eScan - Antivirus & Content Security Forum

"you are a good guy" is a virus, it renames the pendrive. example: when you insert a pendrive to PC, named:removable drive(E:) or KINGSTON(F:)or SCAN DISK(G:) the virus changes the original name of the pendrive to "you are a good guy"
Please i need your help on this, the PC's are successfully updated with the HOTFIX and the very latest version.(escan Corporate 9.0.779)
Thank you

If you plug a USB drive in your system, a window will appear one screen.
Don’t click on Ok , just choose ‘Cancel’. Open the Command Prompt by typing ‘cmd‘ in the run box. In the command prompt type the drive letter: and press enter .
Now type dir /w/a and press enter.
This will display a list of the files in the pen drive. Check whether the following files are there or not like,
Autorun.inf
New Folder.exe
Autorun.exe
you are a good guy virus.exe
you are a good guy virus.inf
or any other exe file which may be suspicious and hidden.
In command prompt type attrib -r -a -s -h *.* and press enter. This will remove the Read Only, Archive, System and hidden file attribute from all the files. Now just delete the files using the command del filename. example del you are a good guy virus.exe. Delete all the files that are suspicious.

Note: Before deleting these file please send mwavlog, pinfect.zip,you are a good guy virus.exe and autorun.inf etc to samples@mwti.net and mark cc. to support@mwti.net