열심히 또는 창 원본 주인을 가진 USB 섬광 열 수 없습니다 드라이브는 원본 파일 autorun.vbs 과실을 찾아낼 수 없다
어떤 상황에서는 특히 항바이러스 프로그램이 컴퓨터에서 벌레, 트로이의 목마 또는 바이러스이라고 제거하거나, 치유하거나, 소독하거나 제거할, 사용자가 드라이브의 폴더에 들어가는 것을 시도할 것이다 탐험가 내 컴퓨터 창에 있는 디스크 드라이브 아이콘에 두 배에게 누르기에 의하여 드라이브를 열거나 접근하는 것을 시도한다 언제든지 일어나는 과실이 있을지도 모른다. 문제 또는 증후는 하드 디스크 드라이브, 휴대용 하드 디스크 드라이브 또는 USB 섬광에서 드라이브 일어나고, 창은 뒤에 오는 메시지를 가진 대화 상자를 자극할 것이다:
창은 주인을 대본을 쓴다
원본 파일 autorun.vbs를 찾아낼 수 없다.
때때로 당신은 800A041F의 오류 코드 - 의외 `를 가진 VBScript를' 다음 제충하도록 요청받을 것이다.
또는
당신이 이 파일을을 가진 여는 것을 이용하고 싶은 프로그램을 선택하십시오:
이 경우에는, "항상 파일의 이 종류를" 여는 사용은 선정한 프로그램 선택권 밖으로 회색 이다.
현상은 autorun.vbs가 트로이의 목마 또는 바이러스에 의해 창조될 때 때문에 발생한다. 바이러스는 일반적으로 체계가 시작할 때 autorun.inf 모든 하드드라이브 USB 드라이브의 폴더를 뿌리박기 위하여 파일을 적재하고, 바이러스가 적재된ㄴ다는 것을 보증하기 위하여 그 후에 기입으로 autorun.reg를 적용하고 합병하기 위하여 원본을 포함하는 뒤에 오는 기입 열쇠에 가능한 변화와 더불어 autorun.bat 파일을 수행한다:
[HKEY_LOCAL_MACHINE \ 소프트웨어 \ 마이크로소프트 \ Windows NT \ CurrentVersion \ Winlogon]
Userinit=userinit.exe, autorun.exe
마지막으로, autorun.bat는 autorun.vbs를 달리기 위하여 wscript.exe를 부를 것이다.
항 바이러스 또는 안전 소프트웨어가 감염될 것과 같이 autorun.vbs 파일을 검출할 때, 파일은 삭제되거나 제거되거나 격리될 것이다. 그러나, 다른 파일 (autorun.*) 및 아직도 autorun.vbs 및 이 문서를 언급하는 기입 가치는 더 이상, 그러므로 과실 때 사용자 두 배 누르기 드라이브 폴더를 열기 위하여 존재하지 않는다.
이 과실을 정정하고 해결하기 위하여, 이것을 족답한다 따르십시오:
- 뛰기 업무 매니저 (Ctrl Alt Del 또는 권리는 Taskbar를 클릭한다)
- 만약에 가공 이름을 강조하고 끝 과정을 눌러서 유효하면 정지 wscript.exe 과정.
- 그 때 explorer.exe 과정을 종결하십시오.
- 업무 매니저에서는, 파일을 - > 새로운 업무 (뛰기…) 클릭하십시오.
- 열려있는 텍스트 박스와 누르기 OK로 유형 "cmd" (따옴표 없이).
- 명중에 선행된 뒤에 오는 명령을 하나씩 차례로 엔터 키를 타자를 치십시오:
del c:\autorun. * /f /s /q /a
del d:\autorun. * /f /s /q /a
del e:\autorun. * /f /s /q /ac는, d, e 각각 창 체계에 드라이브 문자를 대표한다. 만약에 유효한 드라이브 또는 분할이 더 있으면, 다른 드라이브 문자에 바꿔서 명령하는 것을 계속하십시오. Note that you must also clean the autorun files from USB flash drive or portable hard disk as the external drive may also be infected.
