scvhsot.exe virus worm removal

Hi!

You must see all hidden files in the pen drive, after remove the files.. also autorun.inf. Else you can format it, before backup your data (best to be directories) and re-copy again to there.

It should be ok after that.

even if i delete autorun.inf,
it comes back immediately.
thanks marco

Are you sure you eject the device correctly?

actually, i couldn´t eject the device.
when i tried to eject it, the message was that the device is busy with some programs.
probably the virus itself in action from my usb stick.

Viruses in linux don't have effects :)
Stop the process which is using the USB or, if you don't know what is it, restart the PC.

right now i managed to remove it.
what i did is
i killed the process scvhsot.exe from my process list in system monitor.
then edited the contents of the file autorun.inf; it was slightly difficult to do. i opened the file, edited it in gedit. then deleted autorun.inf from nautilus window. then immediately saved my gedit content in the name autorun.inf.

then deleted all the exe files from my usb stick one by one and with *.exe search.

i have seen the same worm in many other usb sticks too.
will try out with a few of them soon and will put my next post soon.

thanks andrea.

I am very puzzled -- Linux doesn't run Windows .exe files, so how could you possibly see a Windows .exe file in a linux process list? Very strange. Were you running Windows or Linux at the time you were cleaning your USB stick?

i don´t have windows installed in my system.
right now i have ubuntu and ubuntu only.
but i have wine installed in my system.
so that i can run quiet a few .exe files.

is it because of this wine that i could see a windows process in process list.