Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Windows Script Host warning


  • Please log in to reply
9 replies to this topic

#1 bandaj

bandaj

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:05:23 AM

Posted 16 June 2013 - 03:06 PM

When I switch on the laptop It says;

Can not find script file "C:\Win32System\Win32System.vbe".

What's this and hw can I get rid or repair this?

It started yesterday when I deleted a script file from. a usb flash disk that was reported to be corrupt by avira.

Please help! Thanks in advance.

BC AdBot (Login to Remove)

 


#2 sikntired

sikntired

  • Members
  • 1,075 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:10:23 PM

Posted 16 June 2013 - 03:25 PM

take note of the location and file name of the script file and verify if it’s a malware or a trusted program has added or using the script. Was the corruption a result of malware and was there a malware scan performed?

 

Some malware authors are taking advantage of WSH because it can be used to automate their malicious software. Antivirus and antispyware software vendors are aware of the security concerns on these files which is why it’s recommended to configure the antivirus software to scan all file types in Windows, and in real-time. Note that some security researchers or vendors recommend that you disable WSH in Windows as a preventive measure to protect from viruses that uses WSH. However, most antivirus programs have the ability to detect malicious scripts in a webpage or a file on a computer so it is not a requirement to disable or remove WSH.


Edited by sikntired, 16 June 2013 - 03:27 PM.


#3 bandaj

bandaj
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:05:23 AM

Posted 16 June 2013 - 03:55 PM

The script file I deleted was on desktop I had put it their,I intented to paste it in a usb that had a corrupt script file coz it wasn't working.

After installing Avira it detected that the script on desktop was corrupt. Theirfore I deleted it from the desktop and recycle bin.

Then I scanned the laptop Using Avira, it didn't find any threats in " C\Win32System\Win32System.vbe",but in one of the books on desktop and another file .Their where no corrupt scripts noted.

I again run Malwarebytes it retained the same results as Avira.

I also tried to check specified folder path but it is empty.

Now the WSH shows everytime I switch the laptop on.
How do I repair or stop it from appearing everytime its switched on?

Is their something I need to worry about due to this?

#4 sikntired

sikntired

  • Members
  • 1,075 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:10:23 PM

Posted 16 June 2013 - 06:53 PM

To upgrade to the latest version of Windows Script Host, search for "Windows Script Host" on the Microsoft Download Center.

You can determine your Windows Script Host version number by typing CScript at a command prompt.

 

Your scans may not have deleted any malware from start-up.


Edited by sikntired, 16 June 2013 - 07:39 PM.


#5 bandaj

bandaj
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:05:23 AM

Posted 17 June 2013 - 04:00 AM

I have checked and my WSH version 5.8. May please send me a link where to download and how to run it. Thanks for the help.

#6 sikntired

sikntired

  • Members
  • 1,075 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:10:23 PM

Posted 17 June 2013 - 07:24 AM

Microsoft Windows Script Host Version 5.8 is part of Internet Explorer 8. You may need to reinstall IE8. You might consider updating to IE9.

 

For that there is info here. This may also resolve your issue with re-register of WSH.

 

http://windows.microsoft.com/en-US/windows7/how-do-i-install-or-uninstall-internet-explorer-9



#7 bandaj

bandaj
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:05:23 AM

Posted 18 June 2013 - 04:21 PM

i have tried to install it  but said "set up cant continue becaause amore recent version of Internet Exploreris installed on your computer.

 

Also tried to install internet Explorer version 10  it said it can only be run on windows 7 service pack 1 or higher.

 

Is their any way this can be sorted out?



#8 sikntired

sikntired

  • Members
  • 1,075 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:10:23 PM

Posted 18 June 2013 - 06:26 PM

Please download MiniToolBox , save it to your desktop and run it.
 
Checkmark the following checkboxes:
 
List last 10 Event Viewer log
List Installed Programs
List Users, Partitions and Memory size.
List Minidump File
 
Click on Go to start the scan. Once it is finished highlight the text, copy it and paste it in your next post
 
This will help in determining what's going on.

