Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.

How to delete viruses from USB drive----- newfolder.exe virus

Created: 21 May 2010 • Updated: 23 Jul 2010 | 20 comments
prasad.ganta's picture
This issue has been solved. See solution.

We have SEP 11.0.5 client installed in one machine.When we insert a pen drive, right click on that and start scan for viruses-- it is unable to delete the viruses which have a .exe folder in folder with the same name of that folder.It is dleting when we are trying to access that folder.Why it is not deleting straight away.Any Solutions regarding scanning a USB drive with entry into deeper levels of folders.

Comments 20 CommentsJump to latest comment

Vikram Kumar-SAV to SEP's picture

Make sure your USB drive is not FAT32..
Auto-Protect detects a file only when it is accessed or modified.

Vikram Kumar

Symantec Consultant

The most helpful part of entire Symantec connect is the Search button..do use it.

Rafeeq's picture

follow this link

https://www-secure.symantec.com/connect/forums/folder-name-exe-virus

prasad.ganta's picture

But when i right click the usb drive and put the drive to scan,it is scanning to some extent only.The same when i tried with custom scan,it is scanning all the areas.Why it is happenning this way.

One more thing many folders are being created in USB drives.Why they are being created.How to stop them.I am just attaching one screen shot.Please look into it.

S4.JPG
pete_4u2002's picture

delete the file itself from the USB. As mentioned by others SEP only scans when the file is accessed.

prasad.ganta's picture

If i delete those files they come again and again with different names.Some times as shown in the attachment.Some times as temp,wins... and soon

Vikram Kumar-SAV to SEP's picture

These files get created by the autorun.inf file

Oopen that file with notepad and check what is the content of the file and where is it pointing to..
Delete all autorun.inf file on that drive..and disable Autoplay.

Vikram Kumar

Symantec Consultant

The most helpful part of entire Symantec connect is the Search button..do use it.

prasad.ganta's picture

When i opened the autorun.inf there is much content in that.As Vikram said i deleted all autorun.inf files and disabled autoplay feature,but still these autorun files are coming into usb drive and along with that the other files as said above

pete_4u2002's picture

you may use application and device control policy and set an application rule not to triger exe from USB.

prasad.ganta's picture

If i triggered that rule, can i install or access .exe files from usb.

Vikram Kumar-SAV to SEP's picture

Copy the Important files and format the Usb Drive..if its a small one..if not then..
Open the Autorun.inf file and let us know what are the content of it..

Vikram Kumar

Symantec Consultant

The most helpful part of entire Symantec connect is the Search button..do use it.

pete_4u2002's picture

you can setup exclusion for the .exe you want to run, but why do you want to install office applicaation by directly running through USB?

prasad.ganta's picture

Today i pit a scan(both Right click scan and Custom scan) for usb drive, it started but showed nothing found it as infected.Infact there is a newfolder.exe virus and regsvr.exe virus in it.Earlier SEP use to delete them but suddenly today i scanned the same usb in more than 3-4 systems.Why this is happened suddenly with that usb.

I am attaching  some screen shots and as vikram asked the content of autorun.inf file. Please verify with that.

usb1.JPG usb2.JPG usb3.JPG usb4.JPG usb5.JPG
AttachmentSize
autorun.txt 367 bytes
AravindKM's picture

Normally this autorun.inf file will get created n the root of the usb drive.You can delete that file and then create a folder in that name so that virus will not be able to create that file there..If you disabled autoplay once you disable it should not come back.In my opinion it is better to apply a rule for not running any executable from removable media.(For applying this rule you need all features to be installed in the clients...)

Please don't forget to mark your thread solved with whatever answer helped you : ) Thanks & Regards Aravind

arif.kausar's picture

dear,
also my same problem New Folder.exe file.
I have attached my virus picture. please see and you will know what is symantec antivirus.

Kaspersky detects as: Trojan.Win32.cosmu.orw

McAfee detects as: Win32/Rontokbro.worm

 Recenlty talk to him & also my computer access and observe:


Norton Technical Support, Mr. Khalid Chowdhury finally says, those are not Virus/Infected files..????????????????
MCAfee detects.JPG Norton 360.JPG NotVirus.JPG Virus Prob.JPG VirusWin32.JPG
AttachmentSize
Conversation Symantec.doc 34 KB
Bijay.Swain's picture

attrib -a -r -s -h
del newfolder.exe
del autorun.inf

run the above commands from commad prompt

SAM_SHAIKH's picture

HI Arif,

I fully agree with you.

Such cases are happening since long back,. McAfee and Kaspersky are able to detect the threat but Symantec still doesn't. I agree it all depends upon sample of new variant and submission of such samples to Symantec.

What i would recommend you is to submit such samples to symantec security response team and after analysis they will post the Rapid Release definition which will include the threat signature.

Rgrds,
SAM

Vikram Kumar-SAV to SEP's picture

Submit these files and they will get detected.
https://submit.symantec.com/gold

Vikram Kumar

Symantec Consultant

The most helpful part of entire Symantec connect is the Search button..do use it.

SOLUTION
prasad.ganta's picture

SEP is detecting and suddenly its not detecting.Is it because those files are into root of usb's.
Why it is happening?

prasad.ganta's picture

In the link provided by Vikram, it is asking fro contact id.How to see the contact id in the Licence.

Is support id and the contact id the same?

AravindKM's picture

How to Contact Customer Care and Technical Support

Please don't forget to mark your thread solved with whatever answer helped you : ) Thanks & Regards Aravind