memory virus: new poly win 32, new win 32, IRC/Flood.c, IRC/

Hi, i need a serious help in saving my laptop right now.
I am badly infected by above viruses. McAfee detects and delete some viruses but may be because of its infinite loop nature or something its keep on coming. I can't use internet anymore. It gets multiplied a lot, if I browse internet.

My laptop is at its worst, its very slow. I tried scanning via stinger but it doesn't work. I also tried http://www.besttechie.net/tools/mbam-setup.exe but as soon as i try to execute the set up file, it says "r u sure you want to exit the set up?" and when i click NO, then it pops the same message again and again. Please help me remove the above viruses.

Thanks in advance and highly appreciating your time.

Thanks,
Raj

Please download the current version of HijackThis from HERE

• Double click and run the installer.
  
• It will install to C:\Program Files\Trend Micro\HijackThis\hijackthis.exe
  
• After installing, you should get the user agreement, press accept and Hijack This will run.
  
• Select Do a system scan and save a log file. This will open a notepad file of everything Hijack This found, copy and paste it back here.
  

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:00:14 PM, on 4/21/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
c:\Toshiba\IVP\swupdate\swupdtmr.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\reader_s.exe
C:\Documents and Settings\Raj M. Shah\reader_s.exe
C:\Documents and Settings\Raj M. Shah\Application Data\svchost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.toshiba.com/search
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.toshibadirect.com/dpdstart
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.toshibadirect.com/dpdstart
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\ntos.exe,
O1 - Hosts: 212.48.121.88 banesto.es
O1 - Hosts: 212.48.121.88 www.banesto.com
O1 - Hosts: 212.48.121.88 banesto.com
O1 - Hosts: 124.217.248.253 www.bancomer.com.mx
O1 - Hosts: 124.217.248.253 www.bancomer.com
O1 - Hosts: 124.217.248.253 bancomer.com
O1 - Hosts: 124.217.248.253 bancomer.com.mx
O1 - Hosts: 124.217.248.253 www.bbva.com.mx
O1 - Hosts: 124.217.248.253 bbva.com.mx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [*ctfmon32] "C:\Documents and Settings\Raj M. Shah\Application Data\svchost.exe"
O4 - HKLM\..\Run: [reader_s] C:\WINDOWS\System32\reader_s.exe
O4 - HKCU\..\Run: [reader_s] C:\Documents and Settings\Raj M. Shah\reader_s.exe
O4 - HKUS\.DEFAULT\..\Run: [svc] c:\program Files\ThunMail\testabd.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\Run: [VRTD8] C:\WINDOWS\TEMP\VRTD8.exe (User 'Default user')
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.toshibadirect.com/dpdstart
O20 - AppInit_DLLs: c:\progra~1\ThunMail\testabd.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: Background Intelligent Transfer Service (BITS) - Unknown owner - C:\WINDOWS\
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: ICF - Unknown owner - C:\WINDOWS\system32\svchost.exe:ext.exe (file missing)
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Swupdtmr - Unknown owner - c:\Toshiba\IVP\swupdate\swupdtmr.exe

--
End of file - 6120 bytes

Thanks and please let me know the further steps.
Highly appreciating your time and efforts.

Raj

Got it !!... please take your time.
Thanks !

Last edited by raj4groups on 21st April 2009, 7:46 pm; edited 1 time in total (Reason for editing : realized my mistake)

Bad news.

You are dealing with a polymorphic file infector known as Virut. It infects ALL exe/scr files on the machine. See here for details.
http://miekiemoes.blogspot.com/2009/02/virut-and-other-file-infectors-throwing.html

Your computer has multiple infections, including a backdoor. A backdoor gives intruders complete control of your computer, logs your keystrokes, steal personal information, etc.

You are strongly advised to do the following:

• Disconnect the computer from the Internet and from any networked computers until it is cleaned.
  
• Back up all your important data except programs. The programs can be reinstalled back from the original disc or from the Net.
  
