1

I don't remember entering any "funny" website and this virus warning seems to pop-up at random once every day, anyone know what it is? How can I fix it?

Object: http://mst.my03.com:8080/k.zip | [Embedded:MSEnc...

Infection: VBS:Downloader-ABT [Trj]

Process: C:\Windows\System32\wbem\scrcons.exe

Cristy
  • 391

1 Answers1

2

Looks like a malicious VBScript is hooked somehow to your WMI event system - that is what scrcons.exe is responsible for - see here.

Using a free version of MBAM is a good idea, I would start with that.

You can allways check URL with Virustotal.

For the mentioned url mst.my03.com you get:

Dr.Web                  known infection source
Websense ThreatSeeker   dynamic dns

So it looks likely it is not a false alarm, it is a vbscript downloader.

One thing you can also do before you get rid of the rogue script completely is to temporarily disable WSH.

Vojtěch Dohnal
  • 3,938