How to deal with aastree virus?

Question

my flash disc has two hidden folder with aastree on it. It caused my other folders hidden. I tried delete them manually but when I checked it again, they're still there. help pls

Answer 1

The malware must be on your hard drive for it to be reinfecting your flash drive.

OK, first, you will need to get some software programs to help you. They are free for personal use.

Anti-Spyware Software

• CWShredder - You can find it at [www.trendmicro.com]
• Lavasoft's Ad-Aware - You can find it at [www.lavasoftusa.com]
• Spybot S&D - You can find it at [www.spybot.info]

• AVG AntiSpyware - You can find it at [free.grisoft.com] / [www.ewido.net]
Anti-Virus Software


Download each of the above programs and then install them. After you install them, you MUST update them so you will have the latest protection. There is one small exception: CWShredder is a stand-alone program that doesn't need to be installed, but you do need to have it check for an update to ensure that you have the latest version. If you don't update these programs and you are infected with the latest parasites, you will not be able to effectively detect and clean them from your computer, so remember to update, update, update.

Since spyware is a bigger problem today than viruses, and spyware is typically harder to find and get rid of, I suggest to start looking for spyware first. I also use the different AS software packages in a specific order so that I go after the tougher problems first and the easiest ones last. What follows is fairly lengthy, but it will take care of just about anything.

1) Turn off System Restore

• Viruses can hide in your restore files, and if you do restore at some point you might reinfect yourself. Because of this, it is recommended to turn off System Restore before you test, and when you're done, turn it back on so you are still protected from standard computer problems.


Click Start.
Right-click the My Computer icon, and then click Properties.
Click the System Restore tab.
Check "Turn off System Restore" or "Turn off System Restore on all drives."
Click Apply.
When turning off System Restore, the existing restore points will be deleted. Click Yes to do this.
Click OK.

2) Carefully Look at Windows Add/Remove programs for suspicious programs

• Many of the spyware threats actually install into your system like a program. Many appear to be utilities that you may think are helpful but in reality aren't. Look for add-an toolbars, while toolbars like those provided by Google, MSN, Yahoo and other are great utils, there are many more that aren't and if in doubt check it out to see if ones you have are parasitic. Another common exploit are the Search helpers, WinTools, Gator products, IE Helper, Comet Cursor and many others just to name a very few. Peer-to-Peer (P2P) programs are another common source for these and even the ones that doen't come with spyware themselves are a security risk that may lead to your system being infected or to spread infections like these. Remove all suspicious programs, if you are wrong, you may always re-install them later.

3) Run Disk Clean-Up

• This actually comes with Windows and has been installed by default since Windows 98. You can find it by clicking the Start Button and then going to Programs / Accessories / System Tools / Disk Clean-up. I recommend selecting all of its options except the ones for Office Setup Files and Compress Old Files if you have them. While you may select those if you wish, they aren't as important. This will clean up all of the temporary files so your testing will go faster, and may also delete any spyware that may hiding there if the spyware isn't already running. To clear systems that have System Restore you will need to select the second tab and click the button for clearing this.

4) Empty your Internet Explorer cache

• Open Internet Explorer and go to Tools..Internet Options… and under the General tab, in the Browsing History section, click Delete… and then select Temporary Internet Files. This probably won’t eliminate any viruses but will make the scanning go faster.

5) Run CWShredder

• This is made for detecting and cleaning of the infamous CoolWebSearch exploits. Currently there are about 40 types of these, each with up to 4 variants and growing. These are some of the toughest ones to get rid of.

6) Run Ad-Aware next

• This handles the next toughest types the best. When it finally presents you with the list of parasites it has found, put a check mark in the box next to the ones you want to get rid of, I suggest checking them all. If it says it can't get rid of a problem right now, it will ask if you want to run it again after you restart your computer, answer yes and restart your computer so it may test again.

7) Run Spybot next

• When you run it, it will automatically select all the spyware that it finds, if there is something you don't want to get rid of for some reason, deselect it and then let Spybot fix all of the rest of the problems that it finds. This program also will ask to restart your computer so it can test again if it has problems removing something, so let it.


8) Now Run The AVG Program

• Run the “Complete system scan” option. AVG will scan all of the files when you scan your computer; it will likely take . a long time to complete.

• If you found any parasites, you need to restart your computer so you can test everything again. There are times that after cleaning certain parasites you will need to test again because something may have been hidden earlier by the infection. So repeat this process of testing and restarting until you find no more parasites.

• Run the scans again in Safe Mode. This will keep many of the parasites from loading and being able to hide from your protection software. To access Safe Mode on most versions of Windows, start tapping the [F8] key after you first start or restart your system, start tapping it before you ever see a Windows Splash Screen and continue until you get the Menu where you may select it from the list. On WinNT, this is called VGA mode and on Win2k you actually start tapping just after the first splash screen shows. For Detailed instructions see Restarting Your Computer in Safe Mode

9) Reboot your computer normally.
• If you're still having problems, continue with the following:

10) Go to
http://www.spywareinfo.com/~merijn/progr...
• and download HiJackThis. Run the program, which will create a log file. Go to

http://forums.spywareinfo.com/

• and post your HiJackThis log. You will get an extremely rapid, very precise answer on the forum (they don’t e-mail responses to you) as to whether or not you still have any infections and, if so, exactly what to do.

11) After everything is all cleaned up
• I recommend installing SpywareTerminator (also free):
http://www.spywareterminator.com/
Good luck!

Answer 2

2

Answer 3

I'm so sorry to hear that. Sometimes we feel like just going for a new one... They're getting cheaper all of the time. I see you have quite a bit of info on what you might try and all that I can say is that I wish you all the success in the world as I know just how frustrating it can be...
Remember the old adage... "An once of prevention is worth a pound of cure" and be real vigilant as to what you accept to open on your computer from now on.
Depending on the age of your computer, I'd try what the Pros are telling you above me and then I might take it to where I bought it to repair the damage all of these anti-virus might cause as they often conflict with the one we had from the start... which gets his own problems when so many others (sometimes even just one) interfere! I can't say that I truly understand this but had serious problems of my own until they were all removed!

Answer 4

Mark S. has some good advice, but i wanted to ask for a clarification: what is "aastree"?

as i was unable to find any meaningful reference to "aastree" on yahoo, i'm assuming that either it is not a virus, or is not yet discovered.

I also wanted to provide a clarification: it is possible aastree is a utility installed by the distributor of your flash drive. if this is the case, it may be present in an unwriteable (ROM) portion of the drive. this is a common method flash drive manufacturers use to protect functionality provided by factory-installed utilities.

the reappearance of files deleted from a flash drive is frequently the result of ROM code automatically detecting the absence of same & recopying them from read-only portions of the drive. don't know if this answers your question, but hope this helps.

try to verify that aastree really is viral before you expend too much energy trying to remove it. good luck!

Answer 5

We had a an identical trojan virus and was once competent to eliminate it by means of discovering the supply proper at the laptop-my records, software records... that type of factor and uninstalled it. I do not know for certain if it might harm and/or do away with most important records at the laptop. That is what the laptop man did on ours.

Answer 6

Active@ Kill Disk - Hard Drive Eraser
http://www.killdisk.com/?gclid=CObmsaHfwYwCFQY8IgodvSJlWQ
Free version supports fixed disks, floppies, zip drives, FlashMedia drives

Answer 7

For all computer related problems please check out
http://sumiram2006.googlepages.com/combatproblems
It not only gives complete solutions but also offers
free downloads of effective softwares which can detect
and eliminate all spy ware /virus /ad ware /Trojans completely.