How can I get rid of the shortcut virus drive.bat ?

Viruses and worms
1

I plugged a USB flash drive into a public computer and it got infected by the driver.bat virus, the one that replaces the files by shortcuts.

I went home and plugged it into my PC assuming my Avast Internet Security would take care of it, but it didn’t. Now my PC is also infected.

How can I get rid of it? Thanks.

2

Attach your basic diagnostic logs. (MBAM and FRST)
Instructions: https://forum.avast.com/index.php?topic=194892

3

Thanks! I attached the logs.

4

OK, now you’ve to wait for one of the malware experts…

5
  • Open Notepad (click Start button → type notepad.exe → press Enter)
  • Copy text from code block below and paste it into Notepad
HKU\S-1-5-21-4217786714-3939335682-2916838579-1001\...\ChromeHTML: ->  <==== ATTENTION
AlternateDataStreams: C:\Windows\SysWOW64\MSIHANDLE:3204 [0]
AlternateDataStreams: C:\Windows\SysWOW64\MSIHANDLE:3247 [0]
AlternateDataStreams: C:\Windows\SysWOW64\MSIHANDLE:3348 [0]
AlternateDataStreams: C:\ProgramData\Reprise:wupeogjxlctlfudivq`qsp`28hfm [0]
AlternateDataStreams: C:\ProgramData\Reprise:wupeogjxldtlfudivq`qsp`26hfm [0]
AlternateDataStreams: C:\ProgramData\Reprise:wupeogjxldtlfudivq`qsp`27hfm [0]
AlternateDataStreams: C:\Users\Darío\Downloads\Descargas temporales BACKUP:com.dropbox.attributes [168]
  • Go to File → Save As
  • Make sure that UTF-8 is selected as Encoding (left side of Save button)
  • Save it as fixlist.txt on Desktop
  • Open again FRST and click on button Fix
  • Wait until FRST finishes
  • fixlog.txt should be genereted and opened. Attach it your post and wait further instructions.
6

Thanks. I attached fixlog.txt.

7

What is system status now?

8

Thank you very much!

It seems to be working fine now. For example, it wouldn’t let me open System Configuration before, but now it does.

Would that be it? Can I begin using by USB flash drive again?

Thanks again! I really appreciate it.

9

You can continue using your USB drive.
Please rename FRST64.exe to uninstall.exe and run it. It should uninstall FRST.

10

OK, sorry it took me so long to respond. I’ve already uninstalled FRST.

Is there anything else I have to do?

Thank you very much!

11

That’s it.