 



#9 bandaj

bandaj
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:05:23 AM

Posted 19 June 2013 - 03:00 PM

MiniToolBox by Farbar  Version: 16-06-2013
Ran by user (administrator) on 20-06-2013 at 21:53:44
Running from "C:\Users\user\Desktop"
Windows 7 Home Premium  (X86)
Boot Mode: Normal
***************************************************************************

========================= Event log errors: ===============================

Application errors:
==================
Error: (06/20/2013 09:12:11 PM) (Source: Application Error) (User: )
Description: Faulting application name: iexplore.exe, version: 9.0.8112.16421, time stamp: 0x4d76255d
Faulting module name: ntdll.dll, version: 6.1.7600.16915, time stamp: 0x4ec49caf
Exception code: 0xc0000005
Fault offset: 0x0002f963
Faulting process id: 0x1588
Faulting application start time: 0xiexplore.exe0
Faulting application path: iexplore.exe1
Faulting module path: iexplore.exe2
Report Id: iexplore.exe3

Error: (06/19/2013 09:30:53 PM) (Source: Application Hang) (User: )
Description: The program iexplore.exe version 9.0.8112.16421 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 179c

Start Time: 01ce6d235c2d6642

Termination Time: 16

Application Path: C:\Program Files\Internet Explorer\iexplore.exe

Report Id:

Error: (06/16/2013 09:56:04 PM) (Source: MsiInstaller) (User: user-PC)
Description: Product: Vedio WebCam -- This installation cannot be run by directly launching the MSI package. You must run setup.exe.

Error: (06/16/2013 08:20:32 PM) (Source: Application Hang) (User: )
Description: The program iexplore.exe version 8.0.7600.17267 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 1224

Start Time: 01ce6ab22773ec61

Termination Time: 3650

Application Path: C:\Program Files\Internet Explorer\iexplore.exe

Report Id: 5db973d0-d6b1-11e2-89ed-001e101f0f44

Error: (06/16/2013 02:03:07 AM) (Source: SideBySide) (User: )
Description: Activation context generation failed for "Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1".
Dependent Assembly Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (06/16/2013 02:02:44 AM) (Source: SideBySide) (User: )
Description: Activation context generation failed for "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="Amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Dependent Assembly Microsoft.Windows.Common-Controls,language="*",processorArchitecture="Amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (06/16/2013 01:19:30 AM) (Source: Application Hang) (User: )
Description: The program mbam.exe version 1.75.0.1 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: b60

Start Time: 01ce6a1e1ba8a151

Termination Time: 16

Application Path: C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

Report Id: f9ec92b1-d611-11e2-9d5a-001e101f2c0e

Error: (06/15/2013 08:08:34 PM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Failed auto update retrieval of third-party root certificate from: <http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/503006091D97D4F5AE39F7CBE7927D7D652D3431.crt> with error: The specified server cannot perform the requested operation.
.

Error: (06/15/2013 08:08:34 PM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Failed auto update retrieval of third-party root certificate from: <http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/503006091D97D4F5AE39F7CBE7927D7D652D3431.crt> with error: The specified server cannot perform the requested operation.
.

Error: (06/15/2013 08:08:32 PM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Failed auto update retrieval of third-party root certificate from: <http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/503006091D97D4F5AE39F7CBE7927D7D652D3431.crt> with error: The specified server cannot perform the requested operation.
.

System errors:
=============
Error: (06/20/2013 09:03:15 PM) (Source: Service Control Manager) (User: )
Description: The Mobile Partner. OUC service failed to start due to the following error:
%%1053

Error: (06/20/2013 09:03:15 PM) (Source: Service Control Manager) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Mobile Partner. OUC service to connect.

Error: (06/20/2013 09:03:13 PM) (Source: Service Control Manager) (User: )
Description: The Mobile Internet. OUC service failed to start due to the following error:
%%1053

Error: (06/20/2013 09:03:13 PM) (Source: Service Control Manager) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Mobile Internet. OUC service to connect.

Error: (06/20/2013 08:53:09 PM) (Source: Service Control Manager) (User: )
Description: The Mobile Partner. OUC service failed to start due to the following error:
%%1053

Error: (06/20/2013 08:53:09 PM) (Source: Service Control Manager) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Mobile Partner. OUC service to connect.

Error: (06/20/2013 08:53:05 PM) (Source: Service Control Manager) (User: )
Description: The Mobile Internet. OUC service failed to start due to the following error:
%%1053

Error: (06/20/2013 08:53:05 PM) (Source: Service Control Manager) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Mobile Internet. OUC service to connect.

Error: (06/19/2013 09:12:00 PM) (Source: Service Control Manager) (User: )
Description: The Mobile Partner. OUC service failed to start due to the following error:
%%1053

Error: (06/19/2013 09:12:00 PM) (Source: Service Control Manager) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Mobile Partner. OUC service to connect.

