Results 1 to 3 of 3
  1. #1
    Lurker
    Join Date
    Jan 2011
    Posts
    2
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Worm throughout network and infects any newly inserted usb device.

    Running Win 10
    I have a worm which exists in volume information and volume information shortcut in system32.
    WINDOWS DEFENDER keeps chiming - found some malware. This continues every 3 or 4 seconds endlessly.
    Reformatting the usb stick does NOT get rid of the volume information and short cut files.

    Every time I plug in any usb drive anywhere, they immediately get infected.
    Trying to delete the files says they are in use in a vbs script file in system 32.
    I cannot locate that file anywhere and am at a complete loss on how I can proceed further.
    Using the attrib cmd with DOS prompt as administrator does not permit deletion of files either --- says files are in use by another program.
    Any ideas????
    I'll attempt to type out the exact files I see in my reformatted P: drive which happens to be my flash drive for my camera. (I am afraid to insert it back into the camera as it will probably render it useless.)

    System volume information (file folder)
    KMS activator all windows (VbScript file) 16kb
    System volume information (shortcut) 1kb
    Last edited by satrow; 2016-06-20 at 17:52.

  2. #2
    Lurker
    Join Date
    Jan 2011
    Posts
    2
    Thanks
    0
    Thanked 0 Times in 0 Posts

    KMS worm on network USB drives

    Worm appears on volume information and volume information shortcut.
    WINDOWS DEFENDER keeps chiming - found some malware. This continues every 3 or 4 seconds endlessly.
    Reformatting the usb stick does NOT get rid of the volume information and short cut files.
    Every time I plug in any usb drive anywhere, they immediately get infected.
    Trying to delete the files says they are in use in a vbs script file in system 32.
    I cannot locate that file anywhere and am at a complete loss on how I can proceed further.
    Using ATTRIB function in DOS as administrator does not permit deletion of files either --- says files are in use by another program.
    Any ideas????
    I'll attempt to type out the exact files I see in my P: drive which happens to be my flash drive for my camera. (I am afraid to insert it back into the camera as it will probably render it useless.)

    System volume information (file folder)
    KMS activator all windows (VbScript file) 16kb
    System volume information (shortcut) 1kb

    Pls get back to me at if you have any ideas as I probably won't find you agn on thew forum TNX.
    Last edited by macropod; 2016-06-20 at 22:03. Reason: email address deleted

  3. #3
    Super Moderator satrow's Avatar
    Join Date
    Dec 2009
    Location
    Cardiff, UK
    Posts
    4,491
    Thanks
    284
    Thanked 577 Times in 480 Posts
    I guess that's the risk you take when using a Windows Activation bypass/crack.

    We don't condone using pirated/illegal software and we cannot help you at WSL.

    /locked.

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •