apr 10, 2016
    #6
  7. 7.62mm

    7.62mm Private E-2

    Unfortunately I installed this program just recently in an attempt to Debug the VBS file to see what the heck its telling my computer to do. The vbs file has a date of birth from 2015, So I do not believe that it is related, Tho it is being it is a VBS debugging and editing software.
     
    7.62mm, Apr 10, 2016
    #7
    Kestrel13! likes this.
  8. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member


    NOTE: This script was written specifically for this user for use on this particular computer. Running this on another machine may cause damage to your operating system.
    Download Fixlist.txt

    Save fixlist.txt on your Desktop. Make sure you save it as a txt file.
    • You should now have both fixlist.txt and FRST64.exe on your Desktop.
    • Now I want you to disconnect your PC connection to the internet by unplugging the cable ( if it is wireless then temporarily shutdown the wireless network ).
    • Run FRST64.exe by right clicking on it and selecting Run As Adminstrator
    • Click the Fix button just once and wait.
    • Your computer should reboot after the fix runs.
    • Reconnect your internet connection after reboot so you can come back here to continue.
    • The tool will make a log on the Desktop (Fixlog.txt) please attach this new log to your next reply (attach or paste)
    Then attach the below log:


      • Fixlog.txt

        Also at this point, I want to double check the status of things by having you run another scan with FRST like in my last message and attach the new FRST.txt and Addition.txt logs.

    Explain how things are running.

     

    Attached Files:

    Kestrel13!, Apr 10, 2016
    #8
  9. 7.62mm

    7.62mm Private E-2

    7.62mm, Apr 10, 2016
    #9
    Kestrel13! likes this.
  10. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    OK, continue on with my instructions. :)
     
    Kestrel13!, Apr 10, 2016
    #10
  11. 7.62mm

    7.62mm Private E-2

    Ok, Ran the fixlist in same DIR as frst64 executable, here is the log!
     

    Attached Files:

    7.62mm, Apr 10, 2016
    #11
  12. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Can the malicious software removal tool deal with it?
    Continue on with my other instructions as well please.
     
    Kestrel13!, Apr 10, 2016
    #12
  13. 7.62mm

    7.62mm Private E-2

    Yes, Windows Mal Tool did scrub the system of the infection, the vbs file is gone from the start menu and the reg entries related to wscript are gone from msconfig aswell, I would like to say mission accomplished but still a wee bit paranoid on the matter.

    I believe i posted the log for frst64, Did i not complete your instructions properly?

    So purely anecdotal, system feels more responsive than its been in awhile. Things are snapping a lil quicker than usual. Internet queries seem to be fetching faster aswell.

    Also Windows UAC turned back on
     
    7.62mm, Apr 10, 2016
    #13
  14. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    I had asked you to run a new scan with FRST. Might as well do that :)
     
    Kestrel13!, Apr 10, 2016
    #14
  15. 7.62mm

    7.62mm Private E-2

    OK, now i know what those instructions were trying to say, I got a lil confused there tbh :cool:

    just redid everything for clarity.
     

    Attached Files:

    7.62mm, Apr 10, 2016
    #15
  16. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Logs look good, Malicious software removal tool did a great job. :)

    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.
    2. Renable your Disk Emulation software with Defogger if you had disabled it in step 4 of the READ & RUN ME.
    3. Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.
    4. If running Vista, Win 7 or Win 8, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    5. Now goto the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    6. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others) and running MGclean.bat did not remove them, you can delete these files now.
    7. If you are running Win 8, Win 7, Vista, Windows XP or Windows ME, do the below to flush restore points:
      • Refer to the instructions for your WIndows version in this link: Disable And Enable System Restore​
      • What we want you to do is to first disable System Restore to flush restore points some of which could be infected.
      • Then we want you to Enable System Restore to create a new clean Restore Point.
    8. After doing the above, you should work thru the below link:
     
    Kestrel13!, Apr 10, 2016
    #16
  17. 7.62mm

    7.62mm Private E-2

    Ok i have re-enabled the items as listed, Took the time to change all my passwords for my major accounts, Hopefully this provides me some security again!. Curious to see how games perform now since the resource hoggin viri is removed. My cpu has already dropped 20C in temp while idling, Normally sat quite high even tho no load was present. Another thing is my Cpu voltages are no longer going 'wonky', Id bring up the cpu monitor and find the voltages going weird even if i manually set them to a certain multiplier, when previous to this all, it would stay where i set it, load or not. I dont over clock but do use the cpus boost function.

    that being said Kestrel13! thank you very much for your time and patience, I like to believe i am somewhat competent in safe computing practices but as i Found out here it still can find a way of sneaking in and i need to take better steps protecting myself, I noticed this issue months ago and thought it was strange but put no thought into it whatsoever.

    Blah complacency is a killer!.
     
    7.62mm, Apr 10, 2016
    #17
  18. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    You are most welcome. Glad you're running smoothly again. ;)
     
    Kestrel13!, Apr 11, 2016
    #18

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds