Prev: Another link that doesn't work (sort of - this is example of "wierd html")
Next: Had to clean up a PC with zbot infection
From: Finn Stampe Mikkelsen on 23 Nov 2009 17:52
Hi

Could anybody tell me, how i could get rid of this virus. Below there is a
directory of my USB-Stick. i have tried several solutions i found on google,
but none of them worked...

Disken i drev P er Cruzer U3
Diskens serienummer er 8AD5-0AE2

Indhold af P:\

16-11-2009 22:40 246 AUTORUN_.0NF
17-11-2009 18:19 <DIR> cold
16-11-2009 22:41 <DIR> System Volume Information
1 fil(er) 246 byte

Indhold af P:\cold

17-11-2009 18:19 <DIR> .
17-11-2009 18:19 <DIR> ..
20-11-2009 10:48 <DIR> hott
0 fil(er) 0 byte

Indhold af P:\cold\hott

20-11-2009 10:48 <DIR> .
20-11-2009 10:48 <DIR> ..
22-11-2009 03:15 63 Desktop.ini
18-11-2009 22:49 25.600 ������o-���
15-11-2009 00:51 102.441 ��������-���
3 fil(er) 128.104 byte

Antal filer i alt:
4 fil(er) 128.350 byte
7 mappe(r) 31.882.956.800 byte ledig

/Finn

--
Der er 10 slags mennesker - Dem som forst�r bin�r og dem som ikke g�r.
There are 10 kinds of people. Those who understand binary and those who
don't.
Es gibt 10 Arten von Menschen. Die, die Bin�r verstehen, bzw. die, die es
nicht tuhen.

From: David H. Lipman on 23 Nov 2009 17:59
From: "Finn Stampe Mikkelsen" <stampe(a)city.dk>

| Hi

| Could anybody tell me, how i could get rid of this virus. Below there is a
| directory of my USB-Stick. i have tried several solutions i found on google,
| but none of them worked...

| Disken i drev P er Cruzer U3
| Diskens serienummer er 8AD5-0AE2

< snip >

| 20-11-2009 10:48 <DIR> .
| 20-11-2009 10:48 <DIR> ..
| 22-11-2009 03:15 63 Desktop.ini
| 18-11-2009 22:49 25.600 ������o-���
| 15-11-2009 00:51 102.441 ��������-���
| 3 fil(er) 128.104 byte

| Antal filer i alt:
| 4 fil(er) 128.350 byte
| 7 mappe(r) 31.882.956.800 byte ledig

| /Finn




First disable AutoPlay/AutoRun on the PC in question.

Scan the system and *all* Read/Write removable media with an anti virus such as the Sophos
and McAfee modules of my Multi AV Scanning Tool.

You can't just try to remove it from a memory card/flash drive as the PC will re-infect
the device and vice versa.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp


From: "nobody >" on 23 Nov 2009 19:43
David H. Lipman wrote:
> From: "Finn Stampe Mikkelsen" <stampe(a)city.dk>
>
> | Hi
>
> | Could anybody tell me, how i could get rid of this virus. Below there is a
> | directory of my USB-Stick. i have tried several solutions i found on google,
> | but none of them worked...
>
> | Disken i drev P er Cruzer U3
> | Diskens serienummer er 8AD5-0AE2
>
> < snip >
>
> | 20-11-2009 10:48 <DIR> .
> | 20-11-2009 10:48 <DIR> ..
> | 22-11-2009 03:15 63 Desktop.ini
> | 18-11-2009 22:49 25.600 ������o-���
> | 15-11-2009 00:51 102.441 ��������-���
> | 3 fil(er) 128.104 byte
>
> | Antal filer i alt:
> | 4 fil(er) 128.350 byte
> | 7 mappe(r) 31.882.956.800 byte ledig
>
> | /Finn
>
>
>
>
> First disable AutoPlay/AutoRun on the PC in question.
>
> Scan the system and *all* Read/Write removable media with an anti virus such as the Sophos
> and McAfee modules of my Multi AV Scanning Tool.
>
> You can't just try to remove it from a memory card/flash drive as the PC will re-infect
> the device and vice versa.
>

At the prices of USB sticks today, the fastest fix would be to spank
that stick with a large hammer and replace it.

