KillVBS.vbs on flashdisk

Posted 6/27/2007 6:21 PM
User avatar

icouldiwill Member

Date Joined Nov 2016
Total Posts: 1
I travel a lot and use internet cafes. I use portable software from my USB flashdisk. Recently -possibly in Thailand- the autorun file of my disk got lost and I started to use right-click "open" to see it's contents. Then Firefox started to get really slow (pausing for 5-10 seconds every few minutes) and when I tried to create a new autorun file I realised there is already one that I can neither see nor delete or write on. I copied my files on a PC and formatted the flashdisk and after copied my files back back on it but the autorun file was still there. One of the rare times when it became visible I managed to open and see the contents. <br/> <br/>Here is what my invisible undeletable autorun.inf looks like: <br/> <br/>[autorun] <br/>shellexecute=wscript.exe killVBS.vbs <br/> <br/>I ran the ClamWin portable virus scanner and it found: <br/> <br/>H:\autorun.inf: Worm.Solow FOUND <br/>H:\MS32DLL.dll.vbs: VBS.Flesh-1 FOUND <br/> <br/>(neither of these files I can see) <br/> <br/>I couldn't find any online sources to clean these. Since all the good scanners/cleaners work on the harddisks and not the removables I do not know what to do with my flashdisc. Is there a software that shows us these unseen files? <br/>It is indispensible for me and I have to carry my archives and programs with me. <br/>Please help. <br/> <br/>Thank you.
May all beings be happy :)
Posted 9/3/2007 3:37 PM
User avatar

aslam Member

Date Joined Nov 2016
Total Posts: 1
OK, I have AVG and Clamwin but none could clean VBS.Flesh-1 as you mentioned above. Here are steps that I followed and my system is clean now: <br/>1. Goto Explorer->Tools->Folder Option->File Types <br/>2. Delete VBS extention (now WScript hosting will not execute VBS file) <br/>3. Restart PC, Open Explorer ->Tools->Folder Option->View, here check Show Hidden Files and Folders <br/>4. Now search your pc for MS32DLL.dll.vbs files and delete those <br/>5. Next step is to clean your boot.ini that reside in Windows folder e.g. in XP C:\Windows\boot.ini <br/>this is very important step, you need to boot system with some other OS say linux or DOS bootable <br/>edit boot.ini and make appropriate changes(you may refer microsoft site for this), in my case I did following , <br/>[boot loader] <br/>timeout=30 <br/>default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS <br/>[operating systems] <br/>multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect <br/> <br/>-Thanks
Posted 5/1/2008 5:52 AM
User avatar

apb Member

Date Joined Nov 2016
Total Posts: 3
Terminate wscript.exe from task manager and replace windows/system32/killvbs.vbs with a 0 byte file of the same name. Now try to delete autorun.inf from your flash drive.
  • Unread posts or replies
  • No unread posts or replies
  • Unread Posts (Read Only Forum)
  • No Unread Posts (Read Only Forum)

Forum Information

Currently it is Monday, December 5, 2016, 3:46 PM (GMT +1)
There are a total of 61,160 posts in 13,449 threads.
In the last 3 days there were 2 new threads and 3 reply posts.

Who's online

This forum has 37,965 registered members. Please welcome our newest member, Old shape.
There are currently no users on-line.