h.com,i.com,ofddh.exe,ntdlr,autorun.inf

Hello,
I did a lot of looking around and the I decided to do ask the question

My computer has two operating systems,one XP and one mandriva.

Now my XP has avast antivirus,which was working fine.
Recently I started reciveing error messages n my avast antivirus that my PC has been infected with a worm called autorun.inf.
I tried deleting it ,removing it moving it...nothing would just work.
The same message kept coming over and over again.
I did a boot scan from avast ..but nothing really helped.After the second boot,the same message began appearing again and again.

Now i booted in to Mandriva and read my ntfs partion ,There I found three .com files lying in he c:\ of my computer
namely
h.com,i.com,ofddh.exe,ntdlr,autorun.inf

I again rebooted into windows and did a whole scan ,nothing was caught.
I am quite sure that h.com and i.com are not windows files.
my antivirus is upto date
I tried googling them but that too would not help much.
Any help from you guys will be highly appreciated

autorun.inf is a text file found on cd rom disks telling the operating
system what to do when it autoruns the disk. Open it in a text editor
and see what it says. I'd be suspicious of the file named ofddh.exe.
Malware often has files with random nonsense names.

I cannot see these files from windows...and linux opens ntfs as read only

The following link will give you instructions on how to mount the NTFS file system with full rights, you can then try and delete the files from there.

http://www.linux-faqs.com/faq/misc/ntfs.php#4.9

Cheers:

Can't see the files in Windows?

HAve you set your folder options to view hidden files..also the other for Protected operating system files.. open Win Explorer goto: Tools-folder options
One of the tricks of malware is to set the file as Hidden - System..

Also I would not just go about deleting files.. Start by at least just renaming them..
I would be looking at a tool like one of the "Rootkit" detection kits like Rootkit revealer.

have you tried removing the files, or even trying to view them in safe mode?

I would make a back-up, then run the files in a dos command prompt, (if you can find them with XP) after all that is the extension .com... I highly doubt it to be a virus, I can't seem to find anything on the com files.

Quote:

---

HAve you set your folder options to view hidden files..also the other for Protected operating system files.. open Win Explorer goto: Tools-folder options
One of the tricks of malware is to set the file as Hidden - System.

---

Tried that...i still cannot see the files

Quote:

---

have you tried removing the files, or even trying to view them in safe mode?

I would make a back-up, then run the files in a dos command prompt, (if you can find them with XP) after all that is the extension .com... I highly doubt it to be a virus, I can't seem to find anything on the com files.

---

Yes....i have backed up my data but then i do not want to go through the pain of installing XP again and loosing all my drivers.....

Quote:

---

The following link will give you instructions on how to mount the NTFS file system with full rights, you can then try and delete the files from there.

http://www.linux-faqs.com/faq/misc/ntfs.php#4.9

Cheers:

---

This is the only thing left to do ...i will try that today....

But my question why is my antivirus so helpless,,,it just cannnot delete the virus or detect them in some case (h.exe,i.exe)

Shenanigans.

I can't even begin to wrap my head around all of the contradictions and absence of experience.

autorun.inf as a virus? h.com and i.com (whatever those are) magically turn into h.exe and i.exe.

Dude doesn't want to LOOSE his drivers, of course.

Either incompetent or stupid.

Shenanigans.

O

Quote:

---

autorun.inf as a virus? h.com and i.com (whatever those are) magically turn into h.exe and i.exe.

Dude doesn't want to LOOSE his drivers, of course.

Either incompetent or stupid.

Shenanigans.

---

ya a typo ..my mistake it was supposed to be h.com and i.com

Drivers....let me tell you a bit more about them

My lappies lan card went boom a few months ago,i am using a usb lan card ( i next).I installed the drivers and it is working properly,but unfortunalty i lost the driver cd,what i am afraid is that if i reinstall the OS ,the usb lan card drivers will a trouble to install

and more over reinstalling a OS every time your system gets a virus is not the answer

If you can help please do help ,and if you are here to tell me that i am incompetent or stupid or what ever ,i bet that even your question look stupid to some one

Quote:

---

then run the files in a dos command prompt

---

I find that advice the same as playing russian roulette with a bullet in evey chamber..
.. once you find those files try a hex editor on them to get an idea of what they are.. if you do execute them.. ONLY ON A Crash Test Dummy PC.. not your production PC.. especially when done from Command Prompt..

I would.. settle down here.. Try one of the Live OS CD's be it a bart PE or UBCD .. even many *nix distros allow correct mounting of NTFS partitions for editing... ubuntu 7.1 has for me..

My preferance has been the Bart PE and UBCD methods for Virus scans and any registry work.. but that is more familurarity

Quote:

---

Originally Posted by alphabetagammadelta91

Now i booted in to Mandriva and read my ntfs partion ,There I found three .com files lying in he c:\ of my computer namely h.com,i.com,ofddh.exe,ntdlr,autorun.inf

---

Do NOT remove ntldr or your system will fail to boot. The other files you mention shouldn't be there, remove them.

And I agree with Undies.. DO NOT EXECUTE THEM!

Formatting and reinstalling the OS is the surest way to remove a virus..

Being a little more proactive in preventing a virus infection is also key.

MLF

Quote:

---

I would.. settle down here.. Try one of the Live OS CD's be it a bart PE or UBCD .. even many *nix distros allow correct mounting of NTFS partitions for editing... ubuntu 7.1 has for me..

---

I will try that now

Quote:

---

Formatting and reinstalling the OS is the surest way to remove a virus..

Being a little more proactive in preventing a virus infection is also key.

