• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 203
  • Last Modified:

on longin the administrator user of this server runs 5 dos windows that run cscript.exe

How do I get rid of these anoying cscript runs' in the login of this user.

I see nothing in hklm run or in scripts dir.  There is no default script bat file on this server, so the cscript is being called from somewher else.  It is a domain controller.

Thanks in advance.
0
mcpmcp
Asked:
mcpmcp
  • 2
1 Solution
 
gobanCommented:
Group policy objects can also call login scripts. Open the Group Policy Management Console, and run the Group Policy Results Wizard. Specify the username and the computername in the wizard. After the wizard completes, click on the Settings tab and look for any scripts.

Look for any entries under:

User Configuration\Windows Settings\Scripts\Logon

and

Computer Configuration\Windows Settings\Scripts\Logon
0
 
intekraCommented:
Are there any errors in the 5 windows?

More insight?: http://smallbusiness.itworld.com/4379/nls_windows_tullochdefault060911/page_1.html

cscript.exe may also be a malicious worm trying to wreak havoc...
0
 
mcpmcpAuthor Commented:
No errors show windows appear and then go away.

Goban:  I did not see any entries in your suggestion.  
0
 
mcpmcpAuthor Commented:
found VB scripts in allusers that added iusr_dotnet and isur_backup users.  I disabled these as they were obvoius hack attempts.  Thanks
0

Featured Post

Receive 1:1 tech help

Solve your biggest tech problems alongside global tech experts with 1:1 help.

  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now