I just bought a MicroSD 4 gig teeny chip for my phone and a tiny USB
adapter for it for less than $20 USD (special need here), and a Lexar
"jacknife" USB stick for $8 usd.
From: Finn Stampe Mikkelsen on 23 Nov 2009 19:47

"nobody >" <usenetharvested(a)aol.com> skrev i meddelelsen
news:YoidnRqc_b-8sZbWnZ2dnUVZ_iydnZ2d(a)supernews.com...
> David H. Lipman wrote:
>> From: "Finn Stampe Mikkelsen" <stampe(a)city.dk>
>>
>> | Hi
>>
>> | Could anybody tell me, how i could get rid of this virus. Below there
>> is a
>> | directory of my USB-Stick. i have tried several solutions i found on
>> google,
>> | but none of them worked...
>>
>> | Disken i drev P er Cruzer U3
>> | Diskens serienummer er 8AD5-0AE2
>>
>> < snip >
>>
>> | 20-11-2009 10:48 <DIR> .
>> | 20-11-2009 10:48 <DIR> ..
>> | 22-11-2009 03:15 63 Desktop.ini
>> | 18-11-2009 22:49 25.600 ������o-���
>> | 15-11-2009 00:51 102.441 ��������-���
>> | 3 fil(er) 128.104 byte
>>
>> | Antal filer i alt:
>> | 4 fil(er) 128.350 byte
>> | 7 mappe(r) 31.882.956.800 byte ledig
>>
>> | /Finn
>>
>>
>>
>>
>> First disable AutoPlay/AutoRun on the PC in question.
>>
>> Scan the system and *all* Read/Write removable media with an anti virus
>> such as the Sophos and McAfee modules of my Multi AV Scanning Tool.
>>
>> You can't just try to remove it from a memory card/flash drive as the PC
>> will re-infect the device and vice versa.
>>
>
> At the prices of USB sticks today, the fastest fix would be to spank that
> stick with a large hammer and replace it.
>
> I just bought a MicroSD 4 gig teeny chip for my phone and a tiny USB
> adapter for it for less than $20 USD (special need here), and a Lexar
> "jacknife" USB stick for $8 usd.

Yeah well, not a viable solution for me. Just bought the damn sucker. 32GB
stick and it cost around $100, so i'm not likely going to spank it any time
soon...

But i tried the solution sugested above and i wonder why my F-Secure, bought
and payed for, did not clean the darn thing.. MCAfee identified it promptly
and removed it.. It hat not yet returned, som i consider it gone now..

Thanks goes out to david...

/Finn

From: David H. Lipman on 23 Nov 2009 20:02
From: "Finn Stampe Mikkelsen" <stampe(a)city.dk>


| Yeah well, not a viable solution for me. Just bought the damn sucker. 32GB
| stick and it cost around $100, so i'm not likely going to spank it any time
| soon...

| But i tried the solution sugested above and i wonder why my F-Secure, bought
| and payed for, did not clean the darn thing.. MCAfee identified it promptly
| and removed it.. It hat not yet returned, som i consider it gone now..

| Thanks goes out to david...

| /Finn

Smashing would NOT have bee a solution as it probably infected the PC and you may have
other devices infected as well.

Did you scan the PC and all removable Read/Write media ?

What did McAfee find ?
You can extract that information from...
C:\AV-CLS\mcafee\ScanReport.HTML


--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp


 |  Next  |  Last
Pages: 1 2 3
Prev: Another link that doesn't work (sort of - this is example of "wierd html")
Next: Had to clean up a PC with zbot infection