How to remove Microsoft Windows Based Script Host - Popup after boot

Question

How can I remove this popup? Norton hasn't been able to find and remove it using various scans. Please see Task Manager screen excerpt. I'm using Windows 11. I've tried WinRe, Diagnostics and even Reset Windows, but the problems persists. Thank you.

Answer 1

Please open the following folder:

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup

There are three VBScript files. If you didn't add them, select all three and delete them.

One of those scripts is causing the fake spyware alert dialog at logon.

Other than that, the system is clean.

Answer 2

Also, note that I have access to the Task Bar, but can not place anything on Desktop window.

Answer 3

Hi, This is Ramesh.

It's a fake alert, and the corresponding script may be running as a startup item or a scheduled task.

Please run the Farbar Scanner and share your logs to inspect the system for malware.

1. Download Farbar Recovery Scan Tool 64-bit (FRST64.exe)

https://www.bleepingcomputer.com/download/farba...

Note: If Microsoft Edge or Chrome mislabels the Farbar Scanner executable as PUA/malware, choose to keep it by tapping … in the bottom bar, choosing Keep, and then choosing Keep anyway in the dialog that appears. See this screenshot: https://learn.microsoft.com/en-us/deployedge/me...

2. If the OS language is non-English, rename FRST64.exe to FRST64English.exe.
3. Run the program. Don't check or uncheck any options. Click "Scan".
4. Zip the two logs, FRST.txt and Addition.txt, upload them to your OneDrive and share the link here.

How-To: Share OneDrive files and folders - Microsoft Support

https://support.microsoft.com/en-us/office/shar...

OneDrive sharing options - screenshot

https://imgur.com/a/vZyxpY9

Standard Disclaimer: There is a link to a non-Microsoft website. The page appears to provide accurate, safe information. Watch out for ads on the site that may advertise products frequently classified as PUPs (Potentially Unwanted Products). Thoroughly research any product advertised on the site before you decide to download and install it.

Answer 4

Greetings Ramesh,

Thanks for a prompt response.

Addition.zip | FRST.zip

Poindexter1978

Answer 5

Thank you for prompt response Ramesh.

Pop up is not popping up now.