Something creates volumeInformation.exe on my USB Flash Drive - how to prevent ?

system · 2017-02-19T11:15:05.000Z

dbrisendine post:38:

How is the system acting now?

Well the strange behavior with USB Flash Drives does not occur anymore. But I do not know if the malware is still somewhere in the system. :-\ How can I detect it?

And I have one important question. How can I protect my USB Drive from malware in the future? I have to use it everyday on many different PCs of my colleagues. Sometimes they have viruses.

Pondus · 2017-02-19T11:23:51.000Z

But I do not know if the malware is still somewhere in the system. :-\ How can I detect it?

If it is there @dbrisendine will tell you

How can I protect my USB Drive from malware in the future?

Install and use MCShield >> http://www.mcshield.net

system · 2017-02-19T16:04:22.000Z

Pondus post:40:

How can I protect my USB Drive from malware in the future?
Install and use MCShield >> http://www.mcshield.net

McShield is great. I have installed it everywhere. It protects a PC from malware coming from the USB Drive.

But how could one protect the USB Drive from malware on the PC?

For example if I plug my USB Drive into an infected PC of somebody and then take it to another not infected PC of somebody else I am infecting it.

Pondus · 2017-02-19T16:19:45.000Z

For example if I plug my USB Drive into an infected PC of somebody and then take it to another not infected PC of somebody else I am infecting it.

Plug it in to a computer with MCShield first or install MCShield before you plug in the USB drive

Note that MCShield only target those type of malware that use removable drives to spread, so to detect other types you need to scan it with your antivirus

dbrisendine · 2017-02-19T20:42:40.000Z

Let’s use a second opinion scanner for one last check (but the FRST logs don’t show anything major)…

Go to Emsisoft and download the Emsisoft Free Emergency Kit from here.

- Double click on the EmsisoftEmergencyKit.exe file and then click on Extract to unpack the files (the default directory of C:\EEK is fine).
- Go to the new directory and right click on Start Emergency Kit Scanner.exe and choose 'Run as Administrator'.
- Once the scanner loads, click on 1.Update to check for and load the current updates.
- When the updates are finished, click on Malware Scan in the 2. Scan box.
- Please enable the PUP detection option.  (The Kit may ask about this after it is loading updates or right when the scan starts; it will only ask once, so enable it when the Kit asks.) 
- If the scan finds anything, it will open a scan finding window.  Please click on View Report; copy this report and paste it here in reply post.
- Please close the Emergency Kit Scanner program now.

system · 2017-02-25T13:03:48.000Z

Here it is, the EEK Scan Report for PC3:

Emsisoft Emergency Kit - Version 12.0
Last update: 25.02.2017 16:08:04
User account: DESKTOP-HUINQM3\hp
Computer name: DESKTOP-HUINQM3
OS version: Windows 10x64

Scan settings:

Scan type: Custom Scan
Objects: Rootkits, Memory, Traces, C:, D:\

Detect PUPs: On
Scan archives: On
ADS Scan: On
File extension filter: Off
Direct disk access: Off

Scan start: 25.02.2017 16:10:08
C:\ORIS\ExcellToXml.exe detected: Gen:Trojan.Heur.VP2.cm0@aCs4jkii (B) [krnl.xmd]
C:\Program Files (x86)\IncrediMail\Bin\AE\aeldr.exe detected: Application.AdConnect (A) [285718]

Scanned 246160
Found 2

Scan end: 25.02.2017 16:56:46
Scan time: 0:46:38

system · 2017-02-25T13:05:35.000Z

I think the Gen:Trojan.Heur.VP2.cm0@aCs4jkii is FP. It was in a folder of our accounting software. I think it is part of the software. It is an old file created in year 2015. I have checked it with VT. Here is the link:

https://virustotal.com/en/file/97d042df98339a28a35c13c1bc6de4d53e84a0176ede8b06955f1b65b8051468/analysis/1488025095/

dbrisendine · 2017-02-26T21:28:08.000Z

That scan is still pretty clean. What about the aeldr.exe file? Did you test it at VT?

Eddy · 2017-02-26T21:53:55.000Z

Hmm is (or was) incredimail installed ?

system · 2017-02-27T06:16:04.000Z

dbrisendine post:46:

That scan is still pretty clean. What about the aeldr.exe file? Did you test it at VT?

