What is ncyrf.bat on USB drive?

Discussion in 'Malware Help (A Specialist Will Reply)' started by rstuff, Dec 7, 2008.

  1. rstuff

    rstuff Private E-2

    I have spent the last couple of days trying to get the autorun virus off my pc. I tried AVG free and Spybot before getting it removed with Combofix. I suspect my USB drives may be infected. I have a hidden file called ncyrf.bat on my USB drive. Is it a virus? Thank you.
     
    rstuff, Dec 7, 2008
    #1
  2. DavidGP

    DavidGP MajorGeeks Forum Administrator - Grand Pooh-Bah Staff Member

    Hi

    Searching on that file name, while my french and polish is not good as most results seemed to be in eithe rlanguage they did point towards this being malware, so would be tempted to save whatever important data from that drive that you know is safe and re-format it.


    Then run the below guide to check your main PC.

    Please follow the instructions in the below link and attach the requested logs when you finish these instructions.


    • If something does not run, write down the info to explain to us later but keep on going.
    • Do not assume that because one step does not work that they all will not.
    READ & RUN ME FIRST. Malware Removal Guide

    Notes:

    1. If you run into problems trying to run the READ & RUN ME or any of the scans in normal boot mode. You can running steps in safe boot mode but make sure you tell us what you did later when you post logs. See the below if you do not know how to boot in safe mode:
    2. If you have problems downloading on the problem PC, download the tools on another PC and burn to a CD. Then copy them to the problem PC. You will have to skip getting updates if (and only if) your internet connection does not work. Yes you could use a flash drive too but flash drives are writeable and infections can spread to them.

    plus a guide on how to attach the logs HOW TO: Attach Items To Your Post
     
    DavidGP, Dec 7, 2008
    #2
  3. rstuff

    rstuff Private E-2

    I formated my USB drive and everything looked good until AVG Free opened a window and told me that it had found the Win32/Heur virus. I healed it and then ran an update of AVG Free and did a scan. It found about 40 copies of the Heur virus and about 5 copies of the Autorun virus. I healed all of them or deleted the files that they were in and I am now working my way through the Malware removal instuctions.
     
    rstuff, Dec 9, 2008
    #3
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    When you finish, we strongly recommend that you attach all 4 requested logs even if you think everything is working okay.
     
    chaslang, Dec 12, 2008
    #4

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds