i been trying to delete this thing off my Pc
URL: http://jack1425.bounceme.net:778/is-ready
Infection: URL:Mal
Process: C:\Windows\System32\wscript.exe
i’m sorry i’m a noob at this.
follow instructions here https://forum.avast.com/index.php?topic=53253.0
attach requested logs and help will arrive later today
ok these are the attachments and sorry for the late reply
Looks like that went right past MCShield
CAUTION : This fix is only valid for this specific machine, using it on another may break your computer
Open notepad and copy/paste the text in the quotebox below into it:
CreateRestorePoint: HKLM-x32\...\Run: [sv] => wscript.exe //B "C:\Users\Dat\AppData\Local\Temp\sv.vbs" <===== ATTENTION HKU\S-1-5-21-685457287-4171896744-1024080384-1000\...\Run: [sv] => wscript.exe //B "C:\Users\Dat\AppData\Local\Temp\sv.vbs" <===== ATTENTION Startup: C:\Users\Dat\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sv.vbs () 2015-03-29 09:21 - 2015-03-29 09:21 - 00153166 _____ () C:\Windows\SysWOW64\sv.vbs Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f RemoveProxy: EmptyTemp: CMD: bitsadmin /reset /allusers
Save this as fixlist.txt, in the same location as FRST.exe
https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG
Run FRST and press Fix
On completion a log will be generated please post that
THEN
Download Anti VBS/VBE to your desktop
[]download the appropriate version (32 bit or 64 bit) and double click the file to run it.
[]After a couple of seconds (might also take a whole minute if the machine is heavily infected and/or slow) a report will open in Notepad.
[*]Post that report
Be aware this is a very new programme and as such is not recognised by any Antivirus or Windows, it is safe so allow it to run
ok i got it
and sorry i post it two times
Did you run the second programme ? Have the alerts ceased
sorry i forgot too. i’ll post it now
Have the alerts now ceased ?
Yes it did thanks =) and is the wscript supposed to stop when i restart my pc because i usually always see it on when i open the task manager
Are you still seeing wscript ?