Hey peeps...

After my mom came back from a trip to India she tried to download a bunch of photos onto her laptop from a USB Key she got there. The key infected the laptop with this nasty little virus/worm/idunno that creates copies of an 'autorun.inf' and a 'RECYCLER' folder onto any USB, or hard drive plugged into the computer. The RECYCLER folder contains the same malware that's causing this BS in the first place.

Ive ran like three AV programs (NOD32, AVG, trendmicro) to no avail. I googled, tried to clean out a bunch of files and the registry, found some files and trashed them.

So now I think I've deleted a bunch of stuff that this virus spawned on my local HD, but there's still some process that copies over the malware to any USB I plug into the system. The worst part is it also does this during safe mode... and so I really don't know how to narrow down which system process has been infected, and this is where I'm stuck right now.

Would appreciate any advice,

DD

you have the w32downadup.b ( something to that name)
symantec has a removal tool to get rid of it and instructions
3rd link down

actual link.

you have to disable autorun on all drives, disable system restore.

it's a lot faster cleaning the drive through another pc but if you don't have one it's gonna take a little longer

Hey HB, thanks for the links. I've already tried that... it doesn't clean it up (the tool doesn't detect anything). My symptoms are accurately described by this link:

http://www.prevx.com/filenames/359854640407425505-X1/LOUISE5Bn5D2EEXE.html

I found it very odd that this virus description isn't anywhere else.

if you run task manager, kill any odd processes, also download process explorer, some shit runs behind a legit process like userinit, winlogon, svchost, and explorer.exe.
your best bet is to take te drive out that pc, hook it up by usb to a clean proteceted pc and scan it and delete weird files modified recently, and run scans on them with symantec, superantispyware spybot, and edit the registry (load hive) and check through it.

So I'm pretty sure I have some variant of downadup or conficker like you said harry. Problem is that I can't find any AV tools that detect it.

nothing will on that pc, you need a clean pc to clean the drive.

little idea
can you boot up live ubuntu cd
I then get online & do an online virus scan of the windows drive ? maybe ? ?

I had some crap sounds like this. Fake autoruns and recycle bins on all the drives. I put in an old hdd and reinstalled Xp since I was going to reinstall anyway, and from there symantec was able to go through the other drives and clean it up.
So maybe make a partition and do a quick OS install or such and search from there?

I fixed it with a combination of google and a couple of tools I found on the internet. I want to mention the tools, since they may come in handy to any of you in the future...

procexp
Lets you view all system processes and all associated file handles for each process (ever get that annoying "cannot delete file because its in use" message?). I used this to figure out which processes the malware had hijacked and used that information to help me scope malicious registry entries and change them up.

Trojan Remover
A simple but super effective malware removal tool. Check a bunch of common registry entries and files in /system, /system32, etc where malware is known to lie. Worked out really well for me... Literally took care of the last remaining bit of malware that I couldn't find for the life of me.

Thanks a lot for your help all!

Just as an aside... maybe this is just paranoia but I noticed that the only references of my particular strain of malware were tied to one particular AV solution. I've also read that there are companies out there that release their own version of malware out into the wild so that only their solution can address that particular strain... If that's true, I was just thinking what a messed up precedent/business tactic that is.

Also.. I wouldn't get too angry about a virus on my computer... but I really get pissed off that viruses and malware end up hurting people who aren't that computer saavy and may not always have someone there to try and fix their computer. /rant

that's been going on, it's called scareware.
the target pc pops up a bogus scan saying your pc is infected and buy this program to remove it.
you can not believe the amount of people who fall for it.

these companies should be dragged into court and the owners jailed for fraud.
that would cut that shit out.

I have a friend who got hit with that shit recently. It's a pain in the ass to get rid of. Having a second clean computer helps a lot. Luckily there is plenty of help on the net to fix the problem.

- heppened to my mom...popped up called like 'ANTIVIRUS 2009' or some shit like that...and my mom isnt the biggest tech head out there so yah...you can put it together what happened...haha...luckily..my brother like invented computers and fixed it.