Unable to Open Hard or USB Flash Drive with Windows Script Host Cannot Find Script File autorun.vbs Error无法打开硬盘或USB闪存驱动器与Windows脚本宿主无法找到脚本文件autorun.vbs错误
In some situation especially when anti-virus program has cleaned, healed, disinfected or removed a worm, trojan horse or virus from computer, there may be error happening whenever users try to open or access the drive by double clicking on the disk drive icon in Explorer or My Computer window to try to enter the drive’s folder.在一些情况，特别是当防病毒程序，已清理，愈合，消毒或消除了蠕虫，木马或病毒从计算机，可能会有错误发生，每当用户尝试打开或访问的驱动器双击就磁盘驱动器的图标Explorer或我的电脑窗口，试图进入硬盘的文件夹。 The problem or symptom happens in hard disk drive, portable hard disk drive or USB flash drive, and Windows will prompt a dialog box with the following message:问题或症状发生在硬盘驱动器，便携式硬盘驱动器或USB闪存驱动器，和Windows会提示一个对话框，与下列讯息：
Windows Script Host Windows脚本宿主
Can not find script file autorun.vbs.无法找到脚本文件autorun.vbs 。
Sometimes you will be asked to debug the VBScript with error code of 800A041F - Unexpected ‘Next’.有时你会被要求调试的VBScript错误代码的800a041f -意想不到的'下一步' 。
or或
Choose the program you want to use to open this file with:选择您想使用的程序用来打开此文件：
In this case, the “Always use the selected program to open this kind of file” option is grayed out.在这种情况下， “始终使用选择的程序打开这种文件”选项是灰色。
The symptom occurs because when autorun.vbs is created by trojan horse or virus.症状的发生原因，是因为当autorun.vbs是所创造的木马或病毒。 The virus normally loads autorun.inf file to root folder of all hard drive or USB drive, and then execute autorun.bat file which contains script to apply and merge autorun.reg into the registry, with possible change to the following registry key to ensure that virus is loaded when system starts:该病毒通常负荷Autorun.inf文件，以根文件夹中的所有硬盘驱动器或USB驱动器，然后执行autorun.bat文件，该文件包含脚本的申请和合并autorun.reg到注册表中，与可能的变化到以下注册表项，以确保这种病毒是装货时，系统启动：
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] [ hkey_local_machine \软件\微软\ Windows NT的\ currentversion \ Winlogon中]
Userinit=userinit.exe,autorun.exe userinit =将Userinit.exe ，的Autorun.exe
Finally, autorun.bat will call wscript.exe to run autorun.vbs.最后， autorun.bat将拜会wscript.exe运行autorun.vbs 。
When antivirus or security software detected the autorun.vbs file as infected, the file will be deleted or removed or quarantined.当防病毒或安全软件的检测autorun.vbs文件作为感染，该文件将被删除或删除或隔离。 However, other files (autorun.*） and registry value still referring to autorun.vbs, and this document no longer exists, hence the error when users double click to open a drive folder.不过，其他文件（ autorun. * ）和注册表值仍指autorun.vbs ，这份文件已不再存在，因此，错误时，用户双击打开驱动器文件夹中。
To correct and solve this error, follow this steps:以纠正和解决这个错误，请依照此步骤：
- Run Task Manager (Ctrl-Alt-Del or right click on Taskbar)运行任务管理器（ CTRL -按Alt -删除或右键点击任务栏）
- Stop wscript.exe process if available by highlighting the process name and clicking End Process.停止wscript.exe过程中如果有突出的过程中的名称，然后点击结束进程。
- Then terminate explorer.exe process.然后终止Explorer.exe进程。
- In Task Manager, click on File -> New Task (Run…).在任务管理器，点击文件-> “新建任务（运行… ） 。
- Type “cmd” (without quotes) into the Open text box and click OK.键入“ cmd ” （不含引号）到打开文本框中并单击确定。
- Type the following command one by one followed by hitting Enter key:键入以下命令逐个其次是打回车键：
del c:\autorun.* /f /s /q /a恢复为C ： \自动.* / / /的Q / 1
del d:\autorun.* /f /s /q /a恢复为D ： \自动.* / / /的Q / 1
