Click here to get back home

recusive folder usb boot sector... virus
 Home | NewsGroups | Search | About
Login Password
Register Now!
 microsoft.public.security.virus    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content
Subject Author Date
recusive folder usb boot sector... virus j_slobo@hotmail.com 03-14-2008
Posted by j_slobo@hotmail.com on March 14, 2008, 6:45 pm
Please log in for more thread options
 well to make the short story long -tried from a supposedly clean 98/
XP PC with attached infected win98 disk : comd.line mcafee, nod32,
avg, addaware,avast with no sucess 'cause either they get stuck in the
infinitely deep recursive subfolders virus makes in windows folder and
elsewhere or the AVs could not open/check bunch of files.
Comm.line Sophos did find, but only on usb flash, MAL/AUTOINF-A but
did not clean it in full mode.
Personally I saw (also on USB) an autorun and MSOCACHE/90000.../
kb915865.exe however its killer?VirusCleaner from e-nil site (nor
avg,avast) did not find anything on hdd from which usb was infected.
Anyway aside from recursive folders on infected win98 HDD, problem is
there are 2 types of infected files and virus refuses to get zipped or
submited to an antivirus site(havent tried ftp though)
-if you try in win/dos to zip or copy the first kind
of infected files-the falsely too big ones(example pkunzip.pif
129MB), the virus is not included-i.e. you get a clean
file-with normal size(changing attributes does not help)
- the other type of files are the ones whose names are
malformed with including \ or | so you cant even rename
In addition virus (or viruses) hide in boot sector cause the mentioned
win98 infected hdd will not boot any more and also when reformated
another infected disk, to prepare a clean win98 PC it would get stuck
in installation until the disk was zeroed first!
Also when you stick flash in infected PC(while the disk still worked-
now it cannot be accesed at all-&probably needs fixboot) the usb diode
just kept flashing and PC bluescreened reporting usspdrr.vxd error
Anone came across this evil or can suggest antivirus that has
definitions for rootkits or registry checker that can load registry
hives from an attached disk as EasyPCFix can?

Posted by David H. Lipman on March 14, 2008, 6:55 pm
Please log in for more thread options
| well to make the short story long -tried from a supposedly clean 98/
| XP PC with attached infected win98 disk : comd.line mcafee, nod32,
| avg, addaware,avast with no sucess 'cause either they get stuck in the
| infinitely deep recursive subfolders virus makes in windows folder and
| elsewhere or the AVs could not open/check bunch of files.
| Comm.line Sophos did find, but only on usb flash, MAL/AUTOINF-A but
| did not clean it in full mode.
| Personally I saw (also on USB) an autorun and MSOCACHE/90000.../
| kb915865.exe however its killer?VirusCleaner from e-nil site (nor
| avg,avast) did not find anything on hdd from which usb was infected.
| Anyway aside from recursive folders on infected win98 HDD, problem is
| there are 2 types of infected files and virus refuses to get zipped or
| submited to an antivirus site(havent tried ftp though)
| -if you try in win/dos to zip or copy the first kind
| of infected files-the falsely too big ones(example pkunzip.pif
| 129MB), the virus is not included-i.e. you get a clean
| file-with normal size(changing attributes does not help)
| - the other type of files are the ones whose names are
| malformed with including \ or | so you cant even rename
| In addition virus (or viruses) hide in boot sector cause the mentioned
| win98 infected hdd will not boot any more and also when reformated
| another infected disk, to prepare a clean win98 PC it would get stuck
| in installation until the disk was zeroed first!
| Also when you stick flash in infected PC(while the disk still worked-
| now it cannot be accesed at all-&probably needs fixboot) the usb diode
| just kept flashing and PC bluescreened reporting usspdrr.vxd error
| Anone came across this evil or can suggest antivirus that has
| definitions for rootkits or registry checker that can load registry
| hives from an attached disk as EasyPCFix can?

Huh ??

--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp



Posted by Dustin Cook on March 15, 2008, 9:17 pm
Please log in for more thread options
$CO3.141@trnddc04:

