Unable to access 2 external drives after xeaYaL.exE worm (now gone)

Back to Giveaway of the Day

Giveaway of the Day Forums » General discussion

Unable to access 2 external drives after xeaYaL.exE worm (now gone)

(25 posts) (6 voices)

Started 1 year ago by NolafromNZ
Latest reply from Robert

Tags:

No tags yet.

NolafromNZ

offline
Member

I have been copying a friend's dvds - ones that he has created himself (or one of his friends has created) on trains that they have taken videos of, throughout New Zealand. (Chasing trains is a big thing in NZ, there is nothing like watching and hearing dvds of steam trains.) I used DVD Decrypter and copied some onto a 1T External drive, and some onto a 320gb external drive depending on which laptop I was using, meaning to use DVD Shrink to put them onto DVD later on (as I have done many times before). I had copied 30 dvds out of 36 without problems but suddenly I got an xeaYaL.exE worm that Avast sent to the virus chest on both laptops. I did a full virus check on both laptops immediately which seems to have got rid of this worm but on rebooting I can't access either drive. I also got a message that I didn't really understand saying something like 'the G drive was being mounted', but it disappeared before I was able to follow it. My 1Tb external drive comes up as a folder and I can access it with right click and explore. I went into Manage (right click on My Computer) and scheduled a Disk Check for the next reboot, but it didn't do one (probably because it is a folder now). The strange thing is the external drive is still coming up as a (healthy) drive in Manage. I tried to do a defragment but after an analysis Windows said it didn't need one.

The 320gb external drive is partitioned into 3 drives and they all show on My Computer but when I try to access them I am told all 3 drives are corrupted and they now show as being blank when the middle drive had about 20 'dvd' folders on it. Only the middle drive had data on it. So now I have 2 external drives I can't use.

I googled the axeaYaL.exE worm and on http://myinternetcorner.com/how-to-fix-remove-xeayal-exe-virus-worm-malware/ I found the same problem I've got but he had a flash drive instead of an external drive and was obviously able to access autorun.inf on his to fix his problem. I am unable to find autorun.inf in the folder that was my 1T ext drive.

Other things you might need to know, the 320gb ext drive is on a 'baby' laptop with a 12" screen, 512mb ram and using XP Home SP2. The 1T drive is on my main 15.4" laptop with 1.5gb ram and XP Prof SP2. Both external drives are only used for storage and I swap them around between 3 laptops and one desktop as the need arises.

Can anyone help me turn these back into fully functioning external drives?

Posted 1 year ago #
Robert

offline
StrayCat

Just popping in.
Try if enabling "view hidden and system files" solves your problem, then go to the root of your drive(s) looking for a possible autorun.inf file, and delete it ( reboot your system)
Next untick "hide known file extensions" and look for folders having an exe extension (and remove the extension).

Posted 1 year ago #
NolafromNZ

offline
Member

Thank you for your reply Robert, I appreciate it. I enabled 'view hidden and system files' but couldn't find any autorun.inf files. So I did a search on all drives and again couldn't find one that was actually anything to do with the system. (I found a couple inside zip files relating to games.)

As for the 320gb drive, I guess I could reformat it, and just put all the missing dvds back in again through DVD Decrypter. Do you think reformatting the drive would fix the problem?

For the 1T drive, I can keep using it as a folder for now. There is a shop that has 1T drives for less than NZ$100 so I can buy another one and throw this one once I have got the stuff off it, or try reformatting it too.

Posted 1 year ago #
Whiterabbit-uk

offline
Games Guru

The DVD's sound interesting Nola. I used to love travelling by rail and now love to play several train sim games . The best of whic is Railworks, though it's become rather an expensive hobby as there are add-ons being released virtually every month. I think the total cost of my Railworks set up is in the region of £300 now. Second place comes the latest trainz simulator. it's not quite as good graphically as Railworks, but you get more for your money with respect to rolling stock; plus the addons give you a lot more as well. You'd love Railworks if you like to watch video of trains running through the country side.

I'd love to see an add-on that gave me a taste of your wonderful countries scenery. :)

Posted 1 year ago #
NolafromNZ

offline
Member

Hi Stephen, When I've got this external drive problem sorted, I'll send you some dvds that my friends have actually shot with their video cameras. Some of the films I will send you I was there as well, although I only took photos, not being rich enough to have a big expensive video recorder like them.

