vbs.runauto

Page 2 of 2 Previous  1, 2

View previous topic View next topic Go down

vbs.runauto

Post by bryanc on Mon 12 Dec 2011, 7:54 pm

First topic message reminder :

G'day, Nortons on my laptop is continually picking up vbs.runauto. My computer tech tells me this is serious.
Is it?

thanks for your help.

here are the logs

aswMBR first

aswMBR version 0.9.8.986 Copyright(c) 2011 AVAST Software
Run date: 2011-12-12 18:44:50
-----------------------------
18:44:50.765 OS Version: Windows 5.1.2600 Service Pack 3
18:44:50.765 Number of processors: 2 586 0x170A
18:44:50.765 ComputerName: WORKSTATION-H UserName: BryanC
18:45:22.921 Initialize success
18:59:12.750 AVAST engine defs: 11121102
19:00:31.171 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
19:00:31.171 Disk 0 Vendor: ST950042 0002 Size: 476940MB BusType: 8
19:00:31.187 Disk 0 MBR read successfully
19:00:31.187 Disk 0 MBR scan
19:00:31.328 Disk 0 Windows XP default MBR code
19:00:31.343 Disk 0 scanning sectors +976752000
19:00:31.484 Disk 0 scanning C:\WINDOWS\system32\drivers
19:00:57.093 Service scanning
19:00:58.281 Modules scanning
19:01:14.125 Disk 0 trace - called modules:
19:01:14.156 ntkrnlpa.exe CLASSPNP.SYS disk.sys iastor.sys hal.dll
19:01:14.171 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8afe5ab8]
19:01:14.171 3 CLASSPNP.SYS[ba108fd7] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x8b042028]
19:01:33.781 AVAST engine scan C:\WINDOWS
19:02:31.046 AVAST engine scan C:\WINDOWS\system32
19:07:31.671 AVAST engine scan C:\WINDOWS\system32\drivers
19:08:29.453 AVAST engine scan C:\Documents and Settings\BryanC
19:36:01.671 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\BryanC\Desktop\MBR.dat"
19:36:01.750 The log file has been saved successfully to "C:\Documents and Settings\BryanC\Desktop\aswMBR.txt"



bryanc

Rookie Surfer
Rookie Surfer

Posts : 132
Joined : 2009-05-24
Operating System : XP

View user profile

Back to top Go down


Re: vbs.runauto

Post by bryanc on Mon 26 Dec 2011, 7:44 am

It came back this morning :-(

Scan type: Auto-Protect Scan
Event: Security Risk Found!
Security risk detected: VBS.Runauto
File: C:\Documents and Settings\BryanC\Local Settings\temp\DWH84B8.tmp
Location: Quarantine
Computer: WORKSTATION-H
User: BryanC
Action taken: Quarantine succeeded : Access denied
Date found: Monday, 26 December 2011 3:58:44 AM

bryanc

Rookie Surfer
Rookie Surfer

Posts : 132
Joined : 2009-05-24
Operating System : XP

View user profile

Back to top Go down

Re: vbs.runauto

Post by Belahzur on Fri 30 Dec 2011, 12:43 pm

Hello.

  • Open HijackThis.
  • Choose "Do a system scan only"
  • Check the boxes in front of these lines:


    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 10.10.10.254:3128
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = nexus.*;nexus;10.10.10.1;


  • Press "Fix Checked"
  • Close Hijack This.

Reboot normally.
How is the machine running now?


@RealBelahzur - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur

Manager | Tech Officer
Manager | Tech Officer

Posts : 34917
Joined : 2008-08-04
Operating System : XP SP3 Media Centre

View user profile

Back to top Go down

Re: vbs.runauto

Post by bryanc on Sat 31 Dec 2011, 6:24 pm

before I do this, Nexus is our office intranet that operates when I'm at work.
Will that be affected?


bryanc

Rookie Surfer
Rookie Surfer

Posts : 132
Joined : 2009-05-24
Operating System : XP

View user profile

Back to top Go down

Re: vbs.runauto

Post by Belahzur on Tue 03 Jan 2012, 12:11 pm

Ahh yeah it might be, okay don't do that.

