WiredWX Hobby Weather ToolsLog in

 


vbs.runauto

2 posters

descriptionvbs.runauto - Page 3 EmptyRe: vbs.runauto

more_horiz
It came back this morning :-(

Scan type: Auto-Protect Scan
Event: Security Risk Found!
Security risk detected: VBS.Runauto
File: C:\Documents and Settings\BryanC\Local Settings\temp\DWH84B8.tmp
Location: Quarantine
Computer: WORKSTATION-H
User: BryanC
Action taken: Quarantine succeeded : Access denied
Date found: Monday, 26 December 2011 3:58:44 AM

descriptionvbs.runauto - Page 3 EmptyRe: vbs.runauto

more_horiz
Hello.

  • Open HijackThis.
  • Choose "Do a system scan only"
  • Check the boxes in front of these lines:


    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 10.10.10.254:3128
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = nexus.*;nexus;10.10.10.1;


  • Press "Fix Checked"
  • Close Hijack This.

Reboot normally.
How is the machine running now?

descriptionvbs.runauto - Page 3 EmptyRe: vbs.runauto

more_horiz
before I do this, Nexus is our office intranet that operates when I'm at work.
Will that be affected?

descriptionvbs.runauto - Page 3 EmptyRe: vbs.runauto

more_horiz
Ahh yeah it might be, okay don't do that.

What issues currently still exist?

descriptionvbs.runauto - Page 3 EmptyRe: vbs.runauto

more_horiz
same issues. Still get the nortons pop ups. though maybe not as often I'll send the log from the next one if you wish.

descriptionvbs.runauto - Page 3 EmptyRe: vbs.runauto

more_horiz
I take it back, they are just as often. That is almost continuous. I delete the Nortons message and another one appears within seconds.

here's the latest.
Scan type: Auto-Protect Scan
Event: Security Risk Found!
Security risk detected: VBS.Runauto
File: C:\Documents and Settings\BryanC\Local Settings\temp\DWH996C.tmp
Location: Quarantine
Computer: WORKSTATION-H
User: BryanC
Action taken: Quarantine succeeded : Access denied
Date found: Friday, 6 January 2012 7:00:21 AM

descriptionvbs.runauto - Page 3 EmptyRe: vbs.runauto

more_horiz
Sorry I should have sent log much sooner. They are still happening constantly.
Here's the latest log. Same as the rest :-(

Scan type: Auto-Protect Scan
Event: Security Risk Found!
Security risk detected: VBS.Runauto
File: C:\Documents and Settings\BryanC\Local Settings\temp\DWHE517.tmp
Location: Quarantine
Computer: WORKSTATION-H
User: BryanC
Action taken: Quarantine succeeded : Access denied
Date found: Sunday, 15 January 2012 10:21:23 AM

descriptionvbs.runauto - Page 3 EmptyRe: vbs.runauto

more_horiz
does this one have you stumped :-)

descriptionvbs.runauto - Page 3 EmptyRe: vbs.runauto

more_horiz
Yes :/ everything looks fine, not sure what's causing it, not sure where the autorun is coming from, everything looks fine.

Are you using any external hardware?

descriptionvbs.runauto - Page 3 EmptyRe: vbs.runauto

more_horiz
I use external hard drives reasonably regulary. I plug a phone in to charge. I use usb sticks and cards. It has a couple of card readers I have added to existing slots in teh side.

VBS Runauto is supposed to be a virus that attaches itself to cards isn't it.

I once tried clening the computer then not using the cards for a while, but it came back anyway.

descriptionvbs.runauto - Page 3 EmptyRe: vbs.runauto

more_horiz
Yeah it is.

The machine is clean, but some of the externel hardware is infected.


  1. Open My Computer.
  2. Go to Tools > Folder Options.
  3. Select the View tab.
  4. Scroll down to Hidden files and folders.
  5. Select Show hidden files and folders.
  6. Uncheck (untick) Hide extensions of known file types.
  7. Uncheck (untick) Hide protected operating system files (Recommended).
  8. Click Yes when prompted.
  9. Click OK.
  10. Close My Computer.


Plug in any/all external hardware and look through the root of the drive for an autorun folder, or an autorun.inf/autorun.ini/autorun.pnf file, or any weirdly named files, could be cmd/bat files, if so, delete them - they are all malicious.

descriptionvbs.runauto - Page 3 EmptyRe: vbs.runauto

more_horiz
I can't find anything.
I have removed the two card readers and the other thing I connect most often is my phone.

If you could confirm that the laptop is clean and I keep all external hardware away from it we could check to see if the bug is on the laptop or an accessary couldn't we.

I did that last time and the bug came back before I reconnected anything.

What do you think?

descriptionvbs.runauto - Page 3 EmptyRe: vbs.runauto

more_horiz
The only thing hard to keep out of this test would be the office network :-(

descriptionvbs.runauto - Page 3 EmptyRe: vbs.runauto

more_horiz
Hmmm, not sure.

Might be best to format the externel hardware, take off anything you want and format them just to be sure.

descriptionvbs.runauto - Page 3 EmptyRe: vbs.runauto

more_horiz
Thankyou, done that.

can we run a scan to see if the computer is clean, then not connect any external hardware to see if it stays that way?

descriptionvbs.runauto - Page 3 EmptyRe: vbs.runauto

more_horiz
privacy_tip Permissions in this forum:
You cannot reply to topics in this forum