How to clean a flash drive before it infects?????

On Fri, 05 Oct 2007 21:26:19 +1300, John <John RemoveThis @falseaddress.com>
wrote:

>I have a flash drive that is infected with W32.Gammima.AG. shootHow do I
> kill it before it infects.
>Thanks
>John

Try this: Plug in the flash drive and open MyComputer. Right click
on the flash drive icon and select "format".

If this works please post to that effect.

On Oct 5, 1:26 pm, John <J....TakeThisOut@falseaddress.com> wrote:
> I have a flash drive that is infected with W32.Gammima.AG. shootHow do I
> kill it before it infects.
> Thanks
> John

Download Microsoft TweakUI powertoy and disable removable drives
autoplay and format the drive .This should resolve the problem.

I want to disable auto run before I format.I read that if I hold down
shift it will do that?

Jackson wrote:
> On Fri, 05 Oct 2007 21:26:19 +1300, John <John RemoveThis @falseaddress.com>
> wrote:
>
>> I have a flash drive that is infected with W32.Gammima.AG. shootHow do I
>> kill it before it infects.
>> Thanks
>> John
>
> Try this: Plug in the flash drive and open MyComputer. Right click
> on the flash drive icon and select "format".
>
> If this works please post to that effect.
>

This one is for a non administrator (student) and she has important
photos etc on it so I couldn't format it.
I plugged it in while holding down the shift key.
Norton found the worm and killed it but in Nortons history
it is detected a minute later and listed as "failed" but on closer
examination appears to have been submitted to symantech and advises "no
action necessary".... but that could just be the virus taking control
again..
john

John wrote:
> Jackson wrote:
>> On Fri, 05 Oct 2007 21:26:19 +1300, John <John.DeleteThis@falseaddress.com>
>> wrote:
>>
>>> I have a flash drive that is infected with W32.Gammima.AG. shootHow
>>> do I kill it before it infects.
>>> Thanks
>>> John
>>
>> Try this: Plug in the flash drive and open MyComputer. Right click
>> on the flash drive icon and select "format".
>>
>> If this works please post to that effect.
>>
>
> This one is for a non administrator (student) and she has important
> photos etc on it so I couldn't format it.
> I plugged it in while holding down the shift key.
> Norton found the worm and killed it but in Nortons history
> it is detected a minute later and listed as "failed" but on closer
> examination appears to have been submitted to symantech and advises "no
> action necessary".... but that could just be the virus taking control
> again..
> john

Plug the USB key in and boot the computer with a Linux live cd such as
Knoppix. Copy the data to an external hard drive (must be formatted
FAT32) or burn it to a CD-R. Then format the flash drive FAT32. Boot
back into Windows and scan the data you saved with a current version
antivirus using updated definitions. Do not copy the data to anything
that will come into contact with Windows until you do this. Here is
general information about using Knoppix for data retrieval:

To get Knoppix, you need a computer with a fast Internet connection and
third-party burning software. Download the Knoppix .iso and create your
bootable cd. Then boot with it and it will be able to see the Windows
files. If you are using the usb thumb drive or the external hard drive,
right-click on its icon (on the Desktop) to get its properties and
uncheck the box that says "Read Only". Then click on it to open it. Note
that the default mouse action in the window manager used by Knoppix
(KDE) is a single click to open instead of the traditional MS Windows'
double-click. Otherwise, use the K3b burning program to burn the files
to cd/dvd-r's.

http://www.knoppix.net

You can use one of the Linux utilities like qtparted or gparted to
format the usb drive or just delete everything after you back it up and
then format the drive once you are back in Windows.


Malke
--
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"
MS-MVP Windows - Shell/User

See http://aumha.net/viewtopic.php?p=161909 > Second post > Steps 2 and 3.

NoScript utiliry: http://www.symantec.com/avcenter/noscript.exe
Flash Disinfector:
http://www.techsupportforum.com/sectools/sUBs/Flash_Disinfector.exe
Clean Autoruns:
http://forums.techguy.org/attachments/103397d1176780296/clean-autoruns.zip
Autoruns Remover and Washer:
http://www.savefile.com/download/859655?PHPSESSID=d2b639063ee3fd8ed962...7b99fd9
Ravmon Removal Tools:
http://technodigits.wordpress.com/2007/06/06/ravmon-virus-killer/
XP USB Reliability Update and USB Hotfix:
http://support.microsoft.com/kb/838989
http://support.microsoft.com/?kbid=918005

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine2.blogspot.com/
http://www.elephantboycomputers.com/page2.html#Removing_Malware

When all else fails, HijackThis v2.0.2
(http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware with
assistance from an expert. **Post your log to
http://forums.spybot.info/forumdisplay.php?f=22,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7,
http://aumha.net/viewforum.php?f=30, or other appropriate forums for expert
analysis, not here.**

If the procedures look too complex - and there is no shame in admitting this
isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE, OE, Security, Shell/User)
AumHa VSOP & Admin http://aumha.net
DTS-L http://dts-l.org/


John wrote:
> I have a flash drive that is infected with W32.Gammima.AG. shootHow do I
> kill it before it infects.
> Thanks
> John