• Call all your banks, financial institutions, credit card companies and inform them that you may be a victim of identity theft and put a watch on your accounts. If you don't mind the hassle, change all your account numbers.
  
• From a clean computer, change all your passwords (ISP login password, your email address(es) passwords, financial accounts, PayPal, eBay, Amazon, online groups and forums and any other online activities you carry out which require a username and password).
  

Do NOT change your passwords from this computer as the attacker will be able to get all the new passwords and transaction records.

Due to its backdoor functionality, your computer is very likely to have been compromised and there is no way that it can be trusted again. Many experts in the security community believe that once infected with this type of Trojan, the best course of action would be to do a reformat and reinstallation of the operating system (OS).

To help you understand more, please take some time to read the following articles:

What are Remote Access Trojans and why are they dangerous
How do I respond to a possible identity theft and how do I prevent it
When should I do a reformat and reinstallation of my OS
Where to backup your files
How to backup your files in Windows XP
Restoring your backups

Hi,
Thanks, I appreciated your research.
But I have already formatted my laptop 2 times and even after that I am facing this problem.
do you recommend me to download rmvirut ? and try to clean virut from my laptop ?

or what would you recommend me to do ?

Thanks in advance.
Raj

Belahzur, r u still resolving my problem ??
please update me !!
Thanks, highly appreciating your time and efforts.

Raj

Hello.
Missed your post, sorry about that.

Lets do a controlled format. Format it again, then download AVIRA from the source website, do not use any software from sites that are questionable.

Please install Avira antivirus otherwise you won't be protected.

1) Antivir PersonalEditionClassic
-Free anti-virus software for Windows.
-Detects and removes more than 50,000 viruses. Free support.

It is strongly recommended that you run only one antivirus program at a time. Having more than one antivirus program active in memory uses additional resources and can result in program conflicts and false virus alerts.

Thanks for the reply. Yes, I do have formatted more than 3 times now and I have also installed an AntiVir software. Right now everything is fine, but I still feel that there might be an elements of Virut left. I have not connected to the internet yet, do you recommend me to connect to internet and test ? or you want me to resend you log file from AntiVir and HijackThis ?

Highly appreciating your help. Waiting for your reply.

-Raj

I have one more question... wht do u mean by controlled formatting ?
I did formatting with TOSHIBA system recovery DVD's.

Please clear my doubt.
Thanks,
Raj

By a controlled format, I mean that you do it again with me watching over, instead of you doing it yourself, then running something you think is real, which in truth isn't, that's why you got infected again and again.

Ok, I got it, please let me know the steps that I have to follow.

-Raj

Below I have included a number of recommendations for how to protect your computer in order to prevent future malware infections. Please take these recommendations seriously; these few simple steps can stave off the vast majority of spyware problems. As happy as we are to help you, for your sake we would rather not have repeat customers.

1) Please navigate to http://windowsupdate.microsoft.com and download all the "critical updates" for Windows. This can patch many of the security holes through which attackers can gain access to your computer.

Please either enable Automatic Updates under Start -> Control Panel -> Automatic Updates , or get into the habit of checking for Windows updates regularly. I cannot stress enough how important this is.

2) In order to protect yourself against spyware, you should consider installing and running the following free programs:

Ad-Aware SE
A tutorial on using Ad-Aware to remove spyware from your computer may be found here.

Spybot-Search & Destroy
A tutorial on using Spybot to remove spyware from your computer may be found here. Please also remember to enable Spybot's "Immunize" and "TeaTimer" features.

SpywareBlaster
A tutorial on using SpywareBlaster to prevent spyware from ever installing on your computer may be found here.

SpywareGuard
A tutorial on using SpywareGuard for realtime protection against spyware and hijackers may be found here.

Make sure to keep these programs up-to-date and to run them regularly, as this can prevent a great deal of spyware hassle.

3) Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in popup blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from here:
http://www.mozilla.org/products/firefox/
I also recommand the following add-ons for Firefox, they will help keep you safe from malicious scripts or activeX exploits.
https://addons.mozilla.org/en-US/firefox/addon/722
https://addons.mozilla.org/en-US/firefox/addon/1865
https://addons.mozilla.org/en-US/firefox/addon/433

4) Also make sure to run your antivirus software regularly, and to keep it up-to-date.

To help you keep your software updated, please considering using this free software program that will check for program updates.
Update Checker

5) Finally, consider maintaining a firewall. Some good free firewalls are Kerio, or
Outpost
A tutorial on understanding and using firewalls may be found here.

Please also read Tony Klein's excellent article: How I got Infected in the First Place

If you would take a moment to fill out our feedback form, we would appreciate it.
The link can be found here.

Hopefully this should take care of your problems! Good luck.

So, you want me to update my computer and install all the anti virus SW and Firewall mentioned.
Then do the Format.
And then again install all the above components and get back to you ?
Please confirm, so I can start the procedure ASAP.
Thanks,
Raj

No, format it first, then install an AV, then come here and read my above prevention speech on how to stay away and stay clear of malware.

Got it, I will let you know once I am done.
Thanks,
Raj

Hi,
I did exactly the way you have explained it to me.
But I still believe that AV can not scan 2 files, and that two files are giving me hard time. if you want I can send you log.
can we talk on phone or something.
I want result now, I am tired. I was planning to change my RAM, incase something works out ...

Please help me.
Thanks

Did you choose not to format?

No I do have formatted my computer. I have followed all your steps.

Ah. Then unless your infected again, what files can't be scanned?

I know some legit files are locked by Windows so they can't be altered in anyway.

I can not track the location but AVIRA AV says "2 Warnings" and in log file it says 2 files can not be scanned.

Ah, I know about them.
One is pagefile.sys in the C:\ drive right?

Don't worry, it's not malware. Windows needs them two files, so it locks so they can't be touched/scanned/changed by anything.

should I send you log file from HijeckTHIS SW ??
now should I connect it to internet ?? is it safe now ?

Yes, it's fine. Stop worrying.

Below I have included a number of recommendations for how to protect your computer in order to prevent future malware infections. Please take these recommendations seriously; these few simple steps can stave off the vast majority of spyware problems. As happy as we are to help you, for your sake we would rather not have repeat customers.

1) Please navigate to http://windowsupdate.microsoft.com and download all the "critical updates" for Windows. This can patch many of the security holes through which attackers can gain access to your computer.

Please either enable Automatic Updates under Start -> Control Panel -> Automatic Updates , or get into the habit of checking for Windows updates regularly. I cannot stress enough how important this is.

2) In order to protect yourself against spyware, you should consider installing and running the following free programs:

Ad-Aware SE
A tutorial on using Ad-Aware to remove spyware from your computer may be found here.

Spybot-Search & Destroy
A tutorial on using Spybot to remove spyware from your computer may be found here. Please also remember to enable Spybot's "Immunize" and "TeaTimer" features.

SpywareBlaster
A tutorial on using SpywareBlaster to prevent spyware from ever installing on your computer may be found here.

SpywareGuard
A tutorial on using SpywareGuard for realtime protection against spyware and hijackers may be found here.

Make sure to keep these programs up-to-date and to run them regularly, as this can prevent a great deal of spyware hassle.

3) Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in popup blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from here:
http://www.mozilla.org/products/firefox/
I also recommand the following add-ons for Firefox, they will help keep you safe from malicious scripts or activeX exploits.
https://addons.mozilla.org/en-US/firefox/addon/722
https://addons.mozilla.org/en-US/firefox/addon/1865
https://addons.mozilla.org/en-US/firefox/addon/433

4) Also make sure to run your antivirus software regularly, and to keep it up-to-date.

To help you keep your software updated, please considering using this free software program that will check for program updates.
Update Checker

5) Finally, consider maintaining a firewall. Some good free firewalls are Kerio, or
Outpost
A tutorial on understanding and using firewalls may be found here.

