Killing Chinese viruses 杀毒
Schools in China, much like their counterparts in other countries, virtually all require that a computer be used for most homework assignment and class projects. Chinese MBA students often study in a very collaborative environment where computers, software, disks, and other digital media are being shared all the time. While flash disks have made the classroom ever more convenient, it also exposes us all to a plethora of computer viruses that can spread across the room almost instantly.
Unfortunately, the common antivirus programs in the US and the rest of the western world fail to catch many of the Chinese-designed viruses. The Chinese solution to this, of course is a Chinese antivirus program but even that fails to catch everything. Just to keep their computers running, MBA students invariably become part-time anti-viral physicians.
A few weeks ago I contracted a nasty little bug. It was causing my processor to run a persistently petulant program called wscript.exe. In fact, this wasn’t really causing my computer any particular operating issues. It was, however, taking up valuable processing power every few seconds. And this was killing my battery life. In fact I didn’t really notice it was a virus and just assumed it was about time to get a new battery (battery life went from about 6 hours per charge to under 3). This particular bug apparently likes to hitch rides on memory sticks when you trade them between computers.
Anyway, one of my classmates found a great solution to this problem. I am most grateful and asked his permission to post his solution here. Hopefully it can help you too. The frustration that comes through in his writing might make you laugh. But, if you live in China and happen to have a computer, you can probably relate to his angst. Suffer no more, here’s one more defensive maneuver against an endless siege of Chinese computer viruses.
I think most of us have get caught by a virus call u.vbe or wsricpt as long as you use your memory stick to print your homework or use other’s memory stick on your computer. Check if your r got caught: press ” crtl+alt+del” at the same time–>process, see if there r a “wscript.exe” or see if there r some u.vbe,autorun.inf and u.bat under your c:\
Although it may not affect your working efficiency while using your computer, u will get uncomfortable when u got caught by a god damn virus.
Anyway, I searched in the searching engine and find 2 methods to clear the god damn virus.
Method 1: download this file (please leave a comment if it works/doesn’t work for you) unzip and double click it, restart your computer. Done.
I tried this method a few days ago, but i find there r still some u.vbe files in my computer. I don’t know if it is because I get caught again.Method 2( a bit more complicated): press ” crtl+alt+del” at the same time–>process–>delete the “wscript.exe”–>clear c:\windows\system32\wscript.exe–>clear all the u.vbe , autorun.inf and u.bat in your computer(c:\ d:\ e:\ ……)–>press “start” on the left bottom–>run–>input”msconfig”–>startup–>clear u.bat–>restart your computer–> Done
I hope it will help you!
October 4th, 2007 at 10:54 pm
I can not get rid of this virus can u help me? Thanx a lot
October 6th, 2007 at 10:09 pm
I sent you a file. Run it and then restart your computer. This should cure your u.vbe woes! Good luck.
October 12th, 2007 at 12:51 am
ABD
Can you post the fix somewhere?
October 12th, 2007 at 11:22 pm
@newuser - I’m trying to figure out a way to make this happen. My server host won’t accept the file format when I try to upload. Looking for a workaround. I can send it via email to you if you’d like.
November 3rd, 2007 at 7:07 am
hi !! i cant remove the virus with a 1st method, please help !!!!
November 4th, 2007 at 11:39 pm
Ok, I can send you the file. I’m not getting much feedback from users as to whether it’s working but you can give it a try. Worked for me. Send me an email at admin [at] screamingsushi.com and I’ll reply with the file.
December 6th, 2007 at 1:33 pm
I am not able to open my hard drive because of this virus. When I use the USB memory stick that originally infected my computer I have the same problem. Now I scan the memory stick before I open it, but the only way to open it is with the autoplay feature. My hard drive doesn’t have autoplay, so what should I do?
December 9th, 2007 at 3:26 am
Hi,
Please can you help me get rid of this worm by providing me with the Method 1 file. I will leave you some feedback on whether it works or fails.
My crappy Norton anitvirus software manged to delete the worm but it leaves me with a problem because now i cannot access my C: drive using explorer. Any help would be great.
Regards
December 10th, 2007 at 3:45 pm
@Hard Drive Problem
Yep, sounds like you’ve contracted the nasty u.vbe virus! I just had the same problem again a few days ago. The patch file I have still works! Guess that means the virus hasn’t mutated yet. I can send it to you. Send a message to admin [at] screamingsushi.com and I’ll forward the fix.
@Ninja-Lips
Sent you the file. Anxious to know how it worked for you.
December 10th, 2007 at 4:26 pm
Finally worked out my file upload issues. A .rar’d version of the virus fix is posted here. Comments are welcome to let us know how it works for you. Get well soon!
January 8th, 2008 at 6:55 am
Thank you MAN
January 11th, 2008 at 2:14 am
I tried your file, but it didn’t help that much. Maybe it’s because I don’t have u.vbe. What I’ve got is u.bat. Whenever I click on a drive a new window opens and AVG antivirus shows a threat is detected named Win32/NSAnti. I’m allowed to move it to the virus vault but I can’t delete it. The infected file is always d5acp.dll.
I tried the second method. But there isn’t any wscript.exe running. I tried searching for u.bat, but there is no such file according to my computer. I can only see the file u.bat when I boot my pc from the CD Rom and use the recovery console. But I can’t delete it in the dos prompt. I tried “del u.bat”, but all I get is the reply “Access Denied”. I don’t know what to do?
One more thing. After I select the option “show hidden files and system files” in the folder options, no hidden files or system files are shown and the selection goes back to “do not show hidden files” in the folder options.
What should I do? Please advise.
January 11th, 2008 at 1:32 pm
I have good news for all the victims of u.bat. There is an anti virus software that can detect and move it. It’s called bit defender. There is a free edition which is valid for a year, which I think is enough. You can get it at www.bitdefender.com I just got rid of u.bat, finally
January 25th, 2008 at 10:34 pm
hi
thanks..i used method1 and all virus got removed..now i can open all drives with double click..
privioulsy i wasn’t able to do that
thank u
February 2nd, 2008 at 8:10 pm
I was trying to remove this virus all night in vain.. , then i found this site… I used method 1 and its working nicely.. Thank u very very much
February 14th, 2008 at 2:39 am
hey jona..
ha ha ha ha…dam thin maw…there a new virus called “VBS.NewLove.A” check it out
…see ya in class
June 13th, 2008 at 2:01 pm
Thank You you saved my day.