problem opening drives

[Neitz]

i know my problem is caused by a virus or is the residue of a virus. im having dificulty opening my flash drive and my local disk, everytime i click on it an open with window pops asking me which program i would like to use to open the file with. if anyone help me, i would like to know what has caused this and how to solve this problem....Thankx....

[gerbil]

Neitz, check in the root of each affected drive to see if there is a file called autoruns.inf: if so, delete it. Then...
==Please download Malwarebytes' Anti-Malware
from: http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html
or: http://www.besttechie.net/tools/mbam-setup.exe
=Dclick that file, mbam-setup.exe, to install the application,
-ensure that it is set to update and start, else start it via the icon, and UPDATE it.
Select "Perform QUICK Scan", then click Scan; the application will guide you through the remaining steps.
ENSURE that EVERYTHING found has a CHECKMARK against it, then click Remove Selected.
If malware has been found [and removed] MBAM will automatically produce a log for you when it completes... do not click the Save Logfile button.
Examine the log: if some files are listed as Delete on Reboot then restart your machine before continuing.
Copy and post that log [it is also saved under Logs tab in MBAM].

[josmcc]

Sounds like a registry error. Try running a scan with http://www.eusing.com/free_registry_cleaner/registry_cleaner.htm
a registry cleaner. Just make sure you make a back up. Some viruses can wreak havoc on your registry, even after removal the registry might still need to be repaired.

[gerbil]

Aw... please don't run registry cleaners. They just don't do anything worthwhile. If you really want to speed up registry access then remove spaces and defragment it - sysinternals have a pgm for doing that latter.

[Neitz]

Neitz, check in the root of each affected drive to see if there is a file called autoruns.inf: if so, delete it. Then...
==Please download Malwarebytes' Anti-Malware
from: http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html
or: http://www.besttechie.net/tools/mbam-setup.exe
=Dclick that file, mbam-setup.exe, to install the application,
-ensure that it is set to update and start, else start it via the icon, and UPDATE it.
Select "Perform QUICK Scan", then click Scan; the application will guide you through the remaining steps.
ENSURE that EVERYTHING found has a CHECKMARK against it, then click Remove Selected.
If malware has been found [and removed] MBAM will automatically produce a log for you when it completes... do not click the Save Logfile button.
Examine the log: if some files are listed as Delete on Reboot then restart your machine before continuing.
Copy and post that log [it is also saved under Logs tab in MBAM].

how do i find the file autoruns.inf

[gerbil]

An example would be C:\ autorun.inf
Just use Explorer, expand each drive [partition] if it exists. If not, just run MBAM. These files are usually found in software cds to automatically start the installation processs when you insert the cd, saves you hunting for setup.exe or whatever. But you can write all sorts of instructions into them. Naughty ones.

[Neitz]

i deleted autorun.inf using msdos and rebooted my machine... it worked!! thanks alot........

[gerbil]

That's good, neitz, so now we know the problem. But something put that file there, and it is likely still in your machine. I do strongly suggest yur run MBAM as above. Post the log.

[Godsp3ed]

For any further similar issue, the following temporary measure can be taken..

Open CMD (Start/Run/Cmd)
Type in :
1) X: (where X is the drive letter of the drive)
2) dir /ah (it'll give you the list of all hidden folders/files)
3) If you find 'Autorun.inf' then type in 'del autorun.* /f /s /q /a'

[Neitz]

ive removed autorun.inf from my c: drive but a problem still remain in my flash drive or any other flashdrive that i connect to my flashdrive. there are 2 files that keep appearing everytime i insert a usb storage device. autorun.inf and backupuser.exe. ive formatted my flashdrive a couple of times but they still keep popping up what are they and what should i do?

[Godsp3ed]

ive removed autorun.inf from my c: drive but a problem still remain in my flash drive or any other flashdrive that i connect to my flashdrive. there are 2 files that keep appearing everytime i insert a usb storage device. autorun.inf and backupuser.exe. ive formatted my flashdrive a couple of times but they still keep popping up what are they and what should i do?

It means your Pc is still infected...And the infection is trying to spread itself by getting into the Flash Drives...

Please Download ATF-Cleaner (Windows XP, 2K, 2003 & Vista ONLY)
• You can put ATF-Cleaner on your Desktop for easy access.
RUN ATF-Cleaner.exe.

-- Click on ATF-Cleaner to run it
-- Where it says Select Files To Delete, Check the Select All Option
-- Click Empty Selected > OK

Download Malwarebytes' Anti-Malware to your desktop.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure to checkmark the Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* Make sure all applications including browsers are closed during the scan and you are preferably not in safe mode
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad, Save the Logfile.
* Immediately Reboot he computer
Post the MBAM log back here.

[gerbil]

I did tell you that some malware inserted those autorun.inf files; just deleting them may not cure the problem. And that you should run MBAM as a next step.

[Neitz]

I scanned with Mbam heres the log

Malwarebytes' Anti-Malware 1.38
Database version: 2297
Windows 5.1.2600 Service Pack 2

6/19/2009 12:34:02 PM
mbam-log-2009-06-19 (12-34-02).txt

Scan type: Full Scan (C:\|D:\|E:\|F:\|G:\|)
Objects scanned: 140335
Time elapsed: 35 minute(s), 10 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue (Hijack.System.Hidden) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

[gerbil]

So these files, autorun.inf and backupuser.exe, are not being recreated now? That's fine then, Neitz.

[Neitz]

the files are being recreated on my flash drive but not on my local disk.

[gerbil]

You are going to have to wipe your flashdrive and format it. Remove it. Then try this:
==Download this file to your DESKTOP: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
.....or this file: http://subs.geekstogo.com/ComboFix.exe
-IMPORTANT! : disconnect from the web, turn off your Antivirus, Antispyware and Firewall for the duration of this scan. Don't forget to reset them before you go back on the web!
- to run it dclick the Combofix.exe icon and follow the prompts to start it. When finished, it will produce a log, C:\Combofix.txt - post that log in your next reply.
A word of caution - do not touch your mouse/keyboard until the scan has completed. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs reboot to restore the desktop.