Welcome to Scribd, the world's digital library. Read, publish, and share books and documents. See more
Download
Standard view
Full view
of .
Save to My Library
Look up keyword
Like this
6Activity
0 of .
Results for:
No results containing your search query
P. 1
Removing the Flash Drive Autorun

Removing the Flash Drive Autorun

Ratings:

4.67

(3)
|Views: 1,494 |Likes:
Published by r.kalpesh

More info:

Published by: r.kalpesh on Nov 10, 2008
Copyright:Attribution Non-commercial

Availability:

Read on Scribd mobile: iPhone, iPad and Android.
download as DOC, PDF, TXT or read online from Scribd
See more
See less

07/11/2010

pdf

text

original

 
Removing the FlashDrive autorun.inf VirusDesai Kalpesh 1 of 6
Removing the FlashDrive autorun.inf Virus
Some of the symptoms of an infected computer:
Hidden files cannot be viewed. Changing options in Tools/Folder Options has no effect.Changing registry values has no effect. No restriction removal tools likeRRTetc are able to fixthe problem.
Regedit cannot be found
when you try to invoke it from the RUN box.
Task Manager has been disabled
by Administrator.
You
cannot enter a particular drive
ie when you click on your drive letters(C, D, E etc) inMy Computer nothing happens.
Computer has become slow and there is noticeable delay in characters to appear on screenwhen you press in keyboard. The
left and right strafing keys in Counter Strike 1.6 dontwork 
. They work on CS: Condition Zero tho.Virus Removal Strategy that works for me:
Full System scan
A full system scan using any of the following Antiviruses/antispyware tools usually do thetrick.1.
Eset NOD32
or 
Eset Smart Security Business Edition
.2.DOS mode virus scan using the antivirus tools in
HirensBootCD*
 3.
Spyware Doctor
and
AdAware
.
Identifying the Virus manually
Most of the time a virus gets detected but the antivirus software is unable to remove it. This is because either the virus is currently running on your system as one of the processesor is being protected by the Operating System Itself. So before doing the virus scan you have to take a few precautions:1.DownloadProcessXPif you Task Manager is disabled.2.DownloadHijackThis from TendMicro Both of these tools are helpful in revealing and killing hidden processes running on your system or those which have recently make changes. If you find something like:1.monit.exe- runs under explorer.exe, keylogger app, creates problems with Counter Strike2.scvhost.exeor 713xRMTmon.exe- not to be confused with svchost.exe, an important windows  process.3.wscript.exe- a harmless process which can be made to execute harmful VBScripts likemswin32.dll.vbs 4.amvo.exeor amva.exe  5.autorun.inf - Its actually a harmless file.more info. But can be used to invoke a virus when you click a folder/drive which has this file.Its best to kill/terminate them by Right Click/
End Process Tree
. Also a good practice is toEndProcessTree
**
Explorer.exe as well. And starting the antivirus executable fromTaskManager/File/Run. And then run a system scan. Explorer can be started again fromTaskManager/File/Run/ Type
explorer
[enter].Several antivirus support forums help out people who submit their HijackThis log files.Viruses usually invoke at startup. So its a good idea to check the startup list byStartMenu/Run/
msconfig
/Startup where you should find something suspicious Uncheck them(only if suspicious ones!)likescvhost.exe. Uncheck them(only if suspicious ones!).Restart your PC. Do system scan.So how do you findout which process is malicious? Google them. If your data is important toyou and you really want to remove the virus without formatting, you have to do this bit. Whenyou familiar with which System processes you should be able to isolate the culprit by justseeing the list.
 
Removing the FlashDrive autorun.inf VirusDesai Kalpesh 2 of 6
You can also goto the command prompt StartMenu/Run/
command
and then
CD\
now youshould be at the
C:\
prompt. Now write
type
 
