[Help! "autorun.inf" and "filesystem" keeps writing to thumbdrive]

Hi there,

Thanks that was it, my database was not updated, all clean now. The problem was that we lost internet as soon as one of the infected PC's were connected, so there was no chance on doing the update. I did the update from home, tool the rules file and replicated it to all PCs, that did the job.

Thanks again,

Ben

[Help! "autorun.inf" and "filesystem" keeps writing to thumbdrive]

Hi,

Open notepad and copy and paste next present in the quotebox in it:

Save this as look.bat , choose to save as *all files and place it on your desktop.

It should look like this:

Doubleclick on it and notepad should open.

Copy and paste the contents of it in your next reply.

Hi,

Sorry to hijack the thread, I am facing the same problem, and the virus is spreading like crazy on our network as people share USB's.

I did what you said below and this is what the output shows. Can you please giude me what to do next? Seems like this virus is no joke, infected PC's take the whole network down by sending an unbelievable amount of information through the NIC card. Once the machine is unplugged, our network is back up again.

See the output below, thanks,

Ben

p.s. I also noticed that by ending the "explorer" task and restarting it, I am able to delete all contects from the USB drive. However upon reinserting, all comes back. Also when I restart the explorer task, windll.exe shows up in the list of tasks

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Taskman REG_SZ C:\RECYCLER\S-1-5-21-9292158119-0441988720-006842578-8518\windll.exe

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Taskman REG_SZ C:\RECYCLER\S-1-5-21-9292158119-0441988720-006842578-8518\windll.exe

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Taskman REG_SZ