Solved Im getting a Windows Script Host error on bootup

Asus / Ux305f
June 1, 2020 at 05:06:40
Specs: Windows 10, intel core M-5Y10c / 8GB ram
The popup says:

Script: C:\Windows\System32\API\sap\autoUpdate.vbs
Line: 2
Char: 1
Error: 0x80070081
Code: 80070081
Source: (null)

This is what is in the autoUpdate.vbs file

Set WshShell = CreateObject("WScript.Shell")
WshShell.Run chr(34) & "csrss.exe" & Chr(34), 0
Set WshShell = Nothing

Happens every full reboot, can anyone help please?


See More: Im getting a Windows Script Host error on bootup

Reply ↓  Report •

✔ Best Answer
June 2, 2020 at 08:52:21
Ok here is the batch script to fix your issue !
Just save it as Fix_Cleaner.bat and run it by double click to get rid of those files !

@echo off
Title Special Fix and Cleaner for IANS_LAPTOP PC by Hackoo 2020
If [%1] NEQ [Admin] Goto RunAsAdmin
cls & color 9E & Mode 95,5
echo(
echo(                ===========================================================
echo(                    Please wait a while ... Working is in progress....
echo(                ===========================================================

Set "LogFile=%~dpn0_Log_%ComputerName%.txt"
Set FilesToDelete="%UserProfile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\startup.lnk" ^
^ "%UserProfile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\starter.lnk" ^
^ "%Windir%\System32\API\sap\autoUpdate.vbs"

> "%LogFile%" 2>&1 (
	@For %%a in (%FilesToDelete%) do (
		Del /F /S %%a  
	)
)
Start "" /MAX "%LogFile%" & Exit
::---------------------------------------------------------------------------------------------------
:RunAsAdmin
cls & color 0B & Mode 95,5
echo(
echo(               ===========================================================
echo(                    Please wait a while ... Running as Admin ....
echo(               ===========================================================
Powershell start -verb runas '%0' Admin & Exit
::---------------------------------------------------------------------------------------------------



#1
June 1, 2020 at 05:51:19
I'm pretty sure that this vbscript was running a virus, but your antivirus has blocked the file and he can't delete it from the registry !, so for this reason the vbscript run again on every reboot !
EDIT :
You can found its location by this batch file :
Just copy and paste this piece of code below to your Notepad and save it as Processes_StartupApp.bat and run it by double click and it will generate a text file with all startup items, you can post in your next reply the results.

::Processes_StartupApp.bat::

@echo off
Title Run as admin using Powershell to get all running processes and startup items by Hackoo 2020
If [%1] NEQ [Admin] Goto RunAsAdmin
cls & color 9E & Mode 95,5
echo(
echo(                ===========================================================
echo(                    Please wait a while ... Working is in progress....
echo(                ===========================================================
  Powershell ^
  Get-WmiObject Win32_Process ^
| where commandline -NE $null ^
| Select-Object ProcessID,Name,CommandLine ^
| Out-String -Width 400 ^
| Findstr /I /V "Admin" ^
| Findstr /I /V "Get-WmiObject" ^
| Out-File "%~dpn0.txt" -Encoding  ASCII 

  Powershell ^
  Get-CimInstance Win32_StartupCommand ^
| Select-Object Name,command,Location,user ^
| Format-List ^
| Out-File -Append "%~dpn0.txt" -Encoding  ASCII

If Exist "%~dpn0.txt" Start "" "%~dpn0.txt"
Exit
::---------------------------------------------------------------------------------------------------
:RunAsAdmin
cls & color 0B & Mode 95,5
echo(
echo(               ===========================================================
echo(                    Please wait a while ... Running as Admin ....
echo(               ===========================================================
Powershell start -verb runas '%0' Admin & Exit
::---------------------------------------------------------------------------------------------------

message edited by Hackoo


Reply ↓  Report •

#2
June 1, 2020 at 14:05:09
Many thanks for the reply, I ran the bat file and here is a link to the output file

https://www.dropbox.com/s/f0ecvswyb...


Reply ↓  Report •

#3
June 1, 2020 at 17:23:51
Please copy and paste this second batch file and save it as Scheduled_Tasks_Services.bat
Run it by double click and send me the second result !

::Scheduled_Tasks_Services.bat::

@echo off
Title Get Shortcut Targets, Scheduled Tasks and Services by Hackoo 2020
cls & color 9E & Mode 70,3
echo( 
echo(         Please be patient ... Working is in progress ...
Set "Log=%~dpn0_%Computername%.txt
Set "All_Users=%ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup"
Set "Current_User=%UserProfile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup"
Set StartupFolders="%All_Users%" "%Current_User%"
If Exist "%Log%" Del "%Log%"
Set "VbsFile=%Tmp%\%~n0.vbs"
 
