Is backup1.vbs from Malwarebytes? It is generating errors.

[dhsmith13]

I'm getting error messages from the script c:\Users\Public\backup1.vbs. When I looked at this script, it appears to be from Malwarebytes. I was not allowed to attach backup1.vbs so I copied it to backup1.vbs.txt and uploaded that.

Is this a Malwarebytes file? Why is it running? And what should I do about it? Rename it? Delete it?

backup1.vbs.txt

[Malwarebytes]

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes for Windows Help forum.

If you are having technical issues with our Windows product, please do the following:

Malwarebytes Support Tool - Advanced Options

This feature is designed for the following reasons:

• For use when you are on the forums and need to provide logs for assistance
• For use when you don't need or want to create a ticket with Malwarebytes
• For use when you want to perform local troubleshooting on your own

How to use the Advanced Options:

Spoiler

1. Download Malwarebytes Support Tool
2. Double-click mb-support-X.X.X.XXXX.exe to run the program
   • You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
3. Place a checkmark next to Accept License Agreement and click Next
4. Navigate to the Advanced tab
5. The Advanced menu page contains four categories:
   • Gather Logs: Collects troubleshooting information from the computer. As part of this process, Farbar Recovery Scan Tool (FRST) is run to perform a complete diagnosis. The information is saved to a file on the Desktop named mbst-grab-results.zip and can be added as an email attachment or uploaded to a forum post to assist with troubleshooting the issue at hand.
   • Clean: Performs an automated uninstallation of all Malwarebytes products installed to the computer and prompts to install the latest version of Malwarebytes for Windows afterwards. The Premium license key is backed up and reinstated. All user configurations and other data are removed. This process requires a reboot.
   •  Repair System: Includes various system-related repairs in case a Windows service is not functioning correctly that Malwarebytes for Windows is dependent on. It is not recommended to use any Repair System options unless instructed by a Malwarebytes Support agent.
   • Anonymously help the community by providing usage and threat statistics: Unchecking this option will prevent Malwarebytes Support Tool from sending anonymous telemetry data on usage of the program.
6. To provide logs for review click the Gather Logs button
7. Upon completion, click OK
8. A file named mbst-grab-results.zip will be saved to your Desktop
9. Please attach the file in your next reply.
10. To uninstall all Malwarebytes Products, click the Clean button.
11. Click the Yes button to proceed. 
12. Save all your work and click OK when you are ready to reboot.
13. After the reboot, you will have the option to re-install the latest version of Malwarebytes for Windows.
14. Select Yes to install Malwarebytes.
15. Malwarebytes for Windows will open once the installation completes successfully.

Screenshots:

Spoiler

 

 

 

 

Spoiler

 

 

 

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

• Renewals
• Refunds (including double billing)
• Cancellations
• Update Billing Info
• Multiple Transactions
• Consumer Purchases
• Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/hc/en-us/requests/new to get help

If you need help looking up your license details, please head here: Find my premium license key

 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

[David H. Lipman]

The error is because it is not a VB Script.  It is in HTML.

Delete it.

[dhsmith13]

I located the scheduled task that is attempting to run backup1.vbs (see the screenshot below). I have renamed the files backup1.vbs and 1.vbs, and disabled the scheduled tasks. We'll see what happens.

[AdvancedSetup]

If still having an issue please zip up the .VBS file to upload it.

The file you attached was not a .VBS file as @David H. Lipman said

Example - just a portion of your file

<!doctype html>
<html>

<head>
  <meta charset="UTF-8">
  <title>Malwarebytes</title>
  <script src="./scripts/vendor/vue.min.js"></script>
  <script src="./scripts/vendor/vue-i18n.js"></script>
  <script src="./scripts/vendor/vue-router.js"></script>
  <script src="./scripts/vendor/jquery-1.11.3.min.js"></script>
  <link type="text/css" rel="stylesheet" href="./scripts/styles.css?d=201921">
  <!-- <link type="text/css" rel="stylesheet" href="http://localhost:8080/scripts/styles.css?123"> -->

 

[dhsmith13]

There is no VBS file to upload. The extension of the files is .vbs, but the content is HTML as you point out. The HTML didn't look like VBScript to the Windows Script Host so it flagged an error in line 1.

Although there probably isn't an easy answer, I want to know how the files got there. And who created the scheduled tasks named adweb, adweb2 and adwebbackup? (After I renamed the files, I kept getting Windows Script Host messages that the original files were missing. That's when I looked at the scheduled tasks.) The files backup1.vbs and 1.vbs had timestamps of 12:37 PM on 3/18/2021. I was logged in to the Windows laptop but working on a different computer at this time.

[AdvancedSetup]

Sorry, I don't have any way to tell you how it got there. If you freeze using the system and hire a Forensic Analyst for probably a few hundred to a thousand dollars they might be able to tell you how it got on there.

We simply don't have the time and resources to do Forensic analysis and we work on removal and improving prevention.

I'd be more than happy to review your logs to see about any possible clean up or recommendations for improvements in security if you like.

Thank you

 

[dhsmith13]

I understand that fully diagnosing the problem would be prohibitively expensive. I think my best bet is to do a full backup of the documents folder on this computer, re-image the hard drive and re-install everything. There has been other strange behavior that I've reported to Microsoft, HP and Malwarebytes (see support ticket 3390259) and none of the scans that have been run have found anything. So I can't prove that there is malware on this computer but I am not comfortable using it (in its current state) for much besides playing games.

Do you think I have a reasonable plan? Is there anything else I should do?

[AdvancedSetup]

Here are my recommendations

Use an external USB drive to backup all your personal data.
Visit the support page from the manufacturer of your computer and download the latest drivers for your system and store them in a new folder on the external USB drive
 

Review the following pages for information and suggestions on backing up your data or imaging the current drive as well

Backup Software
https://forums.malwarebytes.org/index.php?/topic/136226-backup-software

Macrium Reflect discussion

 

I would also delete the partition and allow Windows 10 to create a new partition to install to

 

Below are links to ways to install Windows 10 again. Most are very similar but some do have differences in case you wish to review them.

One NOTE I would make is that for Windows 10 Home installation you need to disable the network in order to make a LOCAL account.
The choice is yours but personally, I do not like being forced to use a CLOUD account for my computer regardless of the claimed values it provides.
See below if that may be an issue for you as well

 

Greg Carmack - MVP 2010-2020 -Clean Install Windows 10
https://answers.microsoft.com/en-us/windows/forum/windows_10-windows_install/clean-install-windows-10/1c426bdf-79b1-4d42-be93-17378d93e587

How to Create a Local Account While Setting Up Windows 10
https://www.howtogeek.com/442792/how-to-create-a-local-account-while-setting-up-windows-10/

How to set up Windows 10 with a local account
https://www.windowscentral.com/how-set-windows-10-local-account

How to Clean Install Windows 10
https://www.tenforums.com/tutorials/1950-clean-install-windows-10-a.html

How to do a Clean Install of Windows 10 the Easy Way
https://www.howtogeek.com/224342/how-to-clean-install-windows-10/

How to do a clean installation of Windows 10
https://www.windowscentral.com/how-do-clean-installation-windows-10

How to install Windows 10 from DVD, USB, or ISO file
https://www.digitalcitizen.life/how-install-windows-10/

How to Custom Install Windows 10
https://www.tenforums.com/tutorials/120352-custom-install-windows-10-a.html

 

Once the computer is set up and running, please bookmark and review the following recommendations on keeping your computer safe and protecting your privacy.

 

 

If there is anything else I can assist you with please let me know

Good luck and take care. Hope you have a great weekend as well

Cheers @dhsmith13