MLF

---

I have a upto date AV (Avast).
I still do not know how i got infected

Thanks dear

Sweetie pie

Up to date Av applications do not prevent viruii

Virus prevention is a layered approach...patched OS, limited user accounts, firewalls

and lets not forget...internet and email habits

MLF

nobody thinks that executing these command files is a good idea? damn I tried =)

avast won't delete the files in safe mode scares me a lil bit...

good luck honey bun lol...

Quote:

---

Originally Posted by alphabetagammadelta91

If you can help please do help ,and if you are here to tell me that i am incompetent or stupid or what ever ,i bet that even your question look stupid to some one

---

Whoa, there. No offense intended. I may be just a bit trigger-happy on the derision/insult gun, but with good reason. I apologize if I offended you, ABGD91.

O

Well so any suggestion except for formating it again or reinstalling it.

execute the files =) just kidding... what av are you using for your other OS?

I have me a linux (madriva) and it don't need an antivirus.

you don't need an anti virus software for linux based OS's?

Learn something new everyday! What is the world coming to when the new generation of virii writers just stop writing for linux...

Forget windows and having to worry about firewalls, anti-virus, spyware, etc..
I'm going to get a copy of linux and be safe =)

Well,

The autorun.inf is bad news being in the Windows root directory.

http://www.f-secure.com/v-descs/worm_w32_autorun.shtml

You will now have to scan all your removable media, as that is what they go for.

I would also recommend that you clear your restore points. Your AV will not be able to clean them ;)

The .com files look like a revamp of h.exe and i.exe, which are malware.

Quote:

---

you don't need an anti virus software for linux based OS's?

Learn something new everyday! What is the world coming to when the new generation of virii writers just stop writing for linux...

Forget windows and having to worry about firewalls, anti-virus, spyware, etc..
I'm going to get a copy of linux and be safe =)

---

Well there are very few anti virus for linux,there are very few viruses around made for linux
I got a link for you

Quote:

---

Currently there are under 100 native Linux viruses known but in many organizations the fact that a Linux viruses exists is enough reason to install and use Linux antivirus protection on Linux desktops and servers.

---

http://www.desktoplinux.com/articles/AT3307459975.html

@nihil
I have scanned and located the *.inf file...I am not able to delete it either by going to safe mode or command prompt.
The .com and .exe files are not visible in windows ,no matter what ever mode you are in.

Mandriva is helpless to delete as ntfs is mounted as read only partition
I tried to make the ntfs partition as read and write by the techniques give by some one here..But well that din't work either

Quote:

---

Well there are very few anti virus for linux,there are very few viruses around made for linux

---

There is an increase in malware though (worms, trojans, rootkits). Originally you would get an AV for your Linux mailserver................ basically to protect your Windows clients. ;)

Have you tried going into Windows and clearing your restore points? I am beginning to suspect that Windows is hiding the files in there?

This might work for you:

http://www.softpedia.com/get/Securit...DelLater.shtml

or this:

http://www.freewarefiles.com/NTFSDOS...ram_11100.html

Still slogging away with same issue are we.....

DJM posted a link on how to mount the partition ...

Obviously this is a personal machines...as in the business world the issue should have been dealt with by now....

Personally I would rather have a clean install as you will never be sure what is on your system

MLF

That is the problem with today's malware.

Quote:

---

Members of the AutoRun family also often contain other functionality in addition to just spreading. In fact this infection method can be used to propagate any malicious payload, such as a backdoor, password stealer, or some other kind of trojan.

---

You just don't have any idea what might be on your machine once it has been "owned" :eek:

Quote:

---

(Mar. 27, 2003)

---

These cute little things are called dates, thats when that link you gave me was made =)

I realize that there are far fewer virii on linux than on microsoft, but to blindly say that you dont need protection for linux systems is ridicules...

after all your the one with suspicious files on your system...

OK,reviving the old thread again.


The avast update in Mid March (Don't remember the date) detected and removed h.com and i.com
But i am still having trouble with autorun.inf....

Here is what is written in it

Quote:

---

;l2J3k12nL7Sjkd0ofjjwdAas22wLA4kr4wiw3Lr1d
[AutoRun]
;Dc
open=oufddh.exe
;4kLKDlJ
shell\open\Command=oufddh.exe
;ksroaqp5ioALqL49idDKjAdK3w25s81LeA2L0747qoifs44kDk3swosqJipDDwwpsiak0CKw3aaaF28rimkorkDwaUa462wkk
shell\open\Default=1
;CSkkdsl2Z42j3KjL2lJkLf00d17Ss9UoaAs0irXi14kJ32so4KLidwD93KJjlDe7ae3jodo9KOipnaadwK4Zq6HiqfkswK1qwwwDj3oA0ia531i
shell\explore\Command=oufddh.exe
;3aDd52iK2sod8fA34rsr3HrDp2KJlde3sl3KkSkskiw9K4dk40eLi5Laf4La5i0Ls30kwU2k5oiqrqqkdawLjkrkDaJK4ZwjDd2jjsc50kLaws

---

Now only two things trouble me now
autorun.inf and oufddh.exe.



I had tried booting from unbuntu and removing them ...but linux just would take it as read only.

I tried modifying the fstab....but that would not work either...every time i would modify linux would make a another copy of it.

You might try a Bart PE disk, too, but a Linux livecd with Captive may be a better way to handle deleting the files. What's the registry entries look like for those files? Insert will write to NTFS, though I'm only familiar with the older versions that ran Captive. Looks like v1.3.9b runs something called "ntfs-3g".