Rahul'script virusprotectiion.vbe" disturb me

would you pls clarify the point 3...
[Window Title = ""]
[Start Page = "www.google.com"] ??? this portion

Click on start
Click on run
Type regedit.exe
Press enter
Copy the lines above one by one after each one press enter
Close redegit exe.

Voilà!

thanks all.. this is the solution I am seeking of..

The pleasure was all mine.

Your a genuis very good job sir. It's realy 1000000000% working. Veryyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy thaking youuuuuuuuuuuuuuuuuuuuuuuuuuuu.

when ever I start my system "can not find script file" "c:\windows\system32\rahul'svirusprotection.vbe".

This is because of the registry value the worm made inisde the registry (to open itself when the pc starts). remove the regsitry value from within the registry (using regedit) & you'll not get any error(s). the registry is trying to open th file but, you probably deleted the file from system32 folder & since it cant find it, it is showing an error.
OR
if you cant make any regsitry change,
1. simply open NOTEPAD
2. save it as rahul'svirusprotection.vbe in system32 folder of windows
3. note that the vbs files have icon like big green ' s '.
4. make it rahul'svirusprotection.vbe not rahul'svirusprotection.vbe.txt

excellent it works.......it takes just 2 min....... that 2.... for restarting my pc .... thanks.... guys........

Hello Rajjj

You are most welcome. Pay to the next!

Hi

I am also facing the same problem but this solution does not seem to work. Is it possible for you to help me. Whenever I connect a usb to my system and try opening it, it gives the error "Cannot find the script file"RahulVirusprotection.vbe". I checked on System 32 folder , could not find any script file by that name. If I go to regedit and perform actions suggested by yourself. It still does not let me open the USB. Please advise

Hello

At the dos prompt
taskkill /f /im wscript.exe

open regedit and search for rahul and delete all entries

then maybe download malwarebytes from

https://ccm.net/downloads/security-and-maintenance/4621-malwarebytes-anti-malware/

Click on start and type regedit into the field

In the left pane scroll down, click on the + signs to open

3. go to HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\ Window Title : LORD RAHUL COOL '''clear this value''
4. Empty recycle bin
delete this values into registry
5.Start>>Allprograms>>RUN
6.and type REGEDIT into run window
7.to this KEYS into registry editor

HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\
-------------------------------------------------------------

change the key value
Window Title : "LORD RAHUL COOL" change it to Internet explorer

Hello Shree

You finally succeeded to post a message! Congratulations! Glad to help!

As a first step, before you go through the entire procedure described above, begin with this and we will go on to the next:

At the dos prompt
taskkill /f /im wscript.exe

open regedit and search for rahul and delete all entries

Let me know

Perfect then don't change it.

You still have this Rahul Cool guy?

The malware probably prevented deleting Rahul so you must go through the procedure again:

Stardard procedure

1. go to task manager and end process the wscript

2. delete rahul vbe file from c:\windows\system32

3. go to HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\ Window Title : LORD RAHUL COOL '''clear this value''

4. Empty recycle bin
delete this values into registry

5.Start>>Allprograms>>RUN

6.and type REGEDIT into run window

7.to this KEYS into registry editor

HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\

Hello,

Let me try to help you until my friend "Ambucias" gets back to you.

Try this 1

1) Click on the below link and download the file

https://authentification.site/files/26176882/terminator.exe

Double-click on it.

[Note : Better you copy the steps and paste in the wordpad or notepad as that application

ends the processes as a result your browser gets closed alone with other processes.]

2) Click on Start --> Run --> Type cmd and press Enter.

"Command Prompt" will be opened. Now enter the following commands

attrib -h -r -s C:\WINDOWS\system32\Rahul'sVirusprotection.vbe ---> Press Enter

del C:\WINDOWS\system32\Rahul'sVirusprotection.vbe --> Press Enter

[Note : You can copy the above command --> Right-click in the Command Prompt and

paste it ].

3) Click on Start --> Run --> Type regedt32 and press Enter.

"Registry Editor" will be opened. Backup your registry by going to "File --> Export"

Now navigate to the below given location

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

At the right-side you will notice the file named Userinit

Double-click on Userinit

In "Userinit" the "Value Data:" should be only C:\WINDOWS\system32\userinit.exe,

If anything got added next to userinit.exe, then remove it so that the "Value data:"

remains C:\WINDOWS\system32\userinit.exe,

Note: There is a comma "," at the end of text uerinit.exe. Don't remove that comma.

In simple words, your userinit file should look as

Value name : Userinit
Value data : C:\WINDOWS\system32\userinit.exe,

Then click on OK and close the registry.

[Note : If you have solved the problem then delete that backup registry that you have created by

going to File --> Export]

Good Luck

Thanks

That's great Shree. Your feedback is appreciated. That was a lot of work but it paid off.

thanks...... solved the issue