resycled/boot.com

[rizay]

I just did a fresh install of xp pro sp2. I have a 250 gig HDD with two partitions. My C: has about 80 gigs and my D: has the rest. When I go into My Computer and double click on the D: drive, I get this error:

I can access the drive by right click and explore, or by selecting it under the address drop down menu. All my files and folders are still there. Everything seems to work fine.

Any ideas on what happened and how I can resolve this issue?

 

[Shane]

resycled/boot.com is a worm that propagates on local fixed and removable USB drives. resycled/boot.com may infect drives via autorun.inf file it created that runs a command each time the drive is accessed. Malicious files will be copied to a drives attached on infected computer.

FOLLOW

http://www.precisesecurity.com/blogs/2008/09/20/resycledbootcom/

 

[mep916]

Moved to the security section. Please follow the steps in this thread. Post the logs in your next reply.

 

[jamesvoss]

open my computer, tools, folder options, view, show operating system files, (ok) (ok) (ok) go back to my computer. right click on the hd go to 'explore' than delete boot.com autoconf.ini and the rescyled folder and you'll be alright

 

[rizay]

Thanks guys. Worked perfectly.

 

[Respital]

Thanks guys. Worked perfectly.

If you followed mep's advice please post the logs the programs generated as it is likely you are still infected.

 

[rizay]

Ok, I think this is what you are looking for. If not, please let me know what "log" you are requesting:

Malwarebytes' Anti-Malware 1.31
Database version: 1475
Windows 5.1.2600 Service Pack 2

12/8/2008 7:44:00 PM
mbam-log-2008-12-08 (19-44-00).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 171937
Time elapsed: 38 minute(s), 9 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
D:\System Volume Information\_restore{01D6024D-46A5-41FD-AEA6-169C333426C5}\RP25\A0002998.exe (Malware.Tool) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{01D6024D-46A5-41FD-AEA6-169C333426C5}\RP25\A0003011.exe (Trojan.Downloader) -> Quarantined and deleted successfully.