“flashy.exe”

[Upcountry]

My wife’s thumb drive got hit with a virus/trojan (flashy)(.exe?) that messes it up and infects computers. I’ve been tasked with cleaning it up, but it’s been tricky finding the solution.

Many websites in my search have Thai script, and English references don’t answer my questions, entirely.

I have AVG Free on my system, but I don’t want to insert the thumb drive until I’m SURE that AVG will kill the mess before it can infect my computer. While I saw a comment by a user indicating that it can handle it, AVG’s website does not mention it (can't find it listed anywhere there).

As I said above, I’m struggling to find the best way to catch the problem on insertion of the thumb drive. The virus/trojan may go by different names.

I hope one or some of you had had this problem already (though I wouldn't wish it on anybody ), and can lend a hand!

Again, I want to kill this problem on the thumb drive before it can harm my computer. Many web links I've found refer to fixing the problem on the computer once it has been infected.

Thanks,

UC

Edited February 18, 2007 by Upcountry

[cdnvic]

While it's no secret that I'm not exactly a fan of AVG's capabilities, it should block this thing from infecting your computer if you have the resident scanner running when you plug it in. After that, find the drive in Windows Explorer, right-click on it and choose "format". That will make sure it's cleaned.

[Farma]

This website gives english instructions on removal of Glupzy (flashy exe) including a link to a removal program.

<url removed>

Edited February 19, 2007 by Totster
Removed url

[cdnvic]

This website gives english instructions on removal of Glupzy (flashy exe) including a link to a removal program.

<url removed>

That's been alleged by many to be a scam site... use caution.

Edited February 19, 2007 by Totster

[Farma]

Pantip.com doesn't seem to think so. It recommends the removal from the site i provided.

[cdnvic]

Pantip.com doesn't seem to think so. It recommends the removal from the site i provided.

Well if you prowl alot of security forums and newsgroups you'll find all sorts of information on various rogue "antispyware" companies and the dirty tricks they play. This is one of them, and all I can say is use at your own risk.

[Totster]

Whether the site is or isn't a scam, I have removed the URL to be on the safe side...

Thanks

Totster

[nikster]

My wife’s thumb drive got hit with a virus/trojan (flashy)(.exe?) that messes it up and infects computers. I’ve been tasked with cleaning it up, but it’s been tricky finding the solution.

Many websites in my search have Thai script, and English references don’t answer my questions, entirely.

I have AVG Free on my system, but I don’t want to insert the thumb drive until I’m SURE that AVG will kill the mess before it can infect my computer. While I saw a comment by a user indicating that it can handle it, AVG’s website does not mention it (can't find it listed anywhere there).

As I said above, I’m struggling to find the best way to catch the problem on insertion of the thumb drive. The virus/trojan may go by different names.

I hope one or some of you had had this problem already (though I wouldn't wish it on anybody ), and can lend a hand!

Again, I want to kill this problem on the thumb drive before it can harm my computer. Many web links I've found refer to fixing the problem on the computer once it has been infected.

Thanks,

UC

If you turn off the windows "Autoplay" feature, the virus will not get installed on your computer upon insertion.

The way to do this is to install TweakUI, part of Powertoys for Windows XP. It's a free download from Microsoft:

http://www.microsoft.com/windowsxp/downloa...ppowertoys.mspx

Once you have TweakUI installed, start it, go to "My Computer" -> AutoPlay -> Types and disable autoplay for all types of media.

I recommend leaving autoplay disabled for security reasons, but if you want you can also re-enable it after you are done dealing with the virus.

The way these viruses propagate is by starting themselves with the autoplay feature- windows automatically executes them as soon as the flash drive is inserted. If autoplay is disabled, this doesn't work and you can just browse the drive normally, disinfect it with a normal AV software or even just plain delete the virus. When not running, the virus will be just another .exe file on the flash drive.

[Upcountry]

Once you have TweakUI installed, start it, go to "My Computer" -> AutoPlay -> Types and disable autoplay for all types of media.

Ah, this is great. Thank you. I'm a big fan of TweakUI, forgot I could do this for removable drives.

Too bad it's so hard to tell good and bad anti-spyware, etc., web sites apart.

[Upcountry]

FYI, after AVG deleted flashy.exe and the exe's that had "replaced" the folder names. the folders were still there. No data lost, thankfully.

Edited February 19, 2007 by Upcountry

[oooooo]

AVG doesnt seem to be so bad after all. works like a charm for me.

[cdnvic]

Three or four AVG users came in here last weekend looking for help with infections, that's never happened with Antivir or nod32.

as the girls say.... up 2 you

[Upcountry]

My biggest complaint about AVG is how I have to wait for it to update on boot-up. Trying to start some apps like Eudora before it runs through its process can cause me to have to quit the app (again, Eudora, sometimes others). But it's good that it checks for updates first thing.

It's possible that users with trouble had not been using it properly. Part of the reason I made it my primary tool (still keep Avast around) is that is seemed better at catching some nasties a while back.

But who knows, I think these products, in constant competition, are constantly leap frogging each other.

UC

[cdnvic]

Avast has one of the best mail scanners IMO. It was my personal pick out of all the free AVs but now Antivir has come along and is far and away doing the best in test after test regardless of who's testing it. It's actually outclassing the paid AVs with the possible exception of nod32 and Kaspersky.

[sabajja]

If you already been infected with this malware, you wont be able to access your computer anymore, as it sets a new administrator password.

(If you only use this profile)

If you've been infected, the password is "hacked"

Type it in, logon,

Then remove with these instructions:

http://www.symantec.com/security_response/...-99&tabid=2