求助 - 我的 USB中毒了

[Living]

將自動播放功能先關閉
(檔案總管, usb槽按右鍵選內容, 然後選"自動播放", 然後選"不要有任何動作")

關閉後移除usb再插入一次應該就不會自動執行, 這樣就可以按上面所講的方式去清除

如果不能關閉"自動執行", 那就得從registry中去改
執行regedit, 然後找到
HKEY_CURRENT_USER
Software
Microsoft
Windows
CurrentVersion
Policies
Explorer
"NoDriveTypeAutoRun"

將數值改成ff然後重開機應該就能關閉自動執行 (先警告, 這會關閉全部cd rom 或移除式裝置autoplay, 所以清完毒後可能得自己再改回來)

[pc5312]

我嘗試你告訴我的2種方法但仍然無法成功移除防寫入功能 因此也無法重新格式化我的USB 實在令人洩氣 難道真的沒有別的方法可以解決嗎 還是我的USB已經沒救了

[hawlan]

在英文網站看見這個方法﹐試一下。
http://www.precisesecurity.com/tools...rom-usb-drive/

How to remove autorun.inf from USB Drive

Worms spreads by creating a copy of itself and starts by autorun.inf files. It is essential to remove the malicious and autorun.inf files not only from computers but also from the source, and that is the USB Drive. PreciseSecurity have created a procedure to delete the malicious files on infected drives.

PROCEDURE:
1. While the computer is still off;
2. Plugin the USB Drive
3. Insert the Windows XP CD-ROM into the CD-ROM drive. It must be the bootable Windows XP Installer
4. Start the computer from the CD-ROM drive. It will start Windows Setup screen
5. When the “Welcome to Setup” prompt appears.Press “R” to start the Recovery Console
6. If asked “Which Window installation would you like to logon to” select the number. Type “1? then Enter, if only one installation of Windows is present
7. Enter the administrator password, press Enter
8. It will bring you to command prompt, C:\Windows>
9. Proceed with the following command:
- Type d: (This is the drive letter of USB. It can be e: or f: defending on how many hard disk or cd drive is installed)
- Type attrib -h -r -s autorun.inf
- Type “edit autorun.inf” it will open DOS Editor and display contents as follows
==========================
[autorun]
open=file.exe
shell\Open\Command=file.exe
shell\open\Default=1
shell\Explore\Command=file.exe
shell\Autoplay\command=file.exe
==========================
Take note on the file that it called to open (in above example it is file.exe)

10. Exit DOS Editor and return to command prompt, D:\>
11. Delete the file that was called to open on DOS Editor
- Type del /f /a file.exe

12. Delete autorun.inf file
- Type del /f /a autorun.inf

13. Exit Recovery Console by typing exit.

[hawlan]

如果嫌以上方法麻煩﹐或者在 safe mode dos prompt 環境下執行看可不可以。
(不知道safe mode dos prompt 能不能找到 pen drive... )

進到safe mode dos prompt 環境後﹐請依下列方法試試看。

Type d: (This is the drive letter of USB. It can be e: or f: defending on how many hard disk or cd drive is installed)
- Type attrib -h -r -s autorun.inf
- Type “edit autorun.inf” it will open DOS Editor and display contents as follows
==========================
[autorun]
open=file.exe
shell\Open\Command=file.exe
shell\open\Default=1
shell\Explore\Command=file.exe
shell\Autoplay\command=file.exe
==========================
Take note on the file that it called to open (in above example it is file.exe)

10. Exit DOS Editor and return to command prompt, D:\>
11. Delete the file that was called to open on DOS Editor
- Type del /f /a file.exe

12. Delete autorun.inf file
- Type del /f /a autorun.inf

--------------------------------------
簡單的說﹐要你編輯 autorun.inf ﹐就是要你檢查這個autorun 到底是執行甚麼命令﹐把這個命令記下﹐然後刪除這個元凶﹐然後再殺掉 autorun.inf

[pc5312]

我依照你的方法在 safe mode Dos 下執行 attrib -h -r -s autorun.inf 但跳出一個視窗 顯示 " 磁碟寫有防寫入功能 無法移除"

還有其他方法嗎 ??????

我現在只想重新格式化這個USB 但因有防寫入及移除功能所以無法格式化

麻煩各位大哥 實在不好意思

如果真的無解請告知 我只好花錢重買一個USB 只是資料沒了很麻煩

[hawlan]

試改一下 registry :

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\CONTROL\StorageDevicePolicies

把 writeProtect 的 reg_dword 改成 0
如果你的 writeProtect 值是 1 的話﹐那是代表唯讀﹐改成 0 (零) 就可讀寫。

改了後﹐重開機看看。

又﹐你的 autorun.inf 裡面是跑甚麼命令﹖能告訴我們嗎﹖

[pc5312]

我已將 writeprotect 的值改成0了 並重開機但仍然無解
另 可否告知如何操作才能看到autorun.inf的指令 謝謝