Author Topic: help with external hard drive and potential virus?  (Read 2568 times)

0 Members and 1 Guest are viewing this topic.

Offline phildaint

  • Jr. Member
  • **
  • Posts: 22
help with external hard drive and potential virus?
« on: March 04, 2013, 06:04:31 PM »
Hi all, now im no computer wiz so sorry if things aren't clear!

Backed up all my files so i could do a restore on my pc, now its all back up and running i cant seem to access my files on my Western digital device and this is what i keep getting...



the pictures file is the main one i need as its all work related

would it be flagging it up by accident?

not quite sure what i have to do to access all these files, cheers

Offline phildaint

  • Jr. Member
  • **
  • Posts: 22
Re: help with external hard drive and potential virus?
« Reply #1 on: March 04, 2013, 06:23:00 PM »
and this is the warning that comes up if i click 'restore' option - do i just need to mark all the folders as safe from the /F: drive


Offline magna86

  • Anti Malware Fighter
  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 4177
    • Ambulanta MyCity Forum - ASAP Member
Re: help with external hard drive and potential virus?
« Reply #2 on: March 04, 2013, 07:07:24 PM »
Hi,

> Check USB storage devices / removable drives


Download MCShield from one of the following links:

MyCity -  Official download link
Softpedija - Mirror download link

  • Double click MCShield-Setup to install the application.
  • Wait a few seconds to MCShield finish initial scan.
Recommendation to under General and Scanner tab you click on Defaults button to choose recommended options.
  • Connect your USB storage devices to the computer one at a time. Scanning will be done automatically.
When all scanning is done, you need to attach a logreport that has made MCShield.

Start -> All Programs -> MCShield -> Logs

Attach here -> AllScans.txt

Explanation: USB storage devices are all the USB devices that get their own partition letter at connecting to the PC,
e.g. flash drives (thumb/pen drives, USB sticks), external HDDs, MP3/MP4 players, digital cameras,
memory cards (SD cards, Sony Memory Stick, MultiMedia Cards etc.), some mobile phones, some GPS navigation devices etc.


--------------------------------------------------




Download DDS and save it to your Desktop from here:
http://download.bleepingcomputer.com/sUBs/dds.scr

Double click dds to run the tool.

    * When done, DDS will open two (2) logs:
        1. DDS.txt
        2. Attach.txt

Save both reports to your desktop. DDS.txt and Attach.txt attach back to topic.

Offline phildaint

  • Jr. Member
  • **
  • Posts: 22
Re: help with external hard drive and potential virus?
« Reply #3 on: March 04, 2013, 07:51:27 PM »
>>> MCShield AllScans.txt <<<



>>> MCShield ::Anti-Malware Tool:: v 2.5.4.20 / DB: 2013.3.3.1 / NT6.1 <<<


04/03/2013 18:47:08 > Drive C: - scan started (no label ~233 GB, NTFS HDD )...



=> The drive is clean.





>>> MCShield ::Anti-Malware Tool:: v 2.5.4.20 / DB: 2013.3.3.1 / NT6.1 <<<


04/03/2013 18:48:47 > Drive F: - scan started (My Book ~1863 GB, NTFS HDD )...



=> The drive is clean.




Offline Pondus

  • Avast Überevangelist
  • Maybe Bot
  • *****
  • Posts: 27818
Re: help with external hard drive and potential virus?
« Reply #4 on: March 04, 2013, 07:57:20 PM »
attach the next log.....not copy and paste

see belowe the txt box you write in, attachment and other options
Chief Wiggum: Uh, no, you got the wrong number. This is 9-1…2.


Offline phildaint

  • Jr. Member
  • **
  • Posts: 22
Re: help with external hard drive and potential virus?
« Reply #5 on: March 04, 2013, 08:05:48 PM »
Sorry im computer illiterate,  shouldn't be allowed near a computer  ;D

Anyway here are 2 attachments for you

Offline Pondus

  • Avast Überevangelist
  • Maybe Bot
  • *****
  • Posts: 27818
Re: help with external hard drive and potential virus?
« Reply #6 on: March 04, 2013, 08:13:22 PM »
Sorry im computer illiterate,  shouldn't be allowed near a computer  ;D

Anyway here are 2 attachments for you
it is just that some logs are very big, meaning you have to use a number of posts with copy and paste to post it all  ;)   
Chief Wiggum: Uh, no, you got the wrong number. This is 9-1…2.


Offline magna86

  • Anti Malware Fighter
  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 4177
    • Ambulanta MyCity Forum - ASAP Member
Re: help with external hard drive and potential virus?
« Reply #7 on: March 04, 2013, 08:16:56 PM »
Ok, download USBNoRisk by bobby to your Desktop.
http://amf.mycity.rs/personal/bobby/USBNoRisk/usbnorisk.exe

- Wait a few seconds while the program performs an initial scan.
- Inserts the USB memory device into the USB slot row and keep in each slot by 10 - 15 seconds.
- If you have several devices for scanning, then please note order of inseritng USB's  drives becouse we will need this information later
- When you're done with all devices, click the right mouse button in the middle of the program window and select Save scrambled log .
-It will automatically open the log in Notepad. Save content of that notepad (USBnoRisk log) to your Desktop

> Attach here USBNoRisk logreport.

