Set objWMIService = GetObject("winmgmts:" _ ProcessName = Replace(ProcessName,Chr(34),"") If CheckProcess(DblQuote(ProcessPath)) = False Then MsgBox "There is an existing proceeding !" & VbCrLF &_ĬommandLineLike(WScript.ScriptName),VbExclamation,"There is an existing proceeding !" Set WshShell = CreateObject("WScript.Shell")
ProcessPath = "%Windir%\System32\Notepad.exe" So far what's been removed by the anti virus AppVShNotifyt.exe, but the tracers are still here, the file's keep getting updated, seems like the virus masked himself or is it running in other ways services etc etc ?
Other file that shares the same time stamp WindowsCodecsRaw.txthere's some similarities in behavior. A dll, shares the same time stamp as the others MCconfig.dll checked with both anti virus and uploaded to VirustTotal but no results, still is pretty suspicious. 
The xx file shares the time stamp of the xxml and AppVShNotifyt.txt ( The script file that autoupdates each boot so as the xx file ). There is an second one called xxml that calls to another non extension file called by xx file. There is this xml file called exacly xml that seems to remote to an non extension file called by x. The problem is, some tracers of the virus ( xml, scripts and logs are still here and what's alarming is one txt file containing script lines keeps getting updated after a reboot despite all the scans done ) 
I manually uploaded some files and traces of the virus using VirusTotal. ESETNOD32 ( for some reason didnt found the virus ? ). Hello there, I think i have been infected, after download something ( stupid of me ) i noticed a quick faded command promp appear, i rushed to scan my computer and found traces off what appeared to be a Trojan dropper.
0 kommentar(er)