del e:\autorun.* /f /s /q /a删除E ：在\自动.* / / /的Q / 1c, d, e each represents drive letters on Windows system.丙，丁，电子商务，每个字母所代表的驱动器在Windows系统。 If there are more drives or partitions available, continue to command by altering to other drive letter.如果有更多的硬盘或分区可用，继续指挥通过改变其他的磁碟机代号。 Note that you must also clean the autorun files from USB flash drive or portable hard disk as the external drive may also be infected.请注意，您也必须清洁自动将文件从USB快闪磁碟机或便携式硬盘作为外置驱动器也可能受到感染。
- In Task Manager, click on File -> New Task (Run…).在任务管理器，点击文件-> “新建任务（运行… ） 。
- Type “regedit” (without quotes) into the Open text box and click OK.键入“ regedit ” （不含引号）到打开文本框中并单击确定。
- Navigate to the following registry key:浏览到以下注册表项：
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon hkey_local_machine \软件\微软\ Windows NT的\ currentversion \在Winlogon
- Check if the value name and value data for the key is correct (the value data of userint.exe include the path which may be different than C drive, which is also valid, note also the comma which is also needed):检查如果该值名称和值的数据，关键是正确的（价值的数据， userint.exe包括路径，其中可能有所不同，比C磁碟机，这亦是有效的，还注意到一个逗号，这也是需要的） ：
“Userinit”=”C:\WINDOWS\system32\userinit.exe,” “ userinit ” = “为C ： \的Windows \ system32 \将Userinit.exe ”
If the value is incorrent, modify it to the valid value data.如果该值是incorrent ，修改它以有效的数值数据。
IMPORTANT : This is a machine translated page which is provided "as is" without warranty. 重要说明 ：这是一个机器翻译网页是“按原样”提供的担保。 Machine translation may be difficult to understand.机器翻译可能很难理解。 Please refer to请参阅 original English article英文原版的文章 whenever possible.只要有可能。
Share and contribute or get technical support and help at分享和贡献，或取得技术的支持和帮助，在 My Digital Life Forums 我的数字生活论坛 . 。
Related Articles相关文章
- Virus Infections via USB Drive病毒感染通过USB驱动器
- PHP 5 Unable to Open HTTP Request Stream with fopen or fsockopen Functions PHP 5中无法打开HTTP请求流与fopen或fsockopen职能
- Fix Windows XP and 2003 Require Activation on Every Boot Even After Activated Error修复Windows XP和2003年需要激活的每次启动后，激活错误
- Script to Backup Current Start State (Startup Type) of Windows Services脚本来备份当前的开始状态（启动类型）的Windows服务
- Firefox Unresponsive Script: Increase JavaScript Execution Waiting Time Firefox的反应迟钝的脚本：增加的JavaScript执行轮候时间
- Block, Hide and Remove Windows Live Mail Ads座，隐藏和删除的Windows Live Mail的广告
- PHP Allowed Memory Size Exchausted Fatal Error PHP的允许内存大小exchausted致命错误
- Recover and Reclaim ‘Lost’ Disk Space After Installing Windows Vista Service Pack 1 (SP1)收回并回收'失去'的磁盘空间后，安装Windows Vista的Service Pack 1 （ SP1 ）的
- Windows XP Setup Could Not Detect and Find Any SATA Hard Disk Drive on AHCI Mode Windows XP安装程序无法检测和找到任何SATA硬碟就ahci模式
- Change or Modify the Drive Letter and Paths in Windows Vista更改或修改的驱动器号和路径，在Windows Vista
July 21st, 2008 06:16 2008年7月21日6时16分
I find this blog very interesting, i will be here everyday till now.我觉得这是博客很有意思，我会在这里，每天到现在。 Greetings问候
July 8th, 2008 17:09 2008年7月8日17时09分
Fantastic solution it worked like a charm神奇的解决方案，它像一个魅力
I am ecstatic, and grateful that I came across this article thank you我很兴奋，并感谢我碰到此文章，谢谢 
was reluctant to edit the registry esp because the machine in question was our company server so tried it on a client machine first and it worked gave me confidence to go apply it on our server and it worked first time不愿编辑注册表的电除尘器，因为机器在的问题是我们公司的服务器，以便尝试，它在用户端机的第一和它的工作给了我信心去申请，这对我们的服务器和它的工作第一次
and keep up the good work并保持了良好的工作
July 1st, 2008 22:42 2008年7月1日22时42分
