Well Guys…n gals…
I have been really happy since my last post that finally I got rid of the virus from my friends computer (Yeh…. Luckily my PC is not yet infected! 
). But then last week, one of my friend, Sachin, told me that hs is facing same problem again… but this time the drive is exploring instead of asking ‘Open with…’ Option… So I said… lets see whats there….
Hm…. new virus?…well has to be… I had tried to remove previous one even when knowing that its not there!.. so I started looking for some unusual stuff… n here is what I got…
Each drive had following two hidden files in their root directory..
- autorun.inf (the usual one)
- .MS32DLL.DLL.vbs (or u may say .MS32DLL.DLL if extensions are hidden)
beside there are few unwanted entries in the startup list :
- MS32DLL
- Winboot
And following process running (shown in the task manager)
- wscript.exe
So again we start with manual Method.. Well this time its purely mine!
- As usual, Turn off the ‘System Restore’ Option
- Boot your system in Safe Mode
- open task manager (Ctrl+Alt+Del)
- Find the process called ‘wscript.exe‘ from ‘Processes‘ tab
- Right Click on it and select ‘End Process Tree‘ from the popup menu.
- Now search following hidden files and delete them with ‘Shift+Del‘.
- [drive]:\.MS32DLL.DLL or .MS32DLL.DLL.vbs
- [drive]:\autorun.inf
- Well there is two more file remaining… ‘%windir%\boot.ini‘ and ‘%windir%\.MS32DLL.DLL.vbs‘ where %windir% is the Windows folder, generally its ‘C:\windows\boot.ini‘
- We need to delete this file also!
- Whats next?…. open run box and type ‘regedit‘ and click ok… a window titled ‘Registry Editor‘ will open…
- Go to Edit> Find… and type in .MS32DLL.DLL
- delete all the entries containing this name
- Goto HKEY_LOCAL_MACHINE>SOFTWARE>Mircrosoft>Windows>CurrentVersion>Run and delete Entry saying ‘winboot‘
- All Done!
Where[drive] is the drive letter..e.g. C, D, etc..
Now Just restart the computer and Check if its really workin!
There is a major problem in this method. I dont know exact reason but I think due to this virus, the ‘View All’ Option in Folder Options Stop Working!
So we start wid The Simpler one : The One Click Option!
Just Download following file and double click it!
http://www.samsden.org/storehouse/techlog/Remove_MS32DLL.vbs
nJoY! KeeP SMiLiNG!!!
