Jump to content


Friends, we are happy to invite you to our NEW Global Kaspersky Club! Please follow this link www.kasperskyclub.com , sign-in and enjoy our new platform!


Photo

Double click on Disk C: and it won't open


  • Please log in to reply
6 replies to this topic

#1 Jingtian

Jingtian

    Frequent poster

  • Global Moderators
  • PipPipPipPipPipPip
  • 1236 posts

Posted 11 November 2006 - 06:03 PM

One of my friends did not use antiviruses on his computer. Although he knew there were viruses in his computer, he didn't do anything about it, until the OS crashed. I helped him reinstall the OS but it crashed a day later. I helped him reinstall it again, and installed KAV and detected some viruses, trojans, adwares, etc and had them disinfected or deleted if disinfect failed.

After reboot, there were no viruses or trojans. But when I double click on C: or D: or E:, the disk won't open. I have to right click on C: and choose Open. The viruses disinfected or deleted included:

worm.p2p.generic
socksa.exe
trojan.win32.vb.atg
tel.xls.exe

I had expected that to happen, as recently the virus autorun.exe is very rampant on campus.

So what should he do so that he can open his disk C: by double clicking on it?

#2 Lucian Bara

Lucian Bara

    Jedi Master

  • Global Moderators
  • PipPipPipPipPip
  • 912 posts

Posted 11 November 2006 - 09:47 PM

I think best would be to format c: then reinstall windows with network cable unplugged. install service pack 2 from a cd (downloaded before). Afterwards install kav/kis+firewall and get windows updates.
I would recommend this since it look that there's an unknown owrm on the pc too.
Intel Core 2 Duo E4500 @ 2,2GHz, Msi Asus P5PL2-E, 2048MB-DDR2 (2*1024), Leadtek PX6600 256MB, Teac DV-W516GA, Leadtek tv2000 xp Expert, HDD 200GB*2 (sata/sata2)

#3 Jingtian

Jingtian

    Frequent poster

  • Global Moderators
  • PipPipPipPipPipPip
  • 1236 posts

Posted 12 November 2006 - 08:49 AM

I think best would be to format c: then reinstall windows with network cable unplugged. install service pack 2 from a cd (downloaded before). Afterwards install kav/kis+firewall and get windows updates.
I would recommend this since it look that there's an unknown owrm on the pc too.


Yes, I'll try. The virus might be rose.exe, which is quite rampant on campus recently.

#4 norwegian

norwegian

    Frequent poster

  • Moderators
  • PipPipPipPipPipPip
  • 1097 posts

Posted 14 November 2006 - 04:52 PM

I think best would be to format c: then reinstall windows with network cable unplugged. install service pack 2 from a cd (downloaded before). Afterwards install kav/kis+firewall and get windows updates.
I would recommend this since it look that there's an unknown owrm on the pc too.


Yes, I'll try. The virus might be rose.exe, which is quite rampant on campus recently.


You could also try downloading this handy tool :- Boot and Nuke

http://dban.sourceforge.net/

Load it to a floppy or CD, then use it to boot off. It will wipe the hard drive. Do it 2 or 3 times if you want. It won't hurt. Then as Lucian already mentioned, re-install.

The only other things you can really do is wonder whether bios in the M/B or other hardware, video card bios for example, but I doubt you'd need to be that concerned. How serious with study/privacy v's how much you are concerned about what you really do, filesharing etc

#5 Jingtian

Jingtian

    Frequent poster

  • Global Moderators
  • PipPipPipPipPipPip
  • 1236 posts

Posted 14 November 2006 - 06:49 PM

Thanks, I'll wait until I have time.
And my friend is not in a hurry, either.
First I'll try to reinstall the OS without internet connection. Hope it will work.

#6 ESecurity

ESecurity

    Newbie

  • Members
  • 6 posts

Posted 05 April 2007 - 01:41 PM

i have the solution ...

the worm virus use auto-run and copy the autorun.inf into local drives .. wich access the virus path ..

u should follow the steps :

1 - from the Explorer Menu select tools --> folder options --> View --> Show hidden files and folders = mark it true
2 - if u didn't find the folder options as effect of virus infection .. make new empty text file and save it into the drives
with the name " autorun.inf " .. then the computer ask u to remove the last one click yes .. then delete the new one
which is not hidden .
3 - restart your computer to take effect of changes.

*- every think oky now !

Good Bye ..

any help i am ready

#7 Jingtian

Jingtian

    Frequent poster

  • Global Moderators
  • PipPipPipPipPipPip
  • 1236 posts

Posted 05 April 2007 - 04:18 PM

i have the solution ...

the worm virus use auto-run and copy the autorun.inf into local drives .. wich access the virus path ..

u should follow the steps :

1 - from the Explorer Menu select tools --> folder options --> View --> Show hidden files and folders = mark it true
2 - if u didn't find the folder options as effect of virus infection .. make new empty text file and save it into the drives
with the name " autorun.inf " .. then the computer ask u to remove the last one click yes .. then delete the new one
which is not hidden .
3 - restart your computer to take effect of changes.

*- every think oky now !

Good Bye ..

any help i am ready


ESecurity, hi & welcome.

Thanks. Actually I downloaded a small tool and successfully killed the trojan. It is a Chinese trojan and it can only be cured by a Chinese tool. :)

Actually I have another solution now, but I have to turn to DOS for help.
dir /A
ATTRIB -S -H AUTORUN.INF
DEL AUTORUN.INF /S /Q
All similar trojans can be killed by such command lines.

And if anyone wants to protect his/her removable disk against such trojans, he/she can delete autorun.exe and creat a folder called autorun.inf in the root directory of the disk.

Anyway, I will try your method first, if I come across such trojans again.