What issues currently still exist?


@RealBelahzur - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur

Manager | Tech Officer
Manager | Tech Officer

Posts : 34917
Joined : 2008-08-04
Operating System : XP SP3 Media Centre

View user profile

Back to top Go down

Re: vbs.runauto

Post by bryanc on Tue 03 Jan 2012, 5:36 pm

same issues. Still get the nortons pop ups. though maybe not as often I'll send the log from the next one if you wish.

bryanc

Rookie Surfer
Rookie Surfer

Posts : 132
Joined : 2009-05-24
Operating System : XP

View user profile

Back to top Go down

Re: vbs.runauto

Post by bryanc on Fri 06 Jan 2012, 7:11 am

I take it back, they are just as often. That is almost continuous. I delete the Nortons message and another one appears within seconds.

here's the latest.
Scan type: Auto-Protect Scan
Event: Security Risk Found!
Security risk detected: VBS.Runauto
File: C:\Documents and Settings\BryanC\Local Settings\temp\DWH996C.tmp
Location: Quarantine
Computer: WORKSTATION-H
User: BryanC
Action taken: Quarantine succeeded : Access denied
Date found: Friday, 6 January 2012 7:00:21 AM

bryanc

Rookie Surfer
Rookie Surfer

Posts : 132
Joined : 2009-05-24
Operating System : XP

View user profile

Back to top Go down

Re: vbs.runauto

Post by bryanc on Sun 15 Jan 2012, 10:21 am

Sorry I should have sent log much sooner. They are still happening constantly.
Here's the latest log. Same as the rest :-(

Scan type: Auto-Protect Scan
Event: Security Risk Found!
Security risk detected: VBS.Runauto
File: C:\Documents and Settings\BryanC\Local Settings\temp\DWHE517.tmp
Location: Quarantine
Computer: WORKSTATION-H
User: BryanC
Action taken: Quarantine succeeded : Access denied
Date found: Sunday, 15 January 2012 10:21:23 AM

bryanc

Rookie Surfer
Rookie Surfer

Posts : 132
Joined : 2009-05-24
Operating System : XP

View user profile

Back to top Go down

Re: vbs.runauto

Post by bryanc on Wed 25 Jan 2012, 6:43 am

does this one have you stumped :-)

bryanc

Rookie Surfer
Rookie Surfer

Posts : 132
Joined : 2009-05-24
Operating System : XP

View user profile

Back to top Go down

Re: vbs.runauto

Post by Belahzur on Thu 26 Jan 2012, 5:30 am

Yes :/ everything looks fine, not sure what's causing it, not sure where the autorun is coming from, everything looks fine.

Are you using any external hardware?


@RealBelahzur - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur

Manager | Tech Officer
Manager | Tech Officer

Posts : 34917
Joined : 2008-08-04
Operating System : XP SP3 Media Centre

View user profile

Back to top Go down

Re: vbs.runauto

Post by bryanc on Mon 30 Jan 2012, 12:24 pm

I use external hard drives reasonably regulary. I plug a phone in to charge. I use usb sticks and cards. It has a couple of card readers I have added to existing slots in teh side.

VBS Runauto is supposed to be a virus that attaches itself to cards isn't it.

I once tried clening the computer then not using the cards for a while, but it came back anyway.

bryanc

Rookie Surfer
Rookie Surfer

Posts : 132
Joined : 2009-05-24
Operating System : XP

View user profile

Back to top Go down

Re: vbs.runauto

Post by Belahzur on Tue 31 Jan 2012, 12:24 pm

Yeah it is.

The machine is clean, but some of the externel hardware is infected.


