Unable to Open Hard or USB Flash Drive with Windows Script Host Cannot Find Script File autorun.vbs Error
In some situation especially when anti-virus program has cleaned, healed, disinfected or removed a worm, trojan horse or virus from computer, there may be error happening whenever users try to open or access the drive by double clicking on the disk drive icon in Explorer or My Computer window to try to enter the drive’s folder. The problem or symptom happens in hard disk drive, portable hard disk drive or USB flash drive, and Windows will prompt a dialog box with the following message:
Windows Script Host
Can not find script file autorun.vbs.
Sometimes you will be asked to debug the VBScript with error code of 800A041F – Unexpected ‘Next’.
or
Choose the program you want to use to open this file with:
In this case, the “Always use the selected program to open this kind of file” option is grayed out.
The symptom occurs because when autorun.vbs is created by trojan horse or virus. The virus normally loads autorun.inf file to root folder of all hard drive or USB drive, and then execute autorun.bat file which contains script to apply and merge autorun.reg into the registry, with possible change to the following registry key to ensure that virus is loaded when system starts:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
Userinit=userinit.exe,autorun.exe
Finally, autorun.bat will call wscript.exe to run autorun.vbs.
When antivirus or security software detected the autorun.vbs file as infected, the file will be deleted or removed or quarantined. However, other files (autorun.*） and registry value still referring to autorun.vbs, and this document no longer exists, hence the error when users double click to open a drive folder.
To correct and solve this error, follow this steps:
- Run Task Manager (Ctrl-Alt-Del or right click on Taskbar)
- Stop wscript.exe process if available by highlighting the process name and clicking End Process.
- Then terminate explorer.exe process.
- In Task Manager, click on File -> New Task (Run…).
- Type “cmd” (without quotes) into the Open text box and click OK.
- Type the following command one by one followed by hitting Enter key:
del c:\autorun.* /f /s /q /a
del d:\autorun.* /f /s /q /a
del e:\autorun.* /f /s /q /ac, d, e each represents drive letters on Windows system. If there are more drives or partitions available, continue to command by altering to other drive letter. Note that you must also clean the autorun files from USB flash drive or portable hard disk as the external drive may also be infected.
- In Task Manager, click on File -> New Task (Run…).
- Type “regedit” (without quotes) into the Open text box and click OK.
- Navigate to the following registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
- Check if the value name and value data for the key is correct (the value data of userint.exe include the path which may be different than C drive, which is also valid, note also the comma which is also needed):
“Userinit”=”C:\WINDOWS\system32\userinit.exe,”
If the value is incorrent, modify it to the valid value data.
Related Articles
- Host Process for Windows Services Has Stopped Working Error – Workaround Fix
- AutoPlay/AutoRun Not Working or Missing Not Open in Windows Vista
- Block Malicious Autorun Files with Autorun Eater
- Open File Location Menu Item Is Missing or Not Showing When Right Click on Shortcut in Windows Vista
- Workaround to Fix Windows 7 Unable To Create or Save New Files in the Folder Error When Unloading Box
- Unable to Login to Windows Live (MSN) Messenger with 80048820 Extended 80048416 Error Code
- Cannot Display the Webpage and Host/Server Not Found or Available Error – EnablePMTUDiscovery MTU Fix
- Microsoft Money 2007 Unable to Connect to Internet to Sign In Online in Windows Vista Error
- Unable to Install and Upgrade PPStream on PowerPlay.dll and PowerList.ocx Error
- Fix Explorer.exe Unable to Locate Component Because Browseui.dll Was Not Found Error
Entries (RSS)
September 3rd, 2009 04:36
Easiest way to correct d same:
To correct and solve this error, follow this steps:
1. click “start”
2. click “run”
3. type “cmd”
4. click “ok”
5. Type the following command one by one and press Enter key:
del c:\autorun.* /f /s /q /a
del d:\autorun.* /f /s /q /a
del e:\autorun.* /f /s /q /a
c, d, e each represents local drives/ partions present on your harddisk.
6. and u done!
7. restart your pc
8. Sometime problem get solved but when u double click on local drive icon the search window open. If this happened, do additional things given below, otherwise not required!
i] open control panel
ii] click on “folder options”, new window will open
iii] click on “file types”
iv] select “drive” from the list under “registered file types” heading
v] click “advanced”, new window will open
vi] you will see “find” option below “actions” heading
vii] click on “new”, a new window up will open
viii] type “open” below “action” heading
ix] click “browse”, again new window will
open with the title “open with”
x] find and double click “explorer.exe”
xi] click “ok”
xii] click “set default” when open is highlighted below “actions” heading
xiii] click “ok”
xiv] again click “ok” to close “folder options” window
xv] and u done!