Please also read Tony Klein's excellent article: How I got Infected in the First Place

If you would take a moment to fill out our feedback form, we would appreciate it.
The link can be found here.

Hopefully this should take care of your problems! Good luck.

Ok, Let me see how it goes. I will get back to you soon.

Thanks for your all help, Highly appreciated.

Have a Good one.

-Raj

Hi,
I just scanned my laptop through Spybot S & D and found 94 problems.
major are with windows folder, I was wondering if I fix them or delete them, I might have to face start up problem. do you think so ?
majority are .dll file : type: file
I do have some other extension files :type: data
and some folders.

Please help.
thanks
Raj

Maybe. I trust MBAM's judgement over Spybot to be truthful.

So now you want me to uninstall Sypbot and install MBAM ?
Right now laptop is working at its best, i dont see any problem, except when ever I connect external USB or ext HDD, I can not double click it to open. It says "Access Denied". But I can access it by right click and do whtever I want.

Thanks,
Raj

Hello.
Plug in whatever USB/external hardrives you have.

Please download USBNoRisk to your Desktop and run it by double clicking the program's icon.

1. Wait a couple of seconds for initial scan to finish.
   
2. Connect all of your USB storage devices to the PC, one at a time, and keep each one connected at least for 10 seconds.
   
3. If there are more USB storage devices to scan, please take a note about the order in which these were connected.
   
4. After all the devices are scanned, right click in the Monitor tab, and choose "Save log". That will open the log in Notepad. Please copy and paste the log into this thread.
   

Explanation: USB storage devices are all the USB devices that get their own partition letter at connecting to the PC, e.g. flash drives (thumb/pen drives, USB sticks), external HDDs, MP3/MP4 players, digital cameras, memory cards (SD cards, Sony Memory Stick, MultiMedia Cards etc.), some mobile phones, some GPS navigation devices etc.

USBNoRisk 2.1 by bobby

Started at 5/1/2009 2:01:38 PM

Scanning for connected USB Mass storage...
----------------------------------------
========================================

Scanning for other storage...
----------------------------------------
C: {145ac1d6-3539-11de-881b-806d6172696f}
========================================


Scanning fixed storage for autorun.inf files...
----------------------------------------

No blocked files found on C:
No Autorun.inf files found on C:
No mountpoint found for C:
No mountpoint found for 145ac1d6-3539-11de-881b-806d6172696f
----------------------------------------

========================================
Initial scan finished!
========================================


New device connected at 5/1/2009 2:02:49 PM

Scanning for connected USB mass storage...
----------------------------------------
E: {2b8e1908-35c9-11de-8820-00038a000015}
Added E:
========================================

Scanning USB mass storage for files...
----------------------------------------
No blocked files found on E:
----------------------------------------
autorun.inf found on E:
----------------------------------------
File E:\autorun.inf renamed successfully

Content of E:\autorun.inf.blocked
----------------------------------------
[autorun]
OPeN=rEcYClEr\sEtUp32.exe
IcON=%wIndIr%\sYstEm32\ShElL32.DlL,7
ACtION=Open USB
sHeLl\OpEN=oPEn
sHeLl\OpEN\cOMMaND=ReCyClER\sEtUp.exe
sHeLl\OpEN\deFaULt=1
----------------------------------------

No mountpoint found for E:
Sanitized mountpoint for 2b8e1908-35c9-11de-8820-00038a000015
----------------------------------------

desktop.ini found on E:
----------------------------------------

Content of E:\$RECYCLE.BIN\desktop.ini
----------------------------------------
[.ShellClassInfo]
CLSID={645FF040-5081-101B-9F08-00AA002F954E}
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-8964
----------------------------------------


Content of E:\Recycled\desktop.ini
----------------------------------------
[.ShellClassInfo]
CLSID={645FF040-5081-101B-9F08-00AA002F954E}
----------------------------------------


Content of E:\My Works\MyWorks\desktop.ini
----------------------------------------
[ExtShellFolderViews]
Default={5984FFE0-28D4-11CF-AE66-08002B2E1262}
{5984FFE0-28D4-11CF-AE66-08002B2E1262}={5984FFE0-28D4-11CF-AE66-08002B2E1262}

