Hi, Isolate your PC (unplug the power). 2) Close wscript.exe, cscript.exe, and suspicious PowerShell processes from Task Manager. 3) Find and remove any VBS remnants: (a) user/system Startup folders; (b) Run/RunOnce keys in HKCU/HKLM; (c) scheduled tasks; (d) WMI subscriptions (root\subscription). 4) Temporarily disable Windows Script Host to block .vbs: create/adjust HKLM\Software\Microsoft\Windows Script Host\Settings → Enabled=0. 5) Delete the malicious file C:\Users\Public\PT2ZQ8.vbs (and clones in %Public%, %TEMP%). 6) Repair Windows: sfc /scannow then DISM /Online /Cleanup-Image /RestoreHealth. 7) Perform a Microsoft Defender Offline scan. 8) Harden: Enable ASR rules in Defender (block suspicious scripts, Office children, etc.), consider AppLocker/WDAC to prohibit scripts from user-writable locations, and set PowerShell to AllSigned. 9) If it returns, use Sysinternals Autoruns (Everything tab) to disable/remove residual startups; if it persists, consider an in-place repair or clean reinstall. Note: PowerShell is almost certainly not "infected," but simply launched by the VBS; eliminating the persistence will stop the warnings.
Getting Error: PERMISSION DENIED, Error Code: 800A0046 related to Powershell.exe. Thoughts on what I might try to correct this?
John Curham
0
Reputation points
Had a malware attack which has apparently affected the Windows Powershell.exe. Following is what I continue to get with my virus/malware protection software (I have tried multiple softwares):
Threats Blocked Powershell.exe (get this 5 times each time I scan)
Error messages: Windows Script Host
Script error | C:\USERS\PUBLIC\PT2ZQ8.VBS |
---|---|
C:\USERS\PUBLIC\PT2ZQ8.VBS | |
Line: | 44 |
Char: | 1 |
Error: | PERMISSION DENIED |
Code: | 800A0046 |
Source: | MICROSOFT VBSCRIPT RUNTIME ERROR |