KillVBS.vbs on flashdisk

Posted 6/27/2007 6:21 PM
#49680
User avatar

icouldiwill Member

Date Joined Nov 2016
Total Posts: 1
I travel a lot and use internet cafes. I use portable software from my USB flashdisk. Recently -possibly in Thailand- the autorun file of my disk got lost and I started to use right-click "open" to see it's contents. Then Firefox started to get really slow (pausing for 5-10 seconds every few minutes) and when I tried to create a new autorun file I realised there is already one that I can neither see nor delete or write on. I copied my files on a PC and formatted the flashdisk and after copied my files back back on it but the autorun file was still there. One of the rare times when it became visible I managed to open and see the contents.

Here is what my invisible undeletable autorun.inf looks like:

[autorun]
shellexecute=wscript.exe killVBS.vbs

I ran the ClamWin portable virus scanner and it found:

H:\autorun.inf: Worm.Solow FOUND
H:\MS32DLL.dll.vbs: VBS.Flesh-1 FOUND


(neither of these files I can see)

I couldn't find any online sources to clean these. Since all the good scanners/cleaners work on the harddisks and not the removables I do not know what to do with my flashdisc. Is there a software that shows us these unseen files?
It is indispensible for me and I have to carry my archives and programs with me.
Please help.

Thank you.
May all beings be happy :)
Posted 9/3/2007 3:37 PM
#53041
User avatar

aslam Member

Date Joined Nov 2016
Total Posts: 1
OK, I have AVG and Clamwin but none could clean VBS.Flesh-1 as you mentioned above. Here are steps that I followed and my system is clean now:
1. Goto Explorer->Tools->Folder Option->File Types
2. Delete VBS extention (now WScript hosting will not execute VBS file)
3. Restart PC, Open Explorer ->Tools->Folder Option->View, here check Show Hidden Files and Folders
4. Now search your pc for MS32DLL.dll.vbs files and delete those
5. Next step is to clean your boot.ini that reside in Windows folder e.g. in XP C:\Windows\boot.ini
this is very important step, you need to boot system with some other OS say linux or DOS bootable
edit boot.ini and make appropriate changes(you may refer microsoft site for this), in my case I did following ,
[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect

-Thanks
Posted 5/1/2008 5:52 AM
#61937
User avatar

apb Member

Date Joined Nov 2016
Total Posts: 3
Terminate wscript.exe from task manager and replace windows/system32/killvbs.vbs with a 0 byte file of the same name. Now try to delete autorun.inf from your flash drive.
  • Unread posts or replies
  • No unread posts or replies
  • Unread Posts (Read Only Forum)
  • No Unread Posts (Read Only Forum)

Forum Information

Currently it is Friday, April 28, 2017, 4:29 AM (GMT +2)
There are a total of 61,194 posts in 13,463 threads.
In the last 3 days there were 0 new threads and 1 reply posts.

Who's online

This forum has 38,022 registered members. Please welcome our newest member, kevint89.
There are currently no users on-line.
We use cookies to ensure that we give you the best experience on our website. By continuing to browse, we are assuming that you have no objection in accepting cookies. You can change your cookie settings at any time.