> "%VbsFile%" (
    echo Option Explicit
    echo Dim Ws,objStartFolder,objFSO,objFolder,colFiles
    echo Dim objFile,strFilePath,Lnk
    echo Set Ws = CreateObject("Wscript.Shell"^)
    echo objStartFolder = WSH.Arguments(0^)
    echo Set objFSO = CreateObject("Scripting.FileSystemObject"^)
    echo Set objFolder = objFSO.GetFolder(objStartFolder^)
    echo Set colFiles = objFolder.Files
    echo For Each objFile in colFiles
    echo strFilePath = objFile.Path
    echo   If Ucase(objFSO.GetExtensionName(strFilePath^)^) = "LNK"_
    echo    Or Ucase(objFSO.GetExtensionName(strFilePath^)^) = "URL" Then
    echo       Call ExtractTargetPath(strFilePath^)
    echo   End If
    echo Next
    echo '*************************************************************
    echo Sub ExtractTargetPath(Lnk^)
    echo set Lnk = Ws.Createshortcut(Lnk^)
    echo WScript.echo "Link="^& DblQuote(Lnk^) ^& vbcrlf ^&_
    echo "Target="^& DblQuote(Lnk.TargetPath^) ^& vbcrlf ^&_
    echo String(100,"*"^)
    echo End Sub
    echo '*************************************************************
    echo Function DblQuote(Str^)
    echo     DblQuote = Chr(34^) ^& Str ^& Chr(34^)
    echo End Function
    echo '*************************************************************
)
 
@For %%A in (%StartupFolders%) Do (
    Call :ExtractTarget "%%~A" "%Log%"
)

SetLocal EnableDelayedExpansion
>> "%Log%" (
	echo(
	echo ****************************************************************************************************
	echo(                                 No Microsoft Scheduled Tasks List
	echo ****************************************************************************************************
	@For /F "tokens=2,9,17,19,20,21,22 delims=," %%a in ('SCHTASKS /Query /NH /FO CSV /V ^|find /I /V "Microsoft" ^|findstr /I /C:"VBS" /C:"EXE"') do (
		Set TaskName=%%~a
		Set TaskPath=%%~b
		Call :Trim_Dequote !TaskName! TaskName
		Call :Trim_Dequote !TaskPath! TaskPath
		echo "!TaskName!"
		echo "!TaskPath!"
		echo %%c;%%d;%%f;%%g
		echo( ---------------------------------------------------------------------------------------------------
	)
)

>>"%Log%" (
	echo(
	echo ****************************************************************************************************
	echo(                                 No Microsoft Services List
	echo ****************************************************************************************************
@for /f "tokens=*" %%a in (
	'WMIC service where "Not PathName like '%%Micro%%' AND Not PathName like '%%Windows%%'" get Name^,DisplayName^,PathName^,Status'
	) do (
		@for /f "delims=" %%b in ("%%a") do (
			echo %%b
			)
	)
)

If Exist "C:\Windows\System32\API\sap\autoUpdate.vbs" Type "C:\Windows\System32\API\sap\autoUpdate.vbs">>"%Log%"
If Exist "%Tmpvbs%" Del "%Tmpvbs%"
Start /MAX "Log" "%Log%" 
Exit
::-----------------------------------------------------------------------------------
:Trim_Dequote <Var> <NewVar>
(
	echo	Wscript.echo Trim_Dequote("%~1"^)
	echo	Function Trim_Dequote(S^)
	echo	If Left(S, 1^) = """" And Right(S, 1^) = """" Then Trim_Dequote = Trim(Mid(S, 2, Len(S^) - 2^)^) Else Trim_Dequote = Trim(S^)
	echo	End Function
)>"%tmp%\%~n0.vbs"
for /f "delims=" %%a in ('Cscript //nologo "%tmp%\%~n0.vbs"') do ( 
	set "%2=%%a" 
)
Del "%tmp%\%~n0.vbs"
exit /b
::-----------------------------------------------------------------------------------
:ExtractTarget <Folder> <LogFile>
>> %2 (
    echo ============================================================================
    echo  Targets on %1
    echo ============================================================================
)
For %%f in (%1) Do (
    CScript //nologo "%VbsFile%" "%%~f" >> %2
)
Exit /b
::----------------------------------------------------------------------------------
:GetFileNameWithDateTime <FileName>
for /f "skip=1" %%x in ('wmic os get localdatetime') do if not defined MyDate set "MyDate=%%x"
set "%1=%MyDate:~0,4%-%MyDate:~4,2%-%MyDate:~6,2%-%MyDate:~8,2%-%MyDate:~10,2%"
Exit /B
::----------------------------------------------------------------------------------

message edited by Hackoo


Reply ↓  Report •

Related Solutions

#4
June 2, 2020 at 07:39:51
Thanks again Hackoo, here is a link to the second file

https://www.dropbox.com/s/c2z6hd7jq...


Reply ↓  Report •

#5
June 2, 2020 at 08:52:21
✔ Best Answer
Ok here is the batch script to fix your issue !
Just save it as Fix_Cleaner.bat and run it by double click to get rid of those files !

@echo off
Title Special Fix and Cleaner for IANS_LAPTOP PC by Hackoo 2020
If [%1] NEQ [Admin] Goto RunAsAdmin
cls & color 9E & Mode 95,5
echo(
echo(                ===========================================================
echo(                    Please wait a while ... Working is in progress....
echo(                ===========================================================

Set "LogFile=%~dpn0_Log_%ComputerName%.txt"
Set FilesToDelete="%UserProfile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\startup.lnk" ^
^ "%UserProfile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\starter.lnk" ^
^ "%Windir%\System32\API\sap\autoUpdate.vbs"

> "%LogFile%" 2>&1 (
	@For %%a in (%FilesToDelete%) do (
		Del /F /S %%a  
	)
)
Start "" /MAX "%LogFile%" & Exit
::---------------------------------------------------------------------------------------------------
:RunAsAdmin
cls & color 0B & Mode 95,5
echo(
echo(               ===========================================================
echo(                    Please wait a while ... Running as Admin ....
echo(               ===========================================================
Powershell start -verb runas '%0' Admin & Exit
::---------------------------------------------------------------------------------------------------


Reply ↓  Report •

Ask Question