[Jingtian]

One of my friends did not use antiviruses on his computer. Although he knew there were viruses in his computer, he didn't do anything about it, until the OS crashed. I helped him reinstall the OS but it crashed a day later. I helped him reinstall it again, and installed KAV and detected some viruses, trojans, adwares, etc and had them disinfected or deleted if disinfect failed.

After reboot, there were no viruses or trojans. But when I double click on C: or D: or E:, the disk won't open. I have to right click on C: and choose Open. The viruses disinfected or deleted included:

worm.p2p.generic
socksa.exe
trojan.win32.vb.atg
tel.xls.exe

I had expected that to happen, as recently the virus autorun.exe is very rampant on campus.

So what should he do so that he can open his disk C: by double clicking on it?

[Lucian Bara]

I think best would be to format c: then reinstall windows with network cable unplugged. install service pack 2 from a cd (downloaded before). Afterwards install kav/kis+firewall and get windows updates.
I would recommend this since it look that there's an unknown owrm on the pc too.

[Jingtian]

lucianbara, on Nov 12 2006, 02:47, said:

I think best would be to format c: then reinstall windows with network cable unplugged. install service pack 2 from a cd (downloaded before). Afterwards install kav/kis+firewall and get windows updates.
I would recommend this since it look that there's an unknown owrm on the pc too.

Yes, I'll try. The virus might be rose.exe, which is quite rampant on campus recently.

[norwegian]

Jingtian, on Nov 12 2006, 13:49, said:

lucianbara, on Nov 12 2006, 02:47, said:

I think best would be to format c: then reinstall windows with network cable unplugged. install service pack 2 from a cd (downloaded before). Afterwards install kav/kis+firewall and get windows updates.
I would recommend this since it look that there's an unknown owrm on the pc too.

Yes, I'll try. The virus might be rose.exe, which is quite rampant on campus recently.

You could also try downloading this handy tool :- Boot and Nuke

http://dban.sourceforge.net/

Load it to a floppy or CD, then use it to boot off. It will wipe the hard drive. Do it 2 or 3 times if you want. It won't hurt. Then as Lucian already mentioned, re-install.

The only other things you can really do is wonder whether bios in the M/B or other hardware, video card bios for example, but I doubt you'd need to be that concerned. How serious with study/privacy v's how much you are concerned about what you really do, filesharing etc

[Jingtian]

Thanks, I'll wait until I have time.
And my friend is not in a hurry, either.
First I'll try to reinstall the OS without internet connection. Hope it will work.

[ESecurity]

i have the solution ...

the worm virus use auto-run and copy the autorun.inf into local drives .. wich access the virus path ..

u should follow the steps :

1 - from the Explorer Menu select tools --> folder options --> View --> Show hidden files and folders = mark it true
2 - if u didn't find the folder options as effect of virus infection .. make new empty text file and save it into the drives
with the name " autorun.inf " .. then the computer ask u to remove the last one click yes .. then delete the new one
which is not hidden .
3 - restart your computer to take effect of changes.

*- every think oky now !

Good Bye ..

any help i am ready

[Jingtian]

ESecurity, on Apr 5 2007, 18:41, said:

i have the solution ...

the worm virus use auto-run and copy the autorun.inf into local drives .. wich access the virus path ..

u should follow the steps :

1 - from the Explorer Menu select tools --> folder options --> View --> Show hidden files and folders = mark it true
2 - if u didn't find the folder options as effect of virus infection .. make new empty text file and save it into the drives
with the name " autorun.inf " .. then the computer ask u to remove the last one click yes .. then delete the new one
which is not hidden .
3 - restart your computer to take effect of changes.

*- every think oky now !

Good Bye ..

any help i am ready

ESecurity, hi & welcome.

Thanks. Actually I downloaded a small tool and successfully killed the trojan. It is a Chinese trojan and it can only be cured by a Chinese tool.

Actually I have another solution now, but I have to turn to DOS for help.
dir /A
ATTRIB -S -H AUTORUN.INF
DEL AUTORUN.INF /S /Q
All similar trojans can be killed by such command lines.

And if anyone wants to protect his/her removable disk against such trojans, he/she can delete autorun.exe and creat a folder called autorun.inf in the root directory of the disk.

Anyway, I will try your method first, if I come across such trojans again.