Previous Topic Next Topic

Winlog.vbs on usb flash drive???

Closed
Andre999 Posts 1 Registration date Friday October 4, 2013 Status Member Last seen October 4, 2013 - Oct 4, 2013 at 03:10 AM
 Gecko - Nov 12, 2013 at 03:27 AM
Hi guys,

I've got a file on my usb called winlog.vbs and I can only see it when I unhide the files on my flash through cmd with attrib -h -r -s /s /d g:\*.*.
All my files are shortcuts btw.

I delete the winlog.vbs but keeps coming back???

please help, its driving me crazy!

thank you.
Related:

2 responses

Answer 1 / 2
Gecko
Nov 12, 2013 at 03:27 AM
I had the same problem. It kept recurring because the file was set to run on startup and load into memory. Here's what I did and it worked a charm:

Backup your work and remove flashdrive.

1. Ensure that you can see hidden files Under folder options in control panel

2. Run regedit and search for winlog.vbs. I found it in 2 places, both set to run on startup. These were in my "users\{your username}\appdata\local\temp\" folder on mine. Don't worry about deleting these registry values now, they will just recur. this is to find out where the winlog file is "hiding".

3. Restart in SAFE MODE (press F8 before windows logo).

4. Go to the location where the .vbs is located <in 2 above> using command prompt.

In my case:
C:
CD\users\{your username}\appdata\local\temp\

type:
dir *.vbs
You'll see its not found.

Type
Attrib -r -s -h *.vbs

type:
dir *.vbs
You'll see it IS found.
del *.VBS {remove the file}

5. Get back to windows, run regedit, search for winlog.vbs and delete those registry entries.

6. Insert flashdrive and do not allow scan for errors(if it asks).

go to the flash drive in command prompt
"g:" in my case

Type
Attrib -r -s -h /s /d *.*

type:
dir *.vbs
You'll see it IS found.
del *.VBS {remove the file}

If you do a "dir/p" your files and folders should be there as well as the shortcuts created by this winlog.vbs script.

I formatted my drive after this, but it should be okay to do this:
del *.lnk {remove the shortcuts}

7. Restart your computer.
5
Answer 2 / 2
Ambucias Posts 47356 Registration date Monday February 1, 2010 Status Moderator Last seen February 15, 2023 11,171
Oct 4, 2013 at 07:35 AM
This type issue could be caused by a USB virus. It will spread to all of your USB memory devices and hard disk.

Here is a tool to remove the virus and vaccinate your USB against further viruses.


Download UsbFix (created by El Desaparecido) on your desktop.

http://ccm.net/download/download-24089-usbfix

If your antivirus gives an alert, ignore it and temporarily deactivate the antivirus.
Plug in your usb devices (Flash drive, pen drive. External HD etc...) don't open them.
Double click sur UsbFix.exe.

Click on deletion
.
Let the tool work.

Ambucias
Moderator/virus security contributor

At the end of the scan a report will show which you can copy and paste here..

The report is save at the root ( C:\UsbFix.txt ).

You can also vaccinate against any virus.
1