Author Topic: autorun.inf worm removal (Read 24662 times)

PatriciaW · « **on:** March 11, 2009, 02:44:52 PM »

Hello again,
Am I in the right place for this type of situation?

On my Desktop PC I picked up an autorun.inf worm or virus from my flash drive. It was changing how my D: drive was running. It was making me open it like a file. I don't know if that PC is fixed yet.. I have used that flash drive on this laptop. I didn't find any files like that on it.. Instead I found a virus called HTML/Spoofing.Gen. I quarantined and removed it with Avira Antivir. I did everything on the list of things to do and here is the logs...

Should I do all this on the Desktop PC with the flash drive attached to clean those out to or, is there a different procedure for the autorun.inf worm??
Thanks .. Patricia

[attachment deleted by admin]

evilfantasy · « **Reply #1 on:** March 12, 2009, 01:26:33 PM »

Sorry for the delay.

Download random's system information tool (RSIT) by random/random from and save it to your Desktop.

Double click on RSIT.exe to run.
Click Continue at the disclaimer screen.
Once it has finished, two logs will open.
log.txt <will be maximized and info.txt <will be minimized
Please post the contents of both logs in the next reply.

evilfantasy · « **Reply #2 on:** March 12, 2009, 01:28:47 PM »

Quote

Should I do all this on the Desktop PC with the flash drive attached to clean those out to or, is there a different procedure for the autorun.inf worm??

Sorry I missed that the first time through.

Use this for any flash drive you have used on the infected computer.

Flash Drive Cleanup

Download Flash Disinfector by sUBs and save it to your Desktop.

Double-click Flash_Disinfector.exe to run it.
Your desktop and icons may disappear. This is normal.
It will do a cleanup of removable storage devices, and write a protected Autorun.inf file to help prevent re-infection.
Follow any prompts that may appear.
The utility may ask you to insert your flash drive and/or other removable drives including your mobile phone. Please do so and allow the utility to clean up those drives as well.
Wait until it has finished scanning and then exit the program.
There will be no GUI interface or log file produced.
Reboot your computer when done.

.
Note: Flash_Disinfector will create a hidden folder named autorun.inf in each partition and every USB drive plugged in when you ran it. Don't delete this folder...it will help protect your drives from future infection.

Will be awaiting the RSIT log...

harry 48 · « **Reply #3 on:** March 12, 2009, 01:45:06 PM »

quote author=PatriciaW link=topic=78698.msg518498#msg518498 date=1236883936]
I was wondering the same thing myself. I followed everything I was suppose to do and still no reply.. I see they answer others with hijack logs.... If they won't answer and don't have the knowledge why make it sound like they do in the first place? waste of my time going through all that stuff and then no one will help me anyway. False advertising I might add... Free computer help for EVERYONE.. I will go else where from now on and tell others to do the same. Have you tried majorgeeks.com???

That's where I am heading.. good luck with your situation..
[/quote]

take your time and wait this time , not like above , help is not at hand for every-one

on tap , harry

Dias de verano · « **Reply #4 on:** March 12, 2009, 02:23:32 PM »

Yup, leave the attitude at the door, lady.

evilfantasy · « **Reply #5 on:** March 12, 2009, 03:22:14 PM »

Trust me you will have a much longer wait at MG's. They usually have at the least a 3 day turn around on the first reply. And their pre-steps are much more involved. Good luck!!

PatriciaW · « **Reply #6 on:** March 13, 2009, 09:39:59 AM »

Evil fantasy
thank you for your help even after my attitude on the other post. Its just frustrating not being able to fix things on my own.. I haven't had any computer training I learn as i go. no one was born with this knowledge. it's taught to you. Even big companies get a virus so for Dias to act like I'm an idiot for getting a virus is uncalled for if he can't help me then don't answer posts that wasn't addressed to him. . I have never posted to a forum before and didn't understand why you skipped me and helped others that posted after me once again sry bout the attitude and thanks for the help. here are the logs you asked for...