fuck you i run the first commands and it deleted all my files stored on my c drive every thing everything … i lost all of my pictures and word files and everything stroed on the c drive beaware of this command i will sue the comapany that made such solution to make lose all my data fuck you…他妈的，你我运行的第一命令，并删除了所有我的档案储存在我的C驱动器的每一件事的一切… …我失去了我所有的图片和Word文件和一切stroed对C磁碟机beaware这个命令的，我会控告comapany表示，作出这样的解决办法，使我失去了所有的数据他妈的你…
June 28th, 2008 13:23 2008年6月28日13时23分
Brilliant and impressive solution shared guys.辉煌和令人印象深刻的解决方案，共同家伙。 I am all sorted.我的所有排序。
June 22nd, 2008 23:13 2008年6月22日23时13分
This worked like a charm!这个工作，像一个魅力！ Thanks for the help.感谢您的帮助。 Step 2 was not available so I went to step 3.第2步是不是可用，所以我到第3步。 I copied and pasted the del c: command into the cmd and that worked. i复制并粘贴该删除c ：命令到cmd和工作。 Followed next few steps and everything was correct.其次是未来几年的步骤和一切是正确的。 Rebooted and presto!重新开机和presto ！ I was not able to open my hard drive due to malicious software that was trying to run when I double clicked it.我无法打开我的硬盘驱动器由于恶意软体，这是试图运行，当我双点击它。 My antivirus program kept telling me no, blocking ddkyir.com or something like that.我的防毒程式不停地告诉我没有，阻塞ddkyir.com或类似的东西。 I ran the new 2008 MSWR tool from microsoft.我参加新的2008年mswr工具从Microsoft 。 A full scan caught 20+ bugs.全面扫描捕获20 +臭虫。 I always use my firewall and routinely scan for viruses but these slipped by.我总是用我的防火墙并定期扫描病毒，但这些下跌。 After the clean was over, I was being prompted to choose a program to open my E drive.后清洁超过，我被提示选择一个程式来开启我的电子驱动器。 Thanks again!再次感谢！
June 6th, 2008 16:11 2008年6月6日16时11分
hello ,喂，
i need your help to remove the autorun file from my external hard drive, when i right click on it , it shows me autorun at the first( above ) , so , how can i remove it ?我需要你们的帮助，以消除Autorun的档案从我的外部硬盘驱动器，当我右键点击它，它显示我Autorun的在第一次（以上） ，所以，我如何才能删除呢？
could you please help me to code a file with the name of autorun-eater.inf ?可否请你帮助我的代码的文件的名称自动- eater.inf ？
Waiting for your kindly respond.等待您的善意回应。
April 28th, 2008 02:16 2008年4月28日02:16
hey guys!嘿家伙！
thank you for your posts.谢谢您的职位。
I think the following will help you better understand the problem and maybe it will help you in some cases.我认为以下将帮助您更好地理解这个问题，并可能会帮助您在某些情况下。
Solution:解决方案：
Terminating the Malware Program终止恶意程序
This procedure terminates the running malware process.这个程序终止运行恶意软件的进程。
Open Windows Task Manager.打开Windows任务管理器。
• On Windows 98 and ME, press •对Windows 98和ME ，新闻
CTRL+ALT+DELETE按Ctrl + Alt +删除
• On Windows NT, 2000, XP, and Server 2003, press •在Windows NT ， 2000 ， XP和Server 2003的，新闻
CTRL+SHIFT+ESC, then click the Processes tab.按Ctrl + Shift +人事编制小组委员会，然后点击进程选项卡。
In the list of running programs*, locate the process:在名单上正在运行的程序*中，找到进程：
SOUNDMIX.EXE soundmix.exe
Select the malware process, then press either the End Task or the End Process button, depending on the version of Windows on your computer.选择恶意程序进程，然后按下要么结束任务或结束进程按钮，这取决于该版本的Windows在您的计算机上。
To check if the malware process has been terminated, close Task Manager, and then open it again.检查，如果恶意软件的进程已被终止，关闭任务管理器，然后打开一遍。
Close Task Manager.关闭任务管理器。
——————————————————————————– ---------------------------
*NOTE: On computers running Windows 98 and ME, Windows Task Manager may not show certain processes. *注：在电脑上运行Windows 98和ME ， Windows任务管理器可能不会显示某些进程。 You can use a third party process viewer such as Process Explorer to terminate the malware process.您可以使用第三方进程查看，如Process Explorer的终止恶意程序进程。
