Forum Home
Press F1
 
Thread ID: 114891 2010-12-22 06:36:00 External HDD chuanwai (12518) Press F1
Post ID Timestamp Content User
1163954 2010-12-22 19:06:00 An update, symantec and trojan remover didn't help.
2 unknown files have now popped up in my external HDD
autorun.V01VVinf
autorun.VVVinf
chuanwai (12518)
1163955 2010-12-22 20:24:00 An update, symantec and trojan remover didn't help.
2 unknown files have now popped up in my external HDD
autorun.V01VVinf
autorun.VVVinf No real surprise there ;)

As mentioned before -- you have to kill the auto runs - Any antivirus program wont take it out while they are running.

In the past when fixing Customers PC's that had conflicker - its either boot from a Bootable CD like Ubuntu, navigate to the USB drive, find the autoruns and other infections ( exe files), and simply delete them, then rerun Eset.

OR sometimes, and its 50/50 -- run the Eset bootable rescue CD, then select the USB drive, and scan. That sometimes takes it out.

The rescue CD is basically your AV program, just running from the CD / Memory -- allows full access to the drives. You have the option to make one yourself, but there is a 1375.9MB download first, which is the Windows AIK kit to make the bootable Win PE environment .

Third option - as mentioned before - Boot from Ubuntu- Copy your data to the PC, format the external drive, copy the data back after doing a full scan just to make sure.

IF you want the Eset bootable CD ISO to make the CD -please advise -- I can upload it and provide a link - its about 175MB.
wainuitech (129)
1163956 2010-12-22 20:42:00 What version of windows is it? Disable autorun as well. Try doing it in safe mode / networking Speedy Gonzales (78)
1163957 2010-12-22 23:42:00 using windows 7 how do I disable it and can u give me step by step instructions for ubuntu

:pf1mobmini:
chuanwai (12518)
1163958 2010-12-22 23:58:00 Reboot then press F8 select safe mode / newtworking first. See if that works. Do a full scan with NOD and run that Symantec tool and trojan remover. Dont forget to select all option under utilities as well Speedy Gonzales (78)
1163959 2010-12-23 01:07:00 To disable auto play, go to This web site (www.sevenforums.com) - theres two ways of doing it.

OR, click start, type in Auto - from the results, select "Autoplay" - top left, untick " use autoplay for all media and devices" --save (bottom Right hand corner)

For ubuntu -- boot from the bootable CD, select TRY --DONT what ever you do install it.

Once up and running, plug in your USB Drive - an Icon should appear on the desktop after a few moments. Double click it to open - there will be the contents of your external drive. You "Should" be able to see them as normal. You should also see the files in the root of the drive, some being the buggers causing all the problems. To delete them, simply select hit delete.
wainuitech (129)
1163960 2010-12-23 01:37:00 Had to load up Ubuntu to check the following ( normally I just do it) To copy files if needed from the external drive, and assuming there is enough space on your HDD.



BTW - I'm writing this from the Live CD - :D

IF you want to copy off the files on the External Drive:

Note: Some things are single click in this.

Make a folder in the HDD. On Ubuntu, click "Places" ( up top to the left) you will see your drive (As Shown Here) (www.imagef1.net.nz)click it to open - right click - Create Folder -- Call it something you want -- then open the External HDD by clicking on the desktop Icon -- Locate the files/Folders you want, single click to select - right click copy, go back to the folder on the Main HDD, open it, right click , paste -- you will see the files transferring across.

Once you have them all transfered, reboot the PC as normal (to reboot from Ubuntu, top right where it says Ubuntu is the button to click- reboot) when restarting pop out the CD, rescan your PC with the external drive disconnected - assuming its all clean, and your files that were on the drive operate as expected, you can format the External HDD and copy them back normally.
wainuitech (129)
1163961 2010-12-23 02:07:00 Dont panic :badpc:

remove the USB HD untill you are sure the PC is clean of viruses
Any Virus removable program may need to be run as administrator in vista
right mouse click: run as admin..

some easier options.
download Malwarebytes & run it several times , reboot each time
http://www.malwarebytes.org/

download Kaspersky ISO & burn it to CD. Boot off the Kaspersky CD, its a good av program for cleaning
rescuedisk.kaspersky-labs.com

NOD32/Eset rescue CD is another option (see above)

When you are sure the PC is clean, connect the USB drive while holding down the shift key.
Scan the USB drive with Malwarebyte, Nod32 etc.

You will need to disable system restore & re-enable, but you can do that later.
1101 (13337)
1163962 2010-12-23 19:48:00 I used the ubuntu method and I deleted the auto exe and I found the files to be hidden I unhid them and they seem to look fine, I have scanned it numerous times and it came out clean. so can I assume it is clean now? thanks for all the responses helped save some important photos.

:pf1mobmini:
chuanwai (12518)
1163963 2010-12-23 20:11:00 Sweet --:thumbs: If you scanned it, and its showing as clean, then it should be fine.

Just a word of advice --- Get your friend to fix their computer ( remove the virus), otherwise if you plug the drive, or anyone else plugs anything into that PC, then that will get infected as well.

IF the data on that drive is important, make sure you have another copy someplace ( another drive) - hardware can always be replaced, important files/ Photos etc cant usually.
wainuitech (129)
1 2