無法開始艱苦或USB閃光驅動用窗口劇本主人不可能發現劇本文件autorun.vbs錯誤
在某一情況，特別是當反病毒程序清洗了，癒合了，消毒了或者去除了蠕蟲、電腦程式內的病毒或者病毒從計算機時，也許有發生，每當的錯誤用戶在探險家或我的計算機窗口設法通過在驅動器像設法的雙擊打開或訪問驅動進入推進的文件夾。 問題或症狀在硬盤驅動器、便攜式的硬盤驅動器或者USB閃光發生驅動，并且窗口將提示一個對話箱與下列信息：
窗口劇本主人
不能發現劇本文件autorun.vbs。
有時您將請求其次調試VBScript以800A041F誤差編碼-意想不到的`』。
或
選擇您想要使用打開這個文件與的節目：
在這種情況下， 「總用途選擇的節目打開這種文件」選擇變灰。
當autorun.vbs是由電腦程式內的病毒或病毒時，創造的症狀發生，因為。 病毒通常裝載autorun.inf文件根源所有硬盤或USB驅動文件夾，然後執行包含劇本申請和合併autorun.reg入登記的autorun.bat文件，與對以下登記鑰匙的可能的變動保證病毒被裝載，當系統開始時：
[HKEY_LOCAL_MACHINE \軟件\微軟\視窗NT \ CurrentVersion \ Winlogon]
Userinit=userinit.exe， autorun.exe
終於， autorun.bat將叫wscript.exe跑autorun.vbs。
當抗病毒或安全軟件查出了autorun.vbs文件如被傳染，文件將被刪除或被去除或者被檢疫。 然而，其他文件(autorun.*)和仍然提到autorun.vbs和本文的登記價值不再存在，因此錯誤，當用戶雙擊打開推進文件夾時。
要改正和解決這個錯誤，跟隨此跨步：
- 跑任務經理(CtrlAltDel或用鼠標右鍵單擊在Taskbar)
- 停止wscript.exe過程，如果可利用通過突出處理名字和點擊結尾過程。
- 然後終止explorer.exe過程。
- 在任務經理，點擊文件- >新的任務(奔跑…)。
- 鍵入「cmd」 (沒有行情)入開放正文框并且點擊OK。
- 鍵入擊中跟隨的以下命令逐個輸入鍵：
del c:\autorun。* /f /s /q /a
del d:\autorun。* /f /s /q /a
del e:\autorun。* /f /s /q /ac， d， e其中每一在窗口系統代表驅動器字母。 如果有更多驅動或分開可利用，繼續命令通過修改對其他驅動器字母。 Note that you must also clean the autorun files from USB flash drive or portable hard disk as the external drive may also be infected.
- In Task Manager, click on File -> New Task (Run…).
- Type “regedit” (without quotes) into the Open text box and click OK.
- Navigate to the following registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
- Check if the value name and value data for the key is correct (the value data of userint.exe include the path which may be different than C drive, which is also valid, note also the comma which is also needed):
“Userinit”=”C:\WINDOWS\system32\userinit.exe,”
If the value is incorrent, modify it to the valid value data.
IMPORTANT: This is a machine translated page which is provided "as is" without warranty. Machine translation may be difficult to understand. Please refer to original English article whenever possible.
Share and contribute or get technical support and help at My Digital Life Forums.
Related Articles
- Virus Infections via USB Drive
- PHP 5 Unable to Open HTTP Request Stream with fopen or fsockopen Functions
- Fix Windows XP and 2003 Require Activation on Every Boot Even After Activated Error
- Script to Backup Current Start State (Startup Type) of Windows Services
- Firefox Unresponsive Script: Increase JavaScript Execution Waiting Time
- Block, Hide and Remove Windows Live Mail Ads
- PHP Allowed Memory Size Exchausted Fatal Error
- Recover and Reclaim ‘Lost’ Disk Space After Installing Windows Vista Service Pack 1 (SP1)
- Windows XP Setup Could Not Detect and Find Any SATA Hard Disk Drive on AHCI Mode
- Change IE Title Bar or TitleBar Text Description (including IE7)
Entries (RSS)
July 21st, 2008 06:16
I find this blog very interesting, i will be here everyday till now. Greetings
July 8th, 2008 17:09
Fantastic solution it worked like a charm
I am ecstatic, and grateful that I came across this article thank you
was reluctant to edit the registry esp because the machine in question was our company server so tried it on a client machine first and it worked gave me confidence to go apply it on our server and it worked first time
and keep up the good work
July 1st, 2008 22:42
fuck you i run the first commands and it deleted all my files stored on my c drive every thing everything … i lost all of my pictures and word files and everything stroed on the c drive beaware of this command i will sue the comapany that made such solution to make lose all my data fuck you…
June 28th, 2008 13:23
Brilliant and impressive solution shared guys. I am all sorted.
June 22nd, 2008 23:13
This worked like a charm! Thanks for the help. Step 2 was not available so I went to step 3. I copied and pasted the del c: command into the cmd and that worked. Followed next few steps and everything was correct. Rebooted and presto! I was not able to open my hard drive due to malicious software that was trying to run when I double clicked it. My antivirus program kept telling me no, blocking ddkyir.com or something like that. I ran the new 2008 MSWR tool from microsoft. A full scan caught 20+ bugs. I always use my firewall and routinely scan for viruses but these slipped by. After the clean was over, I was being prompted to choose a program to open my E drive. Thanks again!