  1. Open My Computer.
  2. Go to Tools > Folder Options.
  3. Select the View tab.
  4. Scroll down to Hidden files and folders.
  5. Select Show hidden files and folders.
  6. Uncheck (untick) Hide extensions of known file types.
  7. Uncheck (untick) Hide protected operating system files (Recommended).
  8. Click Yes when prompted.
  9. Click OK.
  10. Close My Computer.


Plug in any/all external hardware and look through the root of the drive for an autorun folder, or an autorun.inf/autorun.ini/autorun.pnf file, or any weirdly named files, could be cmd/bat files, if so, delete them - they are all malicious.


@RealBelahzur - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur

Manager | Tech Officer
Manager | Tech Officer

Posts : 34917
Joined : 2008-08-04
Operating System : XP SP3 Media Centre

View user profile

Back to top Go down

Re: vbs.runauto

Post by bryanc on Sun 05 Feb 2012, 7:50 am

I can't find anything.
I have removed the two card readers and the other thing I connect most often is my phone.

If you could confirm that the laptop is clean and I keep all external hardware away from it we could check to see if the bug is on the laptop or an accessary couldn't we.

I did that last time and the bug came back before I reconnected anything.

What do you think?

bryanc

Rookie Surfer
Rookie Surfer

Posts : 132
Joined : 2009-05-24
Operating System : XP

View user profile

Back to top Go down

Re: vbs.runauto

Post by bryanc on Sun 05 Feb 2012, 7:52 am

The only thing hard to keep out of this test would be the office network :-(

bryanc

Rookie Surfer
Rookie Surfer

Posts : 132
Joined : 2009-05-24
Operating System : XP

View user profile

Back to top Go down

Re: vbs.runauto

Post by Belahzur on Sat 11 Feb 2012, 11:08 am

Hmmm, not sure.

Might be best to format the externel hardware, take off anything you want and format them just to be sure.


@RealBelahzur - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur

Manager | Tech Officer
Manager | Tech Officer

Posts : 34917
Joined : 2008-08-04
Operating System : XP SP3 Media Centre

View user profile

Back to top Go down

Re: vbs.runauto

Post by bryanc on Sat 11 Feb 2012, 12:15 pm

Thankyou, done that.

can we run a scan to see if the computer is clean, then not connect any external hardware to see if it stays that way?

bryanc

Rookie Surfer
Rookie Surfer

Posts : 132
Joined : 2009-05-24
Operating System : XP

View user profile

Back to top Go down

Re: vbs.runauto

Post by bryanc on Sun 12 Feb 2012, 12:13 pm

I found this on a Toshiba Thumb Drive. It's called autorun.inf but it looks OK to me.

It does go away with a format.

"[AutoRun]
open=LaunchU3.exe -a
icon=LaunchU3.exe,0

[Definitions]
Launchpad=LaunchPad.exe
Vtype=1

[CopyFiles]
FileNumber=1
File1=LaunchPad.zip
[Update]
URL=http://www.toshiba.co.jp/p-media/english/u3/update/"

bryanc

Rookie Surfer
Rookie Surfer

Posts : 132
Joined : 2009-05-24
Operating System : XP

View user profile

Back to top Go down

Re: vbs.runauto

Post by bryanc on Tue 28 Feb 2012, 6:25 am

Hello, I've been away for two weeks so no activity on my computer :-)

Just got back saw the error message again.

In the post above I meant "It does NOT go away with a format"

do you think doing a scan once more to confirm the compter is clean and then keeping all accessories away from it to see if the message comes back would confirm the bug is on the computer and not an external drive?

see ya

bryanc

Rookie Surfer
Rookie Surfer

Posts : 132
Joined : 2009-05-24
Operating System : XP

View user profile

Back to top Go down

Re: vbs.runauto

Post by Sponsored content Today at 1:11 am


Sponsored content


Back to top Go down

Page 2 of 2 Previous  1, 2

View previous topic View next topic Back to top


 
Permissions in this forum:
You cannot reply to topics in this forum