Windows Script Host; Cannot find script file

[zcbm]

Hello all,

Last year on 17.10.2023 I installed a program and did not think of anything. Today 17.10.2024, I suddenly got a Windows Script Host error. I learned that most likely that is virus. I have been a client of Malwarebytes for about 3 years now. Interestingly, today Malwarebytes also found a virus, the same file Windows Script Host error was referencing.

I have deleted the Virus file, renewed script files with DISM and SFC, scanned the computer multiple times. 0 viruses found. But I am still getting the same error. Also, despite finding the virus currently Malwarebytes shows that there have been no detections. Please see attached photo of error and malwarebytes report.

 

PS. What kind of information they might have stolen?

[Porthos]

@zcbm

Although I will not be directly assisting you, a malware removal expert will be along to assist after you do the following.

Let's get the info to get the process started. Be aware it will take many steps and scans to fully remove malware.

Please do all of the requested scans in order and attach all of the results in your next reply.<<<<< Important.

Please respond to all future instructions from your helper in a timely manner.

Let's go ahead and run a couple of scans and get some updated logs from your system. Please read the entire post below before starting so that you're more familiar with the process

Then follow each step in the order provided. Unless otherwise asked, please attach all logs

 

Please make the following system changes: Please pay close attention the the instructions in all of the following links.

• If you have not done so already - Enable System Protection and create a NEW System Restore Point  <<<<< Important.
• Temporarily disable your antivirus real-time protection or other security software first only if it blocks or interferes with the scans or downloads.. Make sure to turn it back on once the scans are completed
• Temporarily disable Microsoft SmartScreen to download software below only if needed. Make sure to turn it back on once the downloads are completed
• Disable-Fast-Startup   Windows 8 and newer only <<<<< Important.
• Show-Hidden-Folders-Files-Extensions

Please run the following scans: Please pay close attention the the instructions in all of the following links.

1. Click the following link and run a  Scan with AdwCleaner
2. Click the following link and run a  Scan with Malwarebytes
      RESTART the computer <<<<< Important.
3. Click the following link and run a  Scan with Farbar Recovery Scan Tool 

Example image of where to click to attach files when posting your reply

Then be patient for the next expert to take your case. <<<<< Important.

 

Thank you

[MKDB]

Hello  @zcbm  and 

 

My name is MKDB and I will assist you.

 

 

Let's keep these principles as we proceed. Make sure to read the entire post below first.

• Please follow the steps in the given order and post back the log files.
• Please attach all log files into your post.
• Before we start, please make sure that you have an external backup, not connected to this system, of all private data.
• Only run the tools I guide you to. Please don't run any other scans, download, install or uninstall any programs while I'm working with you.
• As English is not my native language, please do not use slang or idioms. It may be hard for me to understand.
• If you do not respond within 4 days, your topic will be closed.
• Cracked or hacked or pirated programs are not only illegal, but also will make a computer a malware victim. Having such programs installed, is the easiest way to get infected. It is the leading cause of ransomware encryptions. It is at times also a big source of current trojan infections. If you are running any kin of illegal software on your system, please uninstall them now, before we start the cleaning procedure.

 

 

Please attach the requested logs from "AdwCleaner", "Malwarebytes" and "Farbar Recovery Scan Tool" and we will be happy to help you!

Thank you!

[zcbm]

Hi,

 

Everything was done as requested.

I added 2 malwarebytes logs. One which detected the trojan (before creating forum post) and another after creating forum post. Both are attached.

PS. After all scans the Host error still shows up.

Addition.txt AdwCleaner[C00].txt AdwCleaner[S00].txt AfterForum.txt FRST.txt WhatWasDetectedBeforeForum.txt

[MKDB]

@zcbm

Thanks for those logs.

Please give me time to review what you have posted.

[MKDB]

@zcbm

We will use FRST to run a fix.

Please be patient and do not interefere.

Thank you!

 

 

• Please download the attached fixlist.txt file and save it to the location where you ran FRST from ( F:\Downloads\ ).

Note: It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

• Close all open programs and save your work.
• Run FRST again.
• Press the FIX button only once and wait.
• Please be patient and do not interfere, even if FRST does not respond for some time. That's nothing to worry about.
• Please note: This Fix will remove all temporary files, empty recycle bin and will remove cookies and may result in some websites indicating they do not recognize your computer. It may be necessary to receive and apply a verification code.
• Please note: This step resets your Firewall settings and you may be asked later to grant permission for legitimate programs to pass through the Firewall. If you recognize the program, agree to the request.
• If the tool needs a restart, please make sure you let the system restart normally and let the tool complete its run after restart.
• FRST will create one log now (Fixlog.txt) in the same directory the tool is run. Please attach this logfile to your next reply.

 

 

fixlist.txt

[zcbm]

Hi,

 

Ran FRST as requested. fixlog.txt attached.

 

PS. At the time of writing, host error has not showed up.

Fixlog.txt

[MKDB]

@zcbm

Well done.

Please reboot your system and run the following fresh scans to check the results.

 

 

Scan with Farbar Recovery Scan Tool:

https://forums.malwarebytes.com/topic/306601-scan-with-farbar-recovery-scan-tool/

 

Scan with SecurityCheck:

https://forums.malwarebytes.com/topic/307301-scan-with-securitycheck-by-glax24/

 

 

[zcbm]

Hi,

All done, logs attached.

Addition(1).txt FRST(1).txt SecurityCheck.txt