Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Virus in USB Flash Drive


  • Please log in to reply
9 replies to this topic

#1 cosmic_sniper05

cosmic_sniper05

  • Members
  • 196 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Philippines
  • Local time:04:40 AM

Posted 31 March 2009 - 12:20 PM

My Flash Drive is infected with a virus but my AVG Free cannot detect it. I'm sure that it's a virus because of the nature of its activity. It hides folders that I created in my flash drive and adds malicious folders named "RECYLER" and "RESTORE." In addition to that it makes a dummy of the folders - having the same file name but different extension name (.scr or .exe). The icon of the dummy folders are also quite different from the usual file folders. I'm somehow familiar to this virus because it once infected my PC which left me with no other choice but to reformat.

My flash drive is now free from the dummy folders. Maybe it's been removed by an antivirus or I might have manually deleted it before. The problem is "RECYCLER" and "RESTORE" are still there hidden together with my other file folders. Selecting "Show hidden files and folders" is not enough to show the folders. I still have to deselect "Hide protected operating system files."

After being able to show the hidden folders, I tried to unhide it through the properties but it won't work. Here's how it looks like.

Posted Image

As you can see deselecting the "Hidden" attribute is impossible.

Please help me get rid of this virus because even other antivirus could not detect it.
Let's have a mental fusion!
Let us do our part to make this world a truly symbiotic place.

For other computer problems, this blog might be helpful:
http://cosmicsniper.blogspot.com

BC AdBot (Login to Remove)

 


#2 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 50,942 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:04:40 PM

Posted 31 March 2009 - 02:40 PM

Please download Flash_Disinfector by sUBs and save it to your desktop.
  • Double-click Flash_Disinfector.exe to run the tool and follow any prompts that may appear.
  • If asked to insert your USB flash drive and other removable drives, please do so and allow the utility to clean up them as well.
  • Hold down the Shift key when inserting the drive until Windows detects it to keep autorun.inf from executing if it is present.
  • Wait until it has finished scanning and then exit the program.
  • Reboot your computer when done.
Note: As part of its routine, Flash Disinfector will create a hidden folder named autorun.inf in each partition and every USB drive that was plugged in when you ran it. Do not delete this folder...it will help protect your drives from future infection by keeping the autorun file from being installed on the root drive and running other malicious files.

Please download sreng2.zip and save it to your Desktop.
  • Create a new folder on your hard drive called Sreng2 (C:\Sreng2) and extract (unzip) the file there. (click here if you're not sure how to do this. Vista users refer to this link.)
  • Open the folder and double-click on SREngLdr.EXE to launch it.
  • Select System Repair from the left pane.
  • Click on Windows Shell/IE.
  • Put a check mark in the box next to Enable using Folder Options
  • Click Repair.
  • The Status should now show Ok.
  • Exit SREng and reboot the computer.
If that does not help, try this:

Go to Start > Run and type: cmd
  • press Ok.
  • At the command prompt, type in your primay drive location, usually C:
  • You may need to change the directory. If so type: cd \
  • press Enter.
  • At the command prompt C:\>, type: attrib -s -h desktop.ini /s
  • press Enter.
  • At the command prompt C:\>, type: attrib +s +h desktop.ini /s
  • press Enter.

.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#3 cosmic_sniper05

cosmic_sniper05
  • Topic Starter

  • Members
  • 196 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Philippines
  • Local time:04:40 AM

Posted 01 April 2009 - 07:44 PM

What's the function of the sreng2? I would like to know so that next time I'll know on what problems to use it. I would just be beginning with the downloading process. :thumbsup:
Let's have a mental fusion!
Let us do our part to make this world a truly symbiotic place.

For other computer problems, this blog might be helpful:
http://cosmicsniper.blogspot.com

#4 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 50,942 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:04:40 PM

Posted 02 April 2009 - 09:00 AM

SREng (System Repair Engineer) is a security and system maintenance utility that detects common system issues and damage caused by malware and repairs them. Refer to the Release Notes.

Edited by quietman7, 02 April 2009 - 09:01 AM.

.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#5 cosmic_sniper05

cosmic_sniper05
  • Topic Starter

  • Members
  • 196 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Philippines
  • Local time:04:40 AM

Posted 03 April 2009 - 08:23 PM

I've done what you said. I downloaded the Flash Disinfector and cleaned my flashdrive and then sfely removed it before restarting. Then I download sreng2 and do as you instructed. After that I tried to check my flash drive but nothing has changed I even tried using cmd but still no progress.
Let's have a mental fusion!
Let us do our part to make this world a truly symbiotic place.

For other computer problems, this blog might be helpful:
http://cosmicsniper.blogspot.com

#6 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 50,942 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:04:40 PM

Posted 04 April 2009 - 06:00 AM

Download Dr.Web CureIt and follow the instructions here for performing a scan. You can also download "ClamWin Portable Antivirus", put it on your USB Flash Drive, update its definition files and perform a scan. If you still cannot remove the malware, then its probably time to format the flash drive which deletes all data.

Edited by quietman7, 04 April 2009 - 06:00 AM.

.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#7 cosmic_sniper05

cosmic_sniper05
  • Topic Starter

  • Members
  • 196 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Philippines
  • Local time:04:40 AM

Posted 04 May 2009 - 04:32 AM

Sorry for the late update...


I've tried all the things suggested here but unfortunately, I end up reformatting my flash drive.


Thanks anyway.
:thumbsup:
Let's have a mental fusion!
Let us do our part to make this world a truly symbiotic place.

For other computer problems, this blog might be helpful:
http://cosmicsniper.blogspot.com

#8 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 50,942 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:04:40 PM

Posted 04 May 2009 - 07:20 AM

Sometimes that's the best solution.

Tips to protect yourself against malware and reduce the potential for re-infection:Keep Windows and Internet Explorer current with all critical updates from Microsoft which will patch many of the security holes through which attackers can gain access to your computer. If you're not sure how to do this, see Microsoft Update helps keep your computer current.

Avoid gaming sites, pirated software, cracking tools, keygens, and peer-to-peer (P2P) file sharing programs. They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and malicious Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users. The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications. Read P2P Software User Advisories and Risks of File-Sharing Technology.

Keeping Autorun enabled on USB (pen, thumb, jump) and other removable drives has become a significant security risk due to the increasing number of malware variants that can infect them and transfer the infection to your computer. To learn more about this risk, please read:Many security experts recommend disabling this feature as a method of prevention. Microsoft recommends doing the same.

...Disabling Autorun functionality can help protect customers from attack vectors that involve the execution of arbitrary code by Autorun when inserting a CD-ROM device, USB device, network shares, or other media containing a file system with an Autorun.inf file...

Microsoft Security Advisory (967940): Update for Windows Autorun
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#9 cosmic_sniper05

cosmic_sniper05
  • Topic Starter

  • Members
  • 196 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Philippines
  • Local time:04:40 AM

Posted 06 May 2009 - 09:31 PM

Thanks for the tips. :thumbsup:

I'll try to be more careful next time.



thanks!!!!!
Let's have a mental fusion!
Let us do our part to make this world a truly symbiotic place.

For other computer problems, this blog might be helpful:
http://cosmicsniper.blogspot.com

#10 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 50,942 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:04:40 PM

Posted 06 May 2009 - 09:37 PM

You're welcome.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




1 user(s) are reading this topic

0 members, 1 guests, 0 anonymous users