How to remove SemiAntiVirus.vbs

on Saturday, November 27, 2010

SemiAntiVirus.vbs is a Visual Basic Script and is a virus.  It exploits the capability of Visual Basic Scripts to access file system and Windows Registry.  When I ran a scan on, the file was displayed as having a virus named!IK.  
The Script alters the system registry and changes the title of Internet Explorer to LRI Internet Explorer.  Let us see how we remove the virus.

1.   Download and install LockHunter.

remove semiantivirus.vbs2.   After having installed LockHunter, search for SemiAntiVirus.vbs.  It probably will be in the System32 directory.  Right click it and click on "What is locking this file?" option.  

3.   You will find that the wscript.exe is the process which is locking the file.  Delete the SemiAntivirus.vbs with the program.  If you are unable to do it, first click "Unlock It" button and then delete the vbs file.  wscript.exe is a genuine Windows process and hence do not delete it.

4.   Once you have deleted SemiAntiVirus.vbs, you need to edit system registry too.  Browse to the following location:-
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit

remove semiantivirus.vbs
    Change the value to "C:\Windows\System32\userinit.exe"

5.   To change the title of Internet Explorer, go to the following registry entry:
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Window Title

Change it to any string you like.
6.   Restart your computer.  

Random Links :  Hack Folder Lock Password                                                    
                          How to remove SICHOST.exe
                          How to get rid of _.ex-08.exe Trojan
                          How to Delete an "Undeletable" File
                          Delete any files and folders

Subscribe via RSS