Forums
New posts
Search forums
News
Security News
Technology News
Giveaways
Giveaways, Promotions and Contests
Discounts & Deals
Reviews
Users Reviews
Video Reviews
Support
Windows Malware Removal Help & Support
Mac Malware Removal Help & Support
Mobile Malware Removal Help & Support
Blog
Log in
Register
What's new
Search
Search titles only
By:
Search titles only
By:
Reply to thread
Menu
Install the app
Install
JavaScript is disabled. For a better experience, please enable JavaScript in your browser before proceeding.
You are using an out of date browser. It may not display this or other websites correctly.
You should upgrade or use an
alternative browser
.
Forums
Software
Security Apps
Other security for Windows, Mac, Linux
Wscript trying to run
Message
<blockquote data-quote="cruelsister" data-source="post: 891397" data-attributes="member: 7463"><p>Hi Tickle! May not be due to an update. Actually I think that there is a chance that you may have had a run in with one of my beloved Worms. What may appear to be an actual svchost process may be instead a cloaked (don't ask) wscript. If this is indeed so it is Double Plus Ungood as it frequently will be able to connect out and proceed with various nastiness.</p><p></p><p>A further issue is that running a 2nd opinion scan with the usual suspects either will not detect the presence of the initial worm nor the cloaked svchost spawn, or if they do the persistence mechanism of the worm may not be detected so the infection will keep coming back no matter how many reboots or how many scans are done (kinda like Whack-A-Mole). </p><p></p><p>Anyway, what you can do quite easily is check for Startup Items via Task manager, looking for some wscript (like a vbs file) item. Also check ALL the running svchost processes (task Manager-Details-Properties) Any one of them not in System32 is suspect.</p><p></p><p>Easier still, download and run Kaspersky Virus Removal Tool which is a scanner that has the best chance at detecting wormy processes. </p><p></p><p>Of course there may be other theories...</p><p></p><p>M</p></blockquote><p></p>
[QUOTE="cruelsister, post: 891397, member: 7463"] Hi Tickle! May not be due to an update. Actually I think that there is a chance that you may have had a run in with one of my beloved Worms. What may appear to be an actual svchost process may be instead a cloaked (don't ask) wscript. If this is indeed so it is Double Plus Ungood as it frequently will be able to connect out and proceed with various nastiness. A further issue is that running a 2nd opinion scan with the usual suspects either will not detect the presence of the initial worm nor the cloaked svchost spawn, or if they do the persistence mechanism of the worm may not be detected so the infection will keep coming back no matter how many reboots or how many scans are done (kinda like Whack-A-Mole). Anyway, what you can do quite easily is check for Startup Items via Task manager, looking for some wscript (like a vbs file) item. Also check ALL the running svchost processes (task Manager-Details-Properties) Any one of them not in System32 is suspect. Easier still, download and run Kaspersky Virus Removal Tool which is a scanner that has the best chance at detecting wormy processes. Of course there may be other theories... M [/QUOTE]
Insert quotes…
Verification
Post reply
Top