Remediate VBS malware
I have developed a small tool that will aid you to remove VBS malware (and unhide your files) from a machine, external drive (USB eg.) or in a network. I created the tool some months ago when I saw quite a lot of these doing the rounds.
The tool is simple and pretty much self-explanatory:
 |
| Remediate VBS Worm 8.0.0 |
Instructions on using Rem-VBSworm
You should run the script in the following sequence, at least on a normal machine:
Plug in your infected USB (if any) and choose A (wait), then B (wait) and afterwards C.
After these steps, perform a full scan with your installed antivirus product or perform an online scan.
Instructions in other languages are also available, namely Dutch, French, German and Polish:
Security Tool Spotlight: Rem-VBSworm (Deutsch)
Remediate VBS Worm (fran�ais)
VBS malware verwijderen (Nederlands)
Infekcje z medi�w przeno?nych (Polski)
Some tips and tricks:
- Using option A, the tool will attempt to clean the infection. It will also fix any registry changes made by the malware. (for example it will re-enable Task Manager should it be disabled).
- ! When you use option B, be sure to type only the letter of your USB drive!
So if you have a USB drive named G:, you should only type G
This option will eradicate any related malware on the USB drive, as well as unhide your files (make them visible again). - With option C you can download Panda USB Vaccine to prevent any other autorun malware entering your computer.
- With option D you have the possibility to disable or re-enable the Windows Script Host (WSH), to prevent any malware abusing it.
- I advise to end the script with Q as to ensure proper logfile closing. A logfile will open automatically, but is also created by default on the C: drive. (C:Rem-VBS.log)
- When the tool is running, do not use the machine for anything else.
(it takes about 30 seconds to run) - If VBS malware is found, it will be automatically removed and a copy will be placed at C:Rem-VBSqt.
- Accidentally used an option and want to exit the script? Use CTRL + C to stop it.
You can use this to remedy the following malware:
- Bladabindi?
- Excedow
- Jenxcus
- Houdini/Dinihu
- Autorun worms
- Any other VBS (VBScript) or VBE malware
- Any other malware that abuses the WSH (Windows Script Host)
Download
Download on BleepingComputer:
File integrity check:
MD5: 4c37021f17e02fb9fdb7db3287906bd5
SHA1: 7fef4a43f70262710127051778e0a50ec7a94e64
Mirror:
Rem-VBSworm (ZIP file)
Changelog:
07/06/2016 - version 8.0.0:
FIXED: issue when executing from drive other than system drive (option A)
IMPROVED: detection of malicious scheduled tasks (option A)
IMPROVED: detection of certain autorun/VBS worms
11/03/2016 - version 7.0.0:
ADDED: detection of malicious scheduled tasks (option A)
ADDED: malware detected on USB now copied to quarantine (option B)
ADDED: usage information on top of the tool
FIXED: issue launching download of Panda USB Vaccine (option C)
IMPROVED: autorun.inf vaccination on NTFS formatted drives (option B)
IMPROVED: error handling
IMPROVED: log output (should be final now)
23/12/2015 - version 6.0.0:
ADDED: logging of USB device ID
CHANGED: Panda USB vaccine download (now on BleepingComputer)
IMPROVED: log output is now completely streamlined and cleaned
IMPROVED: disabling of WSH on Windows XP (option D)
IMPROVED: scanning time (option A)
IMPROVED: detection of certain autorun/VBS worms
21/10/2015 - version 5.0.0:
ADDED: logging of installed antivirus
ADDED: detection of malicious shortcut links in startup folders
ADDED: malicious VBS files now automatically copied to quarantine for research purposes (on C:Rem-VBSqt)
IMPROVED: handling of files, resulting in a false positive rate of almost zero
IMPROVED: detection of certain malware variants using autorun to spread or hide files
(Fanny worm, Andromeda/Gamarue malware)
IMPROVED: minor code cleanup, minor log output cleanup - greater visibility
21/04/2015 - version 4.0.0.:
ADDED: removal of AutoIT autorun worms
ADDED: version number (in main window and log)
ADDED: option D will now allow you to disable or re-enable the WSH
FIXED: false negative
IMPROVED: option B will now detect if you try to execute on system drive
IMPROVED: log output is cleaned and more streamlined
03/03/2015 - versio 3.0.0.:
ADDED: more information about attached drives & system
ADDED: root contents of removable drive will now be listed
FIXED: false positive
IMPROVED: general improvements
23/04/2014 - version 2.0.0:
First public version
ADDED: detections & disinfections will now be logged
ADDED: all attached drives are now listed
FIXED: False positive on unrelated files
FIXED: Issue with Read-Only files
IMPROVED: Registry fixes
IMPROVED: Scanning time
IMPROVED: Disinfection mechanism for USB-drives
10/12/2013 - version 1.0.0:
Private use only
CREATION
Conclusion
In regards to autorun worms, you should follow these precautions:
- Install all your Windows Updates.
- Disable autorun. This should already be done by Windows Update, but if not you can use:
- Panda USB Vaccine, download from CNET
- Follow the steps in this Microsoft article (also for companies)
- Dont simply insert a USB-drive in your machine without knowing who it is from. Found a USB-drive at your parking lot? Yeah, dont even think about it. You might want to read:
Criminals push malware by losing USB sticks in parking lots - You can install and run Script Defender along your antivirus/antimalware product:
Script Defender by AnalogX
This will effectively block the execution of malicious scripts like VBS, VBE, HTA, ... - If you arent planning on ever using VBscripts at all, or you are not working on a company laptop (which may use scripts!), you can also simply disable the Windows Script Host. You can use option D in my tool.
- For companies, take a look at this as well:
Command line process auditing - Last but not least, install an Antivirus and update it regularly.
download file now