How do you remove a VBScript Script File on a USB?

Question

The virus came from a computer in the library of my school. The usb got infected. And now im trying to use the usb, but everytime i try moving a folder or file in it, the virus transforms it into a shortcut. It turns everything i move into a shortcut. Luckily, my computer isn't infected yet. Hence the yet part. The whole name of this virus is ' kpcgrhynko..vbs ' ... Please help me, i really do not know what to do.

Answer 1

Bear in mind that the computer is almost certainly infected, and it is essential to correct that.  Sanitize with the free version of MalwareBytes Anti-Malware.  PC Magazine with WestCoast Labs concluded that this is the best program for clearing already infected systems, superior to even the best antivirus products.  Before scanning, insert any flash drive.



http://www.bleepingcomputer.com/download/malwarebytes-anti-malware/



When all malware has been removed, open My Computer and note the USB drive letter.



Open Notepad, then copy & paste these lines.



ATTRIB -S -H -R *.*



DEL KPCGRHYNKO.VBS



MD MOVEVBS



MOVE *.VBS MOVEVBS



DEL AUTORUN.INF



MD AUTORUN.INF



ATTRIB +H +R AUTORUN.INF



Click File and Save As.  Type "C:\MOVEVBS.BAT" (including the quotes) as the file name, then click Save.



Power down the computer.  Power up and immediately begin tapping the F8 or F5 key to invoke the advanced options menu.  Select "Safe Mode with Command Prompt".



Log on to any account with administrator's rights.  When the command prompt opens, type the USB drive letter followed by a colon, then press Enter.  To verify that you're on the correct drive, type

    DIR /A /W

and press Enter to list the drive's contents.



If you're satisfied that you're looking at the right drive, type

    C:\MOVEVBS.BAT

and press Enter..



Remove the flash drive.  Insert another drive and perform the above command.  Repeat for each flash drive.



When done, type SHUTDOWN  -R  -T  0 (the last character is a zero) and press Enter to restart.



[ What the commands do —

The first ATTRIB changes all the hidden, system, and read-only files to ordinary files.

The DELs delete the kpcgrhynko.vbs and autorun.inf files.

The MD and MOVE commands referencing MOVEVBS create a folder by that name, and move any remaining VBS files into it.

The MD creates a FOLDER named autorun.inf, which prevents the creation of a malicious autorun.inf FILE, and ATTRIB makes it hidden and read-only.

SHUTDOWN restarts the computer. ]

Answer 2

This Site Might Help You.



RE:

How do you remove a VBScript Script File on a USB?

The virus came from a computer in the library of my school. The usb got infected. And now im trying to use the usb, but everytime i try moving a folder or file in it, the virus transforms it into a shortcut. It turns everything i move into a shortcut. Luckily, my computer isn't infected yet....

Answer 3

Greetings. My name's Sanjay Patel, and I currently hold an honorary Master's degree in the field of Computer Science. I am aware of, and have personal knowledge related to your question. There are computer maintenance businesses which are probably in your area, however they come at the cost of hiring a professional to enter your home. There may also be some local destinations where you can drop off your computer and wait to have a technician look at it. These options can often be costly, and pretty inconvenient. The answer to this question can probably be found doing a little extra research on Google.



A well-running computer can be a hard thing to maintain. From my experience, there is but only One software which is reputable- and consistently reliable for healing sick, slow computers. Reimage™ is a world-renown, easy to use software designed by Forensic scientists and made for the average person. This thing will fix literally just about ANY problem you could possibly be having with your PC. Reimage was recommended to me by a Professor during my 2nd year of Graduate school.

Answer 4

Make sure that you are an administrator on the computer. Then open a folder, then click tools on the standard buttons menu at the top, folder options, view, show hidden files. Then ok. Should work.

Answer 5

Press CTRL + ALT + DEL

Go to Processes, search for wscript.exe.

Press then END PROCESS, Press Ok.

Search for the kpcgrhynko..vbs or any VBS Virus then delete it.



Run the Command Prompt (CMD) and enter this command: attrib -h -r -s /s /d [replace this with drive letter]:\*.*

You can just search for CMD. Once CMD is open, type the command given above attrib -h -r -s /s /d [replace this with drive letter]:\*.* or if you want it easier, copy and paste that (just make sure that you replace the statement [replace this with drive letter] with the drive letter of the infected removable disk.



Enjoy :D

Answer 6

okay, Here's the thing..first you must have an antivirus and must enabled its firewall to prevent to run the virus. (Because my antivirus can prevent it from running the virus)

If the antivirus did its job then here's the next step,

# open "Folder Option">go to "view" tab>find "Show hidden files and folders" click it and find "Hide extensions for known file types" make it unchecked #

now, open the flash drive and you will see the virus then delete it, but if you can't be deleted the virus, it means the antivirus firewall couldn't blocked it. Message will appear says "Cannot be deleted because the file is running blah blah something like that".

okay, good luck...