[attachment deleted by admin]

PatriciaW · « **Reply #7 on:** March 13, 2009, 10:10:11 AM »

Quote from: evilfantasy on March 12, 2009, 01:28:47 PM

Sorry I missed that the first time through.

Use this for any flash drive you have used on the infected computer.

Flash Drive Cleanup

Download Flash Disinfector by sUBs and save it to your Desktop.

Double-click Flash_Disinfector.exe to run it.
Your desktop and icons may disappear. This is normal.
It will do a cleanup of removable storage devices, and write a protected Autorun.inf file to help prevent re-infection.
Follow any prompts that may appear.
The utility may ask you to insert your flash drive and/or other removable drives including your mobile phone. Please do so and allow the utility to clean up those drives as well.
Wait until it has finished scanning and then exit the program.
There will be no GUI interface or log file produced.
Reboot your computer when done.
.
Note: Flash_Disinfector will create a hidden folder named autorun.inf in each partition and every USB drive plugged in when you ran it. Don't delete this folder...it will help protect your drives from future infection.

Will be awaiting the RSIT log...

Antivir found a worm while downloading it..so i didn't open it.

PatriciaW · « **Reply #8 on:** March 13, 2009, 10:28:11 AM »

I found out it's a false positive.. so I am trying it again...

evilfantasy · « **Reply #9 on:** March 13, 2009, 10:57:59 AM »

Many of the tools I will have you use will be flagged by Avira. The way they work is similar to that of malware. Fight fire with fire...

Don't let Dias bother you. He is somewhat likable once you figure out he has that attitude with everyone. Right Dias?

Be right back. Looking at the logs now.

Dias de verano · « **Reply #10 on:** March 13, 2009, 11:08:19 AM »

Quote from: evilfantasy on March 13, 2009, 10:57:59 AM

Don't let Dias bother you. He is somewhat likable once you figure out he has that attitude with everyone. Right Dias?

More or less. I just can't stand people who come on here badmouthing the "service" they get (or don't get), and/or expecting to be at the head of the queue.

I still find the title of this thread objectionable.

evilfantasy · « **Reply #11 on:** March 13, 2009, 11:18:12 AM »

OK back to business now. Everyone can play nicely long enough to take care of this I hope.

Do you know what this is?

Quote

O23 - Service: SessionLauncher - Unknown owner - C:\Users\ADMINI~1\AppData\Local\Temp\DX9\SessionLauncher.exe (file missing)

If not then please scan it.

Please go to VirusTotal.com
(If more than one file needs scanned they must be done separately and logs posted for each one)

1. Copy the file path in the below Code box:

Code: [Select]

C:\Users\ADMINI~1\AppData\Local\Temp\DX9\SessionLauncher.exe2. At the upload site, click once inside the window next to Browse.
3. Press Ctrl+V on the keyboard (both at the same time) to paste the file path into the window.
4. Next click Send File
Your file will possibly be entered into a queue which normally takes less than a minute to clear.
This will perform a scan across multiple different virus scanning engines.
Important: Wait for all of the scanning engines to complete.
5. Copy and then Paste the link to the results in the next reply.

PatriciaW · « **Reply #12 on:** March 13, 2009, 02:28:25 PM »

I tried to scan the file and it said path don't exist. I'm pretty sure it's an old music file I transferred via the USB flash drive. The date on the file is from 2006 and I didn't have this laptop at that time.I scanned it with antivir and the malwarebytes neither of them detected anything. I was working on the desk top most of the afternoon. I have dial up so everything takes forever to download and i have to keep switching the telephone cord to whichever computer i am working on.. lol

anything else i need to do?? thanks again..

evilfantasy · « **Reply #13 on:** March 13, 2009, 02:41:55 PM »

Quote from: PatriciaW on March 13, 2009, 02:28:25 PM

I have dial up so everything takes forever to download and i have to keep switching the telephone cord to whichever computer i am working on.. lol anything else i need to do?? thanks again..

I will try to use all small tools so it doesn't take too long to download.