[{5984FFE0-28D4-11CF-AE66-08002B2E1262}]
PersistMoniker=file://Folder.htt

[.ShellClassInfo]
ConfirmFileOp=0
----------------------------------------


Content of E:\My Works\MyWorks\Concepts\desktop.ini
----------------------------------------
[ExtShellFolderViews]
Default={5984FFE0-28D4-11CF-AE66-08002B2E1262}
{5984FFE0-28D4-11CF-AE66-08002B2E1262}={5984FFE0-28D4-11CF-AE66-08002B2E1262}

[{5984FFE0-28D4-11CF-AE66-08002B2E1262}]
PersistMoniker=file://Folder.htt

[.ShellClassInfo]
ConfirmFileOp=0
----------------------------------------


Content of E:\My Works\MyWorks\Future Concepts\desktop.ini
----------------------------------------
[ExtShellFolderViews]
Default={5984FFE0-28D4-11CF-AE66-08002B2E1262}
{5984FFE0-28D4-11CF-AE66-08002B2E1262}={5984FFE0-28D4-11CF-AE66-08002B2E1262}

[{5984FFE0-28D4-11CF-AE66-08002B2E1262}]
PersistMoniker=file://Folder.htt

[.ShellClassInfo]
ConfirmFileOp=0
----------------------------------------


Content of E:\Raj_C Drive\RAJ\DARSHAN PATEL\Songs\Romantic (Slow)\desktop.ini
----------------------------------------
[.ShellClassInfo]
FolderType=MusicAlbum
MusicBuyUrl=http://redir.metaservices.microsoft.com/redir/buynow/?providerName=AMG&albumID=F3F7761A-3502-4863-A90E-DCBCA1865A0C&a_id=R%20%20%20220642&album=Bollywood%20Flashback&artistID=35F1A890-95E9-4D2E-8306-F688DBC4D2CD&p_id=P%20%20%20165442&artist=Bally%20Sagoo&locale=409&geoid=f4&version=11.0.5358.4827&userlocale=409
----------------------------------------


Content of E:\Raj_C Drive\RAJ\DARSHAN PATEL\Songs\ENGS\01 7 ENRIQUE\desktop.ini
----------------------------------------
[.ShellClassInfo]
FolderType=MusicAlbum
MusicBuyUrl=http://redir.metaservices.microsoft.com/redir/buynow/?providerName=AMG&albumID=321C65CD-AFD3-4B80-AA50-30CDA4C626D1&a_id=R%20%20%20559247&album=Escape&artistID=AA3A7798-6F6B-4322-A50F-F03424B4862D&p_id=P%20%20%20169286&artist=Enrique%20Iglesias&locale=409&geoid=f4&version=11.0.5358.4827&userlocale=409
----------------------------------------


Content of E:\Raj_C Drive\RAJ\DARSHAN PATEL\Songs\02_Mix Hindi Songs\Mix\desktop.ini
----------------------------------------
[.ShellClassInfo]
FolderType=MusicAlbum
MusicBuyUrl=http://redir.metaservices.microsoft.com/redir/buynow/?providerName=AMG&albumID=9663A712-6851-40D3-8985-A66465C02942&a_id=R%20%20%20764854&album=The%20Movement&artistID=9E9EA56C-C0F4-4764-AA92-0764053E21A7&p_id=P%20%20%20713823&artist=Karmacy&locale=409&geoid=f4&version=11.0.5358.4827&userlocale=409
----------------------------------------

----------------------------------------

No mimics found on drive E:
========================================



New device connected at 5/1/2009 2:03:24 PM

Scanning for connected USB mass storage...
----------------------------------------
F: {4705b9d6-353b-11de-881e-00038a000015}
Added F:
========================================

Scanning USB mass storage for files...
----------------------------------------
No blocked files found on F:
----------------------------------------
autorun.inf found on F:
----------------------------------------
File F:\autorun.inf renamed successfully

