[Resolved] Unable to delete malware from flash drive

Dear Experts, My flash drive contained a thing called "autorun.inf" which my antivirus (Trend Micro Internet Security) defined it as "Mal_Otorun1" There is also a file (which i can't even find…) that is located in the recycler, called "isetup32.exe" and is classified by the antivirus as "Worm_Generic.DIT" the "worm" is found both in my C: drive and H: (my flash disk) drive, which is both in recycler (hidden file). i am wondering if they are both the same? since their name look similar. Here are some info on my PC: OS: WIndows XP (home, i think) Chinese Antivirus: Trend Micro Internet Security (2007 version, not expired) Internet Explorer: IE 8 (and firefox, though not set as default) I also have downloaded HijackThis.exe but not sure how to do the scan >_< There is also problems with certain office files (word, excel, etc…), which i am not sure if it's caused by the virus, that shows strange text rather than "open file…" which is suppose to happen when you right click. The Office programs, however, doesn't seem to have any error in the program when i type, so I guess it might not cause a lot of problem other than display of right clicking it. Please Help! Thanks a lot in advance! ifeelgood

Hi LDTate, Sorry for the late reply, I wasn't able to run MBAM as my computer still have those weird symbols similar (please see attachment), even though i installed it both in chinese and english. For DDS, my computer always ask me to choose a program for it to start, i am not sure how can i let it start on itself? For GMER, everytime i run the scan, after 5 minute my computer starts to freeze, even though i think the program is still running. Should i try and wait for a longer time for the scan to complete? (I wait for 30 minutes then i close down my power… ) Please give me further instructions >< I am not really good at handling computers. Again! Thanks a lot for your help!

Vista users:
1. These tools MUST be run from the executable. (.exe)
2. With Admin Rights (Right click, choose "Run as Administrator") every time you run them


1) exeHelper
Please download exeHelper to your desktop.
Double-click on exeHelper.com to run the fix.
A black window should pop up, press any key to close once the fix is completed.
Post the contents of log.txt (Will be created in the directory where you ran exeHelper.com)
Note: If the window shows a message that says "Error deleting file", please re-run the program before posting a log - and post the two logs together (they will both be in the one file).


Now see if MBAM willl run

Hi LDTate, Thanks a lot for the quick reply, My computer's system is Windows XP, if that helps. I ran exehelper.com and here is the following log exeHelper by Raktor Build 20091220 Run at 09:36:02 on 01/13/10 Now searching… Checking for numerical processes… Checking for sysguard processes… Checking for bad processes… Checking for bad files… Checking for bad registry entries… Resetting filetype association for .exe Resetting filetype association for .com Resetting userinit and shell values… Resetting policies… –Finished– Also, not sure it it's suppose to be the way it is, the dds file is .scr rather than .exe, is it suppose to still run? or did i download the wrong file? The Mbam still appear to have weird symbol (is it possible that it could be some kind of language problem such as Unicode 8??, because i have used app locale before so that i can able to run some programs that my computer isn't able to read, is it possible that the setting was changed that caused the effect?) Also, I think the reason for the GMER to stall is because there are too much files to scan? is there any other things that i can untick to make the scanning faster? Also, for the autorun.inf, my antivirus started to alert me after i plug in my usb, am i think i read before in other topics that autorun.inf could be a good program that helps to prevent infections? Since my usb has been plugged into school computer, could it be the school's computer that auto-installed this device into my usb? Thanks a lot for your help!

I'm not sure what you're up against at this point.
Your USB drive could have been infected at school or infected the school computer you plugged it into.

I take it MBAM won't run?

Lets try combofix.



Download ComboFix from one of these locations:

Link 1
Link 2


* IMPORTANT !!! Save ComboFix.exe to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs
  
  
• Double click on ComboFix.exe & follow the prompts.
  
  Note: Combofix will run without the Recovery Console installed.
  
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
"copy/paste" a new HijackThis log file into this thread as well.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Give it atleast 20-30 minutes to finish if needed.


Also please describe how your computer behaves at the moment.