Do you want to get rid of that service since you don't use it anymore or do you need it?

Open HijackThis and select Do a system scan only.

Place a check mark next to the following entries: (if there)

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

.
Important: Close all windows except for HijackThis and then click Fix checked.

Exit HijackThis.

PatriciaW · « **Reply #14 on:** March 13, 2009, 03:13:48 PM »

Ok.. here is a new log from hijackthis. which service were you asking about??? my dial up or something else?

[attachment deleted by admin]

evilfantasy · « **Reply #15 on:** March 13, 2009, 03:22:24 PM »

This service:

O23 - Service: SessionLauncher - Unknown owner - C:\Users\ADMINI~1\AppData\Local\Temp\DX9\SessionLauncher.exe (file missing)

PatriciaW · « **Reply #16 on:** March 13, 2009, 03:36:02 PM »

I don't use that anymore and will delete it..

So how does things look now?? Is my computer healed??? i know its running quicker even though I'm on dial up..Now I have to fix the other one.. can I post the logs on here or start a new topic?? That ones gonna take some time to do.. thanks again...

evilfantasy · « **Reply #17 on:** March 13, 2009, 03:43:31 PM »

You can't just delete a service...

Open HijackThis and select Do a system scan only.

Place a check mark next to the following entries: (if there)

- O23 - Service: SessionLauncher - Unknown owner - C:\Users\ADMINI~1\AppData\Local\Temp\DX9\SessionLauncher.exe (file missing)

Important: Close all windows except for HijackThis and then click Fix checked.

Exit HijackThis.

----------

Now, go to Start > Run, and copy/paste the following blue text into the Open box:

sc stop "SessionLauncher"

Now click OK.

Again in the Run box copy then paste:

sc delete "SessionLauncher"

Click: OK

----------

If you have another computer then please start a new topic for it. Post here when you do so I will know. It sometimes takes me a while before I start looking for new threads to work on.

PatriciaW · « **Reply #18 on:** March 13, 2009, 04:59:49 PM »

hey Evilfantasy
how do i know if that worked. nothing opened when i did that. I saw a quick flash of something trying to open but,that was it.

evilfantasy · « **Reply #19 on:** March 13, 2009, 05:03:30 PM »

To make sure you can use another method that will work for sure.

Go to Start > Run and type Notepad.exe then click OK.

Copy and paste the following text within the code box into the new Notepad file.

Code: [Select]

@ECHO OFF
sc stop "SessionLauncher"
sc delete "SessionLauncher"
exit

In Notepad select File and Save as
Choose the Save to location to be the Desktop and for the File name: type in fixme.bat making sure that the Save as type field says All files.

Next double click fixservice.bat to run it.
A black box should open and close after a short time, this is normal.
Do not continue until the black box has closed
Delete fixservice.bat from the Desktop.

PatriciaW · « **Reply #20 on:** March 13, 2009, 05:22:01 PM »

ok done and the same quick flash of a box but, it didn't open.

evilfantasy · « **Reply #21 on:** March 13, 2009, 05:26:09 PM »

It won't actually open. It only takes a split second. Run a new HJT scan and see if the entry is gone, which it should be now.

PatriciaW · « **Reply #22 on:** March 13, 2009, 05:43:49 PM »

heres the new log.. I don't see it anymore.

[attachment deleted by admin]

evilfantasy · « **Reply #23 on:** March 13, 2009, 05:50:38 PM »

Looks OK but I am suspicious of one entry. We can look at it with ComboFix.

Download ComboFix© by sUBs from one of the below links. Be sure top save it to the Desktop.

Link #1
Link #2

**Note: It is important that it is saved directly to your Desktop

Close any open Web browsers. (Firefox, Internet Explorer, etc) before starting ComboFix.

Temporarily disable your antivirus, and any antispyware real time protection before performing a scan. Click this link to see a list of security programs that should be disabled and how to disable them.

Double click combofix.exe & follow the prompts.
When finished ComboFix will produce a log for you.
Post the ComboFix log in your next reply.

