vbs script file??

downloaded an mp3 that was actually a "vbs script" file. it changed all my other mp3s into these "vbs script" files and each one is the same size. i am running windows ME. can anyone help me??


thanks.

 

I love you.

 

bigsox - in case Brett didn't make his point clearly enough (or you didn't carefully read all information at that link) -

1. Get an AntiVirus program, use it with full-time protection turned on, and keep your virus def files up to date.

2. The list of folks you passed a copy of the virus along to probably are upset with you. So you might want to send them all a message saying "sorry I tried to infect you" along with a link to information about the virus you passed along.

3. In the case of mp3 files, you are lucky and after you get rid of all traces of the virus, you can unhide them as they are the only file type not damaged by this particular critter.

 

More on those mp3 files, from http://vil.nai.com/vil/content/v_98617.htm

==============copy/paste=========
This virus locates instances of the following file types:

*.MP3
*.MP2

and if found, makes them hidden and copies itself as these filenames except with .VBS extension. For instance, if file exists as "2PAC.MP3 ", this now becomes a hidden file and the virus is copied as "2PAC.MP3.VBS ".
=======end copy/paste==========

This would explain why all your mp3.vbs files are the same size. These are all COPIES of the virus, and have a .vbs extension. The real .mp3 files should still exist, but you will have to go to go into Windows Explorer and "show all files" to see them.

Here is how to UNhide (show all files) from the Symantec article:

===========copy/paste=============
Enable show all files:
Follow these steps to make sure that Windows is set to show all files:

1. Start Windows Explorer.
2. Click the View menu (Windows 95/98/NT) or the Tools menu (Windows Me/2000), and then click Options or Folder options.
3. Click the View tab.
4. Uncheck "Hide file extensions for known file types. "
5. Do one of the following:
o Windows 95/NT. Click "Show all files. "
o Windows 98. In the Advanced settings box, under the "Hidden files" folder, click Show all files.
o Windows Me/2000. Uncheck "Hide protected operating system files" and under the "Hidden files" folder, click "Show hidden files and folders. "
6. Click Apply, and then click OK.
==========end copy/paste=============

Do you have ANY antivirus program installed right now? If so, get the latest virus signature updates and run a full scan before running the VBS.LoveLetter Fix mentioned in Symantec's article (brett's link) but before that:
from http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm

==================copy/paste==================
Windows ME and XP utilize a restore utility that backs up selected files automatically to the C:\_Restore folder. This means that an infected file could be stored there as a backup file, and VirusScan will be unable to delete these files. You must disable the System Restore Utility to remove the infected files from the C:\_Restore folder.

WindowsME

1. Right click the My Computer icon on the Desktop and click on Properties.
2. Click on the Performance tab.
3. Click on the File System button.
4. Click on the Troubleshooting tab.
5. Put a check mark next to 'Disable System Restore'.
6. Click the 'OK' button.
7. You will be prompted to restart the computer. Click Yes.

Note: To re-enable the Restore Utility, follow steps one to seven and on step five remove the check mark next to 'Disable System Restore'.
============end copy/paste==========

For future reference (after your system is cleaned and any damage repaired):
You can still use Symantec's "noscript.exe" to disable the Windows Scripting Host, even if you have an antivirus program other than Symantec's Norton Antivirus installed. This wasn't at all clear in the article at http://www.sarc.com/avcenter/venc/data/win.script.hosting.html (last link in Symantec's article). Noscript.exe is a very simple tool to disable the WSH so that vbs scrpts can't run outside of the browser, where they can do all kinds of mischief. In the rare case that you really want to run a vbs script, WSH can be easily e-enabled just by running noscript.exe again.