34 replies to this topic

[blood618^_^]

Here's a Tip on USB Devices on protecting them.. Hope you want this... Enjoy

1. Check first the Auto Insert Notification setttings. Set it to "prompt user...".
2. Insert your USB device
3. Open "My Computer" after the USB loads
4. DON'T left-click, but right-click on the USB drive
5. Check: (very important)

if it displays:

Quote

Open
Explore
Search
Autoplay

then it's safe.

if it displays:

Quote

Autoplay
Open
Explore
Search

or:

Quote

Auto
Autoplay
Open
Explore
Search

or:

Quote

0pen
Autoplay
Open
Explore
Search

or:

Quote

Open
Autoplay <-- Note that Autoplay comes after Open
Explore
Search

then your USB device is infected.

To remove it (without having to reformat your USB device):
- Of course, scan and clean it with an anti-virus software.

But to do it manually:
1. Go to Tools>Folder Options. If Folder Options isn't displayed, then proceed to step 7**
2. Go to the View tab, then enable "Show hidden files and folders", and uncheck "Hide extensions for known file types" and "Hide protected operating files" (click yes on this part)
3. Apply and Ok
4. Click the address bar
5. Type the drive letter of your USB device (example - F:\)
6. Look for suspicious files... like EXE files that has the icon of a folder, and named after the folder it is in... or VBS files in the root folder... or krag.exe and other unnecessary executables, or the folder RECYCLER. Delete those.
7. Run Notepad
8. Go to File>Save As, go to any folder you want to save.
9. Name it as "autorun.inf", then save.
10. Copy autorun.inf
11. Paste it on the root folder of the USB drive (example - F:\)
12.Confirm file overwrite.
13. Reconnect your USB device.
14. Finished. No more Autoplay.

**if there is no Folder Options, then it might have been disabled by the administrator, or your system also has already been infected.

===================================

Also dont Reboot PC (pressing restart button.) while your USB Device is inserted. it can corrupt data...

[Ridwan sameer]

Ahh you should specify which Operating system you are using. Users of linux will be trying to remove viruses from their USB now well anyway thanks and this is a nicepiece of information.

Hope to see more posting from you

[arnavn3]

Hey I tried this out..it worked for me..but those files keep on coming back to the drive even after i delete 'em..although the autorun doesnt work anymore, but those files are still there on the device.and they can spread this way, if not harm my USB device..so could anyone help me out with that..thanks..regards..

[iGuest]

HOW CAN I UNPROTECT A FLASHDISK
Virus On Your Flash Disk? (usb Devices)

I HAVAE BEEN EXPERIENCING THE PROBLEM PAST 2 WEEKS NOW.

I OPENED MY FLASHDISK AND I SAW MY FILES THERE BUT WHENEVER I TRY TO OPEN ANY FILE, IT SAYS; THE DISK IS PROTECTED.

HOW CAN I RESOLVE THIS PROBLEM TO START SAVING MY FILES INSIDE.

AM WAITING FORWARD FOR YOUR REPLY.

THANKS.

FROM; JOHNNY

-question by ENWOR JOHN

[iGuest]

error message displayed when i insert flash disk!!
Virus On Your Flash Disk? (usb Devices)

When I insert my flash drive its displaying eror mess
!soundmix.Exe-corrupt file

The file or directory autorun.Inf is corrupt and un readable,please run the Chkdsk utility.
And also I cannot format the disk .The files present on the disk are not deleting ...Can anyone help me out

[jopak134]

write-protected? maybe there's a switch in your usb.

i think there are programs that you can use that will format your usb just google it.

[iGuest]

For resolve USB problem just do this way.
1) Go to Run and then type CMD
2) In any drives type: Attib -s -h -are Autorun.Inf
3) After find it type: Del Autorun.Inf

-reply by Loghman Adak

[iGuest]

Good Morning:

I have a problem with a virus in my flash USB kingston, I have a virus in autorun.Inf and create another archive named Lio.Vbs and when I delete manually the virus and put the another autorun.Inf to replace it, the virus is recover again and replace my archive of autorun.Inf and create again Lio.Vbs. How I can do to prevent that the virus come again and infect my drive?.