Important: Do not mouseclick ComboFix's window while it is running. That may cause it to stall.

Remember to re-enable your antivirus and antispyware protection when ComboFix is complete.

If you have problems with ComboFix usage, see How to use ComboFix

PatriciaW · « **Reply #24 on:** March 13, 2009, 06:43:56 PM »

heres the combofix log.

[attachment deleted by admin]

evilfantasy · « **Reply #25 on:** March 13, 2009, 07:16:48 PM »

Looks good.

Final steps.

Click START then RUN
Now type Combofix /u in the runbox
Make sure there's a space between Combofix and /u
Then hit Enter.

.
.
The above procedure will:

Delete:
ComboFix and its associated files and folders.
VundoFix backups, if present
The C:\Deckard folder, if present
The C:_OtMoveIt folder, if present

Reset the clock settings.
Hide file extensions, if required.
Hide System/Hidden files, if required.
Set a new, clean Restore Point.

.
----------

Use the Secunia Software Inspector to check for out of date software.

Click Start Now
Check the box next to Enable thorough system inspection.
Click Start
Allow the scan to finish and scroll down to see if any updates are needed.
Update anything listed.

.
----------

Go to Microsoft Windows Update and get all critical updates.

----------

I suggest using WOT - Web of Trust. WOT is a free Internet security addon for your browser. It will keep you safe from online scams, identity theft, spyware, spam, viruses and unreliable shopping sites. WOT warns you before you interact with a risky website. It's easy and it's free.

SpywareBlaster - Secure your Internet Explorer to make it harder for ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox.
* Using SpywareBlaster to protect your computer from Spyware and Malware
* If you don't know what ActiveX controls are, see here

Check out Keeping Yourself Safe On The Web for tips and free tools to help keep you safe in the future.

Also see Slow Computer? It May Not Be Malware for free cleaning/maintenance tools to help keep your computer running smooth.

PatriciaW · « **Reply #26 on:** March 13, 2009, 07:54:42 PM »

I seem to have alot of problems running java on my computers. It takes forever to get it working. This is what Secunia says.

Status / Currently Processing:
There might be problems loading the Java Applet in your browser.

I'm not sure how to get you a copy of the java console. I tried copy and paste. it won't do it. I found out about the console when i was working on getting my pogo games to run. it still takes many tries to get java to run the game. sometimes an hour. then it takes another 20 minutes to load the game.. lol

any suggestions?? The scan won't do anything because the applet problem.

evilfantasy · « **Reply #27 on:** March 13, 2009, 07:58:40 PM »

Create An Uninstall List

Start HijackThis
Click on the Open the Misc Tools section
Click on the Open Uninstall Manager button.
Click on the Save list button and specify where you would like to save this file and click Save.
- When you press Save button a notepad will open with the contents of that file.
Copy and paste that list in your reply.

PatriciaW · « **Reply #28 on:** March 13, 2009, 08:09:43 PM »

Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 8.1.2
Adobe Shockwave Player 11
ALPS Touch Pad Driver
Apple Mobile Device Support
Apple Software Update
Avira AntiVir Personal - Free Antivirus
Broadcom Gigabit Integrated Controller
Broadcom WLAN
Camera Center
CCleaner (remove only)
Choice Guard
Conexant HD Audio
DirectXInstallService
Drag-to-Disc
DrmRemoval 3.6.3
HDAUDIO Soft Data Fax Modem with SmartCP
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Intel(R) Graphics Media Accelerator Driver
InterVideo WinDVD
iTunes
Java(TM) 6 Update 12
JMicron JMB38X Flash Media Controller
Lenovo Care
Lenovo Care Supplement
Lenovo EasyCamera
Lenovo Registration
Lenovo System Interface Driver
Lenovo System Toolbox
Malwarebytes' Anti-Malware
Message Center
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1
Microsoft Search Enhancement Pack
Microsoft Sync Framework Runtime Native v1.0 (x86)
Microsoft Sync Framework Services Native v1.0 (x86)
Microsoft Visual C++ 2005 Redistributable
Mozilla Firefox (3.0.7)
MSVCRT
MSXML 4.0 SP2 (KB954430)
NetZero Connection Wizard
NetZero Internet
On Screen Display
PM Driver
Power Ux Customization
Presentation Director
Product Recovery Disc Burning Utility
QuickTime
Registry patch for Windows Vista USB S3 PM Enablement
Registry patch of Changing Timing of IDLE IRP by Finger Print Driver for Windows Vista
Registry Patch of Enabling Device Initiated Power Management(DIPM) on SATA for Windows Vista
Registry patch to improve USB device detection on resume from sleep for Windows Vista
Rescue and Recovery
Roxio Activation Module
Roxio Central Audio
Roxio Central Copy
Roxio Central Core
Roxio Central Data
Roxio Central Tools
Roxio Creator Small Business Edition
Roxio Creator Small Business Edition
Roxio Express Labeler 3
Sonic CinePlayer Decoder Pack
Sonic Icons for Lenovo
SUPERAntiSpyware Free Edition
System Update
ThinkVantage Access Connections
ThinkVantage Status Gadget
ThinkVantage Technologies Welcome Message
Ulead Photo Express 4.0 SE
Wallpapers
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Essentials
Windows Live Messenger
Windows Live Sign-in Assistant
Windows Live Toolbar
Windows Live Upload Tool
Yahoo! Messenger
Yahoo! Toolbar

Thanks again!

evilfantasy · « **Reply #29 on:** March 13, 2009, 08:14:25 PM »

Looks OK.

What browser were you using? If Firefox try in IE or the oposite.

Might also clear your java Cache.

Clearing Java Cache

Go to Start > Control Panel and double-click the Java Icon

On the General tab, under Temporary Internet Files, click the Settings button.
Next, click on the Delete Files button
There are two options in the window to clear the cache - Leave BOTH Checked
- Applications
- Applets Trace and Log Files
.
Click OK on Delete Temporary Files Window

Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.

Click OK to leave the Temporary Files Window
Click OK to leave the Java Control Panel.

.
And check this.

Enable Java in Internet Explore

Please open up Internet Explore
Click Tools, then on Internet Options
Click on the tab Advanced
Scroll down too Java (Sun)
Check the box for JRE 1.6*_** (The ** will change depending on the version of Java)

.

Next: Click the tab Security
Click the Custom Level button
Scroll down to Scripting of Java applets
Make sure Enable radio button is checked.
Click OK to save your preference.

PatriciaW · « **Reply #30 on:** March 13, 2009, 08:44:58 PM »

I was using firefox. I got it to work after cleaning the java cache and ran it on IE. I try and keep all the pogo games in the cache so it don't take an hour to load it.. probably not doing me much good keeping them in there for to long..

i have a few things to fix that aren't secure. quicktime,adobe flash player 10.x and macromedia flash player 7.x. windows update is all up to date and i will do the rest in the morning.

evilfantasy · « **Reply #31 on:** March 13, 2009, 08:50:21 PM »

Quicktime should be updated. It has a big security flaw in th eolder versions.

Do this to remove all unstable older versions of Flash.

Download the Flash Player Uninstaller and save it to your desktop.

Run the uninstaller program and then reboot your computer to complete the uninstall.

Download and install the latest version of Flash Player

PatriciaW · « **Reply #32 on:** March 13, 2009, 09:53:06 PM »

the Data Execution Prevention shut down the download and browser. Do i have the settings wrong or something else?? I figured Its best to ask you first before I change the settings. Don't want to put my computer at risk.... its set at turn on DEP for essential windows programs and services only.

evilfantasy · « **Reply #33 on:** March 13, 2009, 09:58:28 PM »

Is this when you try to run the installer, or uninstaller?

