Weebly Avast messages from wscript.exe process

Viruses and worms
1

Hi, I have a problem. Ever since I put in a few flash drives into my computer Avast keeps popping up every 5 seconds with two notifications:

Avast Web Shield has blocked a harmful webpage or file.

Object : http://www.weebly.com/uploads/28/1/0/28102339/ahpaa.exe
Infection: URL: Mal
Process C:\Windows\System32\wscript.exe

And Another exactly the same, but with a different Object:

Avast Web Shield has blocked a harmful webpage or file.

Object : http://www.weebly.com/uploads/28/1/0/28102339/22.exe
Infection: URL: Mal
Process C:\Windows\System32\wscript.exe

So far, I’m doing a full system scan with Avast, did a full system scan with Malwarebytes, adwcleaner, roguekiller (got rid of quite a few things but it didn’t solve the problem) and I’m quite lost as to what to do.

Thanks

2

seems your flash drive was infected…

malware removers are notified

3

Hi,

Please download Anti-VBSVBE and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.

[*]Double click to run the tool and wait until it finishes.
[*]It will make a log named Anti-VBSVBE.txt. Please attach it to your reply.

======================================================

Please download Farbar Recovery Scan Tool by Farbar and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.

[*]Double-click to run it. When the tool opens click Yes to disclaimer.
[*]Under Optional Scan ensure “List BCD” and “Driver MD5” are ticked.
[*]Press Scan button.
[*]It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
[*]The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

4

Thanks for the quick response
files are attached
apparently the notifications stopped

5

No, the notifications keep coming
im attaching OTG logs too

6

Download attached fixlist.txt to your Desktop.
NOTE: => It’s important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

Run FRST/FRST64 and press the Fix button just once and wait.
If the tool needed a restart please make sure you let the system to restart normally and let the tool completes its run after restart.

The tool will make a log on the Desktop (Fixlog.txt). Please attach it to your reply.
Note: If the tool warned you about the outdated version please download and run the updated version.

Please download MCShield from one of the following links:

MCShield -Official download link

[*]Double click on MCShield-Setup to install the application.
Next => I Agree => Next => Install … per installation click on Run! button.
[]Wait a few seconds to MCShield finish initial HDD scan…
[]Connect all your USB storage devices to the computer one at a time. Scanning will be done automatically.
[*]When all scanning is done, you need to post a logreport that MCShield has created.

Under Logs tab (in Control Center) for AllScans.txt log section click on Save button. AllScanst.txt report shall be located on your Desktop.

=> Post here AllScanst.txt

Explanation: USB storage devices are all the USB devices that get their own partition letter at connecting to the PC,
e.g. flash drives (thumb/pen drives, USB sticks), external HDDs, MP3/MP4 players, digital cameras,
memory cards (SD cards, Sony Memory Stick, MultiMedia Cards etc.), some mobile phones, some GPS navigation devices etc.

7

The problem was solved. Thank you very much.
Logs attached
Should I do anything else?

8
Should I do anything else?
now you wait for Clint Eastwood to remove the tools used ..... MCShield you keep, to avoid this happening again. ;)
9

• The following will implement some post-cleanup procedures:

=> Please download DelFix by Xplode to your Desktop.

Run the tool and check the following boxes below;
[i]
http://www.mcshield.net/personal/magna86/Images/checkmark.png
Remove disinfection tools

http://www.mcshield.net/personal/magna86/Images/checkmark.png
Create registry backup

http://www.mcshield.net/personal/magna86/Images/checkmark.png
Purge System Restore [/i]
Click Run button and wait a few seconds for the programme completes his work.
At this point all the tools we used here should be gone. Tool will create an report for you (C:[b]DelFix.txt[/b])

The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning.

10

Thanks again :smiley: You are the boss!