New Virus

[higgy88]

My son brought home a new virus in his flash drive that he uses for school. The virus is called FlashGuard.exe and/or DriveGuard.exe.

It was not recognized by either Avira AntiVir Personal Free Edition or Windows Defender, both kept fully updated.

The way I found out I had it was when running a standard scan using Advanced Windows Care Personal, it told me that I had a new start up program running, so I investigated.

I found this site, and used his quick and easy method to remove the virus.

Tung's Blog

When my son came home from school, I used my linux machine to delete the files on his flash drive, but not before running a scan using Clam AV. It also did not recognize this virus.

Just a heads up, and keep your eyes open.

[gzu88bv]

..... a new virus in his flash drive that he uses for school........

I dont want to generalize, but it also does not surprise me that virus from computers in Thai schools and/or Internet places can be caught quite easily.

When I go to print shops up here to have something scanned or printed, each time I return home my USB stick is virus infected.

So far I have been lucky as Norton always did the job......

[stumonster]

is is not just USB sticks

all removable storage is a problem.

I had an SD card from a camera given to me recently to get somefiles off , it has a USB virus gotten from a camera processing shop.

turn off autorun

start - run - gpedit.msc

admin templates - system - turn off autoplay , enable

then don't double click on untrusted storage or else you will run the autorun.inf anyway , explore it first and make sure it does not contain an autorun.inf

if it does contain an autorun.inf , hightlight it with one left click , hold left shift and right click on it once , choose open with and open it in notepad.

look to see what filename(s) the autorun is supposed to execute and delete all of it.

[higgy88]

Stu, thanks for the lesson on holding the left shift key down while right clicking on the autorun.inf file to see where it points to.

Autorun is turned off on my computers, and I have taught both my kids and wife to always check for viruses and malware before opening any removable media. The problem is when you think the media is clean but it really isn't. This is the first one that got past my son, and I used it as a valuable lesson for him.

I just wanted to let everyone know that this is a new one that, at least the malware software I use, has not identified yet.

Higgy

[stumonster]

Autorun is turned off on my computers, and I have taught both my kids and wife to always check for viruses and malware before opening any removable media. The problem is when you think the media is clean but it really isn't.

was a case last year where USB picture frames were shipped with infections - and been many since with Mp3 players out of china.

[GungaDin]

Jeeez, what can you trust!

[BEENTHEREDONETHAT]

I've found that with the protection programs my machine runs at a snails pace. So I have eliminated all my protection and enjoy the faster response. For protection I let my wife open any mail first as her machine has all kinds of protection. Once she has opened it then I will. So far so good.

[Rice_King]

When I go to print shops up here to have something scanned or printed, each time I return home my USB stick is virus infected.

I have learned to switch my USB drive to "read-only" before taking it to the print shops. Most of those places are virus havens. Making the device read-only prevents infection.

[vagabond48]

When I go to print shops up here to have something scanned or printed, each time I return home my USB stick is virus infected.

I have learned to switch my USB drive to "read-only" before taking it to the print shops. Most of those places are virus havens. Making the device read-only prevents infection.

Sounds like a good idea. How can I do this?

I have a kingston usb and a WD external portable drive and neither have hardware switches. I did a google search but only found changes to the registry which I would think would not be carried over to another PC.

[Rice_King]

When I go to print shops up here to have something scanned or printed, each time I return home my USB stick is virus infected.

I have learned to switch my USB drive to "read-only" before taking it to the print shops. Most of those places are virus havens. Making the device read-only prevents infection.

Sounds like a good idea. How can I do this?

I have a kingston usb and a WD external portable drive and neither have hardware switches. I did a google search but only found changes to the registry which I would think would not be carried over to another PC.

On my flash drives, there is a physical "slide" switch. Slide it one way and it makes the drive read/writable. The other way makes it read only. I have never attempted doing this on a USB external hard drive, only flash drives. I think a hard drive would have to be made "write only" from within the properties tab for that particular drive from within the OS. And I am uncertain if those settings would carry over when it was plugged into another machine. Maybe someone else here can verify?

[pete_r]

Agree that a read-only switch on the side of the USB drive is the best protection, except when I have to copy files from an infected computer (and don't have time to clean it up first).

An alternative I use is to create a new folder on the USB drive and name it "autorun.inf". For some reason the presence of such a folder prevents the USB-drive viruses from creating a file with the same name, which in turn prevents further infection when double-clicking to open the drive. The drive still gets a copy of the virus itself (typically a .exe file), but it's usually easy to locate and delete. Just don't go and double-click on the .exe file, as that will trigger the infection. May not be 100% bulletproof, but it's been working quite well so far.

[stumonster]

An alternative I use is to create a new folder on the USB drive and name it "autorun.inf".

nice tip - thanks

[vagabond48]

ditto on the tip. thanks