KillVBS Remover (KillVBS.vbs)

A virus which tries to be propagated in the system via peripherals USB. It creates also a file autorun.inf what launches the KillVBS.vbs file with each time you try to open a partition or a removal disk.

Creates two files in all the partition in the system:

• autorun.inf
• KillVBS.vbs

Creates too two files in system directory:

• <System>KillVBS.vbs
• <System>WScript.exe

Creates the registry entry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
MS32DLL
[Valeur aléatoire]

Changes value:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
<System>\wscript.exe <System>\killVBS.vbs

The right value is:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
explorer.exe

Replaces too
Userinit
<System>\wscript.exe <System>\killVBS.vbs
The right value is <System>\userinit.exe,

Deletes the parameters of Internet Explorer, Title and Start Page
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Window Title
" "
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Start Page
" "

This virus launches out automatically to each time you open or explore a partition or a removable disk, it is thus preferable to download this patch and to decompress it on the desktop, to start your machine in safe mode and of launching the patch, always in safe mode.

Instruction on how to restart your computer in safe mode.