.vbs popup on Windows Server DataCenter 2019

%3CLINGO-SUB%20id%3D%22lingo-sub-825783%22%20slang%3D%22en-US%22%3E.vbs%20popup%20on%20Windows%20Server%20DataCenter%202019%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-825783%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Admins%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20need%20a%20little%20help%20with%20my%20test%20server.%20Using%26nbsp%3B%20Windows%20Server%20DataCenter%202019%20edition.%20I%20have%20installed%20Plesk%20obsidian%20on%20it.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ESome%20point%20of%20time%20I%20installing%20cloud%20flare%20catching%20system%20in%20my%20website%20hosted%20on%20this%20server.%20To%20enable%20dynamic%20caching%2C%20cloud%20flare%20suggested%20updating%20my%20ip4%20version%20URL%20to%20dynamic%20ip6%20version%20URLs%20for%20dynamic%20caching%20of%20my%20website.%20I%20had%20run%20some%20CLI%20commands%20in%20my%20power%20shell%20that%20were%20mentioned%20on%20cloud%20fare%20instructions.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20am%20facing%20this%20vbs%20pop%20up%20since%20that%20point%20of%20time.%20The%20exact%20popup%20that%20shows%20is%20%22C%3A%2FWindows%5Csystem32%5Cupdateip.vbs%22.%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F128851i8F7F7BB5876B10BB%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20alt%3D%22Screenshot%202019-08-28%20at%204.44.03%20AM.png%22%20title%3D%22Screenshot%202019-08-28%20at%204.44.03%20AM.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ENow%20I%20know%20that%20this%20is%20not%20a%20virus%20or%20some%20kind%20of%20adware.%20This%20has%20just%20caused%20due%20to%20a%20misconfiguration%20or%20the%20commands%20that%20I%20ran%20over%20CLI%20without%20knowing%20the%20outcome.%20I%20request%20experienced%20server%20administrators%20to%20guide%20us%20on%20this%20issue%20and%20put%20some%20light%20on%20it.%3C%2FP%3E%3CP%3EI%20tried%20finding%20some%20articles%20on%20Google%20and%20found%20a%20few%20tricks%20that%20suggests%20editing%20registry%20or%20deactivating%20visuall%20basic%20scripts%20but%20here%20I%20am%20looking%20for%20a%20more%20and%20accurate%20way%20of%20doing%20it%20like%20it%20would%20have%20been%20handled%20in%20a%20production%20environment.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-825783%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EManagement%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EWindows%20Server%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-825890%22%20slang%3D%22en-US%22%3ERe%3A%20.vbs%20popup%20on%20Windows%20Server%20DataCenter%202019%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-825890%22%20slang%3D%22en-US%22%3E%3CP%3ECrappy%20image%2C%20can't%20read%20it.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-829620%22%20slang%3D%22en-US%22%3ERe%3A%20.vbs%20popup%20on%20Windows%20Server%20DataCenter%202019%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-829620%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F51719%22%20target%3D%22_blank%22%3E%40Dave%20Patrick%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-830384%22%20slang%3D%22en-US%22%3ERe%3A%20.vbs%20popup%20on%20Windows%20Server%20DataCenter%202019%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-830384%22%20slang%3D%22en-US%22%3E%3CP%3ENothing%20native%20is%20doing%20this.%20Might%20try%20a%20clean%20boot%20to%20determine%20the%20source.%3C%2FP%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Fhelp%2F929135%2Fhow-to-perform-a-clean-boot-in-windows%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%3CFONT%20style%3D%22background-color%3A%20%23ffffff%3B%22%3Ehttps%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Fhelp%2F929135%2Fhow-to-perform-a-clean-boot-in-windows%3C%2FFONT%3E%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%3CFONT%20style%3D%22background-color%3A%20%23ffffff%3B%22%3E%26nbsp%3B%3C%2FFONT%3E%3C%2FP%3E%0A%3CP%3E%3CFONT%20style%3D%22background-color%3A%20%23ffffff%3B%22%3E%26nbsp%3B%20there's%20nothing%20like%20that%20on%20any%20of%20my%20systems%2C%20if%20you%20just%20wanted%20the%20dialog%20to%20go%20away%20then%20create%20and%20empty%20file%20with%20that%20name%20in%20%5Csystem32%20dir%3C%2FFONT%3E%3C%2FP%3E%0A%3CP%3E%3CFONT%20style%3D%22background-color%3A%20%23ffffff%3B%22%3E%26nbsp%3B%26nbsp%3B%3C%2FFONT%3E%3C%2FP%3E%0A%3CP%3E%3CFONT%20style%3D%22background-color%3A%20%23ffffff%3B%22%3E%26nbsp%3B%3C%2FFONT%3E%3C%2FP%3E%0A%3CP%3E%3CFONT%20style%3D%22background-color%3A%20%23ffffff%3B%22%3E%26nbsp%3B%3C%2FFONT%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
New Contributor

Hi Admins,

 

I need a little help with my test server. Using  Windows Server DataCenter 2019 edition. I have installed Plesk obsidian on it.

 

Some point of time I installing cloud flare catching system in my website hosted on this server. To enable dynamic caching, cloud flare suggested updating my ip4 version URL to dynamic ip6 version URLs for dynamic caching of my website. I had run some CLI commands in my power shell that were mentioned on cloud fare instructions.

 

I am facing this vbs pop up since that point of time. The exact popup that shows is "C:/Windows\system32\updateip.vbs".

Screenshot 2019-08-28 at 4.44.03 AM.png

 

Now I know that this is not a virus or some kind of adware. This has just caused due to a misconfiguration or the commands that I ran over CLI without knowing the outcome. I request experienced server administrators to guide us on this issue and put some light on it.

I tried finding some articles on Google and found a few tricks that suggests editing registry or deactivating visuall basic scripts but here I am looking for a more and accurate way of doing it like it would have been handled in a production environment.

3 Replies
Highlighted

Crappy image, can't read it.

 

 

Highlighted
Highlighted

Nothing native is doing this. Might try a clean boot to determine the source.

https://support.microsoft.com/en-us/help/929135/how-to-perform-a-clean-boot-in-windows

 

  there's nothing like that on any of my systems, if you just wanted the dialog to go away then create and empty file with that name in \system32 dir