>
>| well to make the short story long -tried from a supposedly clean 98/
>| XP PC with attached infected win98 disk : comd.line mcafee, nod32,
>| avg, addaware,avast with no sucess 'cause either they get stuck in the
>| infinitely deep recursive subfolders virus makes in windows folder and
>| elsewhere or the AVs could not open/check bunch of files.
>| Comm.line Sophos did find, but only on usb flash, MAL/AUTOINF-A but
>| did not clean it in full mode.
>| Personally I saw (also on USB) an autorun and MSOCACHE/90000.../
>| kb915865.exe however its killer?VirusCleaner from e-nil site (nor
>| avg,avast) did not find anything on hdd from which usb was infected.
>| Anyway aside from recursive folders on infected win98 HDD, problem is
>| there are 2 types of infected files and virus refuses to get zipped or
>| submited to an antivirus site(havent tried ftp though)
>| -if you try in win/dos to zip or copy the first kind
>| of infected files-the falsely too big ones(example pkunzip.pif
>| 129MB), the virus is not included-i.e. you get a clean
>| file-with normal size(changing attributes does not help)
>| - the other type of files are the ones whose names are
>| malformed with including \ or | so you cant even rename
>| In addition virus (or viruses) hide in boot sector cause the mentioned
>| win98 infected hdd will not boot any more and also when reformated
>| another infected disk, to prepare a clean win98 PC it would get stuck
>| in installation until the disk was zeroed first!
>| Also when you stick flash in infected PC(while the disk still worked-
>| now it cannot be accesed at all-&probably needs fixboot) the usb diode
>| just kept flashing and PC bluescreened reporting usspdrr.vxd error
>| Anone came across this evil or can suggest antivirus that has
>| definitions for rootkits or registry checker that can load registry
>| hives from an attached disk as EasyPCFix can?
>
> Huh ??
>

Lost you too huh? :)


--
Regards,
Dustin Cook - http://bughunter.it-mate.co.uk
BugHunter v2.2e AntiMalware Removal Utility


Posted by David H. Lipman on March 15, 2008, 9:31 pm
Please log in for more thread options


>>
>> Huh ??
>>
| Lost you too huh? :)
|

Totally.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp



Posted by Judicandus on March 16, 2008, 4:00 am
Please log in for more thread options
wrote:
> well to make the short story long -tried from a supposedly clean 98/
> XP PC with attached infected win98 disk : comd.line mcafee, nod32,
> avg, addaware,avast with no sucess 'cause either they get stuck in the
> infinitely deep recursive subfolders virus makes in windows folder and
> elsewhere or the AVs could not open/check bunch of files.
> Comm.line Sophos did find, but only on usb flash, MAL/AUTOINF-A but
> did not clean it in full mode.
> Personally I saw (also on USB) an autorun and MSOCACHE/90000.../
> kb915865.exe however its killer?VirusCleaner from e-nil site (nor
> avg,avast) did not find anything on hdd from which usb was infected.
> Anyway aside from recursive folders on infected win98 HDD, problem is
> there are 2 types of infected files and virus refuses to get zipped or
> submited to an antivirus site(havent tried ftp though)
> -if you try in win/dos to zip or copy the first kind
> of infected files-the falsely too big ones(example pkunzip.pif
> 129MB), the virus is not included-i.e. you get a clean
> file-with normal size(changing attributes does not help)
> - the other type of files are the ones whose names are
> malformed with including \ or | so you cant even rename
> In addition virus (or viruses) hide in boot sector cause the mentioned
> win98 infected hdd will not boot any more and also when reformated
> another infected disk, to prepare a clean win98 PC it would get stuck
> in installation until the disk was zeroed first!
> Also when you stick flash in infected PC(while the disk still worked-
> now it cannot be accesed at all-&probably needs fixboot) the usb diode
> just kept flashing and PC bluescreened reporting usspdrr.vxd error
> Anone came across this evil or can suggest antivirus that has
> definitions for rootkits or registry checker that can load registry
> hives from an attached disk as EasyPCFix can?

Well,

You weren't very clear however, some of this viruses behavior looks
like a vbs worm... Give us some examples of the file names with / and
| so that we have a better idea.

You should try doing a Hijackthis log (http://www.hijackthis.de) and
posting it in a forum such as security-forums, bleepingcomputer(post
in only one forum), they might be able to help you as well.. I'd also
suggest you google combofix and sdfix and try running them considering
you can boot into the OS.

I don't know much about other antiviruses since I only use AVG, the
8.0 version of avg has also the anti-rootkit signatures. I've heard
many good things about Kaspersky so it should have them too. (They are
commercial products so you'll have to download the 30-day trial
version).

Hope I helped you in any way (Hoping google translator did a good job
^_^)

Dan

d

Similar ThreadsPosted
Boot Sector virus September 22, 2006, 6:38 pm
Free virus scanning tool for boot sector and CMOS July 4, 2007, 1:28 am
Virus? Showing up in Exchange mailbox root folder June 15, 2005, 10:11 am
Is this a virus or something else? Disappearing folder named "system", then can't delete the parent June 6, 2006, 6:28 pm
Boot Virus Help June 22, 2006, 12:50 pm
Please help!! Boot Virus?? May 10, 2008, 11:46 am
Anti Virus Solutions That Use Their Own Boot CD? July 2, 2008, 1:47 pm
Virus-like Activity after a boot-time Scandisc November 11, 2007, 12:32 pm
Possilbe Virus, Computer Reboots, Can't Boot any Options November 19, 2006, 10:33 pm
Folder sounds February 14, 2008, 3:13 pm

Our other projects:

Art Dolls, Fairies and Mermaids - Sunnyfaces.net

Roy's Linux, Programming and Search Engines messages

1-Script XML SitemapXML Sitemap