wscript.exe infected with vbs:downloader-atj [trj] won't stop showing up!

Since yesterday about 8pm (BRT) my avast has been telling me that it neutralized the following threats: “wscript.exe infected with vbs:downloader-atj [trj]” (picture) AND “rote.txt” (picture). But it happened 7 times already. I already scanned my whole pc twice and updated the software and it keeps happening.

I’m using Avast Premier, version 18.2.2328 (build 18.2.3827.304).
Virus’ definitions’ version: 180310-0

Attach your basic diagnostic logs. (MBAM and FRST)
Instructions: https://forum.avast.com/index.php?topic=194892

Hi,

use what Asyn suggest or use this.

Download the autoruns from here https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns and go to tasks page. Look for task which spawns wscript. It may have name staring with Yahoo.

Delete that task and you will get rid of this.

Regards,
PDI

I did what PDI asked people to do in another topic:

For now it hasn’t showed up again. But I’m getting the logs as you requested and I’ll soon post them here.

Oh PDI showed up here too. Well I did that, but am doing the logs too.

The task is executed once per hour so that’s maybe why you haven’t seen it yet.

Btw try to restart the PC to make sure it doesn’t appear again.

PDI

There you go

Hi, do you still get warnings from Avast…? Else, we don’t need your logs.

I think it’s all good now. Thank you

how did you do it

Just follow these instructions:

I can’t find anything wscript or yahoo :expressionless:

dang :confused: then try getting your logs and start a topic so they can help you

hi - Getting the same thing. Ran Clamwin and nothing. Couldn’t find the log - I found a log but nothing that says anything about that.

Hi dseg30,

did you try this?

If yes please share the info based on this post

Hi. Could you help me? I have the same problem.
I post my files here:

Hi pacheco1970,

I don’t see any task which can cause it. It was probably deleted. Try to restart the PC to fix the issue.

Regards,
PDI