Avast WEBforum

Other => Viruses and worms => Topic started by: sasin44 on May 08, 2007, 08:11:57 PM

Title: partations wont open
Post by: sasin44 on May 08, 2007, 08:11:57 PM

hi i was infected by VBS:Solow and i had to right click and click on EXPLORE option inorder to open that drive.....
now avsat has detected it and totally deleted it...but wen i double click on them a error msg pops up sayin..
ms32dll.dll.vbs not found ??????
wat do i do.is there some register values i must edit ???
 

Title: Re: partations wont open
Post by: koQQ on August 22, 2007, 05:42:27 AM

- Scan with Anti-virus
- Start\Run\regedit
- Press F3 and Find "MS32DLL.dll.vbs"
- Delete All entry containing "MS32DLL.dll.vbs"
- Please copy the following code and open notepad and paste and save the file
- File name must be "fix-ms32.vbs"
- Click fix-ms32.vbs file


'Fix ms32dll.dll.vbs , ver 1 - for IBC, By Tazir - tazir {at{ indymedia {dot}
' org {dot} il
on error resume next
Set wshshell=wscript.CreateObject("WScript.Shell")
wshshell.Run "CMD /c TaskKill/F /im Wscript.exe /T"
wshshell.Run "TaskKill/F /im Wscript.exe /T"

Set fs=CreateObject("scripting.FileSystemObject")
myWinPath=fs.getSpecialFolder(0)
sFilePathAndName=myWinPath & "/ms32dll.dll.vbs"
If fs.FileExists(sFilePathAndName) = True Then
mf=fs.CreateTextFile(sFilePathAndName,true)
mf.attribute = 0
mf.WriteLine("")
mf.Close
fs.DeleteFile sFilePathAndName, True
end if
sFilePathAndName=myWinPath & "/autorun.inf"
If fs.FileExists(sFilePathAndName) = True Then
mf=fs.CreateTextFile(sFilePathAndName,true)
mf.attribute = 0
mf.WriteLine("")
mf.Close
fs.DeleteFile sFilePathAndName, True
end if

For Each fd in fs.drives
If (fd.DriveType=1 or fd.DriveType=2) and fd.path<>"A:" Then
sFilePathAndName=fd.path & "/ms32dll.dll.vbs"
If fs.FileExists(sFilePathAndName) = True Then
mf=fs.CreateTextFile(sFilePathAndName,true)
mf.attribute = 0
mf.WriteLine("")
mf.Close
fs.DeleteFile sFilePathAndName, True
end if
sFilePathAndName=fd.path & "/autorun.inf"
If fs.FileExists(sFilePathAndName) = True Then
mf=fs.CreateTextFile(sFilePathAndName,true)
mf.attribute = 0
mf.WriteLine("")
mf.Close
fs.DeleteFile sFilePathAndName, True
end if

end if
Next
Set fs=Nothing

oldVal=wshshell.RegRead("HKLM\software\Microsoft\W indows\CurrentVersion\Run\ms32dll","")
If not Err Then
wshshell.RegWrite "HKLM\software\Microsoft\Windows\CurrentVersion\Ru n\ms32dll",""
wshshell.RegDelete("HKLM\software\Microsoft\Window s\CurrentVersion\Run\ms32dll")
wshshell.RegWrite "HKCU\software\Microsoft\Internet Explorer\Main\Window Title","Goodbye"
End If

WScript.echo "Finish cleaning Virus ms32dll" & vbCrLf & "May all being be happy"
Set wshshell=Nothing

Title: Re: partations wont open
Post by: DavidR on August 22, 2007, 03:35:58 PM

Quote from: sasin44 on May 08, 2007, 08:11:57 PM

hi i was infected by VBS:Solow and i had to right click and click on EXPLORE option inorder to open that drive.....
now avsat has detected it and totally deleted it...but wen i double click on them a error msg pops up sayin..
ms32dll.dll.vbs not found ??????
wat do i do.is there some register values i must edit ???
 

avast doesn't delete by default you the user has to choose delete.

Also the file name is highly suspect ms32dll.dll.vbs this has a double file type .dll.vbs

See VBS.Zodgila info (http://www.symantec.com/security_response/writeup.jsp?docid=2006-112416-3424-99&tabid=2)