HEUR:Worm.Script.Generic, What Is It and How to Remove?

What HEUR:Worm.Script.Generic Does?

1. Disables Automatic update by overwriting relevant drivers.
   HEUR:Worm.Script.Generic can affect any connected device and generate autorun.inf for automatic affection and propagation.
2. The worm would affect system running processes to confuse installed security utilities and escape automatic removal.
3. HEUR:Worm.Script.Generic connects designated web sites to download additional malicious items and generates Root.exe in scripts folder under “web” category (utilized to execute commands remotely), which would finally result in unauthorized access and direct control.
4. The worm utilizes shortcut vulnerability to automatically run virulent items whose extension can be .lnk and.dll.
5. DNS setting will be manipulated because of VBScript technology, leading to browser hijacking(e.g. isearch.babylon.com)or redirecting problem.
6. The worm could cause financial loss by taking advantage of JavaScript technology to steal log-in credentials and identity information.

What Is HEUR:Worm.Script.Generic?

HEUR:Worm.Script.Generic is a network worm that takes advantage of vulnerability in Microsoft IIS server and that in DBS (Data Base System). Thus it won’t attack individuals directly as individuals won’t build IIS server or DBS. However, many people start to report that HEUR:Worm.Script.Generic affection becomes crazy. This should mainly blame to online carelessness. Any click on a website embedded with its vicious code would result in automatic download which is completed by Java, ActiveX and VBScript technologies. All in all, HEUR:Worm.Script.Generic is a worm that would use the technologies to collect log-in credentials as well as online whereabouts to give rise to identity theft and money loss.

Since HEUR:Worm.Script.Generic is capable of disabling build-in security service, manual removal way is recommended to be put in use. Below is the instruction to follow up. Be noted that certain level of computer knowledge as well as skills are necessary to dig out random item generated by HEUR:Worm.Script.Generic and remove incidental items so that the possibility of having HEUR:Worm.Script.Generic back can be zero. Should you encounter difficulty and you don’t know how to do, please do feel free to get expert help by contacting Global PC Support Center. 

Manual Way to Remove HEUR:Worm.Script.Generic

1.    start off by accessing Safe Mode

Windows 7/Vista/XP

• Restart system.
• As the computer is booting but before Windows launches, tap the "F8 key" continuously which should bring up the "Windows Advanced Options Menu".
• Use your arrow keys to highlight ‘Safe Mode with Networking’ option and press Enter key.

Windows 8

• Hold the Shift button and keep tapping on the F8 key.
• Choose ‘See advanced repair options’.
• Select ‘Troubleshoot’ option.
• Click on ‘Advanced Options’.
• Select ‘Windows Startup Settings’.
• Hit ‘Restart’ on the lower right hand corner of the desktop.

2.    go to Database and remove everything related to HEUR:Worm.Script.Generic.

• Navigate to the following entries respectively to find suspicious key value started with “Run” and delete accordingly.    

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Current Version
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Startup=”C:\windows\start menu\programs\startup

• Click on “My Computer”/”Computer” on the upper left before using Ctrl+F key combination to bring up search bar.
• Type “HEUR:Worm.Script.Generic” in the search bar and hit Enter key.
• Remove all the entry keys of the found items.
• Keep using F3 functional key to keep looking for the remnants of HEUR:Worm.Script.Generic in Registry Editor.

3.    unveil all hidden items to remove the ones generated by HEUR:Worm.Script.Generic.

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\XAH0SPUQ\js[1].js
%WINDIR%\SYSTEM32\[random numbers and letters].dll
%TEMP%\[messy code]temp_0\[random letters]setup.exe
C:\WINDOWS\iexplore.com
D:\autorun.inf 

Anti-virus programs are always necessary to be mounted on a machine since they offer the basic protection to ward off average infections. While they can be disabled when aggressive infections is penetrating with high secluded performance. Do not ever belittle HEUR:Worm.Script.Generic as few people know about it. What it causes can be much more troublesome than what a generic Trojan horse causes. The above given instruction is supposed to be helpful after multiple tests. Failure can emerge only when incomplete removal has been done or other infections have wormed into target machine through backdoor/vulnerability caused by HEUR:Worm.Script.Generic. If you need specialized technical help, please feel free to live chat with senior technicians for quick fix. 

Reference: Remove HEUR:Worm.Script.Generic – VilmaTech Official Blog