Endpoint Protection

 View Only
  • 1.  W32.SillyDC or phim nguoi lon.exe or secret.exe

    Posted Feb 09, 2010 04:27 PM
    I am a teacher in a media lab with 15 computers without virus protection (not internet computers). We use hard drive camcorders and that's how we detected the phim nguoi lon.exe or secret.exe USB media device virus. It probably came from a student's stick drive although I have seen some references to Ipods and we plug those in as well (not anymore). Thumb drives and my camcorders get the virus, but larger external hard drives do not which doesn't make any sense to me. So far, we don't see much fallout. The computers aren't on the internet (they were briefly) so we are self contained with the camcorders and computers infecting each other. It is an autorun.inf file and when you plug the camcorder into the computer you can actually see the virus name in the AVF_Info file or just right there next to the MPRoot and DCIM files for media.  I am hoping as long as the virus doesn't get internet access that it will just sit there. We do see a few weird connection problems but no issues with video editing or anything to do with our Adobe CS3 production suite. Our computer people are stretched very thin and this will be quite a job to clean all the non protected computers. The camcorders I just plug into my office computer and Symantec cleans it off and says it is W32.SillyDC.  Anyone have experience with this or have any suggestions? Oh...I thought I would try to fix it with AVG so I brought that in on a stick drive, it asked for the internet, it scanned, found infections, said it needed to be restarted and now is in a log on log off loop.
    Any thoughts would be welcomed.


  • 2.  RE: W32.SillyDC or phim nguoi lon.exe or secret.exe
    Best Answer



  • 3.  RE: W32.SillyDC or phim nguoi lon.exe or secret.exe

    Posted Feb 09, 2010 05:31 PM
    Although following Vikram's information is probably more useful than what I am going to post as far as cleaning the problem, read this and it should help for future breakouts.
    If memory serves, it comes from SHADOWSPAPA on these forums, so +1 to you.
    * * * * * *
    Once you have REMOVED the "autorun.inf" FILE on your local drive, likely to be C:

    Create a FOLDER called "autorun.inf".  Sounds silly right, but most of those self containing viruses, create a file called autorun.inf.  Unlike other systems, Microsoft does not allow for two (2) files and or folders to have the same name inside the same space, I.E the root of the system drive.

    By creating: "autorun.inf"  FOLDER, no virus will ever be able to create or re-create the autorun.inf file, thus already preventing most infections from becoming active and or reproducing on your system.

    Hope that can help save you some infections.