This is one of the most annoying which has easy process to create VBS
virus, It only use Notepad tool to make the virus, and this notepad is
provided by the Windows application. VBS virus can make disorder the
regedit of computer system, even to remove (delete) its files. VBS virus
can run the application using its auto run application namely wscript.exe
which locates in the directory c: \ windows \ system32. This file is
very influential on all the files with “.vbs” extensions.
The following ways are the ways to cut down wscript.exe application:
1. If your computer have not been infected
· Open the Run menu -> type regedit.exe
· Into the key "HKEY_LOCAL_MACHINE \ Software \ Microsoft \
Windows NT \ Current Version \ Image File Execution Options"
· On the right side, right-click - new - key
· Give it the name "wscript.exe", and then on the right side,
add a String Value. Give the name "Debugger" and fill in "1". Ok Done.
2. If your computer get infected
Usually the virus is always shut the windows several tools such as
regedit, Task Manager, Folder Option, et cetera, and because of regedit
cannot be accessed directly, so it has to use another way, which is “VBS
before we shut down the wscript”.
Open “Run” menu-> Notepad
Type the following code
· dim reg
· set reg = createobject ( "wscript.shell")
· reg.regwrite "HKLM \ Software \ Microsoft \ Windows NT \
CurrentVersion \ Image File Execution Options \ wscript.exe \ debugger",
1,"REG_SZ"
then, save the folder as "vbsKiller.vbs" and don’t forget to change “Save as type” as "All Files".
Then, double click vbsKiller.vbs to use it. Done.....
End story for this VBS!...
Good luck... hopefully useful
2,To Remove autorun.inf Without Using Antivirus Program
Follow these steps :
step 1:- start your command prompt
select the virus affected drive
in this case i will show you drive D:
type D: them press enter key to see the content on the drive D
you can type the directory (Dir)
step 3: type these also attrib -s -h *.* /s /d then press enter key
then type dir to check whether it contain unusual .exe file yes it
contains .exe file with auorun.inf now you can delete these two files or
rename autorun.inf file into aa now you can acces the drive D: with out
affecting the virus.
credit to mmithelper
Myanmar Kyat Converter
