Godzilla Virus

[keestha]

Running a hotel where 3 computers can be used by guests, I stand a higher chance to contract a virus than the average moderately knowledgeable user. Lately a guest complained he could not access his email acount using one of the computers. He got through to the email provider's sign in page, but than couldn't gain access to his account. I noticed the text "hacked by godzilla" in the blue bar on top of the screen, next to the web page's name. A bit of reseach learned me that the godzilla vrus spreads through portable devices such as memory sticks, and memory cards used with cameras. Went into the registry, if there had been just one key called godzilla I would probably have deleted it after having backed up the registry, but the term godzilla was in many places in the registry. A removal tool for this virus, found after some googling, didn't do the trick. Finally I solved the problem by using the restore option. I warned another guest who had connected his camera with memory card to the same computer before I was aware of the problem, that his memory card now also might be carrying the virus. To check it out we connected his camera to the now virus free computer, had a look at some photos, disconnected the camera, and sure, the computer was infected again. A memory stick can be cleaned of the virus by reformatting it, but than all data will be lost. I read in the internet that this virus is still uncommon outside Asia, but quite a few Europeans already became infected after looking at pictures brought by a friend who just returned from Thailand.

[cdnvic]

There's a topic on this with removal info if you want.

http://www.thaivisa.com/forum/index.php?showtopic=96863

If I were you, I'd get a Linux computers for public internet stations as it eliminates all these problems, and keeps your costs down too.

[Guest Reimar]

I agree with cndvic! And if I would you, I would do an sticker on each "public" computer with a warning that they use the computer at thems own risk and that you're not responsible for any and all infections by virus, spy, trojan pp.!

[sabajja]

2 simple steps to approach USB sticks you "aren't sure of".

1. Enter Group policy editor (run=>"gpedit.msc")

Administrative templates>System=>Turn off autoplay on all drives

2. Scan USB stick with updated antivirus by right clicking the drive Before

opening it.

Any malwarez that uses the "Autorun.inf", can be cleaned this way.

USB sticks are just like harddisks, in that they can be cleaned of infected files.

Offcourse, you can't expect hotel guests to do this...

PS.

You can have "Autoplay" disabled all the time, you don't need it.

If you want to autoplay anyway, simply rightclick the drive you wanna access.

Autoplay will be listed as one of the options.

Edited April 1, 2007 by sabajja