Help: tune.vbs

This is a variant of the original VBS trojan.

To manually remove this virus, perform the following steps:

• Close your mIRC client.
• Using the Find feature in Windows, find and delete the following files:
  • script.ini
  • tune.vbs
  • kernel.vbs
  • winsck.vbs
  • explorer.vbs
• Remove these registry keys:
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Sent?
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ScanRegistry
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Run\(Default value)
  • HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\(Default value)
• Start SYSEDIT from Start, Run
• Edit win.ini and REMOVE anything that refers to a .vbs file.
• Repeat the above step for system.ini
• Close SYSEDIT and save changes.

No file fix is available for this virus.