Content of F:\autorun.inf.blocked
----------------------------------------
[autorun]
OPeN=rEcYClEr\sEtUp32.exe
IcON=%wIndIr%\sYstEm32\ShElL32.DlL,7
ACtION=Open USB
sHeLl\OpEN=oPEn
sHeLl\OpEN\cOMMaND=ReCyClER\sEtUp.exe
sHeLl\OpEN\deFaULt=1
----------------------------------------

Files referenced from F:\autorun.inf.blocked
----------------------------------------
None
----------------------------------------

Sanitized mountpoint for 4705b9d6-353b-11de-881e-00038a000015
----------------------------------------

No Desktop.ini files found on F:
----------------------------------------

No mimics found on drive F:
========================================

Please open USBNoRisk again, we need to use a custom script to delete the malicious autorun.inf files.

1. When USBNoRisk opens, go into the Script tab, copy and paste the bolded script in the quote box below.
   

   
   {2b8e1908-35c9-11de-8820-00038a000015}
   delete: E:\autorun.inf.blocked
   delete: E:\recycler\setup32.exe
   {4705b9d6-353b-11de-881e-00038a000015}
   delete: F:\autorun.inf.blocked
   delete: F:\recycler\setup32.exe
   protect:
   

   
   
2. Then press the Run Script button.
   
3. Copy and paste the report back here.
   

USBNoRisk 2.1 by bobby

Started at 5/1/2009 3:00:38 PM

Scanning for connected USB Mass storage...
----------------------------------------
========================================

Scanning for other storage...
----------------------------------------
C: {145ac1d6-3539-11de-881b-806d6172696f}
========================================


Scanning fixed storage for autorun.inf files...
----------------------------------------

No blocked files found on C:
No Autorun.inf files found on C:
No mountpoint found for C:
No mountpoint found for 145ac1d6-3539-11de-881b-806d6172696f
----------------------------------------

========================================
Initial scan finished!
========================================

Processing script
----------------------------------------
No script to process for C:\
----------------------------------------



New device connected at 5/1/2009 3:01:38 PM

Scanning for connected USB mass storage...
----------------------------------------
F: {4705b9d6-353b-11de-881e-00038a000015}
Added F:
========================================

Scanning USB mass storage for files...
----------------------------------------
Blocked file found: F:\autorun.inf.blocked
----------------------------------------
Content of F:\autorun.inf.blocked
----------------------------------------
[autorun]
OPeN=rEcYClEr\sEtUp32.exe
IcON=%wIndIr%\sYstEm32\ShElL32.DlL,7
ACtION=Open USB
sHeLl\OpEN=oPEn
sHeLl\OpEN\cOMMaND=ReCyClER\sEtUp.exe
sHeLl\OpEN\deFaULt=1
----------------------------------------

Files referenced from F:\autorun.inf.blocked
----------------------------------------
None
----------------------------------------

----------------------------------------
No Autorun.inf files found on F:
Sanitized mountpoint for 4705b9d6-353b-11de-881e-00038a000015
----------------------------------------

No Desktop.ini files found on F:
----------------------------------------

No mimics found on drive F:
========================================

Processing script
----------------------------------------
4705b9d6-353b-11de-881e-00038a000015
Drive letter for GUID: F:
SectionStart = 3
SectionEnd = 6
Delete: F:\autorun.inf.blocked > Done!
Delete: F:\recycler\setup32.exe > File does not exist!
----------------------------------------
Protect F:
----------------------------------------
----------------------------------------

========================================
Scan finished!
========================================

-----------------------------
I will resend you log for other USB. Is this USB fine ?
Thanks for your help.
-Raj
------------------------------

Whatever is plugged into F:\ is fine, now plug whatever was in E:\ before back in and re-run it using the script I supplied.

