KillVBS.vbs Fix - Get rid of the virus KillVBS

Written by Administrator | Friday, 18 September 2009 08:20

Information A virus which tries to be propagated in the system via peripherals USB. It creates also a file autorun.inf what launches the KillVBS.vbs file with each time you try to open a partition or a removal disk.

Fichier

Creates two files in all the partition in the system:

autorun.inf
KillVBS.vbs

Creates too two files in system directory:

<System>KillVBS.vbs
<System>WScript.exe

Registre Creates the registry entry:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
- MS32DLL="[Valeur aléatoire]"

Changes value:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
- Shell="<System>\wscript.exe <System>\killVBS.vbs"

The right value is:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
- Shell="explorer.exe"

Replaces too
Userinit
<System>\wscript.exe <System>\killVBS.vbs
The right value is <System>\userinit.exe,

Deletes the parameters of Internet Explorer, Title and Start Page
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Window Title
" "
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Start Page
" "

ATTENTION This virus launches out automatically to each time you open or explore a partition or a removable disk, it is thus preferable to download this patch and to decompress it on the desktop, to start your machine in safe mode and of launching the patch, always in safe mode.