Microsoft Office Sessions:
=========================

=========================== Installed Programs ============================

Acer Crystal Eye Webcam (Version: 1.5.2904.00)
Adobe Flash Player 11 ActiveX (Version: 11.7.700.224)
Adobe Reader X (10.1.0) MUI (Version: 10.1.0)
Ask Toolbar (Version: 1.15.26.0)
Avira Free Antivirus (Version: 13.0.0.3640)
Avira SearchFree Toolbar plus Web Protection Updater (Version: 1.2.6.45268)
Broadcom Card Reader Driver Installer (Version: 15.0.7.3)
Broadcom NetLink Controller (Version: 15.0.7.1)
Cisco EAP-FAST Module (Version: 2.2.14)
Cisco LEAP Module (Version: 1.0.19)
Cisco PEAP Module (Version: 1.1.6)
DriverNavigator 3.3.2 (Version: 3.3.2.0)
EaseUS Data Recovery Wizard 6.0
ETDWare PS/2-X86 10.6.9.9_WHQL (Version: 10.6.9.9)
InfraRecorder
Intel® Control Center (Version: 1.2.1.1007)
Intel® Management Engine Components (Version: 8.1.0.1252)
Intel® OpenCL CPU Runtime
Intel® Processor Graphics (Version: 8.15.10.2712)
Intel® Rapid Storage Technology (Version: 11.1.0.1006)
Intel® Trusted Connect Service Client (Version: 1.24.388.1)
Launch Manager (Version: 5.1.15)
Malwarebytes Anti-Malware version 1.75.0.1300 (Version: 1.75.0.1300)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft Office Access MUI (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office Access Setup Metadata MUI (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office Enterprise 2007 (Version: 12.0.4518.1014)
Microsoft Office Excel MUI (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office Groove MUI (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office Groove Setup Metadata MUI (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office InfoPath MUI (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office OneNote MUI (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office Outlook MUI (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office PowerPoint MUI (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proof (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proof (French) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proof (Spanish) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proofing (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office Publisher MUI (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office Shared MUI (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office Shared Setup Metadata MUI (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office Word MUI (English) 2007 (Version: 12.0.4518.1014)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.59193)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
MiniTool Power Data Recovery
Mobile Internet (Version: 21.005.22.06.380)
Mobile Partner (Version: 21.005.20.00.350)
MSVC80_x86 (Version: 1.0.1.0)
Nokia Connectivity Cable Driver (Version: 7.1.28.1)
Nokia PC Internet Access (Version: 2.0.1.5)
Nokia PC Suite (Version: 7.0.9.2)
PC Connectivity Solution (Version: 8.22.4.0)
Realtek High Definition Audio Driver (Version: 6.0.1.6543)
REALTEK Wireless LAN Driver (Version: 1.00.10.0909)
Skype Click to Call (Version: 6.8.12323)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)
USB Disk Security
Windows Driver Package - Nokia Modem  (05/22/2008 3.8) (Version: 05/22/2008 3.8)
Windows Driver Package - Nokia Modem  (05/22/2008 7.00.0.1) (Version: 05/22/2008 7.00.0.1)
Windows Driver Package - Nokia pccsmcfd  (10/12/2007 6.85.4.0) (Version: 10/12/2007 6.85.4.0)

========================= Memory info: ===================================

Percentage of memory in use: 56%
Total physical RAM: 1860.36 MB
Available physical RAM: 808.65 MB
Total Pagefile: 3720.71 MB
Available Pagefile: 2096 MB
Total Virtual: 2047.88 MB
Available Virtual: 1966.21 MB

========================= Partitions: =====================================

1 Drive c: © (Fixed) (Total:117.21 GB) (Free:62.47 GB) NTFS
2 Drive d: (GRMCULFRER_EN_DVD) (CDROM) (Total:2.73 GB) (Free:0 GB) UDF
3 Drive e: (E) (Fixed) (Total:98.43 GB) (Free:98.34 GB) NTFS
4 Drive f: (F) (Fixed) (Total:81.56 GB) (Free:81.1 GB) NTFS
5 Drive g: (Mobile Internet) (CDROM) (Total:0.03 GB) (Free:0 GB) CDFS

========================= Users: ========================================

User accounts for \\USER-PC

Administrator            Guest                    user                    

========================= Minidump Files ==================================

No minidump file found

**** End of log ****



#10 sikntired

sikntired

  • Members
  • 1,075 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:10:23 PM

Posted 19 June 2013 - 06:35 PM

Try running this:   "Fix it for me"  ( run fix it for me 50181 ) 

 

After that: Check disk for errors - if re-installing WSH failed to fix script host errors, try to run the check disk utility in Windows to locate bad sectors and recover files. To do this, click Start, click Run, type cmd and then click OK. In the command prompt window, type chkdsk /r and then hit the Enter key on the keyboard. Note that if you are using Windows Vista or Windows 7, you will need to run the command prompt as administrator, by right-clicking on cmd.exe and then select "run as administrator".

 

You should also run sfc /scannow. Tutorial here: http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

 

This will also tell you how you can access the results of the scan in " sfcdetails.txt ".

 

If after you've done all the above and no resolution to the issue then I would recommend posting in the "Am I Infected" forum.


Edited by sikntired, 19 June 2013 - 09:12 PM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users