VBS.Runauto.E
VBS.Runauto.E propagates by duplicating itself to all drives on the infected computer except floppy drive. VBS.Runauto.E will create an autorun.inf file on each drive to execute itself when the drive is accessed. This worm will modify compromised system’s Internet Explorer title to Hacked by Achitasin & ???? ???.
Damage Level: Medium
Systems Affected: Windows 9x, 2000, XP, Windows Vista
Technical Details and Additional Information:
Malicious Files Added by VBS.Runauto.E
%Windir%\achitasin.dll.vbs
%SystemDrive%\achi.htm
%DriveLetter%\achitasin.dll.vbs
%DriveLetter%\autorun.inf
Associated Windows Registry Entries:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Current Version\Run\”achitasin” = “%Windir%\achitasin.dll.vbs”
VBS.Runauto.E – Removal
Removing VBS.Runauto.E Manually:
1. If using Windows ME or XP, System Restore must be disabled to prevent the threat from restoring itself. [Windows XP System Restore]
2. Update the virus definitions.
3. Reboot Windows in SafeMode [how to]
4. Run a full system scan and clean/delete all infected file(s)
5. Delete/Modify any values added to the registry. [how to edit registry]
6. Exit registry editor and restart Windows.
Anti-virus Tools
Scan with Norton Power Eraser:
Norton Power Eraser is a virus removal tool created by Norton Antivirus to remove unfamiliar threats without using the traditional AV signatures. Download the tool and start scanning with Norton Power Eraser.
Online Virus Scanner:
Online virus scanner can provide scan and clean functions just like any anti-virus software without the need to install additional AV product. Perform a thorough scan with free Online Virus Scanner that can be found on websites of legitimate security software provider.