Posted 1 year ago #
hotdoge3

offline
Member

http://www.prevx.com/filenames/X770786961609534730-X1/XEAYAL.EXE.html

File Name Aliases XEAYAL.EXE can also use the following file names:
* 54249947.EXE
* 95895475.EXE

http://www.superantispyware.com/malwarefiles/XEAYAL.EXE.html

SUPERAntiSpyware can safely remove XEAYAL.EXE (Trojan.Agent/Gen-NameThief)

Posted 1 year ago #
Robert

offline
StrayCat

Nola could you tell us the name of the file that Avast sent to the virus chest?
Somehow it all seems too much of a coincidence that both portables were infected at the same time or that both external drives appear to be corrupted(or dying).

Some time ago my antivirus quarantined the main exe of Acrobat Reader and I had to wait for several days (until they finally updated their definition files) ...and I was able to restore it eventually.

Ditto what WhiteRabbit said,chasing steam trains seems like a fun thing to do.

Posted 1 year ago #
NolafromNZ

offline
Member

Hi hotdoge3, Yes, I found that when I did a Google Search and I downloaded the Prev software, only when I double-clicked it wouldn't install/load. However, Avast did just fine in deleting the files anyway, so I didn't need it.

Hi Robert, The reason it happened to both external disks, is that when I put the dvd containing the worm into the baby laptop and loaded it onto the 320gb ext drive first, I stupidly didn't click that Avast deleting axeaYaL.exE had anything to do with that dvd. (I had already put 30+ through both laptops depending on where I was sitting (in bed with the baby and in the recliner with the main one.) And when DVD Decrypter had errors on loading it and rejected the dvd, I even more stupidly put it into my main laptop and loaded it onto the 1Tb drive - which it did fine, by the way, no errors. I only realised when Avast came up with the same damned file to delete plus an extra one. (axeaYaL.exE and axeaYaL.scr both on G:\ (the external drive) and not c: or d: (the local drives). Although axeaYaL.exE got into the memory of the baby laptop with the 320gb drive but Avast got it out again as I found out doing a second virus check.

I am assuming that because the 320gb drive was the first one to get the worm it was the worst hit and the reason for the drive now being corrupted and unusable. Although when I finish writing this, I am going to attach it to this main laptop and see if by chance it will now be a folder like the 1Tb drive is. I'm really hoping for that because I had most of the dvds loaded onto the 320gb drive plus some that have been there for months, and the older ones will be hard to replace now.

Also, I'm now getting all the dvd ISOs off the 1Tb 'folder'/drive and onto dvds. All my photos, music and game setups on the external drive are also backed up onto flash drives thank goodness (I never trust just one backup source and how right I am as this has proved) - these dvd ISOs are the only things not backed up as they were to be deleted as soon as they were put onto dvds anyway. My question is (yes, I AM getting to it) once I have got all the dvd ISOs off, will reformatting the external drive turn it into an external drive again and not have it as a folder? When I right-click on the 'folder' one of the options is 'format' so that ability is still there. And it is still appearing in 'Manage' as a drive too, so I could format it that way as well.

Alternatively, could I write an autoexec.inf file on the g:\ drive, and what would I put in it? I can't even find one on the c: drive of either computer to go by although at a pinch I could copy the one in the internet corner url in my first post, changing the capitals of course:

[AutoRUn]
acTioN=Open folder to view files
sHElLexECuTE=XeAyAl.eXE
ICOn=%SYsteMROOt%\SYSTEm32\shELL32.dlL,4
USEAUTopLay=1

What would I put instead of XeAyAl.eXE though? Would I need the word 'drive' instead of 'folder'? Is AutoRun spelt like this or all lower caps? And, most importantly, would this work? I can't find out for at least another day to allow me to remove all the dvd ISOs (I had nearly 300gb worth on the 1Tb ext drive alone and a little less on the 320gb drive) but once everything I need is deleted, I don't mind giving this a go first if a reformat will fix everything if I stuff it up.

Thank you for your help so far, Robert - I am trying not to panic here with the potential loss of 2 external drives, so I really appreciate the help.