Try right clicking it and choose 'Run as Adninistrator'

PatriciaW · « **Reply #34 on:** March 13, 2009, 10:07:19 PM »

The installer. Ok i will try that next. I also tried to add WOT and firefox stopped it and said something about containing hash?? Do I need Adobe flash player installed first before i do that???

thanks so much for the help.

evilfantasy · « **Reply #35 on:** March 13, 2009, 10:12:05 PM »

There is an issue with the most recent Avira AntiVir update so you might want to wait until tomorrow to install it. It suddenly started flagging WOT as dangerous. See here > http://forum.avira.com/wbb/index.php?page=Thread&threadID=84890

Hopefully they get it straightened out pretty fast. I recommend WOT to everyone and Avast to many people. Doesn't look to good for me or Computer Hope.

PatriciaW · « **Reply #36 on:** March 13, 2009, 10:22:16 PM »

Ok I will do that.. So far you have helped me so much and I trust what you tell me to do and I already recomended computer hope to my family.. John the guy that built my desk top PC will sure be happy i found you.. lol He put a lot of work into the PC and i didn't want to ask him for help cause I felt bad for getting the worm on his creation..

thanks for keeping me from having ask him for help.. lol I will try the rest of these downloads tomorrow. Have a good night...

evilfantasy · « **Reply #37 on:** March 13, 2009, 10:25:21 PM »

You too. I'm about to log off so if you have any questions I will be here sometime tomorrow.

See ya...

PatriciaW · « **Reply #38 on:** March 14, 2009, 10:42:26 AM »

Good Morning
I got WOT installed on both browsers today with no problems.

I installed spywareblaster and working on quicktime. One question before I do macromedia flash player. Is it the same thing as Adobe flash player. Once I uninstalled and reinstalled adobe flash player I don't see the macromedia flash player. thank you again.

Dias de verano · « **Reply #39 on:** March 14, 2009, 10:47:08 AM »

Quote

One question before I do macromedia flash player. Is it the same thing as Adobe flash player.

Yes. They are the same thing. Old name Macromedia, new name Adobe.

PatriciaW · « **Reply #40 on:** March 14, 2009, 10:50:42 AM »

Thank you Dias

PatriciaW · « **Reply #41 on:** March 14, 2009, 01:46:02 PM »

I thought I would check in to see if there is any more steps I need to do.. I'm still downloading adobe reader and then need to do quicktime.

unfortunately that will take me a couple more hours or so. Is there anything else I should be doing besides reading your wonderful blog.

evilfantasy · « **Reply #42 on:** March 14, 2009, 01:58:12 PM »

You should be set once that is complete.

PatriciaW · « **Reply #43 on:** March 14, 2009, 02:15:10 PM »

Oh that's great news! I wanna say thanks.. again. Can never thank you enough for the help and all the great tools you gave me to protect my computers so I don't end up back here.

Well, not as a victim anyway but, I will be on here reading all the great information. Take care and thanks.

evilfantasy · « **Reply #44 on:** March 14, 2009, 02:22:52 PM »

Your welcome.

Safe surfing...

harry 48 · « **Reply #45 on:** March 14, 2009, 05:04:10 PM »

patricia w , i'm glad to see that you finished up a happy girl and will be back

[attachment deleted by admin]

Computer Hope Forum

News:

Author Topic: autorun.inf worm removal (Read 24662 times)

PatriciaW

evilfantasy

evilfantasy

harry 48

Dias de verano

evilfantasy

PatriciaW

PatriciaW

PatriciaW

evilfantasy

Dias de verano

evilfantasy

PatriciaW

evilfantasy

PatriciaW

evilfantasy

PatriciaW

evilfantasy

PatriciaW

evilfantasy

PatriciaW

evilfantasy

PatriciaW

evilfantasy

PatriciaW

evilfantasy

PatriciaW

evilfantasy

PatriciaW

evilfantasy

PatriciaW

evilfantasy

PatriciaW

evilfantasy

PatriciaW

evilfantasy

PatriciaW

evilfantasy

PatriciaW

Dias de verano

PatriciaW

PatriciaW

evilfantasy

PatriciaW

evilfantasy

harry 48