On computers running all Windows platforms, if the process you are looking for is not in the list displayed by Task Manager or Process Explorer, continue with the next solution procedure, noting additional instructions.在电脑上运行的所有Windows平台上，如果过程中你要找的是不是在名单上所显示的任务管理器或Process Explorer的，继续执行下一个解决方案，程序，注意到额外的指示。 If the malware process is in the list displayed by either Task Manager or Process Explorer, but you are unable to terminate it, restart your computer in safe mode.如果恶意软件的进程是在清单中显示，无论任务管理器或Process Explorer的，但您无法终止它，请重新启动电脑在安全模式。
Addressing Registry Shell Spawning解决注册表壳产卵
This procedure prevents the malware from executing whenever a user opens files with certain extension names.这个程序，防止恶意软件执行，每当用户打开文件与某些扩展名。 It should restore the registry to its original settings.应该将注册表还原到它原来的设置。
Click Start>Run.单击开始> “运行。
In the Open input box, type:在开放输入框中，键入：
command /c copy %WinDir%\regedit.exe regedit.com | regedit.com指挥/炭复制的％ windir ％ \ Regedit.exe的regedit.com | regedit.com
Press Enter.按下ENTER 。
In the left panel, double-click the following:在左边的面板中，双击以下内容：
HKEY_CLASSES_ROOT>exefile>shell>open>command hkey_classes_root > exefile >壳> “打开>命令
In the right panel, locate the registry entry:在右面板中，找到注册表项：
Default默认
Check whether its value is the path and file name of the malware file.检查是否有其价值的路径和文件名的恶意文件。
If the value is the malware file, right-click Default and select Modify to change its value.如果该值是恶意软件的文件，右键单击默认，并选择修改，以改变其价值。
In the value data input box, delete the existing value and type the default value:在数值数据输入框，删除现有的价值，并键入默认值：
“%1″ %* “ ％ 1 ” ％ *
Close Registry Editor.关闭注册表编辑器。
Click Start>Run, then type:单击开始> “运行，然后键入：
command /c del regedit.com指挥/炭删除regedit.com
Press Enter.按下ENTER 。
Editing the Registry编辑注册表
This malware modifies the computer’s registry.这个恶意代码修改计算机的注册表。 Users affected by this malware may need to modify or delete specific registry keys or entries.用户受这一恶意代码可能需要修改或删除特定的注册表键或项目。 For detailed information regarding registry editing, please refer to the following articles from Microsoft:为方面的详细资料注册表编辑，请参阅下列文章从微软：
HOW TO: Backup, Edit, and Restore the Registry in Windows 95, Windows 98, and Windows ME如何：备份，编辑和还原注册表在Windows 95 ， Windows 98和Windows Me
HOW TO: Backup, Edit, and Restore the Registry in Windows NT 4.0如何：备份，编辑和还原注册表在Windows NT 4.0
HOW TO: Backup, Edit, and Restore the Registry in Windows 2000如何：备份，编辑和还原注册表在Windows 2000
HOW TO: Back Up, Edit, and Restore the Registry in Windows XP and Server 2003如何：备份，编辑和还原注册表在Windows XP和Server 2003
Removing Autostart Entry from the Registry删除自动进入从注册表
Removing autostart entries from the registry prevents the malware from executing at startup.删除自动启动的项目，从注册表，防止恶意软件在启动时执行。
If the registry entry below is not found, the malware may not have executed as of detection.如果该注册表项下面，是没有找到，恶意软件未必有作为执行检测。 If so, proceed to the succeeding solution set.如果是的话，进行了成功的解决方案。
Open Registry Editor.打开注册表编辑器。 Click Start>Run, type REGEDIT, then press Enter.单击开始“ >运行，键入regedit ，然后按Enter键。
In the left panel, double-click the following:在左边的面板中，双击以下内容：
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft> hkey_local_machine >软件>微软>
Windows>CurrentVersion>Run在Windows > currentversion > “运行
In the right panel, locate and delete the entry:在右面板中，找到并删除条目：
Soundmix = “%System%\soundmix.exe” soundmix = “ ％系统％ \ soundmix.exe ”