Another thing, autorun and Lio appear has hidden, Read - Only and Archive and I cannot remove hidden because the option has disabled.

Thanks for the answer from antelation and excuse my english, if are something wrong.

Lance.

[iGuest]

Replying to Trap FeedBacker

I have the same problem with that lio.Vbs, my pc systems is infected, because Avira Antivir detected it:

The file 'C:WINDOWSsystem32Lio.Vbs'
Contained a virus or unwanted program 'HEUR/HTML.Malware' [heuristic]
Action(s) taken:
HKEY_LOCAL_MACHINEC:WINDOWSsystem32userinit.Exe,C:WINDOWSsystem32wscript.Exe C:WINDOWSsystem32Lio.Vbs
The fund was classified as suspicious.
The file was moved to "48b4e016.Qua"!

After I send it to quarentena, because I couldn't erease it, my script host send me a message after each reload: the archive lio.Vbs is unable in 'C:WINDOWSsystem32Lio.Vbs'
I don't want this in my startup, how I can finish it?

Ahh, my USB was infected too, but the antivir could clean it.

-reply by josebrrs

[ckcomputerstallahassee]

FeedBacker, on Mar 5 2008, 03:45 AM, said:

error message displayed when i insert flash disk!!

And also I cannot format the disk .The files present on the disk are not deleting ...Can anyone help me out

I had a similar problem with my sandisk drive. I went to my computer --> manage-->then go to disk management
It should see the drive there, where you can manually reformat it.

[iGuest]

I have a problem with my flash.It has a virus(brontox)I think.I have triebd scanning and deleting but now I cannot open my files at all .When I scan they seem to be there please help

-reply by labath

[iGuest]

error message
Virus On Your Flash Disk? (usb Devices)

Just create a file in the folder C:windowssystem32and name it Lio.Vbs
Oops problem solved

-reply by Magdiel

[bluedragon]

iGuest-labath, on Jul 23 2008, 06:01 PM, said:

I have a problem with my flash.It has a virus(brontox)I think.I have triebd scanning and deleting but now I cannot open my files at all .When I scan they seem to be there please help

-reply by labath

Try checking if the files/folders have been marked as system / hidden attribute.

You can uncheck "hide protected files/folders" and select "show hidden files" under My computer > Tools > Folder Options > View

If they are visible after that. Just right click , select properties and uncheck the system and hidden attrib and apply.

This should solve the problem

[Erdemir]

When you insert an injected usb drive, the autorun starts automatically. Even you didn't double clicked on the usb drive in My Computer. And also some of viruses don't show Autoplay, and you think your usb drive is safe, but these viruses can also start with the Open.
I think the autoplay when you insert the drive is not useful. We should disable it.

To DISABLE AUTORUN ON ALL DRIVES:
If you are using Windows XP Professional version:
Click Start and then click Run
Type gpedit.msc and click OK
The Group Policy window will open. In the left pane, expand Administrative Templates
In the right pane, double-click System
Scroll down the list and double-click Turn Off Autoplay
In the Turn Off Autoplay Properties window, select Enabled. From the dropdown next to Turn Off Autoplay on, select All drives and then click OK

If you are using Windows XP Home version:
You need to edit Registry.
Click Start and then click Run
Type regedit and click OK. The Registry Editor window will open.
In the left pane, go to:
HKEY_CURRENT_USER -> Software -> Microsoft -> Windows -> CurrentVersion -> Policies -> Explorer.
In the right-pane right click the value NoDriveTypeAutoRun and select Modify from the drop down menu. The base value will be set to Hexadecimal. If not, select Hexadecimal.
Type 95 and click OK.
This will stop Autorun on USB drives.
Now restart the computer. Autoruns will not work.

And this will prevent you from virus when you insert a usb disk.

But remember that double clicking on the usb drive is still dangerous.

