cool.vbs in my usb drive and my start up folder

Viruses and worms
1

every usb drive i connect, all the folders become hidden and theres this cool.vbs in it which is probably causing it. After searching i found the same cool.vbs in appdata\roaming and appdata\roaming\microsoft\windows\start menu.
help please

2

start with MCShield instructions and attach log.
http://forum.avast.com/index.php?topic=53253.msg998925#msg998925

3

then continue with this

follow instructions and attach logs (not copy and paste) http://forum.avast.com/index.php?topic=53253.0

run in order listed
AdwCleaner / Malwarebytes / OTL

when done, removal experts will be notified and help you
when finish, all tools used will be removed

4

reports attatched.

5

removal experts are notified, it may take some hours before one arrive so be patient…

6

rerun AdwCleaner and this time click clean
rerun Malwarebytes …make sure evrything detected is marked for removal and click…remove selected

7

Hi,

Re-run OTL.exe.

[*]Copy and paste the following text written inside of the quote box into the Custom Scans/Fixes box.



:OTL
IE - HKU\S-1-5-21-2525547328-2840125149-3846810408-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www1.delta-search.com/?babsrc=HP_ss&mntrId=BC7694DE8007091B&affID=123884&tt=110813_YTB&tsp=4973
IE - HKU\S-1-5-21-2525547328-2840125149-3846810408-1001\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://www1.delta-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=BC7694DE8007091B&affID=123884&tt=110813_YTB&tsp=4973
O2:[b]64bit:[/b] - BHO: (no name) - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - No CLSID value found.
O4 - HKU\S-1-5-21-2525547328-2840125149-3846810408-1001..\Run: [COOL] wscript.exe //B "C:\Users\Tamzeed\AppData\Roaming\COOL.vbs" File not found
O4 - HKU\S-1-5-21-2525547328-2840125149-3846810408-1001..\Run: [tsiVideo] C:\Windows\SysWOW64\rundll32.exe C:\Users\Tamzeed\AppData\Local\Temp\\tsiVi032.dll,start File not found
O4 - Startup: C:\Users\Tamzeed\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\COOL.vbs ()

:files
C:\Users\Tamzeed\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\COOL.vbs
C:\Users\Tamzeed\AppData\Roaming\COOL.vbs

:commands
[CREATERESTOREPOINT]
[resethosts]
[emptytemp]

[*]Then click the Run Fix button at the top.
[*]Let the program run unhindered; it will reboot the system when it is done and open notepad with logreport. Attach here that logreport.

If the log doesn’t appear, it can be found here:

c:_OTL\MovedFiles\mmddyyyy_hhmmss.log
.

Please download Farbar Recovery Scan Tool (
http://www.mcshield.net/personal/magna86/Images/FRST_canned.png
) by Farbar and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.

[*]Double-click to run it. When the tool opens click Yes to disclaimer.
[*]Under Optional Scan ensure “Driver MD5” are ticked.
[*]Press Scan button.
[*]It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
[*]The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

8

this is one of the files found by MCShield
https://www.virustotal.com/en/file/125be26b664a203918d98b3fe0c518d4946b880d3b96ccdcdaab9bdbe936ab57/analysis/

the others has not been scanned at VT

9

reports attatched

10

OK, connect the flash drive and attach the MCShield last scan.txt

11

done. No cool.vbs thanks. thought i’d have 2 reinstall win8 again. thank u kindly

12

Please download DelFix by “Xplode” to your Desktop.

Run the tool and check the following boxes below;

[] Remove disinfection tools
[] Create registry backup
[*] Purge System Restore

Now click on “Run” button. Wait for the programme completes his work.
All the tools we used should be gone.
Tool will create and open an log report (DelFix.txt)
Note: The report will also be stored on C:\DelFix.txt

I don’t need DelFix log report.

I recommended to you to keep MCShield.
It will prevent infection by computer via USB flash drive, mobile phone or any other memory card.
And not only will prevent infection, but will immediately clean Memory card or external HDD.

Greeting.

btw.

You can set it as the image


http://fotkica.com/thumbs3/1_tmb_125852336_2013-11-13_214429.jpg