autorun.inf 
You should be able to see thecontents of the autorun.inf file which for me was like
Deleting**Identified Virus files - Harddisk, Registry
 Now that you have identified a file say likeautorun.inf or mswin32.dll.vbsin the root of all drives or in your system drive. Immediately delete all instance of it on your system. If its protected downloadhttp://www.gibinsoft.net/gipoutils/locate the file and delete it. For moredetails read my article to 
You can also delete a file from DOS. the command
DIR /w/a
displays all hidden files andfolders. with command
attrib-s -h -r <filename>
. Then
delete <filename>
A virus also hides itself in the
System Volume Information
and
PREFETCH
folder. So itmight be a good idea toturn off System Restore for a while. Doing so will delete all you previous system.Another thing that I do this remove all traces of the virus file from the windows registry. Startregedit - StartMenu/Run/
regedit
. If your system cant findregedit. Copy it from
C:\WINDOWS\system32\dllcache
to
C:\WINDOWS\system32\
or download it. After you open regedit Edit/Find/search for all entries of names of virus files mentioned earlier. Keep pressing
F3
key to look for next result and delete
**
all of them.To prevent future infections in your USB Drive, what you could try is create an emptyautorun.inf file and set read only attribute to it. This should prevent a malicious autorun.inf taking its place. I tried it on some systems, it works!
Ive deleted the virus, But why is my task manager still disabled and files hidden??
… etcThis is because a virus/trojan/worm is the mother alien which an antivirus can remove. But the the settings and changes which they make does not concern an AV. You will have to changethem back manually. If you still cant, that means there is some virus file enforcing thosesettings, like disabling Task Manager, Hiding files etc.
TaskManager disabled - UseRRT, or Follow instructions on mentionedhere.
Files and Folders Hidden - UseRRT,or Goto registry
o
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN “CheckedValue”=0 “DefaultValue”=2
o
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL “CheckedValue”=0 “DefaultValue”=2or download and runthisregitry key.In the end, there are a few golden rules that I find are always true. A virus is harmful while it isrunning. If you cant change your settings, that means something is blocking it or continuouslyenforcing it. So stop the virus from running. Delete all traces of the virus. Change back thesettings manually.
Warnings!
*Contains illegal compilation of shareware softwares. Im not encouraging you and take noresponsibility if you go ahead and use them.**Be very careful while deleting or modifying system files/registry entries, your system maynot even boot the next time you restart your computer. Something might go wrong anyway,thats how it is with these things.
updated: 18th April
Responses
 
Removing the FlashDrive autorun.inf VirusDesai Kalpesh 3 of 6
Your page is the best I’ve seen, thanks. EdMy replicating INF looks like this ….PWS-LegMir.gen.k - Password Stealer ;j444i[AutoRun];Xaj3j2i5D2A3Dpjo3airklC3aiKwaoarr04o3a1wls44s2rJ7SeKwlwd3s5Sk4o2jDa1jaFjdopen=bqk.bat;12wklSf3mqi47siaaqq430IKowd7a4sswdsjkk5C5skrrOAeafrZeLjwAZ40n89iLk3s4Dr5wo8eKUiipk22aSodwswp2shell\open\Command=bqk.bat;43KKfocdki3l7CkiXa3sdA0n19r2w8f shell\open\Default=1;4ashell\explore\Command=bqk.bat …. and so onHi, Thanks!From the looks of your autorun.inf it seems bqk.bat is the virus file. I would suggestfinding one of those bqk.bat files and opening them using any text editor(notepad).The contents should reveal what exactly the virus file is doing.Its important that you find the virus executable currently running on your system, terminate it,and then begin the cleaning procedure.hi, i have AVG scanner which scans my system at start up…i recieeve a mess sayingVirus is detected at C:\Autorun.inf…And i press c for continuing..i have scaned my pc but i am unable to del it..also i tried to see da contents of it in dos mode..it showssome mess like shell execute or somethn…even cant find the entry in Reg Edit…could u helpme..should i download AD Aware ..and try to scann my pc..plz help..due to this trojan/virus…. pc hs foll prob..1.i cnt enter my Drives when i click on them..2.my ctrl +alt+del doesnt work 3.after sme time..my pc gets hanged..thnx in advance.Hi Riya,First of all I would strongly recommend getting ESET NOD32 antivirus and SpywareDoctor and doing a full system scan. I have personally tested almost all major AV brands and find NOD32 to be the best(and fastest). Email me if you need help getting them at->
a e l i e n
at
gmail
because it might be illegal to share download links publicly.After you scan your system using the two above, if problem persists, reply back.[...] .exe files inside a folder, with the same name as the folder. To remove that virus,check out the And Back Up blog, after you’re done with this removal. Fire up your Task Manager (Alt+Ctrl+Del) and end [...]----
Hi. I was recently infected with a virus or worm of some sort. Similar to one of the examplesyou’ve mentioned about in another post, I couldn’t get into my partitions from My Computer when I clicked the icon. Also my antivirus would constantly notify me of some virus. Sincethen I have formated my computer and the laptop itself is free of virus. However, here my real problem now. Before I formatted my infected computer, I also had an external drive (F:)attached to my laptop and I had saved some of my precious pictures and videos and some

Activity (6)

You've already reviewed this. Edit your review.
1 hundred reads
1 thousand reads
Fretz liked this
integrator liked this
MUNGRADA liked this
ngrigore liked this

You're Reading a Free Preview

Download
/*********** DO NOT ALTER ANYTHING BELOW THIS LINE ! ************/ var s_code=s.t();if(s_code)document.write(s_code)//-->