Hi there all! My friend got this virus thingy on her laptop.

First i thought it was a wallpaper because she's an indian and there was chinese wordings displayed on the screen. Then i din bother about that and plugged in my USB flashdrive into the USB port on the laptop to do some file copying. After that, I brought my USB flashdrive back home and plugged it into my PC. After pasting the files into my computer, it seemed nothing. But after i restarted my PC, it started to show its 'TRUE COLORS". I got the same "wallpaper" on my friend's laptop! Then i googled along and found out that this virus is not new and it cannot be removed even if formatted the drive. Is this true? Has any1 encounter the same thing b4? I don't want to reformat my windows again because it's the 3rd time i've formatted my PC this month. Because of the stupid NEW USB flashdisks.

W32/USBToy-A is a worm for the Windows platform.

W32/USBToy-A attempts to spread by copying itself to toy.exe in the root folder of a removable storage device, if one is connected.

W32/USBToy-A copies itself to:
<Startup>\systemnt.exe
<Startup>\mslogon.exe

W32/USBToy-A also creates autorun.inf configuration file that is used to run toy.exe automatically when a device is plugged into an infected computer.

What u need is to copy the files listed above, scan them at www.virustotal.com and get the results. 2 options
1) restore ur pc to the point before infection. Copy those 2 healthy files to ur friends pc, delete the toy.exe and remove the autorun.
2) use the trial copy of the antivirus which succesfuly detects the
virus at virustotal

hope this helps.....

this virus is a real pain in the bum...

where can i get the 2 files if mine is infected?? can i just cop my friends one and replace it??

<Startup>\systemnt.exe
<Startup>\mslogon.exe

and what about my flash drives and external hdd??
im quite a noob.....

haih
i also having the same problems..

cant double click to the ext hdd... the xx code will appear if right click it..
walao...

who can help me ... can juz drop the info to my mail ?
chongfai13@yahoo.com ..thx alot alot

This post has been edited by chongfai13: Apr 23 2007, 04:43 PM

Do you still have the copy? PM sUBs.