Can not find script file

Question

Hi,

This message always pops up when I start my computer. I noticed that it doesn’t pop up when I start my computer in safe mode though.

Windows Script Host

Can not find script file “c:\Users\joejo\AppData\Roaming\hwisi\ryhbq.vbs.”

What can I do?

Thanks,

Joseph

Answer 1

Try running these programs:

MBAM free: https://www.malwarebytes.com/mwb-download/

Eset online scanner: http://www.eset.com/us/online-scanner/

Adwcleaner: https://toolslib.net/downloads/viewdownload/1-a...

If these do not fully remove the virus/malware then it will be wise to register with a malware removal site to receive dedicated malware removal instructions, an expert will remain with you throughout the process until confirmation that your PC is 100% clean.

Malwarebytes virus/malware removal forum:

https://forums.malwarebytes.com/forum/7-windows...

Bleeping computer malware/virus removal forum:

https://www.bleepingcomputer.com/forums/forum22...

Disclaimer - This post contains reference to non-Microsoft websites and there may be ads on the page for products & services including products frequently classified as a PUP (Potentially Unwanted Product). Please thoroughly research any product / service advertised on the page before you decide to use them. Your discretion is very much advised.

Answer 2

Hi Joseph,

Open Windows File Explorer

On the view ribbon, temporarily turn on 'Hidden Items'

Navigate to:

c:\Users\joejo\AppData\Roaming\hwisi

If the file ryhbq.vbs exists:

Right click it and open it in Notepad

Replace all the contents of that file with:

Wscript.Quit

If the file does not exist in that folder, right click and choose New - Text Doument

Put this text in that file: Wscript.Quit

Then click File - Save As

At the bottom of the save as dialog, set save as type to *.*

Save the files as ryhbq.vbs

Note you must enter the vbs file extension youself

Restart your PC

Answer 3

One of two things:

1- Your computer is currently infected with malware, or

2- Your computer was previously infected with malware, and your anti-malware application didn't completely remove the malware. 

Here are two steps to perform:

1- Install the free version of Malwarebytes to (hopefully) remove whatever remains of the malware. If you still see the message:

2- Sign in to an account with Administrator permissions and open Task Manager [CTRL+ESC+DEL] and then open the Startup tab. Right-click on the startup entry for ryhbq.vbs and delete it.

You should also open File Explorer and navigate to 

c:\Users\joejo\AppData\Roaming\hwisi\ryhbq.vbs

Delete the hwisi folder.

Answer 4

Looks like a virus. I recommend the following 2 things:

Scan using Malwarebytes:

https://www.malwarebytes.com/

Perform a Windows Defender Offline Scan:

https://support.microsoft.com/en-in/help/17466/...