tag:blogger.com,1999:blog-2492829521464061954.post4403776706860700252..comments2011-08-01T17:37:15.296+03:00Jaisal Abdurrahmanhttp://www.blogger.com/profile/02474749459567001514noreply@blogger.comBlogger13125tag:blogger.com,1999:blog-2492829521464061954.post-35484166828818653272011-02-27T07:03:31.510+03:002011-02-27T07:03:31.510+03:00I use a live Ubuntu or Linux cd to remote viruses like this, very easy just stick the disk in and boot it up. You get full read/write access to everything on the hard drives in that pc, regardless of any NTFS permissions set, and whats more all hidden and system files show automatically. Windows viruses do not affect Linux. This virus also tends to speard via USB memory sticks too, using the Autorun file. Just use linux to delete the infected files, very easy to do. If you use an uninfected Windows PC to clean the USB memory stick then make sure you hold down shift before inserting USB, and keep holding it down untill the new hardware is installed, this stops the autorun. Also make sure you have something like the NOD32 installed before inserting any USB memory sticks, as it cleans them automatically, but remeber to always hold down shift first.Anonymousnoreply@blogger.comtag:blogger.com,1999:blog-2492829521464061954.post-40935210210397951962009-06-12T05:10:36.834+03:002009-06-12T05:10:36.834+03:00thnx jaz it was more helpful<br />but be sure i already found the file dword exist i just changed value from 0 to 1 <br />any way you helped me to fix big problem <br />see you <br />mohamed mabroukAnonymousnoreply@blogger.comtag:blogger.com,1999:blog-2492829521464061954.post-73899903308564593392008-03-27T12:49:00.000+03:002008-03-27T12:49:00.000+03:00it helped. thank you very much.stormridernoreply@blogger.comtag:blogger.com,1999:blog-2492829521464061954.post-25215003638183140512008-03-27T12:30:00.000+03:002008-03-27T12:30:00.000+03:00try this http://drivers.softpedia.com/get/Other-DRIVERS-TOOLS/Others/Sony-EzRecover.shtml<BR/>and make sure you don't have a write protect switch on memory stickJaisal Abdurrahmanhttp://www.blogger.com/profile/02474749459567001514noreply@blogger.comtag:blogger.com,1999:blog-2492829521464061954.post-74925101426251691312008-03-27T12:17:00.000+03:002008-03-27T12:17:00.000+03:00Thanks for a prompt reply. I've tried this already but I can't. When I'm trying to format it says: disk is protected from writing. I tried on Linux as well, but I cannot mount read/write, because it checks the disk access rights and says no. I used ZoneAlarm and it found the virus, but of course cannot delete it as well.stormridernoreply@blogger.comtag:blogger.com,1999:blog-2492829521464061954.post-23076415252978185812008-03-27T12:13:00.000+03:002008-03-27T12:13:00.000+03:00@ stormrider <BR/><BR/>Just backup your files and format your memmory stickJaisal Abdurrahmanhttp://www.blogger.com/profile/02474749459567001514noreply@blogger.comtag:blogger.com,1999:blog-2492829521464061954.post-29080591361012120252008-03-27T12:06:00.000+03:002008-03-27T12:06:00.000+03:00Hey guys, I've got it on a memory stick and it has changed it mode to read only. I can see the virus files (autorun.ini and this sys.vbs file, but cannot delete it and cannot change rights to read/write. Please could You give any solution?stormridernoreply@blogger.comtag:blogger.com,1999:blog-2492829521464061954.post-49615043902973030462008-01-20T10:10:00.000+03:002008-01-20T10:10:00.000+03:00@Dushyant <BR/> welcome my friend.happy to know that you fixed .<BR/><BR/>@ nociv <BR/> Hello nociv,use the following methord<BR/><BR/>Unhide files by going to Start->Run and type"regsvr32 /u occache.dll"and hit OK.<BR/>logoff and relogon ur pc (must)and make sure you enabled show hidden files from folder option..<BR/>open your drive and delete "autorun.inf" file<BR/>after deleting the file Rehide files - Start->Run and type in "regsvr32 occache.dll" and hit OK<BR/><BR/>@ punit<BR/> Thats good thing.if you can open your drives by double click,then u dont have the aoutorun.inf ...so dont mind it !!!Jaisal Abdurrahmanhttp://www.blogger.com/profile/02474749459567001514noreply@blogger.comtag:blogger.com,1999:blog-2492829521464061954.post-54928739131196367012008-01-07T14:17:00.000+03:002008-01-07T14:17:00.000+03:00well i culd open drives wen i cleaned pc wit kaspersky anti virus......... but wat abt that autorun.inf file??? where is it? neways great work by u brother......... take a bow!!!!!!!!!!punithttp://www.blogger.com/profile/03951358818744350830noreply@blogger.comtag:blogger.com,1999:blog-2492829521464061954.post-2760358130849821442008-01-05T15:59:00.000+03:002008-01-05T15:59:00.000+03:00hei..thanks for the info...very helpful..but i to still have that partition problem..and..there are no autorun.inf :( do you know why ?nocivhttp://www.blogger.com/profile/13035268945769504345noreply@blogger.comtag:blogger.com,1999:blog-2492829521464061954.post-46909324946824564942008-01-04T17:11:00.000+03:002008-01-04T17:11:00.000+03:00Thanks mate. Fantastic post. I had that hidden files problem and now it's completely solved. Thanks again.Dushyanthttp://www.blogger.com/profile/10827515876766603730noreply@blogger.comtag:blogger.com,1999:blog-2492829521464061954.post-2496643699346043582007-12-26T12:20:00.000+03:002007-12-26T12:20:00.000+03:002)Unhide files by going to Start->Run and type"regsvr32 /u occache.dll"and hit OK.<BR/>logoff and relogon ur pc ..<BR/>open your drive and delete "autorun.inf" file<BR/>after deleting the file Rehide files - Start->Run and type in "regsvr32 occache.dll" and hit OK.<BR/><BR/>(make sure you have cleaned virus before doing this.)Jaisal Abdurrahmanhttp://www.blogger.com/profile/02474749459567001514noreply@blogger.comtag:blogger.com,1999:blog-2492829521464061954.post-28131014038565993132007-12-20T21:24:00.000+03:002007-12-20T21:24:00.000+03:00thanx man..info was very helpful<BR/>the hidden folder problem is solved.<BR/>but i still cant open partitions with double click..<BR/>any solutionDeepZhttp://www.blogger.com/profile/02308152170950573907noreply@blogger.com