Member Avatar for aripaka

Hi,

I am using windows XP with SP2. recently it got affected by Funny UST scandal.avi.exe virus. This is creating an exe with the above name and another file - "smss.exe" in very partition. It is clogging the memory, not allowing to edit folder options, very abruptly closing the open exe windows(really irritates if the setup wizard suddenly vanishes in the middle!!). Occasionally using Ubuntu live cd i delete those files in all the partitions but they reappear again and cause a lot of trouble. My Symantec Antivirus is unable to detect it.

Can anybody help me get this fixed...plz?

  • 2 Contributors
  • 3 Replies
  • 248 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by salim hussain

Dani AI

Generated

Short expert summary and a safe, practical cleanup plan.

This thread describes a classic autorun/autorun-infector that spreads to every volume as a disguised EXE (examples reported as “Funny UST Scanda l.avi.exe”) and drops copies named like smss.exe, killer.exe and lsass.exe, plus an autorun.inf and registry hooks (Winlogon/Run) so the files reappear after deletion. That behavior and the common cleanup notes were documented contemporaneously in removal threads. (See the TechTalkz discussion.)
(https://www.techtalkz.com/threads/any-help-about-xmss-exe-and-funny-ust-scandal-avi-exe.182795/)

Containment and preferred approach

  • Treat the machine as infected: cut network access and stop using the PC to avoid spreading credentials or files.
  • The safest way to remove this family is an offline rescue scan: create rescue media (USB/CD) on a clean machine and boot the infected PC to scan and disinfect (Kaspersky Rescue Disk, HitmanPro/USB tools, Avira/Bitdefender rescue ISOs are common choices). Offline scanning removes files and rootkits that hide while Windows runs. (Kaspersky Rescue Disk; AV‑TEST rescue-disk guidance.)
    (https://support.kaspersky.com/krd18)
    (https://www.av-test.org/en/news/how-to-delete-ransomware-trojans/)

If offline rescue is not possible (in-place steps)

Quick manual checks (only if comfortable with command line / registry edits)

  • From an elevated command prompt on each drive letter replace X: with the drive:
    attrib -h -s -r X:\autorun.inf
del /f /q X:\autorun.inf
attrib -h -s -r X:\smss.exe
del /f /q X:\smss.exe
del /f /q "X:\Funny UST Scandal.avi.exe"
  • Caution: do NOT delete the legitimate smss.exe in C:\Windows\System32. Verify path and file size before removal. Back up the registry before editing.

Repair and prevention

  • Remove malicious Run / Winlogon entries (restore Shell to explorer.exe if it was changed) and clear autorun cache; then delete old system-restore points (malware can hide in restore data) and create a fresh restore point. Disable autorun functionality per Microsoft/CERT guidance to prevent reinfection from removable media. If reinfection persists or system integrity is doubtful, a clean OS reinstall is the safest outcome. (Microsoft AutoRun docs; CERT advisory.)
    (https://learn.microsoft.com/en-us/windows/win32/shell/autoplay-reg)
    (https://www.kb.cert.org/vuls/id/889747)

Notes tied to earlier replies

  • ’s suggestion to use System Restore can help only if a clean restore point exists; restore points can also reintroduce malware, so the above cleanup plus deleting old restore points is recommended. ’s observation that Symantec didn’t detect the variant is consistent with how some autorun/AutoIt-built worms circulated in 2007–2008; use the layered offline + on‑demand scans above for best results.

Recommended Answers

All 3 Replies

Member Avatar for salim hussain

have you done a system restore ?
unless you block the program that bring it back; it will continue !

Member Avatar for aripaka

hmm...

i havent created a restore point :( ..

without can i do a system restore..?

In fact i have never done a system restore..so dont know much about it..

Member Avatar for salim hussain

system restore point are created by the XP system; so restore a system restore point will be allowed if you have (i.e.
windows or virus) has not deleted them !
So go to (with mouse, assuming its still working )
All Program
Accessories
System Tools and click on System restore
Then you have to say yes to system restore
and choose a date before the problem - system restore
points are in bold on dates.
If it does it then you're back to how you were configured
at that date.
Some of the viruses these days are really nasty - they come back !
So after that go in fail safe Mode and create another user
say if u r using user name abc - make it abc1.
and then connect to the new user.
remember the virus(es) is/are still on disk no longer active in memory. Do a combofix - you'll find many examples in daniweb forums - please try not using your computer for internet access (so get program ComboFix from a friend) until you've finished with combofix. And then you'll be OK until the next threat. Please use only one Antivirus

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.