Wednesday, November 12, 2014

What is wscript.exe and how to remove it?



wscript.exe - Windows-based script host by Microsoft


What is wscript.exe?



wscript.exe is a Windows service that allows you to execute VBScript files. Normally, it is not dangerous, but if a malicious script is downloaded and executed it will appear as if wscript.exe is the culprit, when it is really a separate .vbs file. Antivirus programs usually detect C:\Windows\System32\wscript.exe as the culprit, however, it's not necessarily infected. It may be that your computer is infected with Worms and Trojans that attempt to execute malicious .vbs scripts. Most users, get these malware infections from SD cards, pen drives and of course infected websites. Malicious files may change Windows registry, establish connection to remove servers controlled by cyber crooks and download additional malware modules. Other issues: can't open Regedit, certain Windows options are missing, can't acces Contol Panel. Malware may also block anti-malware and Windows system utilities. You should not delete wscript.exe manually, many Windows services require it and our computer may not function properly if it cannot be found. But you should use recommend anti-malware software to remove wscript.exe related malware from your computer.

Notepad auto opens on boot?[.shellclassinfo]"localizedResourceName=%SystemRoot%\system32\shell32.dll,-21787]

[.shellclassinfo]"localizedResourceName=%SystemRoot%\system32\shell32.dll,-21787]

[.shellclassinfo]"localizedResourceName=%SystemRoot%\system32\shell32.dll,-21787]

Cause

NOTEPAD editor opens up with a file DESKTOP.INI that contains the above line

Occuring when

After installing Radar and rebooting the computer

Solution

  1. Click Start - All Programs.
  2. With the right mouse button click "Startup"
  3. choose open "Open All Users"
  4. delete the file 'DESKTOP' from this window.
  5. Click Start - All Programs.
  6. With the right mouse button click "Startup"
  7. choose open "Open"
  8. delete the file 'DESKTOP' from this window.
If, having done this the desktop.ini file still opens next time you reboot, do the following:
  1. Click on Start
  2. Click on Run
  3. In the text box, type msconfig
  4. Click on OK
  5. The System Configuration Utility window will display
  6. Click on the Startup tab
  7. Look for the file in the list of Startup Items and untick the box next to it.

Notepad auto opens on boot?

This happens if the Hidden attribute for the desktop.ini file is somehow removed. Follow these steps to resolve the problem:

Open an elevated Command Prompt window. To do so, click Start, click All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator.

Type the following commands below and press ENTER after typing each command.

(You may copy the text below and paste it in the Command Prompt window.)

attrib +s +h "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini"

And then run the following command:

attrib +s +h "%programdata%\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini"

Type EXIT and then press enter to close the Command Prompt window.

Hope this information is helpful. Please let us know if you require further help.