Generic worm and Weird boot

Jackobyte

For the record I've read the charter but I haven't taken any of steps listed as I didn't feel they were necessary unless the things are related.

I had to use a memory stock on school and when I plugged it back into my home system generic worm was found and removed by mcafee (not the best I know but I've a 15 month license with my system so I said I'd use it until it expires.)

Today when I looked to boot, I got a check screen checking the hard drive for consistency. Could they be related? Boot screen is attached.

http://www.imgur.com/CxDjU.jpg

Krik Nav

Well a worm typically doesn't attach itself to a program, It just tunnels around and replicates itself like a real worm. This could replicate alot and use alot of disk space causing your pc to become slow or crash. Generally resulting in a BSOD.
With your problem though I don't think it's related to a worm virus. They are typically transferred by USB keys and I'd advise getting rid of it asap. Formatting the USB key won't remove it. Go control panel, appearance, folder options, show hidden files and folders to show the invisible files on your USB key.
Better run a disk error check on your pc too. Right click your disk drive.
Properties - Tools - Error checking - check now
Hope I helped a bit.
-Aaron

Jackobyte

Krik Nav wrote: »

Well a worm typically doesn't attach itself to a program, It just tunnels around and replicates itself like a real worm. This could replicate alot and use alot of disk space causing your pc to become slow or crash. Generally resulting in a BSOD.
With your problem though I don't think it's related to a worm virus. They are typically transferred by USB keys and I'd advise getting rid of it asap. Formatting the USB key won't remove it. Go control panel, appearance, folder options, show hidden files and folders to show the invisible files on your USB key.
Better run a disk error check on your pc too. Right click your disk drive.
Properties - Tools - Error checking - check now
Hope I helped a bit.
-Aaron

F**k. It's a brand new 16gb stick. Gah! Is there any recovery at all possible?

Have hidden folders shown already and no new files were there in the mem sticks root when the thing popped up yesterday. When McAfee removed it, they quoted I:/Business Presentation/Autorun.inf as the worm. That file is visible but was there before connecting the stick to the school system as it was from a "package for CD" powerpoint to ensure all pictures went with it. A full computer scan returned no results on the worm on my system anyway. I have a partitioned hard-drive with ubuntu on the other partition. Could it have infected there as well? That wouldn't be covered by my antivirus.

Also, how can I connect the stick without it autorunning so I can scan the files. Which software would be the best to ensure nothing is missed?

BTW, thanks for the reply.

Krik Nav

Oh you already got rid of the worm? There are loads of free anti virus software that will pick up what McAffee missed (if anything) such as: Avast, Kapersky, possibly Spybot S&D to name a few.
I don't think the uBuntu would be affected unless you used the key with that?
Another problem with a worm is that it backs itself up inside the system 32 folder sometimes and then even if you system restore, there is a chance of the worm still being there and coming back.
There are USB key recovery tools and you might be able to recover files using one of them.

I'd also recommend turning off autorun while checking your devices just in case.
http://support.microsoft.com/kb/967715

Jackobyte

Jackobyte wrote: »

when I plugged it back into my home system generic worm was found and removed by mcafee (not the best I know but I've a 15 month license with my system so I said I'd use it until it expires.)

Jackobyte wrote: »

When McAfee removed it, they quoted I:/Business Presentation/Autorun.inf as the worm.

Krik Nav wrote: »

Oh you already got rid of the worm? There are loads of free anti virus software that will pick up what McAffee missed (if anything) such as: Avast, Kapersky, possibly Spybot S&D to name a few.
I don't think the uBuntu would be affected unless you used the key with that?
Another problem with a worm is that it backs itself up inside the system 32 folder sometimes and then even if you system restore, there is a chance of the worm still being there and coming back.
There are USB key recovery tools and you might be able to recover files using one of them.

Well, McAfee thinks it did (it came up removed when I plugged it in last night) but if it can't be removed from the USB, will it pop up everytime I plug it in?

Krik Nav

Well one thing worries me besides removing it. Using it again at school and again getting the worm. If you disable autorun then it can't run when plugged in and you could get rid of it without worrying of it infecting when you plug it in to remove it. It can definitely be removed from the USB key but it can come back in an instant. Use e-mail until then and maybe contact your school about this. To be safe though get Kapersky labs removal tools.

Jackobyte

Krik Nav wrote: »

Well one thing worries me besides removing it. Using it again at school and again getting the worm. If you disable autorun then it can't run when plugged in and you could get rid of it without worrying of it infecting when you plug it in to remove it. It can definitely be removed from the USB key but it can come back in an instant. Use e-mail until then and maybe contact your school about this. To be safe though get Kapersky labs removal tools.

Downloading Kaspersky Virus Removal tool off the website now. Will inform school tomorrow and will try disinfect mem stick as well.