Spyware / Malware / Virus Removal
Unknow Script Errors
17 min read
dunacting
OK, I ran Daft and it found problems with VBS and JS files.
I fixed them and r-escanned, this is the resulting log file:-
DAFT Log saved on 2007-05-17 15:26:19
———————————————————————–
All associations okay!
———————————————————————–
I've now been able to run Regscan.vbs and this is the output:-
Windows Registry Editor Version 5.00
; Regscan.vbs Version: 1.2 by rand1038
; 17/05/2007 15:28:28
; Search Term(s) Used: "Javascript"
; 34 matches were found.
; The search took 56 seconds.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3050F3B2-98B5-11CF-BB82-00AA00BDCE0B}]
@="Microsoft HTML Javascript Pluggable Protocol"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FC7D9F01-3F9E-11D3-93C0-00C04F72DAF7}]
@="SignedJavaScript Class"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JavaScript]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JavaScript\CLSID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JavaScript\OLEScript]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JavaScript Author]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JavaScript Author\CLSID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JavaScript Author\OLEScript]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JavaScript1.1]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JavaScript1.1\CLSID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JavaScript1.1\OLEScript]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JavaScript1.1 Author]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JavaScript1.1 Author\CLSID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JavaScript1.1 Author\OLEScript]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JavaScript1.2]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JavaScript1.2\CLSID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JavaScript1.2\OLEScript]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JavaScript1.2 Author]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JavaScript1.2 Author\CLSID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JavaScript1.2 Author\OLEScript]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JavaScript1.3]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JavaScript1.3\CLSID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JavaScript1.3\OLEScript]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\javascript]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SignedJavaScript]
@="Trusted Scripts Wrapper for JavaScript"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SignedJavaScript\CLSID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SignedJavaScript\OLEScript]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Software\RealNetworks\Update\6.0\Preferences\Components\rjjava:1.0\DisplayName]
@="RealPlayer JavaScript Plugins"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\\Program Files\\Adobe\\Acrobat 7.0\\Reader\\Javascripts\\"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4210D39FE9C0D214DA66C66F9C686753]
"68AB67CA7DA73301B7447A9000000020"="C:\\Program Files\\Adobe\\Acrobat 7.0\\Reader\\Javascripts\\JSByteCodeWin.bin"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Maya 5.0 Documentation Server]
"Comments"="A small Java and javascript http server that provides searchable Maya documentation."
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Scripting Host\Script Extensions\.JS]
@="JavaScript Script File"
"EngineID"="JavaScript"
Susan528
Do you still have problems with the Microsoft webpage?
dunacting
Yes I do.

Susan528
Don't give up yet though. I have a few more things to check out first but will get back.
dunacting
Many thanks.
You're doing a great job. It's much appreciated.

Susan528
Please repeat the Regscan using the following for the search criteria and then post the results.
FEATURE_LOCALMACHINE_LOCKDOWN
FEATURE_LOCALMACHINE_LOCKDOWN
dunacting
Done that.
This is the result:-
Windows Registry Editor Version 5.00
; Regscan.vbs Version: 1.2 by rand1038
; 18/05/2007 18:26:30
; Search Term(s) Used: "FEATURE_LOCALMACHINE_LOCKDOWN"
; 8 matches were found.
; The search took 50 seconds.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CRYPTO\CD_LMZ_LOCKDOWN]
"RegPath"="SOFTWARE\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_LOCALMACHINE_LOCKDOWN\\Settings"
"RegPoliciesPath"="SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_LOCALMACHINE_LOCKDOWN\\Settings"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CRYPTO\LMZ_LOCKDOWN]
"RegPath"="SOFTWARE\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_LOCALMACHINE_LOCKDOWN"
"RegPoliciesPath"="SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_LOCALMACHINE_LOCKDOWN"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\IEHardening]
"FEATURE_LOCALMACHINE_LOCKDOWN"=dword:00000001
[HKEY_USERS\S-1-5-21-1752798392-3228812582-103374333-1006\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN]
[HKEY_USERS\S-1-5-21-1752798392-3228812582-103374333-1006\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\Settings]
Susan528
http://boards.live.com/safetyboards/thread…sparam=Page%3D3
This is really frustrating and I am sorry that I have not been able to help
. I found the above newsgroup and it appears that many are experiencing problems.
This is really frustrating and I am sorry that I have not been able to help
- Try downloading Netscape and see if it would work with Netscape (one indicated problem was with IE, other said it did not matter). It will not work with Mozilla Firefox, cause I tried that.
- Try setting up another user account on your computer and see if that user can use the scanner.
- Post out to that Newsgroup. The more that post and complain, increases the chance that more time will be devoted to getting out the bugs.
The squeaky wheel gets the grease.
dunacting
Many thanks for all your support, but you have shown me some interesting things and fixed a couple of problems I didn't know about
At least I know now I'm not alone and I'll watch the board for any further updates.
It's frustrating that Microsoft can't fix something they have written. :rant:
Thanks again, all your work has been appreciated.
Steve

