This
is one of the most annoying which has easy process to create VBS virus,
It only use Notepad tool to make the virus, and this notepad is
provided by the Windows application. VBS virus can make disorder the
regedit of computer system, even to remove (delete) its files. VBS virus
can run the application using its auto run application namely
wscript.exe which locates in the directory c: \ windows \ system32. This
file is very influential on all the files with “.vbs” extensions.
The following ways are the ways to cut down wscript.exe application:
1. If your computer have not been infected
· Open the Run menu -> type regedit.exe
· Into the key "HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows NT \ Current Version \ Image File Execution Options"
· On the right side, right-click - new - key
· Give
it the name "wscript.exe", and then on the right side, add a String
Value. Give the name "Debugger" and fill in "1". Ok Done.
2. If your computer get infected
Usually
the virus is always shut the windows several tools such as regedit,
Task Manager, Folder Option, et cetera, and because of regedit cannot be
accessed directly, so it has to use another way, which is “VBS before
we shut down the wscript”.
Open “Run” menu-> Notepad
Type the following code
· dim reg
· set reg = createobject ( "wscript.shell")
· reg.regwrite
"HKLM \ Software \ Microsoft \ Windows NT \ CurrentVersion \ Image File
Execution Options \ wscript.exe \ debugger", 1,"REG_SZ"
then, save the folder as "vbsKiller.vbs" and don’t forget to change “Save as type” as "All Files".
Then, double click vbsKiller.vbs to use it. Done.....
End story for this VBS!...
Good luck... hopefully useful
2,To Remove autorun.inf Without Using Antivirus Program
Follow these steps :
step 1:- start your command prompt
select the virus affected drive
in this case i will show you drive D:
type D: them press enter key to see the content on the drive D
you can type the directory (Dir)
step
3: type these also attrib -s -h *.* /s /d then press enter key then
type dir to check whether it contain unusual .exe file yes it contains
.exe file with auorun.inf now you can delete these two files or rename
autorun.inf file into aa now you can acces the drive D: with out
affecting the virus.
0 comments:
Post a Comment