- In Task Manager, click on File -> New Task (Run…).
- Type “regedit” (without quotes) into the Open text box and click OK.
- Navigate to the following registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
- Check if the value name and value data for the key is correct (the value data of userint.exe include the path which may be different than C drive, which is also valid, note also the comma which is also needed):
“Userinit”=”C:\WINDOWS\system32\userinit.exe,”
If the value is incorrent, modify it to the valid value data.
IMPORTANT: This is a machine translated page which is provided "as is" without warranty. Machine translation may be difficult to understand. Please refer to original English article whenever possible.
Share and contribute or get technical support and help at My Digital Life Forums.
Related Articles
- Virus Infections via USB Drive
- PHP 5 Unable to Open HTTP Request Stream with fopen or fsockopen Functions
- Fix Windows XP and 2003 Require Activation on Every Boot Even After Activated Error
- Script to Backup Current Start State (Startup Type) of Windows Services
- Firefox Unresponsive Script: Increase JavaScript Execution Waiting Time
- Block, Hide and Remove Windows Live Mail Ads
- PHP Allowed Memory Size Exchausted Fatal Error
- Recover and Reclaim ‘Lost’ Disk Space After Installing Windows Vista Service Pack 1 (SP1)
- Windows XP Setup Could Not Detect and Find Any SATA Hard Disk Drive on AHCI Mode
- Change IE Title Bar or TitleBar Text Description (including IE7)
Entries (RSS)
July 21st, 2008 06:16
I find this blog very interesting, i will be here everyday till now. Greetings
July 8th, 2008 17:09
Fantastic solution it worked like a charm
I am ecstatic, and grateful that I came across this article thank you
was reluctant to edit the registry esp because the machine in question was our company server so tried it on a client machine first and it worked gave me confidence to go apply it on our server and it worked first time
and keep up the good work
July 1st, 2008 22:42
fuck you i run the first commands and it deleted all my files stored on my c drive every thing everything … i lost all of my pictures and word files and everything stroed on the c drive beaware of this command i will sue the comapany that made such solution to make lose all my data fuck you…
June 28th, 2008 13:23
Brilliant and impressive solution shared guys. I am all sorted.
June 22nd, 2008 23:13
This worked like a charm! Thanks for the help. Step 2 was not available so I went to step 3. I copied and pasted the del c: command into the cmd and that worked. Followed next few steps and everything was correct. Rebooted and presto! I was not able to open my hard drive due to malicious software that was trying to run when I double clicked it. My antivirus program kept telling me no, blocking ddkyir.com or something like that. I ran the new 2008 MSWR tool from microsoft. A full scan caught 20+ bugs. I always use my firewall and routinely scan for viruses but these slipped by. After the clean was over, I was being prompted to choose a program to open my E drive. Thanks again!
June 6th, 2008 16:11
hello ,
i need your help to remove the autorun file from my external hard drive, when i right click on it , it shows me autorun at the first( above ) , so , how can i remove it ?
could you please help me to code a file with the name of autorun-eater.inf ?
Waiting for your kindly respond.
April 28th, 2008 02:16
hey guys!
thank you for your posts.
I think the following will help you better understand the problem and maybe it will help you in some cases.
Solution:
Terminating the Malware Program
This procedure terminates the running malware process.
Open Windows Task Manager.
• On Windows 98 and ME, press
CTRL+ALT+DELETE
• On Windows NT, 2000, XP, and Server 2003, press
CTRL+SHIFT+ESC, then click the Processes tab.
In the list of running programs*, locate the process:
SOUNDMIX.EXE
Select the malware process, then press either the End Task or the End Process button, depending on the version of Windows on your computer.
To check if the malware process has been terminated, close Task Manager, and then open it again.
Close Task Manager.
——————————————————————————–
*NOTE: On computers running Windows 98 and ME, Windows Task Manager may not show certain processes. You can use a third party process viewer such as Process Explorer to terminate the malware process.