USBNoRisk 2.1 by bobby

Started at 5/1/2009 6:08:59 PM

Scanning for connected USB Mass storage...
----------------------------------------
========================================

Scanning for other storage...
----------------------------------------
C: {145ac1d6-3539-11de-881b-806d6172696f}
========================================


Scanning fixed storage for autorun.inf files...
----------------------------------------

No blocked files found on C:
No Autorun.inf files found on C:
No mountpoint found for C:
No mountpoint found for 145ac1d6-3539-11de-881b-806d6172696f
----------------------------------------

========================================
Initial scan finished!
========================================

Processing script
----------------------------------------
No script to process for C:\
----------------------------------------



New device connected at 5/1/2009 6:09:42 PM

Scanning for connected USB mass storage...
----------------------------------------
E: {2b8e1908-35c9-11de-8820-00038a000015}
Added E:
========================================

Scanning USB mass storage for files...
----------------------------------------
No blocked files found on E:
----------------------------------------
No Autorun.inf files found on E:
No mountpoint found for E:
Sanitized mountpoint for 2b8e1908-35c9-11de-8820-00038a000015
----------------------------------------

desktop.ini found on E:
----------------------------------------

Content of E:\$RECYCLE.BIN\desktop.ini
----------------------------------------
[.ShellClassInfo]
CLSID={645FF040-5081-101B-9F08-00AA002F954E}
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-8964
----------------------------------------


Content of E:\Recycled\desktop.ini
----------------------------------------
[.ShellClassInfo]
CLSID={645FF040-5081-101B-9F08-00AA002F954E}
----------------------------------------


Content of E:\My Works\MyWorks\desktop.ini
----------------------------------------
[ExtShellFolderViews]
Default={5984FFE0-28D4-11CF-AE66-08002B2E1262}
{5984FFE0-28D4-11CF-AE66-08002B2E1262}={5984FFE0-28D4-11CF-AE66-08002B2E1262}

[{5984FFE0-28D4-11CF-AE66-08002B2E1262}]
PersistMoniker=file://Folder.htt

[.ShellClassInfo]
ConfirmFileOp=0
----------------------------------------


Content of E:\My Works\MyWorks\Concepts\desktop.ini
----------------------------------------
[ExtShellFolderViews]
Default={5984FFE0-28D4-11CF-AE66-08002B2E1262}
{5984FFE0-28D4-11CF-AE66-08002B2E1262}={5984FFE0-28D4-11CF-AE66-08002B2E1262}

[{5984FFE0-28D4-11CF-AE66-08002B2E1262}]
PersistMoniker=file://Folder.htt

[.ShellClassInfo]
ConfirmFileOp=0
----------------------------------------


Content of E:\My Works\MyWorks\Future Concepts\desktop.ini
----------------------------------------
[ExtShellFolderViews]
Default={5984FFE0-28D4-11CF-AE66-08002B2E1262}
{5984FFE0-28D4-11CF-AE66-08002B2E1262}={5984FFE0-28D4-11CF-AE66-08002B2E1262}

[{5984FFE0-28D4-11CF-AE66-08002B2E1262}]
PersistMoniker=file://Folder.htt

[.ShellClassInfo]
ConfirmFileOp=0
----------------------------------------


Content of E:\Raj_C Drive\RAJ\DARSHAN PATEL\Songs\Romantic (Slow)\desktop.ini
----------------------------------------
[.ShellClassInfo]
FolderType=MusicAlbum
MusicBuyUrl=http://redir.metaservices.microsoft.com/redir/buynow/?providerName=AMG&albumID=F3F7761A-3502-4863-A90E-DCBCA1865A0C&a_id=R%20%20%20220642&album=Bollywood%20Flashback&artistID=35F1A890-95E9-4D2E-8306-F688DBC4D2CD&p_id=P%20%20%20165442&artist=Bally%20Sagoo&locale=409&geoid=f4&version=11.0.5358.4827&userlocale=409
----------------------------------------


