Verecno worm

[Abdel]

Hello,im new there i have a problem after removing the verecno worm that infected my computer by my usb key theres a problem left after the removing the infected autoit exe in the google folder and i also removed the stuff in the skypee folder 

sorry for my bad english i hope you understand.

the picture below says that "windows couldnt find C:\Google\Autoit3.exe Verify you entered the correct name,then try again"

[Luke94]

I assume you're trying to run AutoIt?

Are you trying to run AutoIt via a Desktop Shortcut?

[Earthshine]

use Autoruns and find it, then you can right click and delete it from registry. run it in administrator mode so you can delete the offending startup registry entry

https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns

[Abdel]

24 minutes ago, Luke94 said:

I assume you're trying to run AutoIt?

Are you trying to run AutoIt via a Desktop Shortcut?

no it pop in startup of windows and how to remove it at startup

[Luke94]

Hold the Windows key and press R to open Run.

In the Open field, type:

shell:startup

Is there a shortcut in there pointing to "C:\Google\Autoit3.exe"?

[Abdel]

22 minutes ago, Earthshine said:

use Autoruns and find it, then you can right click and delete it from registry. run it in administrator mode so you can delete the offending startup registry entry

https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns

i think i found some suspects in this section is there anything suspect ?

[Abdel]

sorry wrong picture here is the correct

[Nine]

It is starting from one of the four possibilities :

1- From startup directory

2- From registry run

3- From task manager

4- From service manager

You need to look at all of these to see where it is starting from and delete it...

[Abdel]

2 minutes ago, Luke94 said:

Hold the Windows key and press R to open Run.

In the Open field, type:

shell:startup

Is there a shortcut in there pointing to "C:\Google\Autoit3.exe"?

nothing there

[Abdel]

2 minutes ago, Nine said:

It is starting from one of the four possibilities :

1- From startup directory

2- From registry run

3- From task manager

4- From service manager

You need to look at all of these to see where it is starting from and delete it...

where can i find it in reg run? and startup directory?

[Luke94]

That's the file it's attempting to launch.

32 minutes ago, Earthshine said:

then you can right click and delete it from registry. run it in administrator mode so you can delete the offending startup registry entry

 

[Abdel]

Just now, Luke94 said:

That's the file it's attempting to launch.

 

how to turn it off or delete it then ill try to restart my computer

[Abdel]

deleted it now i will restart my pc hope it helps

 

[Luke94]

4 minutes ago, Abdel said:

how to turn it off or delete it then ill try to restart my computer

I assume like @Earthshine said, right-click and delete it from the registry?

[Abdel]

3 minutes ago, Luke94 said:

I assume like @Earthshine said, right-click and delete it from the registry?

hey thank you for the help it no longer pops up it just the cmd windows try to open but fastly closes you dont have the time to see it but the important thing it no longer show that message 

[Abdel]

5 minutes ago, Luke94 said:

I assume like @Earthshine said, right-click and delete it from the registry?

i will mark your message as a solution thank you so much!!!!!! 

i was stuck with this for months you are a life saver!!!!

[Jos]

1 minute ago, Abdel said:

but the important thing it no longer show that message 

Serious? Why would that not be important? 

[Abdel]

3 minutes ago, Jos said:

Serious? Why would that not be important? 

ikr 

[Luke94]

I'd maybe also take a look at that VBScript - not sure if that's normal?

 

[Abdel]

1 hour ago, Luke94 said:

I'd maybe also take a look at that VBScript - not sure if that's normal?

here is the file i found it in a folder named windows update files that looks so suspicious for me.

 

Edited June 16, 2021 by Jos
removed potential virus