MUGEN.vbs Virus Removal From System Or Flash Drive

This article is to show you how to clean an infected data drive, full of shortcuts and delete mugen.vbs from the system manually. Without having to use any program or application.
The MUGEN.vbs virus is a malware that mostly goes from one system to other by removable USB devices.
The only damage it does so far is to hide the existing folders on a device and create shortcuts that have the unique function of starting the virus and copying it inside the computer.
A contaminated USB data memory is not accessible from files inside folders.
Many users see it as the only solution to clean their devices, formatting them. It leads to losing all information, which is unnecessary, in case the virus is already inside the computer.

mugen.vbs

What is the MUGEN.vbs virus?

The MUGEN.vbs virus is said to have been created by fans. It began to go from system to system by intentionally send inside a popular free game. It is just a variation of other previous malware.
The MUGEN.vbs virus is quite simple to manually remove from a PC or Laptop, even without having to use any program or application for it.
We can also clean any memory or another device, Even without any programming or computer knowledge.
The purpose of this article is to show how to do both tasks, without having to download or install any program for it.
The MUGEN virus, like other scripts, can not harm our computer unless we give double clicks on a shortcut or the virus file.
The malware does not delete any existing files and only affects and modifies the folders or directories on the USB storage units.
Folders that seemingly disappear, remain intact on the device, only they are hidden.
USB should never be formatted if it contains personal files that we need to recover.

How to know if a USB stick has the MUGEN virus?

The first step is to know if our memory drive is infected.
while using any USB memory or another portable device into a computer with the MUGEN virus, a file named “mugen.vbs” will be created. It will not be visible normally because it has the attributes of “hidden” and “system file”.
Several shortcuts are also created with the name of the folders in that directory and the original folders are hidden.

It is important to know that the shortcuts do not open the folders it indicates, they only execute the virus file, which can be verified by placing the mouse cursor over any of them, it will look something like the following:
C: \ Windows \ system32 \ cmd.exe / c start mugen.vbs & start explorer FileHistory & exit
That is what they do is run the virus file.
As it follows if we do not double clicks on any of the shortcuts, the virus will NOT be able to harm our computer.

What to do in case of an infection?

  1. If a memory is infected but the virus has not entered the PC, it will suffice to format it to eliminate all the dangerous files.
  2. In case the memory contains valuable files, we must first remove the .exe file of the virus, the created shortcuts and then recover the affected files.
  3. In case the virus has entered the computer, then we must, first of all, eliminate it and clean the PC and only after cleaning the infected memory.

How to remove MUGEN.vbs virus from the computer?

Follow these steps to remove MUGEN.vbs from a computer:

1- Stops the process called: “wscript.exe” (Windows Script Host).

To do this begin the Windows Task Manager > Processes tab >”wscript.exe”, right-click with the mouse and choose: “End process”.

mugen.vbs
WScript

 

***In Windows 8 it appears by another name: “Microsoft @ Windows Script”***

 

 

 

 

2- Delete the virus file

The file that starts the virus process every time with Windows is: “mugen.vbs”. It will be in the following folder:
C: \ Users \ UserName \ AppData \ Roaming \
To view the folder AppData it is necessary to activate the Folder Options tool the option “Show files, folders, and hidden units”.
Another way to open this folder is to enter the % appdata% variable in the Start box (Windows7), the Run tool (Windows + R) or the Windows 8 start screen.
• Finally, click on the file ” Mugen.vbs “and delete it.

A warning window with the following message comes up:
“The mugen.vbs file is a system file. If you remove it from Windows or another program it might stop working correctly”.
• Press the “Yes” button
• Empty the recycle bin if necessary.

3- Delete the registry entry

Although it is not essential you can clean the entry run by the virus to start with the system.

  • In Windows 7 type in the Start box or Run MSCONFIG and press the Enter key.
    Open the “Windows Start” tab and uncheck the entry called: Microsoft @ Windows Script.
    Save the changes.
  • In Windows 8, open Task Manager, open the Start tab and disable the same entry mentioned above.
    Another option is to directly access the Windows registry key using REGEDIT and delete it.
    The key is as follows:
    HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Run

How to clean a USB memory and recover files?

After removing the virus mugen from the computer, the next step is to clean our USB memory and very necessary to improve our existing information.
If there is no value in it, it may be easier to format it only.
If you have files on your equipment that you need to recover, then follow these steps:

  1. On the View tab of the Folder Options tool, which you can find in Control Panel, uncheck the box: “Hide Protected Operating System Files”.
  2. Open the USB memory in the browser and delete all the existing shortcuts and virus file called: “mugen.vbs”
  3. Right-click on one of the folders that are somewhat translucent and in the Properties window Uncheck the box: “Read Only” if it exists.
  4. Shift-click the right mouse button inside the device folder and choose: “Open command window here.”
  5. In the black window of the command console type the following:
    ATTRIB -S -H
  6. Hit the space bar once to make space.
  7. Drag any of the folders to retrieve, drop them above the console window and push the Enter key.

mugen.vbs

 

Add a Comment

Your email address will not be published. Required fields are marked *