AVG-IS9 : E:\OBJESI\sise.exe Threat detected!Closed

Question

Hello, 
I inserted by USB RAM stick, and (Because XP isn't smart enough to know how I always open it.) accidentally selected  'Open files with contained access program', and AVG9 screamed "Threat detected!"
`sise.exe' not found; `Cryptic.BEB' not found; {stupid web}
\* Go to file ? 0 obj
	E:\OBJESI\ appears empty, but AVG scan => 1 object (invisible!?),
	 and WinExp cannot even find E:\OBJESI\
?* Move to Vault ? no response except AVG panel disappeared without comment.
* AVG-IS-9>help> => `Threats detected' by Identity Protection	{but note `Resident Shield alert'}
* AVG>History>Res.Shield> 1 entry: cannot copy without export to "Res.Shield.Alert101105.csv"
Resident Shield detection
Infection;"Object";"Result";"Detection time";"Object Type";"Process"
Trojan horse Cryptic.BEB;"e:\OBJESI\sise.exe";"Moved to Virus Vault";"10.11.05, 6:20:02 PM";"file";"C:\WINDOWS\Explorer.EXE"
Although (before 'move to valut) I could not find that file or path on my USB RAM stick, I assume Explorer is not infected by sise.exe.  AVG help, AVG VE, & web search were useless & unproductive.
Have I been infecting other computers!?
Has this damaged any of my files?
Why is this so difficult?
Configuration: Windows XP / Firefox 3.6.12

Kamron3 · Answer

Most likely OBJESI is hidden by default.

Turn it on by changing the "Show hidden folders" option in the Folder Options in your Control Panel.

DO_1234 · Answer

I just found this on my backup drive as well. Showing hidden folders doesn't make it visible. I found it because I was using a spatial analysis program that showed me this OBJESI folder in its catalog system. I also couldn't delete the folder because it said it was being used by a process. Although it appears as nothing is being stored in that folder it was actually taking up about 1.5 gigs of space. So any files in it must be hidden. The IT guy didn't have a solution except to reformat my computer. The McCaffee virus software did not find this sise.exe file.  And I definitely infected other computers buy moving my flash drive to them. However I didn't infect my laptop with it don't know why. Possibly because I have Comodo or could be because my laptop wasn't connected to the internet. IT guy thinks the purpose is too use other people's available disk space.

surfer · Answer

I used a linux(ubuntu 10.04) machine to mount the drive, I can see the \OBJESI folder and sise.exe inside it. The autorun.inf was modified to run this virus when you connect it to your windows computer. I can easily delete them from linux computer. I also get a lot of music which are stored in the RECYCLER folder by the hacking program. I guess they're shared online when you connect your drive to your computer. If you don't have linux machine, you can use some bootable CD to delete them.

Biggles7 · Answer

Problem: USB flashdrive/pendrive/stick can NOT be formatted if there is a folder OBJESI/sise.exe stored there. This executable file WILL infect ANY and all USB flashdrives connected to the affected computer.  And when these infected USB flashdrives are connected to another "clean" computer, this infection will be passed ON to this computer, spreading the infection.  Furthermore, the KEY elements of this infection create changes in the Windows REGISTRY.  And until these registry keys are deleted....the infection can NOT be eradicated.  And USB flashdrives with the OBJESI folder  can NOT be formatted...remember.

Step 1: To SEE the OBJESI folder you must change the Windows setting in the Tools/Folder Options/View window.  UNCHECK the box "hide protected operating system files".

Step 2: On my PC,  I was able to track down the precise location in the registry thanks to one of the best Anti-Spyware + Anti-Virus programs on the Web : SPYWARE TERMINATOR.  And it's freeware.....NO catch !!
(I"ve been using it for years, and this software has come to my rescue countless times....)

Step 3: Back up the registry BEFORE any changes or deletions are made, please!!

Step 4: Now carefully go to these TWO registry keys using these two pathways:

HKCU\Software/Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*g E:\OBJESI\sise.exe

HKCU\Software/Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\exe\j E:\OBJESI\sise.exe

Step 5: DELETE these two keys.

Step 6: Reboot the computer.

Step 7: Insert the infected USB flashdrive and you can now FORMAT this flashdrive/pendrive/USB stick.... Use QUICK-FORMAT.  

IMPORTANT:  You may have to repeat this process if you have two or three USB flashdrives/pendrives/sticks.   Every time ONE infected USB flashdrive is inserted...the computer Registry can be instantly changed with the infected registry keys.  But when ALL your USB flashdrives are cleaned out from OBJESI, the infection has been eradicated.  
Keep these notes handy in case the infection reappears when you inadvertently insert some newly infected flashdrive.  Perhaps one used by a colleague or lent to you by a friend.  

The OBJESI folder is highly contagious: all it takes is just ONE connection to an infected computer.

AVG-IS9 : E:\OBJESI\sise.exe Threat detected!

4 responses

Similar discussions

Subscribe To Our Newsletter!