Posted 1 year ago #
NolafromNZ

offline
Member

Further to my problem, I tried to cd g:\ on DOS to del the autorun.inf file that Search has now found on the g: drive when I did another search this morning, but DOS didn't recognise the g drive. I also had a look through the external drive/'folder' but autorun.inf is not visible. So creating an autorun file as above isn't possible. Does anyone know how I can delete the autorun.inf file on the external drive that is now a folder?

Posted 1 year ago #
Robert

offline
StrayCat

Hi Nola,
Strange...somehow you should be able to view hidden files changing the folder view options.

But maybe try it the 'sneaky' way:
create an (empty)autorun.inf (using notepad and renaming the extension .txt to .inf) and copy it to your G drive (folder) - confirm replacement.That should take care of the culprit.
Make sure the G drive (folder) is NOT set to read only,if so ..change the attribute using the properties tab.Confirm.

Safely disconnect the drive and reboot.

If that still don't solve the problem,look for a way to restore a previous registry too,
(I'd recommend using ERUNT in the future) but using a restore point prior to the infection also might do the trick.

Posted 1 year ago #
NolafromNZ

offline
Member

Hi Robert, Ok, I created an autorun.inf file, no problem but you guessed it, the original one is read only. So I went into the Properties of this drive/folder and even though it has the yellow folder option, Windows obviously still regards it as a drive. Properties tells me it is a FAT32 drive and all the usual info for a drive with the pie chart, but obviously nowhere to change the Read Only attribute.

By the way, if I just click on the folder in My Computer, I am told that Windows cannot find XeAyAl.eXE so cannot execute the command. To get into it, I right click and click on Explore.

Posted 1 year ago #
Robert

offline
StrayCat

You should be able to overwrite autorun.inf even when read only though,using drag and drop.
(using explorer)
I'll try and catch you later if not tomorrow.

Posted 1 year ago #
NolafromNZ

offline
Member

I wrote the file 2 different ways : 1. Created an autorun.txt file on G:\ then went into G:\ and found it. Renamed it autorun.inf. The error message exactly reads: "Cannot rename autorun. A file with the name you specified already exists. Specify a different file name."

2. I created an autorun.inf file in Notepad, remembering to change it from a txt file to "All Files" and specifying G:\ for its placement. The error message exactly reads: autorun.inf This file exists with Read Only attributes. Please use a different name.

Am I doing it correctly?

The existing Read Only autorun.inf is not appearing even with Show Hidden System Files unticked.

Posted 1 year ago #
hotdoge3

offline
Member

This file exists with Read Only attributes. Please use a different name. That be right can only do with luck if you can Change to Read & write you may need to be Administrator to Change, as for Show Hidden System that only show Hidden it will be Super Hidden like in fist part of main drive boot system,I dont know if Panda USB Vaccine will help it free

Posted 1 year ago #
andreas_nd

offline
Member

@NolafromNZ

It looks like an external drive infection caused by a worm that copied itself in external USB drives, some worms can even be added in DVDs while burning, and infected the autorun.ini to be able to run itself everytime you insert the external USB / DVD in a PC. The easiest way to fix this problem is to delete the autorun.ini file from the USB, if it is from the DVD and you need your own autorun.ini, you need to re-burn the DVD with a clean autorun.ini file without the "XeAyAl.eXE" string inside. You may also want to delete the executable file "XeAyAl.eXE" from the external drives. If you cannot find the file autorun.ini or XeAyAl.eXE is possible the worm has added the attribute "hidden" to these files, so you will need to un-hide them, to do this you can:

1) Click Start
2) Click Run...
3) Type: cmd.exe
4) Now you need to open the main directory of your infected external device, ex: G:\
5) Now type:
attrib -s -h -r autorun.ini
attrib -s -h -r XeAyAl.eXE
6) You should be able now to see these files
7) I can suggest you to delete them since in USB devices is not needed the autorun.ini file (except in special cases, such as if you want to auto run a setup.exe of a presentation or of an installer)

After this, I would recommend to make a scan of your PC with Hijack Hunter (http://www.novirusthanks.org/products/hijack-hunter/) and when it has finished the scanning process, please upload the report file to http://mediafire.com/ so we can take a look at it and let you know if are needed other procedures or if your main PC is infected by other worms/trojans.

