USB Virus.

I was directed here from here
http://forums.whatthetech.com/USB_Virus_au…xe_t106358.html

We have suggested a couple of options in the staff area, I will list them here and you can choose which you feel most comfortable with.

My route would be to 1st make sure ALL protection is fully updated, do NOT allow the drive to auto run (turn that off first), then connect it but do NOT enter it, bring up your "My Computer" where you should see it (assuming it doesn't want a reboot to finish installing drivers for it), then right click on it and run the protection if you wish to clean it up first, or if going for a straight wipe then I suggest using HDD Low Level Format Tool.
BUT, Be Warned, this is an extremely powerful and unforgiving tool, it is a windows based format tool, and it WILL wipe your OS drive if you select the wrong drive to format, and yes even though your using the OS drive to run the tool, it will still format that drive without confirmation the second you tell it go, so triple check the drive you tell it to wipe, but this is the best tool IMHO if it's a really nasty infection.

Another suggestion from Ztruker is to use DBAN (Darik's Boot and Nuke), I am not used to this tool so can't say much about what to do, but he suggested putting this on floppy or disk then unplugging the hard drives of the system that will be used to do this, then boot to this tool and format, this appears the better idea on paper because your drives are never connected at the time this USB one is, but that said if this is a memory resident virus involved it could save itself to the system memory and infect your drives once you connect them back up.

The thing to remember with these things is that no matter how you try, there is ALWAYS risk, there is no way round that, BUT, that said I have used the method I suggested many times without issue, as I dare say Ztruker has with his, all we can do is minimise risk, but the only way to take away the risk is not to do it, but IMHO either of these methods should be as safe as you can get without going to extremes, please take your time to think about these options, and ask for any input you need to give you the best info possible before you start, this should give you a trouble free solution.

*edit
OK I have been doing some experimenting, as it happened I needed to reinstall my daughters system, so I took the opportunity to try this DBAN option, and it's the 1st time I've ever been able to run this program, previous attempts on the UBCD disk have failed for me, but what you need is v1.07, it has to be the dban-1.0.7_i386.exe file, save that to your desktop and run it with the floppy or thumb drive in, select which you're wanting to use from the drop down box, then click on install and it will install the required files to your selected media.

Once you have done that you will need to enter your bios and change your boot order to the media you have chosen, alternately if your system has an option to press a specific key to select what to boot from then thats even better if it allows the media chosen, once the program has loaded follow the on screen prompts, select the external drive, BUT, we can't be certain if it will allow this or not, info that Ztruker has come across seems to suggest it's hit and miss, so some can, others can't, but you should be able to see quickly enough if the drive is shown, if it is then you can format using this, but it is extremely slow, so if you go this route it may take many hours to complete, so running it overnight may be a wise option for this, hope it helps anyway.

Hey, Thanks for your help but I'm having trouble understanding this. -How do I turn off autorun? -What sort of protection do I turn on? I'm guessing this refers to my antivirus. Since there is always a risk, would it be sensible to use the first option, and if I get infected, go to the malware removal forum?

Thats why I suggested to ask all you need before starting, now here is a link from m$ on how to disable AutoRun, unfortunately it's a bit overwhelming, and I don't have the confidence to guide on this subject personally, so I hope you can make out this guide.
How to disable the AutoRun functionality in Windows
And here is an easy guide to follow, hopefully it will do the same thing as the m$ guide.
http://antivirus.about.com/od/securitytips/ht/autorun.htm

As to protection Yes, your A\V is the main one, as that should give real time cover, so make sure it's fully updated first, but on top of that I suggest Malwarebytes, SUPERAntiSpyware and a-squared, all have free options, install and update them before connecting the drive, they don't give real time cover, but they do add a scan via right click option which is a great idea as you can scan individual things rather than the entire system.

Now even though they wont stop an infection without having the paid version(s) (NB. only ever run 1 tool of the same type at any one time, especially with real time cover or you can get conflicts), they do give you a head start should the worst happen, when you get infected the 1st job of any infection is to shut down your protection, this includes blocking you from installing protection, and from updating it, it even blocks you from accessing online scanners in some cases, so by having this in place already means you only need to run it, so less chance of being blocked from using such tools.

You may want to consider scanning your system with these (1 at a time) before starting this, because making sure your clean before you start would be a wise move IMHO, with luck the most these will find is tracking cookies and the like, then once you have finished formatting the external drive I'd suggest running ALL the protection again, may seem overkill, but it's the safest way to ensure you didn't pick anything up from the infected drive, an extra thing you can do during all this is unplug your net, it will stop info from being sent out (worst case), then plug it back after the final scans are done.

But if going for the 1st suggestion make sure you select the correct drive to format, because it WILL format your OS drive while you are using it, and once you tell it start thats it, so really make sure you select the right drive, if in doubt take note of the options offered then disconnect the drive, then ask back here and we can tell you which one is correct, but it "should" be obvious for the most part, hope this helps.