September 1st, 2009 06:26
hay people it’s too easy to solv these problem
just transfeer the data from drive to another one and format it and return the data again to it’s partition
August 20th, 2009 08:53
[...] CLICK HERE Categories: How-to, Tech Tips, Tutorials Tags: Aikelyu, Autorun Feature, Cmd, Command Prompt, Good Luck, Infected Memory, Kernell Dll, Machine Software, Memory Cards, Memorycards, Microsoft Windows, Shell Explorer, Software Microsoft, Startup Control Panel, System32 Dll, Task Manager, Tech Tips, Type Regedit, Usb Drives, Windows Startup, Worms Comments (3) Trackbacks (0) Leave a comment Trackback [...]
August 14th, 2009 04:52
Thank you so much. I had just rebooted my computer and reinstalled everything, and would HATE to have reboot again. This helped me out a ton. I just restarted my computer and it was as good as new. just one question, why do you need to terminate explorer? I accidently skipped that step but it still worked fine
July 19th, 2009 23:02
thanx very much , the problem is solved and it did not delete any of my files (like it did to others )
may be they tried something else !?
July 16th, 2009 09:04
good post!! worked on mine too.. thanks a lot!!!!!!!!!
April 17th, 2009 10:52
I tried to the solution and it worked.
March 14th, 2009 22:29
GOOD IT WROKED HATS OFF WHO POSTED THIS
..
January 17th, 2009 20:58
Thanx a lot it works
December 9th, 2008 22:44
hi friends if u delete the autorun.inf file as specified above u may loose some other files also so make sure that first at command prompt the path is like this
C:\attrib -r -h -s autorun.inf
c:\del autorun.inf
next repeat the above procedure at command prompt for remaining drives also for ex:
d:\attrib -r -h -s autorun.inf
d:\del autorun.inf
then after deleting autorun.inf file in all the drives as specified above follow the remaining steps in the tutorial..the tutorial works like charm thanks for the person who posted it …all the best guys…
November 29th, 2008 20:59
Hello everyone…
This post is very excellent..after deleting the autorun files my hard disks are nw working absolutely fine…Thanxxxx a lot…!!!
October 7th, 2008 20:51
Thank you so much for this!
Worked perfectly.
After a bunch of Trojans found there way into my computer – I ran Kaspersky and got rid of them all – and the found myself without access to my hard drives!!!
These instructions worked perfectly, thank you so much. x
September 20th, 2008 14:15
works like a charm.
ur only deleting the autorun.inf files across the harddisk. y would you loss all your files.
September 12th, 2008 16:15
hi friends ,
Pls dont try this code.
The one who sent it is a real fucker .
I tried this in one of my drives, thank god it didnt have any contents,.
These codes delete all the files.
The asshole is trying to ditch others.
I would kick his ass if he is nearme.
Fuck u bastard
So dont try these codes
September 4th, 2008 21:51
MAIOR ROUBADA..VOCE FAZ OS PASSO QUE AQUI ESTÃO E FERRA TUDO SEU HD, PERDE TODOS OS ARQUIVOS NAO CAIAM NESSA ENGANAÇÃO!!!!!!!!!!!!!!!!!!!!!!!
URGENTE NAO CAIA NESSA!!!!!!!!!!!!!!!!!!!!!!!!!NAOA FAÇA ESSE PROCEDIMENTO EU PERDI TUDO DO HD!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
July 21st, 2008 06:16
I find this blog very interesting, i will be here everyday till now. Greetings
July 8th, 2008 17:09
Fantastic solution it worked like a charm
I am ecstatic, and grateful that I came across this article thank you
was reluctant to edit the registry esp because the machine in question was our company server so tried it on a client machine first and it worked gave me confidence to go apply it on our server and it worked first time
and keep up the good work
July 1st, 2008 22:42
fuck you i run the first commands and it deleted all my files stored on my c drive every thing everything … i lost all of my pictures and word files and everything stroed on the c drive beaware of this command i will sue the comapany that made such solution to make lose all my data fuck you…
June 28th, 2008 13:23
Brilliant and impressive solution shared guys. I am all sorted.
June 22nd, 2008 23:13
This worked like a charm! Thanks for the help. Step 2 was not available so I went to step 3. I copied and pasted the del c: command into the cmd and that worked. Followed next few steps and everything was correct. Rebooted and presto! I was not able to open my hard drive due to malicious software that was trying to run when I double clicked it. My antivirus program kept telling me no, blocking ddkyir.com or something like that. I ran the new 2008 MSWR tool from microsoft. A full scan caught 20+ bugs. I always use my firewall and routinely scan for viruses but these slipped by. After the clean was over, I was being prompted to choose a program to open my E drive. Thanks again!
June 6th, 2008 16:11
hello ,
i need your help to remove the autorun file from my external hard drive, when i right click on it , it shows me autorun at the first( above ) , so , how can i remove it ?
could you please help me to code a file with the name of autorun-eater.inf ?
