Look for a hidden file called boot.pif, also. Anothere telltale sign.
Microsoft released a patch recently which turns Autorun off by
default, which will help prevent these file from propagating from
whichever PC is infected. Track down that PC and patch it up.
Also, MCAfee has a free utility called Stinger which will find and
eradicate many of these Autorun worms.
If you're mostly Mac-based, the danger is probably minimal. This could
have come from a USB thumb drive that somebody plugged in to your File
Manager, for example. From there, the worm installs itself on every
mounted workspace.
On 7/15/11, Andi Meek <kwikpasta@hotmail.com> wrote:
>
> Frickin' hotmail has mangled that - it should be
> open cmd line, type attrib -h -r -s recycler and hit enter and replace with
> autorun.inf to remove autorun virus. Also just to be clear i'm talking
> about ISIS not Unity so it may not be the same for you but at least the
> info's out there. UNITY will just delete anything is that right? That
> always scares the shit out of me!
> Andi
>
>> To: avid-l2@yahoogroups.com
>> From: kwikpasta@hotmail.com
>> Date: Fri, 15 Jul 2011 13:42:39 +0100
>> Subject: RE: [Avid-L2] Autorun.inf on Unity workspaces?
>>
>>
>> Hi John,
>> it's a virus. The main problem with this virus is that the files recreate
>> themselves and as you need to have a completely clear workspace to delete
>> it, it means you will find that you can't delete workspaces once you're
>> done with them. They are hidden files but you can reveal them and delete
>> them through the command line as follows;
>>
>>
>> Go
>> to Start
>> > Run
>> and type cmd
>> The
>> command prompt will open. Type the drive letter for the drive you
>> wish to delete the files from e.g. N:
>> Hit
>> Enter
>> Now
>> type attrib
>> -h -r -s recycler and
>> hit Enter
>>
>> Now when you double
>> click the workspace you will see the recycler folder which you can
>> delete in the normal way
>>
>>
>>
>>
>>
>> To
>> reveal the Autorun file follow the directions above but substitute
>> the word recycler
>> with
>> autorun.inf.
>> Delete as normal.
>>
>>
>> We have to do this quite a lot as it jumps from workspace to workspace.
>> Microsoft Security essentials does a really good job of keeping things
>> clean. HTH.
>>
>> Cheers,
>> Andi
>> To: Avid-L2@yahoogroups.com
>> From: bigfish@pacbell.net
>> Date: Thu, 14 Jul 2011 18:13:33 -0700
>> Subject: [Avid-L2] Autorun.inf on Unity workspaces?
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>> I noticed that some if not all of the unity workspaces I access
>> projects from have an autorun.inf on the surface. Curious what the
>> purpose is for that. I'm familiar with autoruns that happen when you
>> mount a drive but I've been on macs for a while now so I haven't dealt
>> with them. Is this just a generic pc disk thing or something that unity
>> is creating. I seem to recall autorun.inf files were not on Terrablock
>> volumes but when they got on a few it was do to a virus not the system.
>> Not having any problem but would like to understand better.
>>
>>
>>
>> John Moore
>>
>>
>>
>> Barking Trout Productions
>>
>>
>>
>> Studio City, CA
>>
>>
>>
>> bigfish@pacbell.net
>>
>>
>>
>> [Non-text portions of this message have been removed]
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>> [Non-text portions of this message have been removed]
>>
>>
>>
>> ------------------------------------
>>
>> Search the offical complete Avid-L archives at:
>> http://archives.bengrosser.com/avid/
>>
>> If you want to donate to Red Cross quake relief, you can do so through
>> your cell phone. Text redcross to 90999 to make a $10 donation. It will be
>> on your next cell bill.Yahoo! Groups Links
>>
>>
>>
>
>
> [Non-text portions of this message have been removed]
>
>
--
---
Rob Lawson
System Administrator, ACSR ISIS, Windows & Interplay
CBS News
If you want to donate to Red Cross quake relief, you can do so through your cell phone. Text redcross to 90999 to make a $10 donation. It will be on your next cell bill.
No comments:
Post a Comment