killVBS.vbs-help is needed

By cosmo
Aug 17, 2007
  1. Hi,

    My father bought in Thailand a new Creative mp3 player. When i attached it with the usb to my laptop to recharge it my avg av found a trojan killVBS.vbs.

    When i tried to look what files in the mp3 player i found an "Autorun.inf" file with this script "[autorun] shellexecute=wscript.exe killVBS.vbs". should i delete this file?

    I found another 2 folders:1) "ms.config" which is empty 2) "$lddata$" with some files which have .ldf extention. are those part of the mp3 or i should delete them?

    after that i was looking in here and found the 15-step solution to get rid of malware and Co. i was going through all the steps except the 3rd tool and the online scan of trend micro.

    i attached what you guys ask to. is everything o.k? was it enough that the av found the trojan? please let me know if can use my laptop with no worries.


    oh, and I forgot to tell that the rootkit found nothing.

    Attached Files:

  2. raybay

    raybay TS Evangelist Posts: 7,241   +9

    Is it running ok now? Is the About:blank startup screen intentional?
  3. cosmo

    cosmo TS Rookie Topic Starter


    Thanks for responding.

    My laptop is running and all is good. i just wanna know whether there is a Trojan in my laptop according to the file i attached and i should do something or there isn't.
    Another thing is should i delete the autorun file? can it run again on another PC?

  4. raybay

    raybay TS Evangelist Posts: 7,241   +9

    I don't see evidence of it, but I am not the real expert on Malware on this forum.
    It looks clean. I would run free scans from,, EZTrust EZArmor at They won't remove it, but they will detect it if there, and these free versions are good for finding killVBS.vbs and residuals.
    Then you can rest easy. Just don't go where you went to get it.
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...