Content of E:\Raj_C Drive\RAJ\DARSHAN PATEL\Songs\ENGS\01 7 ENRIQUE\desktop.ini
----------------------------------------
[.ShellClassInfo]
FolderType=MusicAlbum
MusicBuyUrl=http://redir.metaservices.microsoft.com/redir/buynow/?providerName=AMG&albumID=321C65CD-AFD3-4B80-AA50-30CDA4C626D1&a_id=R%20%20%20559247&album=Escape&artistID=AA3A7798-6F6B-4322-A50F-F03424B4862D&p_id=P%20%20%20169286&artist=Enrique%20Iglesias&locale=409&geoid=f4&version=11.0.5358.4827&userlocale=409
----------------------------------------


Content of E:\Raj_C Drive\RAJ\DARSHAN PATEL\Songs\02_Mix Hindi Songs\Mix\desktop.ini
----------------------------------------
[.ShellClassInfo]
FolderType=MusicAlbum
MusicBuyUrl=http://redir.metaservices.microsoft.com/redir/buynow/?providerName=AMG&albumID=9663A712-6851-40D3-8985-A66465C02942&a_id=R%20%20%20764854&album=The%20Movement&artistID=9E9EA56C-C0F4-4764-AA92-0764053E21A7&p_id=P%20%20%20713823&artist=Karmacy&locale=409&geoid=f4&version=11.0.5358.4827&userlocale=409
----------------------------------------

----------------------------------------

No mimics found on drive E:
========================================

Processing script
----------------------------------------
========================================
Scan finished!
========================================

I hope this USB is fine. Please let me know.

Now I have one more issue, I was backing up my data, I rescanned that HDD with Avira AV, It was all clear. So when I was copying a bunch of movies from that HDD, CRE (Cyclic Redundancy Error) occurred and it stopped copying for the rest. I thought its ok, it happens some times, but the strange thing is after that I tried to play some media files, my voice is stuttering and I noticed that in background my memory is too busy, this was not the case yesterday when I installed all AV's and all Sypware's. I used quite a while and then I decided to back up my data.
Now something happened after that file transfer and that is eating my memory.

Stuttering happened with me while back when I removed my HDD from Laptop, I was recommended to format my laptop because it was interface issue. But I haven't touched my HDD this time.

Can you please recommend me something.

Thanks,
Raj

Hello.
Have asked Doctor_Inferno to drop by here.

Thanks a million, I really appreciate that.
But USB is fine right ?

Ok

Last edited by raj4groups on 2nd May 2009, 1:47 am; edited 1 time in total (Reason for editing : -)

Hello,

Is your HDD's file system FAT, FAT32 or NTFS? Check under - right click the drive >> Properties.

CRC or CRE is bit of mathematics used to ensure that your data is OK when being transferred. It's a checking procedure that quickly identifies when data has been damaged. If you get this message, it means that the file being read by your PC or software is corrupted. However, it does not mean all the data is lost forever.

When data is transferred, it is usually in small blocks and each block is given a CRC value. If something goes wrong with the data between the time it leaves the source and arrives at its destination, the CRC sent at the source will no longer match the one that is calculated when the data arrives - this is when the cyclic redundancy check error will appear.
The most common time you will see the cyclic redundancy check error message is when trying to read data from a damaged CD or DVD.

Just before it appears, your drive will probably grind and whirl away - your PC may also become a little sluggish.

Less frequent causes are the result of system crashes, and buggy software.

You can read more here:
http://www.softwarepatch.com/tips/cyclic-redundancy.html


I would strongly suggest backing up anything that is important to you. Do not Attempt to fix or repair the drive till you do so.

Any type of relocation of the data to good sectors can cause issues if it does not work/pass/move the data etc. It can cause loss of data or irreversible damage.

Start >> run >> cmd >>type in CHKDSK [drive letter] /r

it is NTFS. Result is:
C:\Documents and Settings\Raj M. Shah>CHKDSK c:/r
The type of the file system is NTFS.
Cannot lock current drive.

Chkdsk cannot run because the volume is in use by another
process. Would you like to schedule this volume to be
checked the next time the system restarts? (Y/N)

wht you want me to do ?

Select Y.