Edited by Erdemir, 06 August 2008 - 08:44 PM.

[iGuest]

To delete autorun.Inf
Attirb -are -h -s autorun.Inf . Then
Del autorun.Inf .
But it not completely works for removal from flash disk.
And I have the next NoeNoeJetma.Vbs.
Please help me to delete these files from my flash disks.

-reply by Okia

[bluedragon]

I found another way of removing these pen drive trojans. Take any live Linux distro. Run it and plug your pen drive after you've booted into the linux.
Find any unnecessary files .exe and .vbs and delete them. Most of trojan exe's are generally under 1 MB
Though ppl will find it difficult if they have a complex directory structure on their pen drive but this works 100%. Also the Autorun wont work properly in Linux. Since it will try to call an EXE which will not execute.

Hope this helps .. Happy Hunting

[iGuest]

I have been experiencing this problem lately. When I opened my flashdisk, every files are ok, then the window refreshed and the files' icon changed and they became application files. I cant access my files anymore. How can I solve this problem. Is it a virus or what? is their a way to have my file return to what they should be?

-reply by Nymp

[iGuest]

Recycler & System Volume Folders
Virus On Your Flash Disk? (usb Devices)

I used to get RECYCLER & SYSTEM VOLUME FOLDER on my External Hard Disk, Pen Drive & on Flash Drive also. Each time I deleted them but they came back again. Is this virus? If yes then why Norton & AVG Antivirus don't detect them???

One thing more, When I insert my pen drive then I m not be able to open or explore. I have to use the "search" option by right click and then I used to type the file name.

I don't don't know, How to solve the prob.?
Please Help. Thnxx


-feedback by sound.Sfm

[iGuest]

virus make me crazyVirus On Your Flash Disk? (usb Devices)

I have a one flash dr ive which included more important files.Now it effect a virus it name is global exe.It is not stopping and continuesly spreading.So would you please guied me how to remove them from my flash memo without deleting files.

[iGuest]

autorun.infVirus On Your Flash Disk? (usb Devices)

I have tried the procedures.. Follow every steps, but still my flash drive have its auto run.. And when I paste the autorun.Inf there is no message that says to replace it.. Is it just fine or is there something wrong???

-question by zephyrKeywords:

[iGuest]

Concerning RECYCLER folderVirus On Your Flash Disk? (usb Devices)

I get this when confirming deletion:  You "The file 'Desktop.Ini' is a system file.  If you remove it, your computer or one of your programs may no longer work correctly..."  I'm hesistant to delete this...

 I also can't see any steps to remove the virus worm from the system itself (not only the USB).  The worm infects other USBs through the computer.  Although it may be removed from the USB, the computer the flash drive was plugged into, still has the virus and will infect any other USB that is plugged into it.

[aloKNsh]

yeah its cool but plz can any one tell me how to disable the autoplay option

[iGuest]

how to bring back yor lost filesVirus On Your Flash Disk? (usb Devices)

Got START then click run. IN the run dialog box type cmd. A command prompt will show. Type attrib followed by the path of your pendrive and *.* then /s /d -h -s

note the spaces between attrib and the path and between  /s /d -h -s

eg:

attrib H:*.* /s /d -h -s

-reply by Junaid

[iGuest]

Memory Card ErrorVirus On Your Flash Disk? (usb Devices)

My memory card last night stopped working. It reads Card error everytime I turn on my camera. When I put the memory card into the computer, it says I need to reformat the disk. Is there any way to save the files on the memory drive, before I format it? I cant even open the memory card on my computer without it saying I need to format it.

[iGuest]

Files not showing but the memory size is as is the last time I used it.Virus On Your Flash Disk? (usb Devices)

Can someone help me out..?

My best friend went to a computer shop and have the memory card checked. A virus has been detected - an "autorun" virus - and the attendant deleted it.

I assumed that it was the reason why files are not showing up. Is there any way I can get back the files? I can't reformat it 'coz my thesis is saved there T_T

-reply by Timie