How To Remove Boot.vbs Virus

Posted on 23rd May 2008 by Sanix

13

If you're new here, you may want to subscribe to my RSS feed. Thanks for visiting!

Today my antivirus (NOD32 Security Suite) was creating troubles for me. After every five minutes, a request to debug the application would appear because the some module of NOD32 would crash and then reload. It has been a long time that I have been using NOD32. So I decided to test some other antivirus. There were two good choices for me. One Bitdefender and then second Kaspersky. The problem was that I didn’t want to buy any one of those. So I decided to use a 6 months trial of Kaspersky Internet Security which will be more than enough for me to test it. Here is my previous article about how to get Kaspersky Internet Secutiry trial of 6 months.

I downloaded it and installed it. It began scanning my PC. And to my amazement, it detected a threat that NOD32 was unaware of!! It was the boot.vbs virus. I thought it would be better to remove the virus manually rather than relying on Kaspersky. That way I would learn more. So here are the steps which I did to remove the boot.vbs virus:

1. Go to Task Manager –> Processes and End the following processes in order:
   1. dxdlg.exe
   2. wscript.exe
2. Go to Start –> Run –> regedit –> Open the following key:
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
3. In the right hand pane, select Userinit and delete everything except “C:\windows\system32\userinit.exe”
4. 
5. Make sure the processes wscript.exe and dxdlg.exe are not running.
6. Delete the following files
   1. C:\Windows\System32\dxdlg.exe
   2. C:\Windows\System32\boot.vbs
   3. In your Windows drive, search for boot.vbs and delete all of them.
   4. In your Windows drive, search for kinza.exe and delete all of them.
7. Disable System Restore and then Enable it again.
8. Restart your computer.

Hopefully everything will be cleaner now and your computer will be free from boot.vbs virus :-). Please share your experiences.

Popularity: 43% [?]

More Interesting Articles

• Bit Defender Antivirus 2008 and Kaspersky Internet Security 6 Months Trials (7)
• How To Remove infostealer pws-yahmali Virus (3)
• My Documents Folder Opens At Windows Startup (1)
• XP-Antivirus Information and Removal (4)
• Bitdefender Renames Suspected Files To .bd.ren (22)

   

Leave a reply...

Name (required)
Mail (will not be published) (required)
Website

Notify me of followup comments via e-mail