For example, I was given a USB drive that had as its main folder something that was like a shortcut but had the information inside. Although it seemed strange to me if I ended up opening it () and from there, although my antivirus blocked its entry, it was inside the Operating System of my computer because it had copied the files in search of repairing that removable memory. This is what led me to create this tutorial.

Let's start by explaining the basics:

Microsoft creates VBScript "... as an automation tool, since, jointly and in parallel with the improvements introduced in the Windows operating systems where it operates fundamentally, it allows more room for action and flexibility than the batch language (or batch process) developed in the late 1970s for MS-DOS.

The growth of the use of Internet technologies has meant a significant advance for this language, given that it is a fundamental part of the execution of server applications programmed in ASP (Active Server Pages), which are in boom in the period 1997-2003, currently declining in favor of managed code technologies and virtual machines, more secure in the execution of processes, and therefore, more adapted for executions in publicly accessible and distributed environments."

---

The VBScript works with extension files ".Vbs" and they were not created for the purpose of being a virus but they are being used as an easy tool to enter malicious files into our computers. The files Visual Basic Scripts (VBS) are not files that run on their own, they need another to run them, that is, they need a program (which in this case is the already named VBScript).

In the world of viruses, VBS are malicious files, considered as "worms", in this case affecting RAM more directly.

I recommend you follow these steps:

SHOWING HIDDEN FILES

Now we have to make Windows show us the hidden files of the system:

• Start.
• Control Panel.
• Appearance and Personalization.
• Folder options.
• Show all hidden files.
• View tab.
• Search in the list the option "Hidden files and folders" and select the option "Show files, folders and hidden units".
• And deselect the option "hide protected files of the operating system".
• Apply
• Acept

This virus changes its name, it can be called in several ways (Microsoft, Service, Help...)
Usually, it is located in the main user in the folder APP DATA, ROAMING o LOCAL.

STOPPING EXECUTOR OF .VBS

This type of virus is not able to run when your computer is disabled with the option of Windows Scripting Host, which would be the same as VBScript -as I understand so far.

In versions prior to Windows 98 the WSH is not installed by default in the operating system, but from there it is an activated add-on from the installation. The truth only we see its real utility if we are advanced technicians in systems or specialized personnel, that is, for a normal user does not make much difference to disable it.

What is recommended is to keep this complement disabled and for this you have to follow these steps:

• Open the Task Manager.
• Process Tab.
• Find file "wscript.exe".
• Right side of the mouse over the file.
• Press "End process tree".

But if they get very complicated with so many processes they can go to http://www.vsantivirus.com/otros.htm#esp and download the program NOSCRIPT.EXE which is free and has 124Kb.

Click on NONSCRIPT_EXE_124k At the end of the download open the file to execute it.
And now the WSH will be disabled.

If we do not deactivate it before deleting the virus, it will replay without stopping.

LOOKING FOR THE ARCHIVE OR
MALWARE


Open the Window browser.
In the search engine place *.Vbs there will appear all the files with that.

For my part, I usually look for the files with the most recent modification or creation date and they will appear at the beginning of the list, before any doubt, better to ask.

ELIMINATED THE VIRUSSSS!!!

PREVENTING FOR THE FUTURE



As a last step, you should prevent the execution of this type of virus again on your PC, for this you must:
• START.
• Control Panel.
• Default programs.
• "Associate a file type or protocol with a specific program".
• Search the ". Vbs" listing that says associated with Visual Basic Script.
• Change the association of this type of files and relate it to the Block of Notes.

Although it does not affect anything, it is good to do so to prevent future infections.







ADDITIONAL NOTE



This tutorial is made for Windows 7, if you need the tutorial in another Operating System do not hesitate to indicate me and I will try to help you.

Additionally, if restarting the computer gives you a notepad with an error, you can proceed as follows:

Delete everything in the notebook file, delete it and that's it.
Or go to the beginning and delete the file from your direct access from there.



---

For see the original article in spanish press here.

---