Friday 16 September 2011

Virus or I have misconfiged?

When I create a file name and change it's name to autorun.inf or boot.exe, I don't see it any more in windows explorer (it disappears). But when I create a new file and try to rename it to autorun.inf or boot.exe, I receive a error message that the file I try to rename to has already existed. I have check the options to show hidden file and system file in windows explorer option but I still can't see the file I've created even thought I can see some other common hidden/system file like autoexec.bat, boot.ini, ntdetect.com, io.sys, config.sys,... in windows explorer. I use some text editor and I can open the file with name above (autorun.inf and boot.exe) by type it's name from the open file dialog (I still can't see this file). After modify it content, I run cmd and when I type command



type autorun.inf (let's say the file I've modified is autorun.inf, the same happen to the file with the name boot.exe)



I see the the file's content. Then I type command



del autorun.inf



I receive the message %26quot;Could not find autorun.inf%26quot;



Also when I insert a CD-ROM to my drive, if the CD content the file autorun.inf, I can not see it content from windows explorer



Does anybody know if this is a virus or I have misconfiged the autorun/autoplay policy? And how can I fix this?
Virus or I have misconfiged?
You can boot up your PC in safe mode command prompt.



unhide the autorun.inf

c:\attrib -r -s -h autorun.inf



rename it the autorun.inf to txt

c:\ren autorun.inf to autorun.txt



create a FOLDER call autorun.inf to prevent re-infection

c:\mkdir autorun.inf



find out the virus file name

c:\type autorun.txt



It may show something like this



[AutoRun]

open=virusname.exe

shellexecute=virusname.exe

shell\Auto\command=virusname.exe



unhide the virus

c:\attrib -r -s -h virusname.exe



remove the virus

c:\del virusname.exe



del the autorun.txt

c:\del autorun.txt



Keep the autorun.inf folder to prevent future infection
Virus or I have misconfiged?
Hello

your computer may be infected with the virus and Trojan

I suggest you use a comprehensive killing NOD

Then clean up your registry repair documents can be resolved

Please visit

http://www.Fix-pc-Master.com

Can help you
Do a full set of scans lets see what you find - you may have a worm.



Also do a search for heap41a if this is on your PC then you have W32 USB worm.
  • software
  • computer eye strain
  •