No I forgot to test it with VT. I just moved it to quarantine.

And the other file - "ExcellToXml.exe ", I have not deleted it. It is still there.

Eddy post:47:

Hmm is (or was) incredimail installed ?

Yes. Incredimail is installed on this PC. My mother in law uses it for email. This software is simillar to Outlook as I know. Can this software harm the PC?

dbrisendine · 2017-02-28T06:37:22.000Z

Do you have the VirusTotal link for the Incredimail file? Best I can tell is that the application uses ads to support the company but that does not mean anything malicious is going on.

system · 2017-02-28T14:07:10.000Z

dbrisendine post:49:

Do you have the VirusTotal link for the Incredimail file? Best I can tell is that the application uses ads to support the company but that does not mean anything malicious is going on.

https://virustotal.com/en/file/a368a60da5e66fa34494b9f5b498783f99603a7f8269f45eeb3a921442158fce/analysis/1488289440/

dbrisendine · 2017-03-01T05:15:57.000Z

That file is fine. I would say your system (or your Mom’s system, in this case) is good to go. Is the AV scanning correctly?

system · 2017-03-01T06:24:27.000Z

dbrisendine post:51:

That file is fine. I would say your system (or your Mom’s system, in this case) is good to go. Is the AV scanning correctly?

Once we visit her I try to scan whole PC with Avast AV.

One question. Can you reccomend me some encryption tool to protect my USB Flash Drive? I have to use Flash Drive on different PCs and some of them may have viruses. I already have McShield on my PC, but I can not install it on PCs of all the people I have to work with.

Pondus · 2017-03-01T09:52:28.000Z

I have to use Flash Drive on different PCs and some of them may have viruses.

MCShield will protect[b] your[/b] computer / flash drive Other users need to install it on there computers if they want protection against malware that use USB drive to spread

system · 2017-03-01T10:59:07.000Z

Pondus post:53:

I have to use Flash Drive on different PCs and some of them may have viruses.
MCShield will protect[b] your[/b] computer / flash drive Other users need to install it on there computers if they want protection against malware that use USB drive to spread

I can recommend it to people I know well, but when I see a person first time in my life - it’s difficult.

Pondus · 2017-03-01T11:05:03.000Z

If you after using your flash drive in another computer see your MCShield detect and clean when you plug it in your computer, you should tell them that they have a infected computer and recomend MCShield

IMHO mcshield should be installed on all scool, hotel, printshop, internet cafe, computers. It would save them fore lots of trouble

system · 2017-03-01T12:28:39.000Z

Pondus post:55:

If you after using your flash drive in another computer see your MCShield detect and clean when you plug it in your computer, you should tell them that they have a infected computer and recomend MCShield

IMHO mcshield should be installed on all scool, hotel, printshop, internet cafe, computers. It would save them fore lots of trouble

If the Malware encrypts files (making them inaccessible) on my USB Flash Drive I plug into an infected PC of somebody, MchShield (on my PC) will not help.

Pondus · 2017-03-01T12:54:47.000Z

dafarulia post:56:

Pondus post:55:

If you after using your flash drive in another computer see your MCShield detect and clean when you plug it in your computer, you should tell them that they have a infected computer and recomend MCShield

IMHO mcshield should be installed on all scool, hotel, printshop, internet cafe, computers. It would save them fore lots of trouble

If the Malware encrypts files (making them inaccessible) on my USB Flash Drive I plug into an infected PC of somebody, MchShield (on my PC) will not help.

Correct, MCShield is not a antivirus and does not detect ransomware, it only detect those malwaretypes that use removable drives to spread

For ransomware protection you should always have backup of your file(s)

system · 2017-03-02T05:25:25.000Z

I have uploaded the volumeInformation.exe (the file I have mentioned in the title of the tread) to VT again. Just to see how many Antiviruses recognise it. Vt says only 28 of 58 recognized it. Kaspersky has disappointed me.

https://www.virustotal.com/en/file/0e239235388c2c6d015c942dd66acf46580d897041bf218cb3a7a136c733eee8/analysis/1488432035/

Announcements