On computers running all Windows platforms, if the process you are looking for is not in the list displayed by Task Manager or Process Explorer, continue with the next solution procedure, noting additional instructions. If the malware process is in the list displayed by either Task Manager or Process Explorer, but you are unable to terminate it, restart your computer in safe mode.
Addressing Registry Shell Spawning
This procedure prevents the malware from executing whenever a user opens files with certain extension names. It should restore the registry to its original settings.
Click Start>Run.
In the Open input box, type:
command /c copy %WinDir%\regedit.exe regedit.com | regedit.com
Press Enter.
In the left panel, double-click the following:
HKEY_CLASSES_ROOT>exefile>shell>open>command
In the right panel, locate the registry entry:
Default
Check whether its value is the path and file name of the malware file.
If the value is the malware file, right-click Default and select Modify to change its value.
In the value data input box, delete the existing value and type the default value:
“%1″ %*
Close Registry Editor.
Click Start>Run, then type:
command /c del regedit.com
Press Enter.
Editing the Registry
This malware modifies the computer’s registry. Users affected by this malware may need to modify or delete specific registry keys or entries. For detailed information regarding registry editing, please refer to the following articles from Microsoft:
HOW TO: Backup, Edit, and Restore the Registry in Windows 95, Windows 98, and Windows ME
HOW TO: Backup, Edit, and Restore the Registry in Windows NT 4.0
HOW TO: Backup, Edit, and Restore the Registry in Windows 2000
HOW TO: Back Up, Edit, and Restore the Registry in Windows XP and Server 2003
Removing Autostart Entry from the Registry
Removing autostart entries from the registry prevents the malware from executing at startup.
If the registry entry below is not found, the malware may not have executed as of detection. If so, proceed to the succeeding solution set.
Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>
Windows>CurrentVersion>Run
In the right panel, locate and delete the entry:
Soundmix = “%System%\soundmix.exe”
(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, and C:\Windows\System32 on Windows XP and Server 2003.)
Restoring Modified Registry Entry
Still in the Registry Editor, in the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>
CurrentVersion>Explorer>Advanced>Folder>Hidden>SHOWALL
In the right panel, locate the entry:
CheckedValue = “0″
Right-click on the value name and choose Modify. Change the value data of this entry to:
1
Close Registry Editor.
Restoring AUTORUN.INF
Right-click Start then click Search… or Find…, depending on the version of Windows you are running.
In the Named input box, type:
AUTORUN.INF
In the Look In drop-down list, select a drive, then press Enter.
Select the file, then open using Notepad.
Check if the following lines are present in the file:
[autorun]
open=
shell\open=´ò¿ª(&O)
shell\open\Command=RECYCLER\autorun.exe -OpenCurDir
shell\open\Default=1
shell\explore=×ÊÔ´¹ÜÀíÆ÷(&X)
shell\explore\Command=RECYCLER\autorun.exe –ExploreCurDir
If the lines are present, delete the file.
Repeat steps 3 to 6 for AUTORUN.INF files in the remaining removable drives.
Close Search Results.
(Note: The folder not addressed in this section may be used by a legitimate application. Thus, it is best that the said folder is left on the system.)
Important Windows ME/XP Cleaning Instructions
Users running Windows ME and XP must disable System Restore to allow full scanning of infected computers.
Users running other Windows versions can proceed with the succeeding solution set(s).
Running Trend Micro Antivirus
If you are currently running in safe mode, please restart your computer normally before performing the following solution.
Scan your computer with Trend Micro antivirus and delete files detected as WORM_AGENT.PGV. To do this, Trend Micro customers must download the latest virus pattern file and scan their computer. Other Internet users can use HouseCall, the Trend Micro online virus scanner.
Trend Micro offers best-of-breed antivirus and content-security solutions for your corporate network, small and medium business, mobile device or home PC.
sourse: http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM%5FAGENT%2EPGV&VSect=Sn