Another raccomandation would be to disable the automatic load of autorun.ini files from USB devices, to do so, follow these instructions:

1) Create with notepad a new file named disableusbautorun.reg (make sure it has extension .reg)
2) Copy this text inside the file:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoDriveTypeAutoRun"=dword:00000095

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoDriveTypeAutoRun"=dword:00000095

3) Now save the file and double-click it

Restart your PC

Posted 1 year ago #
Robert

offline
StrayCat

Nola,

I just remembered a small program I found to be very useful when searching for files,even the hidden ones.
It's called Everything (272 KB) ,look for the portable version.
Just give it some time when building its database of all your connected drives, when you launch it.
So this program might help you to find the autorun.inf on your G: drive the easy way (and delete it)

Btw Thanks for your support Andreas.

Posted 1 year ago #
NolafromNZ

offline
Member

Hi andreas_nd, Thank you for your answer. I have tried a couple of things without success.

Re No 4 - I cannot open g:\ on DOS - I tried cd\ g:\ cd g:\ cd g DOS just tells me invalid path. I reached into my memory on DOS - if you needed help with a command didn't you type cd ? ? Which didn't work either. When I got into DOS I was in c:\documents and settings and cd\ worked, it took me back to the root directory. How can I change to the g: drive in DOS ?

As it looked the easiest thing to do, I created a registry file as you wrote it above. The icon definitely came up as a registry file (.reg) with its "blue pineapple shape on a piece of paper" but when I double click on it, it just opened up the notepad file. So, I went into the Registry and followed what was written (HKEY_CURRENT_USER/Software etc) but there has been no change to the Registry at all. "NoDriveTypeAutoRun" doesn't even appear in the first one, but under HKEY_USERS|.DEFAULT.... there is NoDriveTypeAutoRun REG_DWORD 0x0000091 (145) with a funny 'icon' at the start with 4 blue letters that look like OU above and HD below (my eyes aren't very good). Doesn't this mean that the reg file shouldn't have opened as a notepad file so it hasn't changed the registry? I did restart the PC but no difference. I even double clicked and opened the reg file again and rechecked the registry - still as I have written.

I don't think XeAyAl.eXE exists in G:\ any more, a search couldn't find it after I had run Avast.

Posted 1 year ago #
Paul F. Quantum AKA "The Dragon"

offline
Member

Hi NolafromNZ,

I have read all of this thread twice to be sure of my facts before answering!

As I understand, you have problems with a single USB external drive that was partitioned into 3 drives.

On top of that, you cannot reach the G: drive under DOS.

So if this is so, my two cents would be that problem #1 could be due to partition table damage.

You could use TestDisk, an OpenSource software licensed under the GNU General Public License (GPL).

TestDisk is a powerful free data recovery software found at this link: http://www.cgsecurity.org/wiki/TestDisk

Quoted here is part of that linked page:

"TestDisk is a powerful free data recovery software! It was primarily designed to help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused by faulty software, certain types of viruses or human error (such as accidentally deleting a Partition Table)".

As for problem #2, DOS not finding the G: drive, that can be explained too!

The DOS file (and drive) searching system (AKA operating system prompt) is an older text-based interface for interacting with computers, their drives and their files.

While many tasks can still be accomplished easily using DOS, finding the location of an external (USB or other) hard drive on a computer system is not as convenient as on other more modern visual operating systems.

As there is no native function for scanning drive locations and reporting their connections under DOS, your drive might not be viewed by DOS as G:.

However, there are workarounds to this problem.

Anyone with some patience can find an external hard drive in DOS.

One method can be found here: How to Find an External HD Using a DOS Prompt

The instructions difficulty level for users is set as Moderate and it explains two methods which are:

1) Trial and Error

and

2) a Batch Script.

The trial and Error method is basically to first type "vol c:" at the DOS prompt and press "Enter."

All computers contain a C: drive, and this command will return information about the internal hard drive.

It is possible to search for an external hard drive the same way by cycling through the 22 available drive letters until a drive is found.

Drive letters E through Z are usually used for external drives.

The second method you will find at the link!

