My Windows Box Infected with virus!!! Yes, some time I need to use M$ Windowz for few of my clients. Any way, when I was looking for solution I found following article: Unable to Open Hard or USB Flash Drive with Windows Script Host Cannot Find Script File autorun.vbs ErrorIn some situation especially when anti-virus program has cleaned, healed, disinfected or removed a worm, trojan horse or virus from computer, there may be error happening whenever users try to open or access the drive by double clicking on the disk drive icon in Explorer or My Computer window to try to enter the drive’s folder. The problem or symptom happens in hard disk drive, portable hard disk drive or USB flash drive, and Windows will prompt a dialog box with the following message:
Windows Script Host
Can not find script file autorun.vbs.
Sometimes you will be asked to debug the VBScript with error code of 800A041F - Unexpected ‘Next’.
or
Choose the program you want to use to open this file with:
In this case, the “Always use the selected program to open this kind of file” option is grayed out.
The symptom occurs because when autorun.vbs is created by trojan horse or virus. The virus normally loads autorun.inf file to root folder of all hard drive or USB drive, and then execute autorun.bat file which contains script to apply and merge autorun.reg into the registry, with possible change to the following registry key to ensure that virus is loaded when system starts:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
Userinit=userinit.exe,autorun.exe
Finally, autorun.bat will call wscript.exe to run autorun.vbs.
When antivirus or security software detected the autorun.vbs file as infected, the file will be deleted or removed or quarantined. However, other files (autorun.*） and registry value still referring to autorun.vbs, and this document no longer exists, hence the error when users double click to open a drive folder.
To correct and solve this error, follow this steps:
1. Run Task Manager (Ctrl-Alt-Del or right click on Taskbar)
2. Stop wscript.exe process if available by highlighting the process name and clicking End Process.
3. Then terminate explorer.exe process.
4. In Task Manager, click on File -> New Task (Run…).
5. Type “cmd” (without quotes) into the Open text box and click OK.
6. Type the following command one by one followed by hitting Enter key:
del c:\autorun.* /f /s /q /a
del d:\autorun.* /f /s /q /a
del e:\autorun.* /f /s /q /a
c, d, e each represents drive letters on Windows system. If there are more drives or partitions available, continue to command by altering to other drive letter. Note that you must also clean the autorun files from USB flash drive or portable hard disk as the external drive may also be infected.
7. In Task Manager, click on File -> New Task (Run…).
8. Type “regedit” (without quotes) into the Open text box and click OK.
9. Navigate to the following registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
10. Check if the value name and value data for the key is correct (the value data of userint.exe include the path which may be different than C drive, which is also valid, note also the comma which is also needed):
“Userinit”=”C:\WINDOWS\system32\userinit.exe,”
If the value is incorrent, modify it to the valid value data.
Actually I just ignored the section as I found no autorun.inf file any of my drives:
6. Type the following command one by one followed by hitting Enter key:
del c:\autorun.* /f /s /q /a
del d:\autorun.* /f /s /q /a
del e:\autorun.* /f /s /q /a
But I was wrong!!! In blank eyes no file was there, even enabling 'Show all hidden file' failed to display any autorun.inf file on drive root. Even command:
del c:\autorun.inf failed, returned 'autorun.inf not found!'.
Now that box is working again... Thanks to author of article above for this nice article. Original version of article can be
found here. If I get some time, I will update the last steps for new users...
Happy Linuxing...
Thanks
See that happy-looking lady in the pic? She's standing in an Emirates A380 in-flight shower room, details of which have emerged recently. The "shower spas" are pretty decently kitted-out, and the aircraft carries an extra 1,100-pounds of water to allow every one of the 14 first-class passengers to have a splash.
That extra 1,000 pounds of water (25% more than usual) means the aircraft will have to carry more fuel, which may weigh heavy on your environmental conscience. Or maybe lying in your massage bed in the private first class room, with remote-control doors and mini bar will make you forget your woes.
