Forum Home
Press F1
Thread ID: 75988	2007-01-17 01:44:00	HELP - the VBS/Butsur virus	Aporosa (5671)	Press F1

Post ID	Timestamp	Content	User
516693	2007-01-17 21:21:00	Speedy, That file: MS32DLL.dll.vbs is NOT in the msconfig (under Startup tab). I assume ccleaner is a downloadable program?? I had another thought............ I have a Ghost of my C drive. Is the problem on my C drive or the actual ext HDD. If its on my C drive, can I reinstall the Ghost image and fix the problem? If its on the actual ext HDD, then I still have the problem - yes?? What you think?? Or should I go for the cclean? What is cclean? cheers, Aporosa	Aporosa (5671)
516694	2007-01-17 21:38:00	You can get ccleaner from here (www.ccleaner.com) I would say its on the external hdd not C. As the worm copies itself to removable drives. Is the external bootable as well, or do u have to access it through c ?? By going thru My computer / whatever letter? When u clicked on scan using trojan remover, did it bring up anything about that vbs file?? Saying the file path doesn't exist? It should have asked u if u wanted to delete a startup entry (if there is one) to remove the entry for it. Also do a scan of the external drive using trojan remover. Under file menu / scan a drive / directory. Hopefully it'll list the external hdd here. So, u can scan it.	Speedy Gonzales (78)
516695	2007-01-18 01:01:00	Hi Speedy, Re the Trojan remover: when I did the initial scann, it revealed 2 files only, and both had something to do with vbs, and I do not recall it saying anything about the pathway not existing. I ran Trojan Remover on the ext HDD and it found nothing. I have since tried using my 128MB flash drive, and it also will not open, saying it cannot find the same file "F/MS32DLL.dll.vbs. The ext HD is basically a huge flash drive, is NOT bootable, and you have to access it through MY Computer. I ran cclean, both the Cleaner and Issues (registry check) but I couldn't find any file that contained MS32DLL.dll.vbs. Is this what I am looking for?? I analysed only, and was reluctant to run the cleaner as I didn't know if it would clean out some important files. What do yu think? Also, if the problem is on the ext HD (:F), how will cclean know to check there, as there is no instructions to specifically check the ext HDD? Dude, at panic level 8.75 now!! Cheers, Apo	Aporosa (5671)
516696	2007-01-18 01:10:00	Do a search for autorun.inf It'll have the command / reference to that vbs in the autorun.inf file as stated on the Symantec site. # Creates the following files: * %Windir%\MS32DLL.dll.vbs * [DRIVE LETTER]:\MS32DLL.dll.vbs * [DRIVE LETTER]:\autorun.inf - Thats why its saying it cant be found. Note: %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows (Windows 95/98/Me/XP) or C:\Winnt (Windows NT/2000).	Speedy Gonzales (78)
516697	2007-01-18 01:11:00	It can't find the script file with the (illegal) ".dll.vbs" extension\ because it isn't there. :D Something in the system is wanting to load it so it can do nasty things. That's what is causing the error message. Try searching for something which contains the name "MS32DLL.dll.vbs".	Graham L (2)
516698	2007-01-18 01:36:00	Hi Graham, When you say "Try searching for something which contains the name "MS32DLL . dll . vbs"", do you mean useing the search function in My Computer? I have done that, and did it AFTER I "Show(ed) all hidden files" . I have also tried looking in the config, and I have just finished running cclean and it is not listed anywhere in there . Do you think that file will be on the C drive, or the actual ext HDD (F drive)? It has also infected my small 128MB flash drive . I have run AVG and Trjoan Remover and Fixed 2 files . . . . . Panic level 9 NOW>>>>>>	Aporosa (5671)
516699	2007-01-18 01:39:00	Search for autorun.inf if any are found delete it. Hard drives don't have autorun.inf files on them, and they're not needed for hdd's. They're only used on cd's etc. Just make sure the autorun.inf file isn't in a file u downloaded, which maybe part of something. Then reboot. Are any letters showing in My computer, before u plug in the flash drive?? If so delete it and the autorun.inf file that maybe in the folder.	Speedy Gonzales (78)
516700	2007-01-18 01:56:00	Hi Speedy, I searched for autorun.inf using the search in My Computer, and it listed about 40 files, ¾ of them on the ext HDD. But it doesn’t have, like a proper file name, even when I go View/Details, and it just shows the In Folder name. There is nothing with .vbs Can you advise please. And I am wondering if I fully did as you suggested???	Aporosa (5671)
516701	2007-01-18 01:56:00	I'm suggesting that you not search for a "file or folder" with that name; but for a file containing that text string, at the point where it tries to invoke the script... that's where the problem is. It will probably take a while ...	Graham L (2)
516702	2007-01-18 02:00:00	Hi Graham, Thanks for your help. I'm a bit of a novice at this. Can you please tell me how to search "or a file containing that text string". I'm a bit of a newbi at this. Cheers, A	Aporosa (5671)
1 2 3 4 5