Hi, calling from Germany
on Sat, March 27th 2010, i ran a Full Scan intensive on C: D: E: and an 8 GB USB memory stick as Administrator (Internet access disconected). Now the System wants to format the USB Stick if I try to access it.
USB Stick Info:
drive letter is I:
Volume Name ‘home_’
FAT 32
manufacturer: hama
contains about 6.5 GB of data, 1.5 GB free
Windows 2000 SP4
avast! 4.8 home , signature 100325-1, 25.03.2010
found Virus/Wurm on drive I:
Malware-Name:VBS-Malware-gen
File: Virus_holen_1.doc\WordDocument
I checked with the Windows explorer and could only see ‘Virus_holen_1.doc’, but it did NOT appear to have the “extension” ‘WordDocument’ , which looks strange to me on a FAT32
I did NO action, continued scan.
In addition the Scanner complained several files / directories beeing corruptet and thus was not able to scan them (Msg: “Prüfung nicht möglich: Die Datei oder das Verzeichnis ist beschädigt.”)
Stored parts of scan result as snapshot on C:
Since this PC was recently set up new, avast! 4.8 was not set up to store report files …
Logged off as Administrator and on again as normal user (Peter), did NOT disconnect USB Stick from PC. Try to access the stick resulted in the attempt of the OS to format the unit ! It is still seen as ‘home_’ .
Tryed Stick on other W2000 PC: same.
Tryed Stick on XP Professional PC: same.
Since HJT helps to fix the PC but not an USB Stick, I didn´t use it yet.
Have file ‘Virus_holen_1.doc’ still on an older backup and sent it to virustotal.com: Ergebnis: 8/39 (20.52%)
My questions:
- is it possible, that the virus/worm got activated by the Avast-scan itself ?
- do You have any fix to save / get back the data of the USB stick ?
- My ‘Acronis true image 7’ does not offer to create an image of USB Drive I:. Do You know any tool to create an image of USB stick ‘as is’ (ahead of running any repair tools)
Kind regards & Thanks in advance
Peter