Home

.vbs popup on Windows Server DataCenter 2019

%3CLINGO-SUB%20id%3D%22lingo-sub-825783%22%20slang%3D%22en-US%22%3E.vbs%20popup%20on%20Windows%20Server%20DataCenter%202019%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-825783%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Admins%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20need%20a%20little%20help%20with%20my%20test%20server.%20Using%26nbsp%3B%20Windows%20Server%20DataCenter%202019%20edition.%20I%20have%20installed%20Plesk%20obsidian%20on%20it.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ESome%20point%20of%20time%20I%20installing%20cloud%20flare%20catching%20system%20in%20my%20website%20hosted%20on%20this%20server.%20To%20enable%20dynamic%20caching%2C%20cloud%20flare%20suggested%20updating%20my%20ip4%20version%20URL%20to%20dynamic%20ip6%20version%20URLs%20for%20dynamic%20caching%20of%20my%20website.%20I%20had%20run%20some%20CLI%20commands%20in%20my%20power%20shell%20that%20were%20mentioned%20on%20cloud%20fare%20instructions.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20am%20facing%20this%20vbs%20pop%20up%20since%20that%20point%20of%20time.%20The%20exact%20popup%20that%20shows%20is%20%22C%3A%2FWindows%5Csystem32%5Cupdateip.vbs%22.%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F128851i8F7F7BB5876B10BB%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20alt%3D%22Screenshot%202019-08-28%20at%204.44.03%20AM.png%22%20title%3D%22Screenshot%202019-08-28%20at%204.44.03%20AM.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ENow%20I%20know%20that%20this%20is%20not%20a%20virus%20or%20some%20kind%20of%20adware.%20This%20has%20just%20caused%20due%20to%20a%20misconfiguration%20or%20the%20commands%20that%20I%20ran%20over%20CLI%20without%20knowing%20the%20outcome.%20I%20request%20experienced%20server%20administrators%20to%20guide%20us%20on%20this%20issue%20and%20put%20some%20light%20on%20it.%3C%2FP%3E%3CP%3EI%20tried%20finding%20some%20articles%20on%20Google%20and%20found%20a%20few%20tricks%20that%20suggests%20editing%20registry%20or%20deactivating%20visuall%20basic%20scripts%20but%20here%20I%20am%20looking%20for%20a%20more%20and%20accurate%20way%20of%20doing%20it%20like%20it%20would%20have%20been%20handled%20in%20a%20production%20environment.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-825783%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EManagement%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EWindows%20Server%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-825890%22%20slang%3D%22en-US%22%3ERe%3A%20.vbs%20popup%20on%20Windows%20Server%20DataCenter%202019%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-825890%22%20slang%3D%22en-US%22%3E%3CP%3ECrappy%20image%2C%20can't%20read%20it.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-829620%22%20slang%3D%22en-US%22%3ERe%3A%20.vbs%20popup%20on%20Windows%20Server%20DataCenter%202019%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-829620%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F51719%22%20target%3D%22_blank%22%3E%40Dave%20Patrick%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-830384%22%20slang%3D%22en-US%22%3ERe%3A%20.vbs%20popup%20on%20Windows%20Server%20DataCenter%202019%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-830384%22%20slang%3D%22en-US%22%3E%3CP%3ENothing%20native%20is%20doing%20this.%20Might%20try%20a%20clean%20boot%20to%20determine%20the%20source.%3C%2FP%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Fhelp%2F929135%2Fhow-to-perform-a-clean-boot-in-windows%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%3CFONT%20style%3D%22background-color%3A%20%23ffffff%3B%22%3Ehttps%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Fhelp%2F929135%2Fhow-to-perform-a-clean-boot-in-windows%3C%2FFONT%3E%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%3CFONT%20style%3D%22background-color%3A%20%23ffffff%3B%22%3E%26nbsp%3B%3C%2FFONT%3E%3C%2FP%3E%0A%3CP%3E%3CFONT%20style%3D%22background-color%3A%20%23ffffff%3B%22%3E%26nbsp%3B%20there's%20nothing%20like%20that%20on%20any%20of%20my%20systems%2C%20if%20you%20just%20wanted%20the%20dialog%20to%20go%20away%20then%20create%20and%20empty%20file%20with%20that%20name%20in%20%5Csystem32%20dir%3C%2FFONT%3E%3C%2FP%3E%0A%3CP%3E%3CFONT%20style%3D%22background-color%3A%20%23ffffff%3B%22%3E%26nbsp%3B%26nbsp%3B%3C%2FFONT%3E%3C%2FP%3E%0A%3CP%3E%3CFONT%20style%3D%22background-color%3A%20%23ffffff%3B%22%3E%26nbsp%3B%3C%2FFONT%3E%3C%2FP%3E%0A%3CP%3E%3CFONT%20style%3D%22background-color%3A%20%23ffffff%3B%22%3E%26nbsp%3B%3C%2FFONT%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E
Ryan_smith
New Contributor

Hi Admins,

 

I need a little help with my test server. Using  Windows Server DataCenter 2019 edition. I have installed Plesk obsidian on it.

 

Some point of time I installing cloud flare catching system in my website hosted on this server. To enable dynamic caching, cloud flare suggested updating my ip4 version URL to dynamic ip6 version URLs for dynamic caching of my website. I had run some CLI commands in my power shell that were mentioned on cloud fare instructions.

 

I am facing this vbs pop up since that point of time. The exact popup that shows is "C:/Windows\system32\updateip.vbs".

Screenshot 2019-08-28 at 4.44.03 AM.png

 

Now I know that this is not a virus or some kind of adware. This has just caused due to a misconfiguration or the commands that I ran over CLI without knowing the outcome. I request experienced server administrators to guide us on this issue and put some light on it.

I tried finding some articles on Google and found a few tricks that suggests editing registry or deactivating visuall basic scripts but here I am looking for a more and accurate way of doing it like it would have been handled in a production environment.

3 Replies

Crappy image, can't read it.

 

 

Nothing native is doing this. Might try a clean boot to determine the source.

https://support.microsoft.com/en-us/help/929135/how-to-perform-a-clean-boot-in-windows

 

  there's nothing like that on any of my systems, if you just wanted the dialog to go away then create and empty file with that name in \system32 dir

  

 

 

Related Conversations
Tabs and Dark Mode
cjc2112 in Discussions on
38 Replies
Extentions Synchronization
Deleted in Discussions on
3 Replies
flashing a white screen while open new tab
Deleted in Discussions on
14 Replies
Stable version of Edge insider browser
HotCakeX in Discussions on
35 Replies
Security Community Webinars
Valon_Kolica in Security, Privacy & Compliance on
13 Replies