How to delete viruses from USB drive----- newfolder.exe virus
Created: 21 May 2010 | Updated: 23 Jul 2010 | 20 comments
This issue has been solved. See solution.
We have SEP 11.0.5 client installed in one machine.When we insert a pen drive, right click on that and start scan for viruses-- it is unable to delete the viruses which have a .exe folder in folder with the same name of that folder.It is dleting when we are trying to access that folder.Why it is not deleting straight away.Any Solutions regarding scanning a USB drive with entry into deeper levels of folders.
Discussion Filed Under:
Comments 20 Comments • Jump to latest comment
Make sure your USB drive is not FAT32..
Auto-Protect detects a file only when it is accessed or modified.
Vikram Kumar
Symantec Consultant
The most helpful part of entire Symantec connect is the Search button..do use it.
follow this link
https://www-secure.symantec.com/connect/forums/folder-name-exe-virus
Please don't forget to mark your thread solved with whatever answer helped you : ) Rafeeq
But when i right click the usb drive and put the drive to scan,it is scanning to some extent only.The same when i tried with custom scan,it is scanning all the areas.Why it is happenning this way.
One more thing many folders are being created in USB drives.Why they are being created.How to stop them.I am just attaching one screen shot.Please look into it.
delete the file itself from the USB. As mentioned by others SEP only scans when the file is accessed.
Cheers!
Pete
Help Link: http://www.symantec.com/business/support/overview.jsp?pid=54619
If i delete those files they come again and again with different names.Some times as shown in the attachment.Some times as temp,wins... and soon
These files get created by the autorun.inf file
Oopen that file with notepad and check what is the content of the file and where is it pointing to..
Delete all autorun.inf file on that drive..and disable Autoplay.
Vikram Kumar
Symantec Consultant
The most helpful part of entire Symantec connect is the Search button..do use it.
When i opened the autorun.inf there is much content in that.As Vikram said i deleted all autorun.inf files and disabled autoplay feature,but still these autorun files are coming into usb drive and along with that the other files as said above
you may use application and device control policy and set an application rule not to triger exe from USB.
Cheers!
Pete
Help Link: http://www.symantec.com/business/support/overview.jsp?pid=54619
If i triggered that rule, can i install or access .exe files from usb.
Copy the Important files and format the Usb Drive..if its a small one..if not then..
Open the Autorun.inf file and let us know what are the content of it..
Vikram Kumar
Symantec Consultant
The most helpful part of entire Symantec connect is the Search button..do use it.
you can setup exclusion for the .exe you want to run, but why do you want to install office applicaation by directly running through USB?
Cheers!
Pete
Help Link: http://www.symantec.com/business/support/overview.jsp?pid=54619
Today i pit a scan(both Right click scan and Custom scan) for usb drive, it started but showed nothing found it as infected.Infact there is a newfolder.exe virus and regsvr.exe virus in it.Earlier SEP use to delete them but suddenly today i scanned the same usb in more than 3-4 systems.Why this is happened suddenly with that usb.
I am attaching some screen shots and as vikram asked the content of autorun.inf file. Please verify with that.
Normally this autorun.inf file will get created n the root of the usb drive.You can delete that file and then create a folder in that name so that virus will not be able to create that file there..If you disabled autoplay once you disable it should not come back.In my opinion it is better to apply a rule for not running any executable from removable media.(For applying this rule you need all features to be installed in the clients...)
Please don't forget to mark your thread solved with whatever answer helped you : ) Thanks & Regards Aravind
dear,
also my same problem New Folder.exe file.
I have attached my virus picture. please see and you will know what is symantec antivirus.
Kaspersky detects as: Trojan.Win32.cosmu.orw
Recenlty talk to him & also my computer access and observe:
Norton Technical Support, Mr. Khalid Chowdhury finally says, those are not Virus/Infected files..????????????????
attrib -a -r -s -h
del newfolder.exe
del autorun.inf
run the above commands from commad prompt
HI Arif,
I fully agree with you.
Such cases are happening since long back,. McAfee and Kaspersky are able to detect the threat but Symantec still doesn't. I agree it all depends upon sample of new variant and submission of such samples to Symantec.
What i would recommend you is to submit such samples to symantec security response team and after analysis they will post the Rapid Release definition which will include the threat signature.
Rgrds,
SAM
Submit these files and they will get detected.
https://submit.symantec.com/gold
Vikram Kumar
Symantec Consultant
The most helpful part of entire Symantec connect is the Search button..do use it.
SEP is detecting and suddenly its not detecting.Is it because those files are into root of usb's.
Why it is happening?
In the link provided by Vikram, it is asking fro contact id.How to see the contact id in the Licence.
Is support id and the contact id the same?
How to Contact Customer Care and Technical Support
Please don't forget to mark your thread solved with whatever answer helped you : ) Thanks & Regards Aravind
Would you like to reply?
Login or Register to post your comment.