Getting constant messages popping up on screen of
Can not find script file.
C:\Users\Dave\AppData\Roaming\653CD80D-0C2C-6CF8-5B79-14DDA9D30D16\run20.vbs
If I go to Roaming there are 2 copies of 653CD80D-0C2C-6CF8-5B79-14DDA9D30D16
both created 3 days ago about 4 hours apart one is 3bytes in size the other 45 bytes.
Is there a way I can stop this annoying message?
That file location and its visual basic script (.vbs) extension seem quite suspicious. I would do a full system scan looking for malware/viruses.
Can you upload that file to Virustotal to have it checked?
It sounds as if either a start-up programme or a schedule task is trying to run the script does it run at start or random?
Will appear soon after I boot up, may only display the message once. If it displays it and I get a second notification this will be after 3 minutes then possibly another after 3 minutes. I do not delete the screen message there are no other notifications as soon as I delete it/them the cycle starts again.
I have done a full virus/malware scan. The malware scan found a suspicious looking .vbs file but not the one that I keep getting flagged about. This file was quaratined but I still get my messages.
As eLPuSHeR and Samuria respectively said, have you uploaded that file to Virustotal to have it checked?, and have you checked your start-up programs and/or task scheduler for reference to that file?
You could also post the contents of that .vbs file (edit->notepad), so someone could have a look at what it is trying to do.
Hi
Latest info.
Virustotal found nothing.
Checked startup files disabled all except an AVG file which I could not disable so uninstalled AVG no difference to problem.
Contents of file are" run=https://lapweol.me/sload/ps1/findmail.ps1 "
so looked at task scheduler and noticed there seemed 2 entries around time i began to notice the problem so I disabled both. They were
1. OneDrive Standalone Update Task v3 sLoad with reference After triggered repeat every 1 hour indefinitely, no idea what this is but it is not the cause, because the cause is.....
2. AppLog0 which has a reference After triggered repeat every00:03:00 indefinitely. hence my noticing the annoying message every 3 minutes.
Now i have no idea what this even is supposed to do but will stay disabled.
A whois lookup for lapweol.me shows...Creation Date: 2018-07-05...so this domain has only existed for less than a month. This has all the hallmarks of malware. Run a scan with AdwCleaner.
https://www.malwarebytes.com/adwcleaner/
https://lapweol.me/ is being flagged as a malware site by 3 anti virus engines, although personally I wouldn't know if the "findmail.ps" could be a virus or not ( a .ps is a postscript file ; although it could be masquerading as something else ).
Virustotal analysis of the hosting URL: https lapweol me
https://www.virustotal.com/en/url/04...bb3a/analysis/
Maybe somebody more knowledgeable could chip in.
In the mean time make sure all your anti virus / anti malware programs are up to date and running.
Last edited by das10; 01 Aug 2018 at 18:06.
Quote