Clean your system after SemiAntivirus.vbs attack

To get the most out of this post, read the following blog posts first.If you feel you do not understand what the commentators have said, don't worry, I have taken the gist of the comments to write this.

Find out how SemiAntiVirus.vbs has come into your machine and how to delete it

Errors that can be possibly shown after you (or Anti Virus Software) delete SemiAntiVirus.vbs

Read the script of SemiAntiVirus.vbs

and here in this post, I will tell you how to fix the errors

Fixing the Windows Script Host Error which puts up a pop up window at the start up saying "cannot find script file c:windows\system32\semiantivirus.vbs"

Reasons

This happens because the virus is coded to launch with the userinit.exe which manages the start up sequences at the start up.

When the computer boots, userinit.exe is executed and then, it looks for the semiantivirus.vbs to execute. But we (or the anti virus software) have deleted the semiantivirus.vbs in this step.

Since the computer cannot find the semiantivirus.vbs file it displays the above pop up window

So, first, you have to break the link between the userinit.exe and semiantivirus.vbs

Fix

1.Open Registry Editor (Start-->Run-->regedit-->OK)

2. Go to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion and select \Winlogon

3. On the right side pane, you will see a long list of entries. Out of them, right click on userinit and select Modify

4.In the Value Data text box, you will see something like C:\WINDOWS\system32\userinit.exe,c:windows\system32\semiantivirus.vbs

5. Modify the value to C:\WINDOWS\system32\userinit.exe and click ok (then, the userinit registry entry should look like this. Look at the status bar for navigation details)

6. Close the registry editor and restart the computer

--OR--

If you like to do it in the command prompt this is the command reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit /d %%SYSTEMROOT%%\System32\userinit.exe, /f

Fixing the Internet Explorer

Reasons
It looks like this because the virus has edited the registry entries for the Title bar and the Home Page

Fix for the Title Bar
1.Open Registry Editor (Start-->Run-->regedit-->OK)

2.Go to HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer and select main

3. On the right side pane, you will see a long list of entries. Out of them, right click on Window Title and select Modify

4. Under Value Data, you will see LRI Internet Explorer. Change that to Internet Explorer and click ok

--OR--

If you would like to do it in the command prompt, this is the command reg add "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Window Title" /d "" /f


Fix for the Home Page
1. Repeat the 1 and 2 steps of the Fix for the Tiltle Bar

2.On the right side pane, right click on Start Page and select Modify

3. Fill in the Value Data box with the URL of the page that you wish to have as your home page(For example,www.google.lk) and click ok

--OR--

If you would like to do it in the command prompt this is the command reg add "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d "http://www.google.lk/" /f

--OR--

Do it simply in the settings of Internet Explorer
1.Go to Tools-->Internet Options-->General-->Home Page

After completing above steps, the registry entry for Internet Explorer should look like this(look at the status bar for navigation details) All the changes would be visible after you restart Internet Explorer

Completing the above steps should remove the implications of the semiantivirus.vbs attack on your computer.

And thank you Shaakunthala, Sadeepa, Isuru and Abish for your valuable comments in earlier posts!!