Waiting for your kindly respond.
April 28th, 2008 02:16
hey guys!
thank you for your posts.
I think the following will help you better understand the problem and maybe it will help you in some cases.
Solution:
Terminating the Malware Program
This procedure terminates the running malware process.
Open Windows Task Manager.
• On Windows 98 and ME, press
CTRL+ALT+DELETE
• On Windows NT, 2000, XP, and Server 2003, press
CTRL+SHIFT+ESC, then click the Processes tab.
In the list of running programs*, locate the process:
SOUNDMIX.EXE
Select the malware process, then press either the End Task or the End Process button, depending on the version of Windows on your computer.
To check if the malware process has been terminated, close Task Manager, and then open it again.
Close Task Manager.
——————————————————————————–
*NOTE: On computers running Windows 98 and ME, Windows Task Manager may not show certain processes. You can use a third party process viewer such as Process Explorer to terminate the malware process.
On computers running all Windows platforms, if the process you are looking for is not in the list displayed by Task Manager or Process Explorer, continue with the next solution procedure, noting additional instructions. If the malware process is in the list displayed by either Task Manager or Process Explorer, but you are unable to terminate it, restart your computer in safe mode.
Addressing Registry Shell Spawning
This procedure prevents the malware from executing whenever a user opens files with certain extension names. It should restore the registry to its original settings.
Click Start>Run.
In the Open input box, type:
command /c copy %WinDir%\regedit.exe regedit.com | regedit.com
Press Enter.
In the left panel, double-click the following:
HKEY_CLASSES_ROOT>exefile>shell>open>command
In the right panel, locate the registry entry:
Default
Check whether its value is the path and file name of the malware file.
If the value is the malware file, right-click Default and select Modify to change its value.
In the value data input box, delete the existing value and type the default value:
“%1″ %*
Close Registry Editor.
Click Start>Run, then type:
command /c del regedit.com
Press Enter.
Editing the Registry
This malware modifies the computer’s registry. Users affected by this malware may need to modify or delete specific registry keys or entries. For detailed information regarding registry editing, please refer to the following articles from Microsoft:
HOW TO: Backup, Edit, and Restore the Registry in Windows 95, Windows 98, and Windows ME
HOW TO: Backup, Edit, and Restore the Registry in Windows NT 4.0
HOW TO: Backup, Edit, and Restore the Registry in Windows 2000
HOW TO: Back Up, Edit, and Restore the Registry in Windows XP and Server 2003
Removing Autostart Entry from the Registry
Removing autostart entries from the registry prevents the malware from executing at startup.
If the registry entry below is not found, the malware may not have executed as of detection. If so, proceed to the succeeding solution set.
Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>
Windows>CurrentVersion>Run
In the right panel, locate and delete the entry:
Soundmix = “%System%\soundmix.exe”
(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, and C:\Windows\System32 on Windows XP and Server 2003.)
Restoring Modified Registry Entry
Still in the Registry Editor, in the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>
CurrentVersion>Explorer>Advanced>Folder>Hidden>SHOWALL
In the right panel, locate the entry:
CheckedValue = “0″
Right-click on the value name and choose Modify. Change the value data of this entry to:
1
Close Registry Editor.
Restoring AUTORUN.INF
Right-click Start then click Search… or Find…, depending on the version of Windows you are running.
In the Named input box, type:
AUTORUN.INF
In the Look In drop-down list, select a drive, then press Enter.
Select the file, then open using Notepad.
Check if the following lines are present in the file:
[autorun]
open=
shell\open=´ò¿ª(&O)
shell\open\Command=RECYCLER\autorun.exe -OpenCurDir
shell\open\Default=1
shell\explore=×ÊÔ´¹ÜÀíÆ÷(&X)
shell\explore\Command=RECYCLER\autorun.exe –ExploreCurDir
If the lines are present, delete the file.
Repeat steps 3 to 6 for AUTORUN.INF files in the remaining removable drives.
Close Search Results.
(Note: The folder not addressed in this section may be used by a legitimate application. Thus, it is best that the said folder is left on the system.)
Important Windows ME/XP Cleaning Instructions
Users running Windows ME and XP must disable System Restore to allow full scanning of infected computers.
Users running other Windows versions can proceed with the succeeding solution set(s).
Running Trend Micro Antivirus
If you are currently running in safe mode, please restart your computer normally before performing the following solution.
Scan your computer with Trend Micro antivirus and delete files detected as WORM_AGENT.PGV. To do this, Trend Micro customers must download the latest virus pattern file and scan their computer. Other Internet users can use HouseCall, the Trend Micro online virus scanner.
Trend Micro offers best-of-breed antivirus and content-security solutions for your corporate network, small and medium business, mobile device or home PC.
sourse: http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM%5FAGENT%2EPGV&VSect=Sn