(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, and C:\Windows\System32 on Windows XP and Server 2003.) （注： ％系统％是Windows系统文件夹，这是通常是C ： \的Windows \ System对Windows 98和ME为C ： \ Winnt \ System32中对Windows NT和2000年，和C ： \的Windows \ system32在Windows XP和Server 2003中） 。
Restoring Modified Registry Entry恢复修改注册表项
Still in the Registry Editor, in the left panel, double-click the following:仍然在注册表编辑器，在左边的面板中，双击以下内容：
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows> hkey_local_machine >软件>微软>的Windows >
CurrentVersion>Explorer>Advanced>Folder>Hidden>SHOWALL currentversion >总管> “高级> ”文件夹>隐藏> showall
In the right panel, locate the entry:在右面板中，找到项目：
CheckedValue = “0″ checkedvalue = “ 0 ”
Right-click on the value name and choose Modify.右键单击该值的名称，并选择修改。 Change the value data of this entry to:数值数据更改这个条目：
1
Close Registry Editor.关闭注册表编辑器。
Restoring AUTORUN.INF恢复的Autorun.inf
Right-click Start then click Search… or Find…, depending on the version of Windows you are running.右键单击开始，然后单击搜索或寻找… … ，这取决于该版本的Windows正在运行的程序。
In the Named input box, type:在名称输入框中，键入：
AUTORUN.INF的Autorun.inf
In the Look In drop-down list, select a drive, then press Enter.在查找范围下拉列表中，选择一个驱动器，然后按下ENTER 。
Select the file, then open using Notepad.选择该文件，然后打开使用记事本。
Check if the following lines are present in the file:检查是否以下线目前在该文件中：
[autorun] [自动]
open=开放=
shell\open=´ò¿ª(&O)蚬壳\开放= ' ò ¿ ª （ ＆海外）
shell\open\Command=RECYCLER\autorun.exe -OpenCurDir蚬壳\开放\命令=回收再利用\的Autorun.exe - opencurdir
shell\open\Default=1蚬壳\开放\默认= 1
shell\explore=×ÊÔ´¹ÜÀíÆ÷(&X)蚬壳\探索= × êô ' ¹ üàíæ ÷ （ ＆ x ）的
shell\explore\Command=RECYCLER\autorun.exe –ExploreCurDir蚬壳\探索\命令=回收再利用\的Autorun.exe - explorecurdir
If the lines are present, delete the file.如果线，目前，删除该文件。
Repeat steps 3 to 6 for AUTORUN.INF files in the remaining removable drives.重复步骤3至6 Autorun.inf文件在余下的可移动驱动器。
Close Search Results.接近的搜索结果。
(Note: The folder not addressed in this section may be used by a legitimate application. Thus, it is best that the said folder is left on the system.) （注：该文件夹不解决，在本节将可能利用合法的应用。因此，这是最好的，该说的文件夹是系统中留下的） 。
Important Windows ME/XP Cleaning Instructions重要的Windows Me中/ XP的清洁指示
Users running Windows ME and XP must disable System Restore to allow full scanning of infected computers.用户运行的是Windows Me和Windows XP ，必须禁用系统还原，让全面扫描受感染的电脑。
Users running other Windows versions can proceed with the succeeding solution set(s).用户运行其他Windows版本，可以进行与成功的解集（ ） 。
Running Trend Micro Antivirus运行Trend Micro防病毒
If you are currently running in safe mode, please restart your computer normally before performing the following solution.如果您正在安全模式下运行，请重新启动电脑，通常前执行下列的解决办法。
Scan your computer with Trend Micro antivirus and delete files detected as WORM_AGENT.PGV.扫描您的计算机与Trend Micro防病毒和删除档案发现worm_agent.pgv 。 To do this, Trend Micro customers must download the latest virus pattern file and scan their computer.为此，趋势科技的用户必须下载最新的病毒的病毒码文件和扫描自己的电脑。 Other Internet users can use HouseCall, the Trend Micro online virus scanner.其他互联网用户可以使用housecall ，趋势科技的在线病毒扫描。
Trend Micro offers best-of-breed antivirus and content-security solutions for your corporate network, small and medium business, mobile device or home PC.趋势科技提供同类最佳的防毒和内容安全解决方案为您的企业网络，中小企业，移动设备或家用PC 。
sourse:源： http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM%5FAGENT%2EPGV&VSect=Sn http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?vname=worm ％ 5fagent ％ 2epgv ＆ vsect =锡