Winlog.vbs on usb flash drive???

Closed
Report
Posts
1
Registration date
Friday October 4, 2013
Status
Member
Last seen
October 4, 2013
-
 Gecko -
Hi guys,

I've got a file on my usb called winlog.vbs and I can only see it when I unhide the files on my flash through cmd with attrib -h -r -s /s /d g:\*.*.
All my files are shortcuts btw.

I delete the winlog.vbs but keeps coming back???

please help, its driving me crazy!

thank you.

2 replies

I had the same problem. It kept recurring because the file was set to run on startup and load into memory. Here's what I did and it worked a charm:

Backup your work and remove flashdrive.

1. Ensure that you can see hidden files Under folder options in control panel

2. Run regedit and search for winlog.vbs. I found it in 2 places, both set to run on startup. These were in my "users\{your username}\appdata\local\temp\" folder on mine. Don't worry about deleting these registry values now, they will just recur. this is to find out where the winlog file is "hiding".

3. Restart in SAFE MODE (press F8 before windows logo).

4. Go to the location where the .vbs is located <in 2 above> using command prompt.

In my case:
C:
CD\users\{your username}\appdata\local\temp\

type:
dir *.vbs
You'll see its not found.

Type
Attrib -r -s -h *.vbs

type:
dir *.vbs
You'll see it IS found.
del *.VBS {remove the file}

5. Get back to windows, run regedit, search for winlog.vbs and delete those registry entries.

6. Insert flashdrive and do not allow scan for errors(if it asks).

go to the flash drive in command prompt
"g:" in my case

Type
Attrib -r -s -h /s /d *.*

type:
dir *.vbs
You'll see it IS found.
del *.VBS {remove the file}

If you do a "dir/p" your files and folders should be there as well as the shortcuts created by this winlog.vbs script.

I formatted my drive after this, but it should be okay to do this:
del *.lnk {remove the shortcuts}

7. Restart your computer.
5
Thank you

A few words of thanks would be greatly appreciated. Add comment

CCM 2821 users have said thank you to us this month

Posts
47367
Registration date
Monday February 1, 2010
Status
Moderator
Last seen
September 1, 2021
11,286
This type issue could be caused by a USB virus. It will spread to all of your USB memory devices and hard disk.

Here is a tool to remove the virus and vaccinate your USB against further viruses.


Download UsbFix (created by El Desaparecido) on your desktop.

http://ccm.net/download/download-24089-usbfix

If your antivirus gives an alert, ignore it and temporarily deactivate the antivirus.
Plug in your usb devices (Flash drive, pen drive. External HD etc...) don't open them.
Double click sur UsbFix.exe.

Click on deletion
.
Let the tool work.

Ambucias
Moderator/virus security contributor

At the end of the scan a report will show which you can copy and paste here..

The report is save at the root ( C:\UsbFix.txt ).

You can also vaccinate against any virus.