BullGuard
 HomeLog InRegisterCommunity CalendarSearch the ForumView The Member ListHelp
KillVBS.vbs on flashdisk
   
BullGuard Antivirus Forum > Virus Removal > Removal Help > KillVBS.vbs on flashdisk  
Forum Quick Jump
 
New Topic Post reply to : KillVBS.vbs on flashdisk Printable version of : KillVBS.vbs on flashdisk
[ << Previous Thread | Next Thread >> ]

icouldiwill
New Member


Date Joined Jun 2007
Total Posts : 1
 
   Posted 6/27/2007 9:21 PM (GMT +3)    Quote: KillVBS.vbs on flashdiskAlert an admin about: KillVBS.vbs on flashdisk
I travel a lot and use internet cafes. I use portable software from my USB flashdisk. Recently -possibly in Thailand- the autorun file of my disk got lost and I started to use right-click "open" to see it's contents. Then Firefox started to get really slow (pausing for 5-10 seconds every few minutes) and when I tried to create a new autorun file I realised there is already one that I can neither see nor delete or write on. I copied my files on a PC and formatted the flashdisk and after copied my files back back on it but the autorun file was still there. One of the rare times when it became visible I managed to open and see the contents.

Here is what my invisible undeletable autorun.inf looks like:

[autorun]
shellexecute=wscript.exe killVBS.vbs

I ran the ClamWin portable virus scanner and it found:

H:\autorun.inf: Worm.Solow FOUND
H:\MS32DLL.dll.vbs: VBS.Flesh-1 FOUND


(neither of these files I can see)

I couldn't find any online sources to clean these. Since all the good scanners/cleaners work on the harddisks and not the removables I do not know what to do with my flashdisc. Is there a software that shows us these unseen files?
It is indispensible for me and I have to carry my archives and programs with me.
Please help.

Thank you.
Back to Top
 

aslam
New Member


Date Joined Sep 2007
Total Posts : 1
 
   Posted 9/3/2007 6:37 PM (GMT +3)    Quote: KillVBS.vbs on flashdiskAlert an admin about: KillVBS.vbs on flashdisk
OK, I have AVG and Clamwin but none could clean VBS.Flesh-1 as you mentioned above. Here are steps that I followed and my system is clean now:
1. Goto Explorer->Tools->Folder Option->File Types
2. Delete VBS extention (now WScript hosting will not execute VBS file)
3. Restart PC, Open Explorer ->Tools->Folder Option->View, here check Show Hidden Files and Folders
4. Now search your pc for MS32DLL.dll.vbs files and delete those
5. Next step is to clean your boot.ini that reside in Windows folder e.g. in XP C:\Windows\boot.ini
this is very important step, you need to boot system with some other OS say linux or DOS bootable
edit boot.ini and make appropriate changes(you may refer microsoft site for this), in my case I did following ,
[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect

-Thanks
Back to Top
 

apb
New Member


Date Joined Apr 2008
Total Posts : 3
 
   Posted 5/1/2008 8:52 AM (GMT +3)    Quote: KillVBS.vbs on flashdiskAlert an admin about: KillVBS.vbs on flashdisk
Terminate wscript.exe from task manager and replace windows/system32/killvbs.vbs with a 0 byte file of the same name. Now try to delete autorun.inf from your flash drive.
Back to Top
 
New Topic Post reply to : KillVBS.vbs on flashdisk Printable version of : KillVBS.vbs on flashdisk
 
Forum Information
Currently it is Thursday, October 23, 2014 12:29 PM (GMT +3)
There are a total of 60,683 posts in 13,331 threads.
In the last 3 days there were 2 new threads and 19 reply posts. View Active Threads
Who's Online
This forum has 36548 registered members. Please welcome our newest member, nudey.
3 Guest(s), 0 Registered Member(s) are currently online.  Details
5 Latest Threads
Errors, warnings, infections, trojans and junk (19)10/23/2014 5:54:29 AM (Deb1957)
I very satisfy of this product and I decide to buy it (0)10/21/2014 12:33:09 AM (jaksum)