Offline phildaint

  • Jr. Member
  • **
  • Posts: 22
Re: help with external hard drive and potential virus?
« Reply #8 on: March 04, 2013, 08:24:29 PM »
next step for you ;D

Offline magna86

  • Anti Malware Fighter
  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 4177
    • Ambulanta MyCity Forum - ASAP Member
Re: help with external hard drive and potential virus?
« Reply #9 on: March 04, 2013, 09:02:18 PM »
Re-run USBNoRisk,

-Wait a few seconds while the program performs an initial scan.
Attach the USB memory device.

Click on Script tab, in white window box copy-paste the following text:

Code: [Select]
{23a820f6-820b-11e2-a00f-001b21431b30}
delete_mimics:
no_sh:
folder_list: %DRIVE%


Click on RunScript button



Upon execution of commands, USBNoRisk will automatically return to the Monitor tab;

- Do right click inside the white window frames and choose Save Log Scrambled;

-It will automatically open the log in Notepad. Save content of that notepad (USBnoRisk log) to your Desktop

Offline phildaint

  • Jr. Member
  • **
  • Posts: 22
Re: help with external hard drive and potential virus?
« Reply #10 on: March 04, 2013, 09:17:43 PM »
And all my files are now showing :D

Do i need to do anything else or is that it all sorted?


Offline magna86

  • Anti Malware Fighter
  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 4177
    • Ambulanta MyCity Forum - ASAP Member
Re: help with external hard drive and potential virus?
« Reply #11 on: March 04, 2013, 09:38:04 PM »
We still have work here, I'll tell you when we're done.  ;)


> Attach USB memory drive and manualy delete RECYCLER folder.


Has MCShield been running through/via avast sadbox?



Offline phildaint

  • Jr. Member
  • **
  • Posts: 22
Re: help with external hard drive and potential virus?
« Reply #12 on: March 04, 2013, 09:56:24 PM »
deleted 'recycler' folder though kept the $RECYCLE.BIN (unles you want me to delete that too)

not sure what you mean about the sadbox but i have had no warnings like before where it pops up to say x trojan was stopped


Offline magna86

  • Anti Malware Fighter
  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 4177
    • Ambulanta MyCity Forum - ASAP Member
Re: help with external hard drive and potential virus?
« Reply #13 on: March 04, 2013, 10:06:44 PM »
deleted 'recycler' folder though kept the $RECYCLE.BIN (unles you want me to delete that too)

not sure what you mean about the sadbox but i have had no warnings like before where it pops up to say x trojan was stopped

I know, but something has prevented MCShield to do his job. We are trying to determine what is it.
Are you sure that MCShield is good/right and fully installed?

> Remove USB mem. device from the computer.


Download fresh MCShield setup and re-run MCShield installation.
http://amf.mycity.rs/mcshield/





> Right click on MCShield in system tray ( blue shield icon ) and click on Control Centre.

- Click on Scanner tab and check the options:

Always unhide items on flash drive


. Attach USB mem. device and allow MCShield to preform the scan.


Start -> All Programs -> MCShield -> Logs

Attach here fresh -> AllScans.txt


------------------------------------------


Additional check:


> Download ComboFix from here and save it to your Desktop.
If you are unsure how ComboFix works please read this guide carefully.
note: ComboFix must be downloaded to your Desktop.

> Temporarily disable your AntiVirus program.
If you are unsure how to do this please read this or this Instruction.

How to disable avast:

  • Right-click on the avast! icon in the lower right corner of the screen and choose Open Avast! User Interface.
  • In the window that opens on the top right corner, click Settings.
  • In a new window that opens, choose the option Troubleshooting, Uncheck Enable avast! self-defense, and click OK.

  • Right-click on the avast! icon in the lower right corner of the screen and select avast! shield controls .
  • In the menu that appears, choose Disable Permanently. When you are prompted to turn off security, click Yes.
Note: Do not forget to turn on this option after the cleaning.



> Run ComboFix. Click on I Agree!
ComboFix will check if there is a newer version of ComboFix available.
Click Yes if prompted to download.

ComboFix will display DISCLAIMER OF WARRANTY ON SOFTWARE.
Click Yes to allow ComboFix to continue.

If Recovery Console is not installed, ComboFix will offer download & installation.
Click Yes to allow ComboFix to install Recovery Console.
Note:Do not mouse-click Combofix's window while it is running.
If you see a message like "Illegal operation attempted on a registry key that has been marked for deletion" just restart computer once more.


> When the tool is finished, it will produce a log report for you. (typical location: C:\ComboFix.txt )
  Attach log reports ( ComboFix.txt) back to topic.


Offline phildaint

  • Jr. Member
  • **
  • Posts: 22
Re: help with external hard drive and potential virus?
« Reply #14 on: March 05, 2013, 12:10:21 AM »
sorry fpr the long reply, here is the first and combo fix log