June 6th, 2008 16:11
hello ,
i need your help to remove the autorun file from my external hard drive, when i right click on it , it shows me autorun at the first( above ) , so , how can i remove it ?
could you please help me to code a file with the name of autorun-eater.inf ?
Waiting for your kindly respond.
April 28th, 2008 02:16
hey guys!
thank you for your posts.
I think the following will help you better understand the problem and maybe it will help you in some cases.
Solution:
Terminating the Malware Program
This procedure terminates the running malware process.
Open Windows Task Manager.
• On Windows 98 and ME, press
CTRL+ALT+DELETE
• On Windows NT, 2000, XP, and Server 2003, press
CTRL+SHIFT+ESC, then click the Processes tab.
In the list of running programs*, locate the process:
SOUNDMIX.EXE
Select the malware process, then press either the End Task or the End Process button, depending on the version of Windows on your computer.
To check if the malware process has been terminated, close Task Manager, and then open it again.
Close Task Manager.
——————————————————————————–
*NOTE: On computers running Windows 98 and ME, Windows Task Manager may not show certain processes. You can use a third party process viewer such as Process Explorer to terminate the malware process.
On computers running all Windows platforms, if the process you are looking for is not in the list displayed by Task Manager or Process Explorer, continue with the next solution procedure, noting additional instructions. If the malware process is in the list displayed by either Task Manager or Process Explorer, but you are unable to terminate it, restart your computer in safe mode.
Addressing Registry Shell Spawning
This procedure prevents the malware from executing whenever a user opens files with certain extension names. It should restore the registry to its original settings.
Click Start>Run.
In the Open input box, type:
command /c copy %WinDir%\regedit.exe regedit.com | regedit.com
Press Enter.
In the left panel, double-click the following:
HKEY_CLASSES_ROOT>exefile>shell>open>command
In the right panel, locate the registry entry:
Default
Check whether its value is the path and file name of the malware file.
If the value is the malware file, right-click Default and select Modify to change its value.
In the value data input box, delete the existing value and type the default value:
“%1″ %*
Close Registry Editor.
Click Start>Run, then type:
command /c del regedit.com
Press Enter.
Editing the Registry
This malware modifies the computer’s registry. Users affected by this malware may need to modify or delete specific registry keys or entries. For detailed information regarding registry editing, please refer to the following articles from Microsoft:
HOW TO: Backup, Edit, and Restore the Registry in Windows 95, Windows 98, and Windows ME
HOW TO: Backup, Edit, and Restore the Registry in Windows NT 4.0
HOW TO: Backup, Edit, and Restore the Registry in Windows 2000
HOW TO: Back Up, Edit, and Restore the Registry in Windows XP and Server 2003
Removing Autostart Entry from the Registry
Removing autostart entries from the registry prevents the malware from executing at startup.
If the registry entry below is not found, the malware may not have executed as of detection. If so, proceed to the succeeding solution set.
Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>
Windows>CurrentVersion>Run
In the right panel, locate and delete the entry:
Soundmix = “%System%\soundmix.exe”
(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, and C:\Windows\System32 on Windows XP and Server 2003.)
Restoring Modified Registry Entry
Still in the Registry Editor, in the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>
CurrentVersion>Explorer>Advanced>Folder>Hidden>SHOWALL
In the right panel, locate the entry:
CheckedValue = “0″
Right-click on the value name and choose Modify. Change the value data of this entry to:
1
Close Registry Editor.
Restoring AUTORUN.INF
Right-click Start then click Search… or Find…, depending on the version of Windows you are running.
In the Named input box, type:
AUTORUN.INF
In the Look In drop-down list, select a drive, then press Enter.
Select the file, then open using Notepad.
Check if the following lines are present in the file:
[autorun]
open=
shell\open=´ò¿ª(&O)
shell\open\Command=RECYCLER\autorun.exe -OpenCurDir
shell\open\Default=1
shell\explore=×ÊÔ´¹ÜÀíÆ÷(&X)
shell\explore\Command=RECYCLER\autorun.exe –ExploreCurDir
If the lines are present, delete the file.
Repeat steps 3 to 6 for AUTORUN.INF files in the remaining removable drives.
Close Search Results.
(Note: The folder not addressed in this section may be used by a legitimate application. Thus, it is best that the said folder is left on the system.)
Important Windows ME/XP Cleaning Instructions
Users running Windows ME and XP must disable System Restore to allow full scanning of infected computers.
Users running other Windows versions can proceed with the succeeding solution set(s).
Running Trend Micro Antivirus
If you are currently running in safe mode, please restart your computer normally before performing the following solution.
Scan your computer with Trend Micro antivirus and delete files detected as WORM_AGENT.PGV. To do this, Trend Micro customers must download the latest virus pattern file and scan their computer. Other Internet users can use HouseCall, the Trend Micro online virus scanner.
Trend Micro offers best-of-breed antivirus and content-security solutions for your corporate network, small and medium business, mobile device or home PC.
sourse: http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM%5FAGENT%2EPGV&VSect=Sn