Jump to content

Recommended Posts

Posted

My computer has been infected with a virus this afternoon from a removable USB stick .The virus is VBS:Solow...I've run the antivirus but it only found the virus once and I deleted it. I restarted the computer and now my antivirus is alerting me every 2 seconds that a virus was found on my C and E drives. I have pressed delete about a hundred times already but it continues to pop up...is this because it's not deleting or there a million infections? Every time I hit delete or quarantine the box pops up again straight away with another warning. I am currently running the windows malicious software removal tool but after running for 5 minutes that's not finding anything. What should I do since my virus protection is obviously detecting it but not deleting it?

Thanks

Posted

RueFang:

go to http://www.freedrweb.com and download CureIt.

Run to first the default Sacn and after that the Full Scan.

Not forget to run on ALL computers where that stick was connected.

Cheers.

Posted (edited)

Google the exact name of the file you keep deleting and you will get a step by step how to for removal. LIKE: "VBS:solow removal"

Is it VBS:solow a or b or c or d or e?

Basically it will keep putting itself back on (that is what the virus does) until you end its processes, edit the registry and possibly end the startup process in msconfig... and then run a full virus scan to find all the vbs files and delete them. DO NOT do these things unless you find a good step by step guide for your exact virus. I had KILL VBS and I removed that with a good guide, there was no virus scanner to remove it, it had to be done manually. Or, you could format your hard drive and reinstall windows. Also, all your external media will be infected (psp, ipod, usb flash drives etc....) so you will have to delete the files from them too after you fix your computer or you could reinfect.

Damian

Edited by DamianMavis
Posted (edited)
RueFang:

go to http://www.freedrweb.com and download CureIt.

Run to first the default Scan and after that the Full Scan.

Not forget to run on ALL computers where that stick was connected.

Cheers.

Follow this route. This is what I used to delete those pesky infection that keeps coming back.

Check if you can still access the Task Manager and the Folder Options

Chances are, the infection could have disabled it by now.

If that is so, then you would have to do some registry tinkering after you get rid of the worm

CureIt is great!

Antivir might do a good job of blocking it if the worm hasn't settled in yet.

Edited by sensei
Posted (edited)

Thanks for your advice. I used CureIt on both my computers which appears to have fixed it yesterday but I've just scanned again this morning and it's still finding the virus. One computer is functioning normally but the other one on start up has the message -

"Windows: Loading Script "C:\WINDOWS\.MS32DLL.dll.Vbs"failed (Access is denied)"

I also can't open my drives from "My Computer" and get the same error messages popping up regarding the different drives. I can still access files on the drives if I open them through the relevant programs though.

I have looked for detailed instructions on the net on how to remove entries from the register but they all seem to be in Thai or relate specifically to VBS a,b,c etc. This VBS virus/malware has no letter and on removal states only VBS Generic 548 deleted. I've previously removed the "Hacked by Godzilla" virus from the register which seems to be a similar thing but I had specific details about how to do that. If anyone can tell me specifics regarding deleting register entries (if that is what is needed) or how to repair the My Computer function, would be greatly appreciated.

As I'm in Thailand my version of windows is not exactly original so am unable to reinstall windows.

Edited by RueFang
Posted (edited)
Thanks for your advice. I used CureIt on both my computers which appears to have fixed it yesterday but I've just scanned again this morning and it's still finding the virus. One computer is functioning normally but the other one on start up has the message -

"Windows: Loading Script "C:\WINDOWS\.MS32DLL.dll.Vbs"failed (Access is denied)"

I also can't open my drives from "My Computer" and get the same error messages popping up regarding the different drives. I can still access files on the drives if I open them through the relevant programs though.

I have looked for detailed instructions on the net on how to remove entries from the register but they all seem to be in Thai or relate specifically to VBS a,b,c etc. This VBS virus/malware has no letter and on removal states only VBS Generic 548 deleted. I've previously removed the "Hacked by Godzilla" virus from the register which seems to be a similar thing but I had specific details about how to do that. If anyone can tell me specifics regarding deleting register entries (if that is what is needed) or how to repair the My Computer function, would be greatly appreciated.

As I'm in Thailand my version of windows is not exactly original so am unable to reinstall windows.

The message saying that a certain dll file is missing is because that dll file is the worm that had been rooted out by CureIt. It only means that it's trying to start automatically as your computer starts but it can't anymore because the file isn't there.

You can remove the startup of that dll by doing this... Start--> Run --> msconfig --> startup tab

look for the command pointing to that dll file and uncheck it.

for the meantime, to open a folder or drive, right click on the icon then select open or explore from there...

you will notice that on the very top of the right click menu, it would say Autorun- that's the reason why you cant open the folder or drive.

An autorun file (autorun.inf) in that drive has to be deleted manually but it's hidden so you have to allow viewing of hidden files to do so. If in case the worm has disabled the folder options that allows you to see hidden files, a registry tweaking might be required.

To enable the task manager...

Here's how to you could get the task manager back.

There is a registry hack to enable or disable Windows NT TaskManager. The same registry hack applies to Windows 2000 and Windows XP.

