How to remove 3.vbe

Removal instructions for 3.vbe

Related tutorials with screenshots:

How to Remove a VBS Worm
Ultimate Guide in Removing VBS Worms 
How to block or prevent malware from running 
How to terminate a process

 

Analysis:

Type of file: VBEFile
Description:
Location: C:\Documents and Settings\Administrator\Local Settings\Temp\
Size: 70650 b
MD5: FDAD2912CB7A669D34A4CBCB0F7895F1

Known system changes:

Files added:
C:\Documents and Settings\Administrator\Local Settings\Temp\3.vbe
C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\3.vbe
F:\3.vbe
F:\Document.lnk
F:\Photos.lnk

Files [attributes?] modified:
F:\Document.lnk

Manual Removal Instructions for 3.vbe:

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

Make sure you create a System Restore point before proceeding:

1.  Use Task Manager to terminate the malicious process wscript.exe.

2.  Delete the 3.vbe (random filename) from these locations.

    %Temp%
    Startup folder 
    Root directory of USB drives

    Tutorial:  How to delete startup entries

3.  Delete all *.lnk located at the root directory of your external drives.  Replace DRIVE with the correct drive letter of your external drives.

    DEL DRIVE:\*.LNK

4.  Unhide all hidden files and folders using this commands:  Replace DRIVE with the correct drive letter of your external drives.  Do steps 3 and 4 to all your infected USB drives.

    ATTRIB DRIVE:\*.* -S -H /S /D

5.  Update your antivirus/antimalware program and perform a full scan of the computer.

NOTE:  This sample does not create startup registry keys.


All my tutorials are based on my own research.  If you find this tutorial useful, please comment or share.  You can also help fund my continued work by making a donation.  Thank you and GOD bless!

To GOD be the glory!

All content ("Information") contained in this report is the copyrighted work of WinXPert: Virus and Malware Removal.

The Information is provided on an "as is" basis. WinXPert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, WinXPert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.

Copyright © 2014-2015 WinXPert. All rights reserved. All other trademarks are the sole property of their respective owners.