'new folder.exe' worm

[meetdenis]

I think I have the 'new folder.exe' worm on my pc.

Whenever I plug in any USB drive(or even a usb card reader), a 'new folder.exe' file gets created in the root of the drive. This looks like a folder as it has the folder icon.

Also, inside all folders and sub folders, an .exe file gets created which has the same name as its parent folder. All these exes look like a folder as it has the folder icon. This is the worm creating these exe files.

I tried to isolate and kill the process creating these exes in safe mode, from the dos prompt. I also tried to format the plugged in usb drive, but the format doesn't start as the worm process uses up the drive and format doesn't run. I tried scanning the drives with Kaspersky and Avast but they don't seem to detect it.

I have tried all options but to no avail. The moment I plug any usb storage device, the exes get created in it.

And the funny thing is, its nowhere to be seen on the pc itself. There are no such exes created anywhere. It looks as if the worm targets peripherals plugged via usb ports only.

Can anyone please suggest a way to isolate and erase this worm?

[Maq.H]

Hi, its not a difficult job to remove this worm. I wanna make you know that please search the forum before making a new post to avoid duplications. There are already many posts made on this topic with solution of removing this worm.

Just have a look on the following posts:
How to remove new folder.exe or regsvr.exe or autorun.inf
NEW FOLDER.EXE VIRUS

[huntluck]

Get the best antivirus such as AVG 9.0 im sure it will help you out.

[meetdenis]

Hi, its not a difficult job to remove this worm. I wanna make you know that please search the forum before making a new post to avoid duplications. There are already many posts made on this topic with solution of removing this worm.

Actually I did try to search threads for this worm removal but i guess i didnt use the proper keywords... n e ways thanks for your help will try out the steps mentioned in the link

[Maq.H]

Thanks.. Do let me know the results for any furthur help. !!

[meetdenis]

I managed to remove the virus form my pc.

But my pendrive is still affected.

It has the 'new folder.exe' file and no other file displayed. But when I viewed the contents from dos prompt, it tells me the drive has 5 files. I assume these are the files running the virus.

I accessed the pendrive root [G:] folder and typed 'G:autorun.inf' in the address bar - and voila!, the suspect file opened up. And it has 3-4 entries which execute the 'regsvr.exe' file (the main culprit)

But sadly I cannot do much after that.

I cannot format the drive as the 'autorun.inf' uses the drive and thereby has locked it.
I tried to delete the 'autorun.inf' and 'regsvr.exe' from the dos prompt, but wasnt successful.

I also created an empty 'autorun.inf' on my desktop and cust-pasted it on G: inorder to replace the existing file. But it also failed as the existing 'autorun.inf' file is read-only.

I Know that from the dos prompt there are certain flags which make hidden, locked files available for deletion.

Could anyone please tell me these flags?

...or even an alternate way to erase the virus from my pendrive?

[meetdenis]

Also, I did a boot scan from Avast! but it didn't help... Avast! did not detect anything wrong anywhere

[Zachary]

Download CLEAN ZIP, Uncompress it on your desktop (Right click / extract all), you must get a clean record.

a) Restart in safe mode (press F8 key at the start of your PC)
b) Open the folder that is clean on your desktop, and double-click on clean.cmd, a black window will appear.

[Spyrus]

If the pen drive is getting affected with the infection, when inserted in the system and if you are not able to format the same, then it means that the infection is still in the system. To format the pen drive, insert it in a virus free system and do not open the same. There, you will be able to format it. For the removing the infections from the computer, you will have to do a system restore because I do not think that there is any other solution to get rid of the infections from the computer.