Hive: HKEY_CURRENT_USER

Key: Software\Microsoft\Windows\CurrentVersion\Policies\System

Name: DisableTaskMgr

Type: REG_DWORD

Value: 1=Enablethis key, that is DISABLE TaskManager

Value: 0=Disablethis key, that is Don't Disable, Enable TaskManager

As part of the enhanced management available in Windows 2000 and Windows XP, rather than risking a registry change, as an administrator you can enable or disable Windows 2000 Pro or Windows XP Pro's TaskManager using Group Policy Editor. This can be applied to the local policy. Note: if you are trying to override your organizations group policy, you can't. As soon as you re-authenticate to the domain, the domain or OU Group Policy will rewrite the registry setting. But if the TaskManager was accidently disabled or you need to control this item for a set of standalone boxes this is for you:

* Click Start

* Click Run

* Enter gpedit.msc in the Open box and click OK

* In the Group Policy settings window

o Select User Configuration

o Select Administrative Templates

o Select System

o Select Ctrl+Alt+Delete options

o Select Remove Task Manager

o Double-click the Remove Task Manager option

And as I mentioned above, since the policy is Remove Task Manager, by disabling the policy, you are enabling the Task Manager.

Got XP Home - use the registry edit.

FOLDER OPTIONS

Here's How:

1. Click Start

2. Click Run

3. Type REGEDIT

4. Click OK

The Registry Editor will now open

5. Browse to the following key:

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

Note: HKCU stands for HKEY_CURRENT_USER

6. In the right pane, look for the value: NoFolderOptions

7. Right click NoFolderOptions and select Delete. (When prompted with "Are you sure you want to delete this value", select Yes.

8. Now browse to the following key:

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

Note: HKLM stands for HKEY_LOCAL_MACHINE

9. In the right pane, look for the value: NoFolderOptions

10. Right click NoFolderOptions and select Delete. (When prompted with "Are you sure you want to delete this value", select Yes.

11. Close the Registry by choosing File | Exit

12. You should now be able to access the Folder Options menu. If not, reboot into Safe Mode and repeat the steps outlined above.

or see this link:

http://techbold.com/2007/06/disable-or-ena...ions-in-xp.html

Edited by sensei
Posted

sensei is correct:

But instead of the windows Taskmanger I would suggest to use Whatsrunning 2.2 a Freeware and can bedownloaded from HERE. You should also download FastSum for to compare the Checksum of the file to be in original stage. FastSum, also an Freeware can de downloaded from HERE.

Later the day as I'm back at my office, I'll upload both file to the Download Section of Thaivisa.

RueFang, if you need any special Software, PM me with your requirements.

Cheers.

Posted
To enable the task manager...

Here's how to you could get the task manager back.

There is a registry hack to enable or disable Windows NT TaskManager. The same registry hack applies to Windows 2000 and Windows XP.

Hive: HKEY_CURRENT_USER

Key: Software\Microsoft\Windows\CurrentVersion\Policies\System

After Policies I only have the option of Explorer..there is no System!

FOLDER OPTIONS

Here's How:

1. Click Start

2. Click Run

3. Type REGEDIT

4. Click OK

The Registry Editor will now open

5. Browse to the following key:

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

Note: HKCU stands for HKEY_CURRENT_USER

6. In the right pane, look for the value: NoFolderOptions

After Explorer only have the options of (default) - Reg_Sz

NoDriveTypeAutoRun - Reg_DWORD

There is no option available No Folder Option

7. Right click NoFolderOptions and select Delete. (When prompted with "Are you sure you want to delete this value", select Yes.

8. Now browse to the following key:

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

Note: HKLM stands for HKEY_LOCAL_MACHINE

After Policies there is only Non Enum, Ratings, System.............there is no Explorer option

9. In the right pane, look for the value: NoFolderOptions

10. Right click NoFolderOptions and select Delete. (When prompted with "Are you sure you want to delete this value", select Yes.

11. Close the Registry by choosing File | Exit

12. You should now be able to access the Folder Options menu. If not, reboot into Safe Mode and repeat the steps outlined above.

Thank you Sensei for that detailed post...I did the Start--> Run --> msconfig --> startup tab but that file was not there to uncheck, as well as your other instructions that I noted in red above.

Reimar I've downloaded the What's Running and it's interesting and a handy tool but I can't see that process running and don't really know where to go from there!

Posted

All problems have been successfully cleared! Woohoo! All thanks to CureIt....highly recommend it. Deleted all traces of the virus and got my drives working again. Will keep an eye on it though just to be sure!

Thanks for the recommendation Reimar :o

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.


  • Topics

  • Latest posts...

    1. 3

      The Post 'Comment Link URL' Has Disappeared

    2. 7

      Taking Someone Home: Ever Reach Down and Get an Unexpected Surprise?

    3. 213

      Something smelling musky -- the age of undemocratic in your face oligarchy in the USA.

    4. 1

      Biden lifts restrictions on Ukraine using US weapons to strike deep inside Russia.

    5. 81

      Foreign Driver in Fatal EV Collision with Motorbike, Drags It Over 50 Metres

    6. 0

      Female Journalists Rally Around Allison Pearson Amid Fears for Press Freedom

    7. 0

      Trump Aide Urges UK to Embrace US Free Market Over 'Socialist' EU

  • Popular in The Pub


×
×
  • Create New...