Solved Shortcut reappearing in USB, autorun.ini deleted already

[akitsuki05]

Hi, so I've been looking at common solutions for autorun virus and successfuly deleted the autorun.ini file. My problem is that the USB still creates a shortcut of my files malwarebytes doesn't scan any malware (full scan) Help me!

 

[Jacee]

Have you disabled Autorun? See this tutorial telling you how to do that http://www.sevenforums.com/tutorials/161443-autorun-inf-files-completely-block.html

What device is the USB? If it's a flash drive or? ... immunize it with Panda USB Vaccination ANTIMALWARE: Panda USB Vaccine - Download FREE - PANDA SECURITY

 

[akitsuki05]

Can I vaccinate my computer and USB without me being sure whether it's clean or not? I'm not sure if it's clean but Malwarebytes told me it is XD

 

[akitsuki05]

Okay, I've done both but no progress the USB still creates shortcut

 

[cottonball]

akitsuki05,

Please do the following...

:info: Download RogueKiller:
http://tigzy.geekstogo.com/roguekiller.php
Select the version that applies to the system (64-bit).
Save to the Desktop.

After closing all windows and browsers, right-click the downloaded RogueKiller file and select: Run as Administrator
At the program console, wait for the Prescan to finish. (Under Status, it says: Prescan finished.)

Press: SCAN

When done, a report opens on the drive: RKreport.txt

:ar: Please provide the RKreport.txt (Mode: Scan) in your reply.


:info: Next, please download UsbFix:
http://www.infospyware.com/utiles/usbfix/

It is a Spanish language website, but the program is in English.
To download. press the button that says: Descagar

Right-click the downloaded file and select: Run as Administrator
Connect your External drive when requested.

Press: Listing

When done, the program closes on its own, and a report appears.

:ar: Please post the USBFix Listing report in your reply.

 

[akitsuki05]

cottonball,

I've done the RogueKiller scan and came up with that results. For USBFix, i've done it last night and it got stuck (not responding) at 14% for about 15-30mins? Is that normal? I suddenly stopped it and went to sleep.
Thank you for answering!

 

[cottonball]

See if you can run USBFix in Safe Mode:

• Restart your computer.
• When the computer starts, tap the F8 key on the keyboard repeatedly until presented with the Advanced Boot Options menu
• Using the arrow keys, select: Safe Mode
• Press the Enter key on your keyboard to boot into Safe Mode

 

[Jacee]

Is this a Dell or Toshiba computer? Looks like a conflict here.

¤¤¤ MBR Check: ¤¤¤
+++++ PhysicalDrive0: TOSHIBA MK5076GSX +++++
--- User ---
[MBR] a9f3b81dcd040565cdf5cee156a64fea
[BSP] 5979044ecda8c1a78bc50a485c14a875 : Windows 7/8 MBR Code
Partition table:
0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 16065 | Size: 94 Mo
1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 208896 | Size: 14999 Mo
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 30926848 | Size: 461838 Mo
User = LL1 ... OK!
User = LL2 ... OK!
+++++ PhysicalDrive1: TOSHIBA MK5076GSX +++++
--- User ---
[MBR] 4a2c2f9cf4ffe77014b5930dbae3d73c
[BSP] df4f83c1f72e36823a12b0dfc7617313 : Empty MBR Code
Partition table:
0 - [XXXXXX] FAT32 (0x0b) [VISIBLE] Offset (sectors): 8192 | Size: 3833 Mo
User = LL1 ... OK!
Error reading LL2 MBR!

 

[akitsuki05]

This is a Dell laptop, I don't know what happened in there with that Toshiba conflict. Anyway, I used USBFix but my USBs at home. Here are the results. It's "Clean 3" since I stopped the other 2 halfway. I tried a guinea pig USB and it didn't create shortcuts anymore! Is it safe to say my laptop's clean already?

 

[akitsuki05]

Oh, I think that Toshiba conflict was when my Hard Drive got a problem and the seller company replaced my Hard Drive. Maybe they replaced it with a Toshiba and didn't told me.

 

[cottonball]

Is it safe to say my laptop's clean already?

The laptop appears to be, but, have no clue about the USB drive.

The instructions were to run USBFix (presuming the USB drive would be plugged in) and obtain a Listing. Instead, Deletion was used, and, do not see where there is a USB drive showing in the USBFix Deletion report.

Please run USBFix once again, and plug in whatever USB drive was infected, and other USB drives, if in doubt.

Please obtain a Listing this time.

 

[akitsuki05]

cottonball,

Sorry about that misread instruction. Here's the listing result

 

[cottonball]

akitsuki05,


:info: Please connect your removable drives, and, if you have not disabled Autorun, hold down the Shift key when connecting. This action stops the autorun.inf from executing automatically


:info: Next, download Dr.Web CureIt:
http://www.freedrweb.com/cureit/?lng=en
(Free download at bottom left of page)
Info on how to use:
http://www.freedrweb.com/cureit/how_it_works/

Save to the Desktop.

:warn: Temporarily disable your AntiVirus, Firewall, and AntiMalware programs
Info: http://www.bleepingcomputer.com/forums/index.php?showtopic=114351

Right-click drweb-cureit.exe and select: Run as Administrator

At the program console, click: Select objects for scanning
On the next screen, place a checkmark on all the boxes, except: Temporary files

Click on: Start scanning

For any item detected, click on the Action column down arrow and select: Cure
If you see an item that you are sure is OK, un-check it. However, typically, you keep the default Cure action.
Next, click on the Neutralize button.

When the Curing Completed prompt appears, click on: Open Report
The Cureit.log report opens in Notepad.
Save the report to your Desktop.
Close Dr.Web Cureit.

:info: Restart your computer.

:ar: Please attach the report in your reply, and re-enable your antivirus/antimalware programs.

 

[cottonball]

Post above edited!

 

[grazcy]

thanks the usbfix seem working good! but antivirus just delete the usbfix after it done haha~ is it thread when it ask me to donate money?

 

[cottonball]

graczy,

Please post your own topic here:
System Security - Windows 7 Help Forums

Thanks!