autorun.inf

[Rich]

Nigel, I found this is a real baddy as it loads all sorts without you knowing, my sister in law took her flash disk to a photo processing place and came back with a virus that infected her comp without her knowing, brought it to our house (2 comps) my wife plugged it into her's also became affected, plugged it into mine to run the antivirus but to late also infected.

After some Googling I found out what the virus was and manualy removed it it had a denial of services built in so no internet access no regedit no dos prompt.

Autorun inf is now dissabled in XP on all the families comps, this allows you to run a virus scan without opening the USB, so you have to find the exe to run CD's and manualy open USB drives, less of a hardship than having to hunt down a virus.

[Rich]

Nigel, the libeay32_0.9.6l.dll is part of zone alarm, I have it too in C\windows32, zone alarm is now Check point I think,

http://en.wikipedia.org/wiki/Check_Point

I found the dll in windows32 and right clicked it to get the properties up click details and you should get verification that it is Check point, it may be that XP or whatever can't find it because your autorun.inf thing has modified the registry as it did on ours.

Edit

Just looked at my Zone Alarms install log and it has these 2 entries

Made Dir: C:\WINDOWS\system32\ZoneLabs\streamapi
File Copy: C:\WINDOWS\system32\libeay32_0.9.6l.dll | 07-09-2008 | 09:05:08 | | 796048 | 41b50393

File Copy: C:\WINDOWS\system32\ZoneLabs\avsys\libeay32.dll | 12-19-2006 | 18:13:52 | 0.9.8.3 | 1093632 | c4f6b87b

So it seems you should have libeay32_0.9.6l.dll in C\Windows\system32 and libeay32.dll in C:\WINDOWS\system32\ZoneLabs\avsys

It may well be something has been altered in the registry and libeay32.dll cannot be found hence the hangup

I am no expert !

[NigelC]

Thanks guys.

I tried opening libeay32.dll with notepad last night, couldn't , and that caused notepad "not responding". Just to prove, I cut libeay32.dll from system 32 and popped it on the desktop, tried to uninstall and got the same response, so it's looks like it may well be corrupted.

Allsorts of other things doing likewise, and when I shut the PC down, I get multiple "End File-Install" coming up and not responding, usually after about 4 or 5 times it goes, I think it maybe connected with the number of times I've tried to run the Netgear disk, to uninstall and re-install the wireless adapter.

N

[ianhind]

dll files (such as libeay32.dll) cannot be opened in Notepad - they are compiled binary files = no useful text in them.

Can you find that autorun.inf file and look at that?

Or if it is in c:\, just delete it.

[NigelC]

Tried a search for it but no result. And that was with show hidden files and folders selected. I seem to recall somewhere that it can inhibit display of hidden files. I'll keep trying though :brick:

[ianhind]

From Explorer, select Tools/Folder Options/View and then for "Hidden Files and Folders", select "Show hidden files and folders"
For this exercise, it might also be worthwhile unticking "Hide protected operating system files".
Then you should be able to explore the disks.

But afterwards, undo these changes to avoid any mistakes in the future!

As for the network card, it might be worth trying to uninstall the hardware from Control Panel. In System/Hardware/Device Manager your network card probably has a yellow exclamation mark next to it. If you right click and then select uninstall it will probably give a warning. But once uninstalled, Windows should try to reinstall the hardware again next time round - it might even pick up the correct drivers from the hard disk by itself!

Anyone see a problem with this?

Ian

[Rich]

Ian, can you open a dos window or regedit without your comp crashing ?

[Rich]

Nigel as libeay32. dll is part of Zone Alarm firewall you could try to uninstall zone alarm then try a reinstall but make sure you are not connected to the internet, the autorun.inf I suspect is not the virus but something that came with it and triggered it via XP autorun so a good reason for dissabling autorun, if you can find that particular autorun.inf it should tell what it is running.

That probably will not work if the virus thing is there, it is more a denial of service thing which can be fixed when we know the cause

You could try this to dissable autorun, make a new text file, copy past the following in to it, close the text file and rename it to DisableAutoRun.reg and the icon will change to a reg edit icon click on it and agree, it has worked but I leave it up to you to decide

REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf]
@="@SYS:DoesNotExist"

Working in the dark until we can find out what that autorun.inf is running, bar311.exe was one we had and was easy to remove once we knew what it was

[NigelC]

Thinking back, I had "cleaned up" my Pc because of problems getting FS9 to run.

As part of this, I removed MS Money (2003 I think), and when I got everything working again, I put it back on.

However, if my ageing memory serves me correctly, I got a Update Available box, and STUPID I went for it. I'm now pretty sure, it was shortly after this I got my first "Threat Detected" warning.

I'm seriously considering the sledgehammer approach of wiping everything and reloading from a totally clean machine, AND with a decent Anti-Virus package. Bit Defender has some good reviews, although I'm open to recommendations

N

[ianhind]

Well you won't need MS Money any more - have to wait for the upgrade MS No Money