Hi LDTate, Very sorry for being not clear I am able to run MBAM, but after i open up the program, it shows words/symbols that i don't really recognize (it is the same kind of words that happens when i play some programs in which the language of my computer isn't able to read, which i have to run app locale and choose the appropriate language that matches that program in order for the program to show the correct words) I was wondering if you could to a screenshot as to what to press for the MBAM program? i think the buttons work, but since it's weird symbols, i don't know which one to press. Also, could the language thing be some kind of setting in my computer that could change? rather than malware? When i run combofix (i don't really like the program, since after it does it, it sort of makes my computer unable to display a lot of the utilities like USB port names, which my internet relys on), do i need to plug in the flash drive while running the program? Just to be clear, the "autorun.inf" is a hidden file inside my flash drive, and there are programs called "isetup32.exe" and they are in a hidden recycler file in both the C:/ and in my flash drive, which when i went into the folder and can't find it. Another strange thing is also that my computer only detects the "isetup32.exe" everytime my flash drive is connected through the USB port. Other than that, my computer seemed to be all fine. If possible, is there anything i can do to fix it before using the combofix program to fix my computer? Sorry for asking a lot >< and thanks a lot for your help and patience!

Is your windows os in english?

Hi LDTate, Unfortunately.. not >< My computer is Windows XP Home Traditional Chinese but i did tried to install the chinese version and english version of the mbam seperately, but they still appear to have those weird symbol. The symbols (i think it's a kind of language which the computer couldn't display) happened long ago with a program that requires to be run in simplified chinese, but my computer is in traditional chinese. I then used app locale, a program that allows to start the .exe program in a certain langage, to help run the program so that it is displayed in simplified chinese, which matches the requirement of the program. I was wondering if there could be something wrong with the setting after i used app locale which i didn't change back, and result with those weird symbols in some programs. Because almost all other programs run fine, only specific ones have those appear, which i think it doesn't affect anything other than it's display. Thanks a lot for your help!

http://forums.whatthetech.com/Help_deletin…re_t100564.html

Is that the same computer?

Hi LDTate, O_O yeh, that one, but then after that i reinstall my entire OS with a new hard drive.. as after combo fix there are some things than went awkward and was also fixed by the experts in this forum and I think i also accidentally delete a bootup file for my windows… so yeh >< Thanks a lot for your help!

You could try System Restore. 1. Click Start. 2. Point to All Programs. 3. Point to Accessories. 4. Point to System Tools. 5. Click System Restore. 6. Follow the instructions on the wizard. See if you can find a date the the PC worked.

Hi LDTate, Sorry for asking a lot of questions If i run system restore, will i lose the existing programs if i restore it back to the time i install a specific program? Also, i was wondering if there are any method to force delete the program "autorun.inf", because after i press delete, it appears back again in my USB drive ><. and I can't see the file "isetup32.exe" in the hidden recycler also… which my antivirus was able to catch it. But when i want the antivirus to delete it, it always says "Quarantine (something error, please close off the program before continue (something like that… i translated it))". Thanks a lot for your help!

How to use System Restore


Download this file
http://download.bleepingcomputer.com/sUBs/…Disinfector.exe


For all of your USB or external drives:

Open the drive.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Uncheck "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Uncheck "Hide protected operating system files."
Click Apply, and then click OK.

Look for the file autorun.inf and delete it if found.
Also look for a Folder that's named resycled, make sure of the spelling and delete the folder if found. DO NOT delete the Recycler folder.

Now run the Flash_Disinfector.exe.

Be sure to insert any flash drives or USB devices that you use.

Do this for every USB / external drives:

Hi LDTate,

Thanks a lot for your help!!


I couldn't find the "isetup32.exe" file even after i untick the buttons to let it show the names, but the scanner told me it is under

H:/ RECYCLER/ S-1-5-21-1482476501-1644491937-682003330-1013

I also couldn't find the resycled, and the autorun.inf, after i deleted it, it still came back up, so i ran the Flash_Disinfector.exe

After that, it made a folder called autorun.inf and have lpt3.This folder was created by Flash_Disinfector file in it, do i then delete the file?

Once again, sorry for bothering you that long, and thanks in advance!