autoplay on my hdd

[ston3sour]

---

mga bro.. mangayu unta kog tabang..

pagmata nako karong buntag kay dli na ma open ug derecho ang drive G: sa among pc..
nag gamit diay akong manghod gabie sa pc.. nag taod pa jud cyag usb..
then pag tan-aw nako sa every drive kay naay 2 files (autorun.inf & tracker.vbs)
ako dayun g delete ang duha ka files..







unsaon pag tang2x aning autoplay sa hdd mga bro? kay hasol man gud cgeg ryt click kng mag open gud..

akong gisuwayan ug ang mga solusyon sa mga similar threads diri sa istorya pero d gihapon mawala ang autoplay..

tabang mga bro..

[pangitko79]

mga bro.. mangayu unta kog tabang..

pagmata nako karong buntag kay dli na ma open ug derecho ang drive G: sa among pc..
nag gamit diay akong manghod gabie sa pc.. nag taod pa jud cyag usb..
then pag tan-aw nako sa every drive kay naay 2 files (autorun.inf & tracker.vbs)
ako dayun g delete ang duha ka files..







unsaon pag tang2x aning autoplay sa hdd mga bro? kay hasol man gud cgeg ryt click kng mag open gud..

akong gisuwayan ug ang mga solusyon sa mga similar threads diri sa istorya pero d gihapon mawala ang autoplay..

tabang mga bro..

hahaha! vbs script bayrus!

una abli kag windows exporer..daun adto ka sa tools...human folder options...nya sa view tab, show hidden files and folders..tpos uncheck hide extensions for known file types...

karon mag sugod ang lingaw! hahaha!!! imo pangitaon kada folder sugod sa root directory (e.g. c:'\) kanang 2 ka file nya imu pang deleton...

dayon adto ka sa registry...search nimo tanan entries anang tracker.vbs unya pang deleta..

kapoy sa? REFORMAT....hehehe

[ston3sour]

kapoy sa? REFORMAT....hehehe

waaahhh!

kapoyag reformat bai oi.. hapit na raba puno ang 500gb

[luwid]

turn off system restore update antivirus...restart... scan....then adto registry.. CNTRL F lang kungg mangita ka ana nga file nya kung naa kay makit an delete hangtud mahurot sa registry.. restart.. turn on system restore

[Ebyong2009]

scan disk rana bai... automatic fix na.. wagtang na ang autorun..

[butitoy]

shortest / shortcut version : by butitoy <<< my tested and proven way...

download RRT.exe ( remove restriction tool )

run.. and restart


download COMBOFIX.EXE

run...and just let it RUN alone..

..it will audit ur pc scripts...

gud bye lame usb virus.


** BEST DONE IN SAFEMODE**

Long version : by SHENGTON ..fellow istoryan... tested techie

Software used to build the virus= AutoIt V3
drop Files- killer.exe(4084 kb) in c:\windows\
lsass.exe(3920kb) in c:\documents and settings\all users\start menu\programs\startup
smss.exe(4088kb) in all root drives and in c:\windows
autorun.inf(1kb) in all root drives with a script

[autorun]
open=smss.exe
shell\Open\Command=smss.exe
shell\open\Default=1
shell\Explore\Command=smss.exe
shell\Autoplay\command=smss.exe

Funny UST Scandal.avi.exe(228kb) in all root drives

Registry Entries-HKLM\Software\Microsoft\WindowNT\CurrentVersion\Wi nlogon=shell(killer.exe)
HKCU\Software\Microsoft\windows\Currentversion\Run =runonce(c:\windows\smss.exe)


HOw to remove this lame virus?Huh

-first download taskiller in [ Task Killer - process manager to terminate applications (tasks) quickly and tracking their memory usage ] - RSD Software, Inc. and install it to
your computer because you cant use taskmanager to terminate the virus(the virus automatically close taskmanager).

-run taskiller and left click it on the system tray(the one with a skull icon)

-click processes

-to close the virus, select process and click yes to the question

(process to close)
1.killer.exe
2.lsass.exe
3.smss.exe

note: close only file that have the same icon of Funny UST Scandal.avi.exe


CMD STEPS
1-now, click "start" then "run"
2-type "cmd" without quotes
3-type "cd\" without quotes
4-type "attrib -h -s smss.exe" without quotes
5-type "attrib -h -s autorun.inf" without quotes
6-type "start c:" without quotes(a new window will open)
7-select smss.exe,autorun.inf,Funny UST Scandal.avi.exe and delete it

-if theres any drive or a partition type "d:" in command prompt without quotes
"d" is the drive letter then repeat the CMD STEPS number 4-7 above.......

-now type this on the command prompt "cd windows" without quotes(na naman!)
-type "attrib -h -s smss.exe" without quotes(uli)
-type "start c:\windows" without quotes(hay naku!)
-delete the file smss.exe
-now, goto c:\documents and settings\all users\startmenu\programs\startup
-delete lsass.exe

-click "start" then "run"
-type "regedit" without quotes then delete the registry entries above....

-thats all!!!!!! MABUHAY ANG LIPA(6519)

question email me at: six519@yahoo.com

Note:
Magtatagalog na ako.. hirap na akong mag english......
Kapag nagkaproblema kau sa pagoopen ng drives sa mycomputer open
nyo lang uli ang regedit tpos find nyo lang ang "smss.exe"
tpos burahin nyo [Text style: ung -> Please type the word completely. Please read 3.7] mga value na katulad nito--->>"c:\smss.exe","d:\smss.exe" etc.....

ok?Huh

[ston3sour]

@butitoy

thnx kaau bro.. ok na ako hdd diri.. wla nay autoplay
ako gamit kay combofix diay.. thnx!

[kabz]

nice bro maau nuon na balik na jud imong 500gig