I hope this will help you

Warm regards

The Dragon (Paul)

Posted 1 year ago #
NolafromNZ

offline
Member

Hi Paul, Thank you very much for joining in. This is turning out to be a battle! I tried typing vol g: knowing that my 1Tb Elements drive is 'programmed' to g: and it comes up immediately as volume in g: drive is Elements and gives the number. Great! It is definitely there. But, how do I get into g: ? I tried cd g:\ and every combination of it, so that I could change the attribute as andreas_nd wrote out for me above, but I just stay at c:\ drive.

I have downloaded TestDisk - I'm pretty excited about this, and I will be trying it shortly, but I probably won't be able to report back until tomorrow. It is time to cook tea now dammit, so I will be off for a while.

I really appreciate your input, thank you.

Posted 1 year ago #
NolafromNZ

offline
Member

Hi hotdoge3, I had a look at Panda USB Vaccine as you suggested, and on first reading it I was thinking, great, that's exactly my problem, but when I read all 246 comments I was too scared to give it a go before getting all the dvd ISOs off it. Quite a few had lost all use of their USB drive. I've only got a few dvds to do now (done over 60) so will look at that again tomorrow. In the meantime I've downloaded it. Thank you so much for your help.

Posted 1 year ago #
NolafromNZ

offline
Member

Hi Robert, I downloaded Everything (portable) and had it on the root drive and on g:\ and ran it from each but nothing turned up from the g:\ drive. Under Tools/Options/Volumes I noticed that it was reporting on the NTFS drives and g:\ is apparently a FAT32 drive, so I tried adding g:\ to the Database location above the drives, but not one g:\ file/folder is reported. There were around 223,305 objects but no g:\ objects.

I really appreciate your input too. We have a wonderful batch of people in this forum and you are certainly one of them.

Posted 1 year ago #
andreas_nd

offline
Member

@NolafromNZ

To access an external device you not need to type "cd G:\" but only "G:", example:

C:\>F:

F:\>

Posted 1 year ago #
NolafromNZ

offline
Member

Andreas_nd, THAT DID IT !!!! I have now got a clean 1Tb drive back again! Oh joy! I used to be a real DOS afficionado, how can I have forgotten so much. How easy it was once I put in g: and no cd, which I realise now was change directory - not what I was aiming for at all.

So now, TestDisk and I are going to spend some time with the 320gb drive and see if we can rescue that one as well. I'm feeling very hopeful after the success of my 1Tb drive.

Once I have sorted out the other external drive, I will get stuck into Hijack, although I'm sure that the XeAyAl.eXE has gone. When I did the attribute command on autorun.inf that worked fine, but when I did it on XeAyAl.eXE I was told the file didn't exist. But, still better to be safe than sorry.

Thank you all for your help and assistance, you are a wonderful bunch of people. I really appreciate the lot of you. If not for you all, I probably would have had to fork out for new external drives or for someone knowing as much as you all do, to fix it for me, which probably would have been as expensive. A 1Tb external drive is only NZ79.00 on special, I think an expert's hourly rate would be more than that.

I will be back to let you know how TestDisk worked.

Posted 1 year ago #
NolafromNZ

offline
Member

Well, damn! I have had a long battle with the 320gb drive and TestDisk without success. The first time I ran TestDisk, all 3 partitions appeared during the Deeper Search when I followed the prompts as advised in the instructions. But on completion of the Search, they disappeared and I haven't been able to get them to appear again, no matter how many times I repeat the Search. In fact, now when I do the Deeper Search it comes up with 'Read Errors' as what it is searching through and ends up with a blank result. I will also try googling Partition table damage, and also try the PhotoRec program that comes with TestDisk. So, I haven't given up yet, but it is looking more likely that my last resort of reformatting will be happening.

Never mind, to get the 1Tb drive fully functioning again is wonderful.

Posted 1 year ago #
Robert

offline
StrayCat

It's good to hear your 1TB drive is up and running again,Nola.
Btw if you're still wondering about that reg file opening with notepad,I remember some antivirus do associate reg files this way, to protect against accidentally opening reg files.
(...and changing the registry).
There probably is an option in your antivirus settings to (temporarily!) allow reg files being executed.

Posted 1 year ago #

RSS feed for this topic

Reply

You must log in to post.