BleepingComputer.com: Suspicious folder on Ext. Hard Drive

Okay, about 2 days ago, I was looking through google images and one of them lead to a damn virus. It was one of those viruses where the entire wbesite turns into a fake virus-scanner and bombards you with pop-ups telling you to download it.

I immediately ctrl-alt-deleted out of the website, and I run a full system scan on both Malware Bytes and Avira. Neither found anything, however, on my external hard drive, there's a mysterious folder named "6506a12a9cce3614cb46802cf625" that I've never seen before, and I didn't put it there. And it's full of bad things like 'setup', 'eula', and other unpleasantness. I'm almost certain this has something to do with the virus, because every couple of minutes, Avira pops up from the task bar saying "Autorun: Blocked", and there's a file in that folder called autorun. I'm almost positive it's associated with what happened a few days ago.

Anyway, now to the actual problem. I tried to delete the folder and it said it was read-only. So I went to properties and tried to uncheck that, and it keeps telling me that access is denied, and it won't let me un-read-only any of the folders inside of it. Therefore, I can't delete it, or any of the folders inside of it. I did manage to delete the single files that weren't in any of the numerous folders, but I fear that won't stop it. I even run rkill, but it didn't close anything related to this folder. Most of the folders contain things that look identical to a fake anti-virus scam thing. There's a bunch of little icons and pictures and stuff.

The external hard drive is a seagate. Thanks for reading and I really hope you can help.

Edit: I just noticed this should of went into the "External Hardware" section of the forum. Sorry

This post has been edited by Sursion: 11 May 2011 - 01:32 PM

Hello and welcome to the forum!

Is formatting the drive an option for you or do you have things on the drive you need to keep?

There's stuff on there I need to keep. I never thought viruses would completely bypass my internal drive and go onto my external. That's never happened with any of the other viruses I've gotten since I bought it.

What is the path for this folder, please?

FWIW: Setup and EULA are typical files for installig any number of programs, as well as Windows. I believe that such may also refer to restore/recovery mechanisms, but i cannot be sure since i have no systems with such. The folder could possibly be related to some temporary folder established or one created by backup software. Autorun is also a typical file found for installing from optical drive media.

I would enable all file extensions...go to details view...then post the file contents of this folder.

Louis

The drive is H:

Inside the "6506a12a9cce3614cb46802cf625" folder, there are about 25 folders, each named 1025, 1028, etc. all the way to 3082. Then there's one folder called 'graphics' with a bunch of pictures (which look a lot like the fake anti-virus program).

In each of the numbered folders, there is:
1 eula.rtf
1 Localized Data.xml
1 Setup Resources.dll


In the 6506a12a9cce3614cb46802cf625 folder itself, seperate from all the other folders, there was autorun, setup, and a bunch of other .dll's. I can't remember what exactly, because I already deleted them. It's only the folders and contents within them that say "access denied."

Edit: I should also mention that the .dll description is in a different language in every folder. I've found spanish, german, and arabic, dutch, etc.

Edit again: I enabled hidden files, and there's a file called $shtdwn$.req in the 6506a12a9cce3614cb46802cf625 folder.

This post has been edited by Sursion: 11 May 2011 - 02:40 PM

Post the contents of the EULA file, please. That should easily shed some light and eliminate guessing.

Louis