VBS.Pleh - help.vbs

tasklist.org		A comprehensive list of processes running in your computer
		tasklist \| attachlist

bookmark this website!		total tasks: 16297

AttachList is a list of email attachment files that viruses usually send in email. It contains the attached file names, typical subjects and messages, the name of the viruses that send them, and instruction on how to remove these viruses.

most requested

Browse attachlist by file name:

| a | b | c | d | e | f | g | h | i | j | k | l | m | n | o | p | q | r | s | t | u | v | w | x | y | z |

Name: VBS.Pleh

Sender:

Varies.

Subject:

I hate you.

Message:

i think that you must see this file ,i insist.

Attachment:

help.vbs

Comments: A worm that sends itself to email addresses in the Microsoft Outlook address book.

Symptoms:


 Copies itself to the WindowsSystem folder as Kernel.vbs and to the
Windows folder as Help.vbs 
 Creates the WindowsLook Here folder. 
 Configures itself to run each time the computer restarts by adding
the line run=C:Windowshelp.vbs to the C:WindowsWin.ini file. 
 It also adds the value help     C:WINDOWShelp.vbs to the registry
key
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunServices 
 Once the worm has been executed, it displays the message Read
Youmustread.txt file:-)

Recommended Cleanup Software: We found that Easy SpyRemover is the most effective tool for removing this file.

Manual Removal Instructions: Click Start, and click Run. The Run dialog box appears.
Type sysedit and then click OK. The System Configuration Editor opens.
In the Autoexec.bat file, look for the following lines and delete them:@cls@Please wait it can take only few minuts@format C:
Click File, and click Save.
Click the C:\Windows\Win.ini title bar.
Locate and delete the linerun=C:\Windows\help.vbs
Click File, and click Save.
Close the System Configuration Editor.
Run LiveUpdate to make sure that you have the most recent virus definitions.
Start Norton AntiVirus (NAV), and run a full system scan, making sure that NAV is set to scanall files.
Delete any files detected as VBS.Pleh.A@mm.