Abdel Posted June 16, 2021 Share Posted June 16, 2021 Hello,im new there i have a problem after removing the verecno worm that infected my computer by my usb key theres a problem left after the removing the infected autoit exe in the google folder and i also removed the stuff in the skypee folder sorry for my bad english i hope you understand. the picture below says that "windows couldnt find C:\Google\Autoit3.exe Verify you entered the correct name,then try again" Link to comment Share on other sites More sharing options...
Luke94 Posted June 16, 2021 Share Posted June 16, 2021 I assume you're trying to run AutoIt? Are you trying to run AutoIt via a Desktop Shortcut? Link to comment Share on other sites More sharing options...
Solution Earthshine Posted June 16, 2021 Solution Share Posted June 16, 2021 use Autoruns and find it, then you can right click and delete it from registry. run it in administrator mode so you can delete the offending startup registry entry https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns My resources are limited. You must ask the right questions Link to comment Share on other sites More sharing options...
Abdel Posted June 16, 2021 Author Share Posted June 16, 2021 24 minutes ago, Luke94 said: I assume you're trying to run AutoIt? Are you trying to run AutoIt via a Desktop Shortcut? no it pop in startup of windows and how to remove it at startup Link to comment Share on other sites More sharing options...
Luke94 Posted June 16, 2021 Share Posted June 16, 2021 Hold the Windows key and press R to open Run. In the Open field, type: shell:startup Is there a shortcut in there pointing to "C:\Google\Autoit3.exe"? Link to comment Share on other sites More sharing options...
Abdel Posted June 16, 2021 Author Share Posted June 16, 2021 22 minutes ago, Earthshine said: use Autoruns and find it, then you can right click and delete it from registry. run it in administrator mode so you can delete the offending startup registry entry https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns i think i found some suspects in this section is there anything suspect ? Link to comment Share on other sites More sharing options...
Abdel Posted June 16, 2021 Author Share Posted June 16, 2021 sorry wrong picture here is the correct Link to comment Share on other sites More sharing options...
Nine Posted June 16, 2021 Share Posted June 16, 2021 It is starting from one of the four possibilities : 1- From startup directory 2- From registry run 3- From task manager 4- From service manager You need to look at all of these to see where it is starting from and delete it... “They did not know it was impossible, so they did it” ― Mark Twain Spoiler Block all input without UAC Save/Retrieve Images to/from Text Monitor Management (VCP commands) Tool to search in text (au3) files Date Range Picker Virtual Desktop Manager Sudoku Game 2020 Overlapped Named Pipe IPC HotString 2.0 - Hot keys with string x64 Bitwise Operations Multi-keyboards HotKeySet Recursive Array Display Fast and simple WCD IPC Multiple Folders Selector Printer Manager GIF Animation (cached) Screen Scraping Multi-Threading Made Easy Link to comment Share on other sites More sharing options...
Abdel Posted June 16, 2021 Author Share Posted June 16, 2021 2 minutes ago, Luke94 said: Hold the Windows key and press R to open Run. In the Open field, type: shell:startup Is there a shortcut in there pointing to "C:\Google\Autoit3.exe"? nothing there Link to comment Share on other sites More sharing options...
Abdel Posted June 16, 2021 Author Share Posted June 16, 2021 2 minutes ago, Nine said: It is starting from one of the four possibilities : 1- From startup directory 2- From registry run 3- From task manager 4- From service manager You need to look at all of these to see where it is starting from and delete it... where can i find it in reg run? and startup directory? Link to comment Share on other sites More sharing options...
Luke94 Posted June 16, 2021 Share Posted June 16, 2021 That's the file it's attempting to launch. 32 minutes ago, Earthshine said: then you can right click and delete it from registry. run it in administrator mode so you can delete the offending startup registry entry Link to comment Share on other sites More sharing options...
Abdel Posted June 16, 2021 Author Share Posted June 16, 2021 Just now, Luke94 said: That's the file it's attempting to launch. how to turn it off or delete it then ill try to restart my computer Link to comment Share on other sites More sharing options...
Abdel Posted June 16, 2021 Author Share Posted June 16, 2021 deleted it now i will restart my pc hope it helps Link to comment Share on other sites More sharing options...
Luke94 Posted June 16, 2021 Share Posted June 16, 2021 4 minutes ago, Abdel said: how to turn it off or delete it then ill try to restart my computer I assume like @Earthshine said, right-click and delete it from the registry? Link to comment Share on other sites More sharing options...
Abdel Posted June 16, 2021 Author Share Posted June 16, 2021 3 minutes ago, Luke94 said: I assume like @Earthshine said, right-click and delete it from the registry? hey thank you for the help it no longer pops up it just the cmd windows try to open but fastly closes you dont have the time to see it but the important thing it no longer show that message Link to comment Share on other sites More sharing options...
Abdel Posted June 16, 2021 Author Share Posted June 16, 2021 5 minutes ago, Luke94 said: I assume like @Earthshine said, right-click and delete it from the registry? i will mark your message as a solution thank you so much!!!!!! i was stuck with this for months you are a life saver!!!! Link to comment Share on other sites More sharing options...
Developers Jos Posted June 16, 2021 Developers Share Posted June 16, 2021 1 minute ago, Abdel said: but the important thing it no longer show that message Serious? Why would that not be important? SciTE4AutoIt3 Full installer Download page - Beta files Read before posting How to post scriptsource Forum etiquette Forum Rules Live for the present, Dream of the future, Learn from the past. Link to comment Share on other sites More sharing options...
Abdel Posted June 16, 2021 Author Share Posted June 16, 2021 3 minutes ago, Jos said: Serious? Why would that not be important? ikr Link to comment Share on other sites More sharing options...
Luke94 Posted June 16, 2021 Share Posted June 16, 2021 I'd maybe also take a look at that VBScript - not sure if that's normal? Link to comment Share on other sites More sharing options...
Abdel Posted June 16, 2021 Author Share Posted June 16, 2021 (edited) 1 hour ago, Luke94 said: I'd maybe also take a look at that VBScript - not sure if that's normal? here is the file i found it in a folder named windows update files that looks so suspicious for me. Edited June 16, 2021 by Jos removed potential virus Link to comment Share on other sites More sharing options...
Recommended Posts