Hi, This is exactly what I've done; -I downloaded a windows update which was a prerequisite for disabling autorun. -I disabled autorun via gpedit.msc -I downloaded and installed Hard Disk Low Level Formatting Tool. -I restarted my computer to allow for changes made by windows update. -I connected my external hard drive but did not open it. -I ran Hard Disk Low Level Formatting Tool on it. How should we proceed to make sure no viruses are there? I haven't opened my external hard drive yet, just in case.

Sounds good, have you installed the other scanners yet ? probably a bit late now if you've connected the drive already, but TBH they probably wont be needed, it's just another level of protection\security should the worst happen, because often you can't install after as the infection blocks you, but by running the format tool on the drive you will be removing the infection(s).

So by the sound of it your ready to format it, so load the format tool, look in your "My Computer" and identify the drive letter for the USB drive, but do NOT enter it, look for that drive in the formating list of options and highlight it, make sure you look 3 of 4 times and make sure you identify EVERY entry in the formatting list it gives you, as I've said previously this program WILL wipe your OS drive while you are using it if you select the wrong drive, so take extreme care.

Just looked in mine again and one of my drives is not identified by drive letter, this is a prime example of why I stress the importance of making sure you select the correct drive, because it may not always be as simple as a drive letter, so a 2nd way to double check you have the right drive selected is to look at the drive size, this program shows you how big each drive is, which aids identifying the correct drive, so if you have the slightest doubt about which drive to select take a screenshot of what it shows you and post back with it, odds on you will easily identify the drive, but this gives you a safety net if needed.

When your ready then proceed, thats it, let it run and carry on surfing as normal, when it's finished the drive can be formatted again and then used, now this second format you do from windows normally, this makes the drive usable by windows, the main format your doing first is purely to destroy ALL data on the drive which wipes the infection(s), so don't be confused by the 2 formats here.
When you have reached this stage I suggest running Flash Disinfector and install to this drive, it loads a hidden file to the drive which blocks auto run, this will help block future infections, hope all goes well for you.

What's the format tool you're talking about? What's the exact name of the tool I'm meant to use now?

I'm sorry for any confusion, there is no other tool as such, the easiest way to describe it, is think of when you get a new drive, when you first connect it the system needs to format it before it will see it, this format sets the file structure (NTFS or FAT etc), once that format is done the system will see and be able to use the drive. But please don't confuse that with the current format we are discussing to remove the infection(s), because this format will completely zero the drive in a very thorough way to destroy EVERYTHING on the drive, so in essence once you have completed this format you will have what the system will see as a brand new drive, sorry if I wasn't clear enough before, and sorry if it still sounds confusing, it's not always easy to describe certain things, but even if this still doesn't make sense to you please don't worry, just format using the Low Level tool as discussed previously, and don't worry about the other format mentioned yet. Once this format is complete post back and then I will take you through anything else that is needed, but first just run the HDD Low Level Format Tool to eradicate the infection(s) then reply back with any further questions to do with getting the system to see the drive after if needed, hope this makes a little more sense now.

Hi, I've completed the HHD Low Level Format Tool's Format. How to proceed?

OK great stuff, now with the drive unplugged, and the system booted to the desktop and with everything loaded (eg all background processes etc), then connect the USB drive, with luck the system will see it and pick it up as a new device, if it does it "should" give you a pop up acknowledging the new device, and advising it needs to be formatted before you can use it, then it should offer to do this for you, if so just follow the prompts and allow it to do this for you, once it's finished the system will see it properly and you will then be able to use it, job done. Now should the system not want to play nice this way we can go into the admin tools in the control panel and do this from there, and if need be will talk you through that should it be required, but I'm pretty confident the system should pick up on it and deal with it as described above, so see how you go and let me know how it goes, and we can go from there if required.

Hi, I used My Computer > Manage > Disk Management to initiate my disk. That worked fine. I then converted my drive into an extended partition and when I tried to format it into a logical partition it failed numerous times. I have a feeling it has something to do with HDDLLFT? Because when i ran that, it finished successfully but it had many many errors. It had the same sector error or something from 30,000,000 to 120,000,000.

Ouch, thats starting to suggest the drive is on the way out, best bet there is to get and run the makers utility, not sure if you've mentioned the make ?
But most of the big names provide free utility's to scan their drives, run the extended tests and they should tell you if the drive is starting to fail, if it is (sods law is a swine) then hopefully you can just replace the drive cheaply enough, or if it's under warranty you can get it sorted.

Should the maker of your drive not offer such a utility then use HD Tune to test the drive, but makers will prefer they're software results if claiming under warranty, Seagate\Maxtor and WD all have utility's, Samsung do not, other lesser names probably wont have one either, see what that reports back and we can go from there.

*edit
Just had a look as it seemed crazy that Samsung didn't have such a tool, and I found This, never knew they had one before lol, learnt something at least lol.