Susan528
Hi Dunacting,
I noticed that you were using DAP but if you are using paid-subscription version, you may not have any problems with pop-ups. If you are having problems you may want to remove it and use an alternative. You can use SartDownloader as a DAP alternative:
http://www.stardownloader.com/downloads.php
To remove it, go to Start > Settings > Control Panel > Add/Remove Programs and remove it.
I am sorry about the Microsoft problem and thought maybe you might want to try this.
Please register (it's free, don't worry) with PCPitStop and run the full tests here.
When the tests are complete, a results page will pop up. If you want to share the results here you can click "Share these results with TechExpress" on the left-hand side. Then copy the URL provided and post (reply) with it here for me.
Otherwise these are the clean-up instructions. You need to clear those _restore points so that if you do a system restore, you will not become infected again.
STEP 2.
======
Cleanmgr
To clean temporary files:
Reset hidden/system files and folders
System Restore for Windows XP
Reset and Re-enable your System Restore to remove infected files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: (You will lose all previous restore points which are likely to be infected)
Turn ON System Restore.
STEP 5.
======
DON’T BECOME OVERCONFIDENT WITH ANTIVIRUS APPLICATIONS INSTALLED!!!
http://forum.malwareremoval.com/viewtopic….39eba6ea0b5e8ee
Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:
Thank you for allowing me to assist you.
Susan
I noticed that you were using DAP but if you are using paid-subscription version, you may not have any problems with pop-ups. If you are having problems you may want to remove it and use an alternative. You can use SartDownloader as a DAP alternative:
http://www.stardownloader.com/downloads.php
To remove it, go to Start > Settings > Control Panel > Add/Remove Programs and remove it.
I am sorry about the Microsoft problem and thought maybe you might want to try this.
Please register (it's free, don't worry) with PCPitStop and run the full tests here.
When the tests are complete, a results page will pop up. If you want to share the results here you can click "Share these results with TechExpress" on the left-hand side. Then copy the URL provided and post (reply) with it here for me.
Otherwise these are the clean-up instructions. You need to clear those _restore points so that if you do a system restore, you will not become infected again.
STEP 2.
======
Cleanmgr
To clean temporary files:
- Go > start > run and type cleanmgr and click OK
- Scan your system for files to remove.
- Make sure Temporary Files, Temporary Internet Files and Recycle Bin are the only things checked.
- Click OK to remove those files.
- Click Yes to confirm deletion.
Reset hidden/system files and folders
- Click Start.
- Open My Computer.
- Select the Tools menu and click Folder Options.
- Select the View tab.
- Deselect the Show hidden files and folders option.
- Select the Hide file extensions for known types option.
- Select the Hide protected operating system files option.
- Click Yes to confirm.
- Click OK.
System Restore for Windows XP
Reset and Re-enable your System Restore to remove infected files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: (You will lose all previous restore points which are likely to be infected)
- Turn off System Restore.
- On the Desktop, right-click My Computer.
- Click Properties.
- Click the System Restore tab.
- Check Turn off System Restore.
- Click Apply, and then click OK.
Turn ON System Restore.
- On the Desktop, right-click My Computer.
- Click Properties.
- Click the System Restore tab.
- UN-Check *Turn off System Restore*.
- Click Apply, and then click OK.
STEP 5.
======
DON’T BECOME OVERCONFIDENT WITH ANTIVIRUS APPLICATIONS INSTALLED!!!
http://forum.malwareremoval.com/viewtopic….39eba6ea0b5e8ee
Stay up to date on security patches and be extremely wary of clicking on links and attachments that arrive unbidden in instant messages and e-mail.
"The number one thing the majority of the malicious code we're seeing now does is disable or delete anti-virus and other security software," Dunham said. "In a lot of cases, once the user clicks on that attachment, it's already too late."
Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:
- Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
- Visit Microsoft's Update Site Frequently - It is important that you visit Windows Updates regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
- Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an antivirus software.
A tutorial on installing & using this product can be found here:
Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers
- Install Ad-Aware - Install and download Ad-Aware. ou should also scan your computer with program on a regular basis just as you would an antivirus software in conjunction with Spybot.
A tutorial on installing & using this product can be found here:
Using Ad-aware to remove Spyware, Malware, & Hijackers from Your Computer
- Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.
A tutorial on installing & using this product can be found here:
Using SpywareBlaster to protect your computer from Spyware and Malware
- Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
- More info on how to prevent malware you can also find here (By Tony Klein)
Thank you for allowing me to assist you.
Susan
dunacting
I don't have problems with pop-ups with DAP, well not yet anyway. If there are no other problems with it, I'll hang on to it for now.
PCPitStop results are here:-
http://www.pcpitstop.com/techexpress.asp?id=AY08HWWUE0WSVCYW
STEP 2 - I have Window Washer set to delete temporary files, and others, when IE closes down. Is that OK?
STEP 3 - OK
STEP 4 - OK - This is current set to 12% 13727Mb is that OK?
STEP 5 - 1 - I have Norton Internet Security and update on a regular basis.
2 - Yep do this, I have auto update on and check to see if anythings missed.
3, 4 & 5 - Will any of these conflict with Norton?
6 - Will do.
7 - OK.

PCPitStop results are here:-
http://www.pcpitstop.com/techexpress.asp?id=AY08HWWUE0WSVCYW
STEP 2 - I have Window Washer set to delete temporary files, and others, when IE closes down. Is that OK?
STEP 3 - OK
STEP 4 - OK - This is current set to 12% 13727Mb is that OK?
STEP 5 - 1 - I have Norton Internet Security and update on a regular basis.
2 - Yep do this, I have auto update on and check to see if anythings missed.
3, 4 & 5 - Will any of these conflict with Norton?
6 - Will do.
7 - OK.
Susan528
Sorry it has been a few days.
STEP 4 - OK - This is current set to 12% 13727Mb is that OK? That's ok.
3, 4 & 5 - Will any of these conflict with Norton? No they will not conflict with Norton.
dunacting
That's OK.
Thanks for the update.
I've added some extra memory and run a new PitStop test.
My results are here:-
http://www.pcpitstop.com/techexpress.asp?id=HZ91HWWUE0WSHQZW
Thanks for the update.
I've added some extra memory and run a new PitStop test.
My results are here:-
http://www.pcpitstop.com/techexpress.asp?id=HZ91HWWUE0WSHQZW
dunacting
Just to let you know the USB problems shown in the log have now been sorted out.
Susan528
USB problems shown in the log
I am glad but you lost me. Did I miss something?
Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI