The original version of this page can be found at : http://forum.bullguard.com/forum/10/KillVBSvbs-on-flashdisk_49680.html
Posted By : icouldiwill - 6-27-2007 7:21
I travel a lot and use internet cafes. I use portable software from my USB flashdisk. Recently -possibly in Thailand- the autorun file of my disk got lost and I started to use right-click "open" to see it's contents. Then Firefox started to get really slow (pausing for 5-10 seconds every few minutes) and when I tried to create a new autorun file I realised there is already one that I can neither see nor delete or write on. I copied my files on a PC and formatted the flashdisk and after copied my files back back on it but the autorun file was still there. One of the rare times when it became visible I managed to open and see the contents.

Here is what my invisible undeletable autorun.inf looks like:

[autorun]
shellexecute=wscript.exe killVBS.vbs

I ran the ClamWin portable virus scanner and it found:

H:\autorun.inf: Worm.Solow FOUND
H:\MS32DLL.dll.vbs: VBS.Flesh-1 FOUND

(neither of these files I can see)

I couldn't find any online sources to clean these. Since all the good scanners/cleaners work on the harddisks and not the removables I do not know what to do with my flashdisc. Is there a software that shows us these unseen files?
It is indispensible for me and I have to carry my archives and programs with me.
Please help.

Thank you.

Posted By : aslam - 9-3-2007 4:37
OK, I have AVG and Clamwin but none could clean VBS.Flesh-1 as you mentioned above. Here are steps that I followed and my system is clean now:
1. Goto Explorer->Tools->Folder Option->File Types
2. Delete VBS extention (now WScript hosting will not execute VBS file)
3. Restart PC, Open Explorer ->Tools->Folder Option->View, here check Show Hidden Files and Folders
4. Now search your pc for MS32DLL.dll.vbs files and delete those
5. Next step is to clean your boot.ini that reside in Windows folder e.g. in XP C:\Windows\boot.ini
this is very important step, you need to boot system with some other OS say linux or DOS bootable
edit boot.ini and make appropriate changes(you may refer microsoft site for this), in my case I did following ,
[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect

-Thanks

Posted By : apb - 5-1-2008 6:52
Terminate wscript.exe from task manager and replace windows/system32/killvbs.vbs with a 0 byte file of the same name. Now try to delete autorun.inf from your flash drive.


Need Support? Write to: | Forum Help Manual

Download free trial version of Bullguard