Disk Knight
Reported: October 23, 2007
Category: Unwanted Program, Threats
Disk Knight is a supposed to be security program that prevents malicious programs or executables from USB and Memory stick to start. However, its ability to spread and protect gave wrong impressions to users.
Other Alias:
Virus.Win32.autorun.fb
Threat Level: Low
Systems Affected:
Windows - All
Others:
Disk Knight on Mobile Phones
1. Temporarily Disable USB Drive to autorun (Windows XP):
a. Open Windows Explorer or press the Windows + “e” key.
b. Right-click the drive of the USB Drive. Then select Properties. Drive Properties will appear.
c. Select the AutoPlay tab.
d. Choose Select an Action to Perform
e. At the bottom of the selection, click Take no Action, then click Apply.
f. Click OK to exit Drive Properties.
2. Show Hidden Files
a. Open Windows Explorer
b. Go to Tools > Options
c. On View tab, mark Checked the “Show Hidden Files and Folders and “Hide Protected OPerating System Files” Unchecked.
3. Delete the files manually
a. Go the USB Drive and delete autorun.inf
b. Go to C: Drive and delete autorun.inf
c. Go to C:\Windows and delete Disk Knight.exe
4. Modify Windows Registry
a. Go to Start > Run then type regedit
b. On Registry Editor, go to Edit > Find and type “knight”
c. Delete all entries it found.
5. Connect to Internet and update your AntiVirus
6. Reboot your computer in SafeMode
a. During BootUp process Press F8 continuously until selection appears
b. Use Arrow Up+Down to select SafeMode on the selections menu.
c. Hit Enter to proceed.
7. Scan your computer with an updated AntiVirus and delete all infections it founds.
Note: You may enable autorun of the USB Drive by reversing the process in Step 1.
I just want to confirm if you’re required to log in your computer as Administrator before you can execute the ‘disk knight’ removal procedure, and what if another autorun.inf is found within your C:/WINDOWS folder, should you delete that one too, aside from the one in C:/ only. I found one in mine.
There are some actions that require you to have an Admin privilege such as modifying the registry and deleting the autorun.inf file located on Windows folder.
Thanks for the instructions! It removed Disk Knight all right, but when I double-click on any program icon I get the “open with” dialog, where I have to select the program, which with some programs doesn’t work; typing “regedit” in the command line brings up “open with” dialog, as well. Furthermore, right-click on “My PC” - “Properties” yields the message “C:/WINDOWS/system32/rundll32.exe Cannot find the application” even though it’s there in windows explorer. I cannot open System Restore either. It seems as though my hands are tied…
yeah your right it well not open instead it wll “open with” we have thesame problem……
Once removed the default value in the “open” key for “exefile” in windows registry, as you say it is impossible to open any exe file.
To solve this just open windows explorer, locate and launch regedit.exe with Run As (shift + right click) and correct the default value for that key, that’s “%1″ %*
I would like to confirm that the procedure also works for v4 of Disk Knight. Choosing ‘help’ from the disk knight icon loads and information web page where the author say to uninstall from add/remove programs and he stresses that if you try and delete the knight.exe file you will have problems. ‘Uninstalling’ seems only to deactivate the automatic loading but does not actually uninstall the file, as knight.exe still exists on both my hard drive and flash disk.
I’m worried about trying to remove it myself because of the warning and the experience of gaston.
Same thing happend to me, “rundll32.exe” crap. Does anybody know what to do?
On the site below I found a link to the program ‘btask-fix.reg’ that would repair the so called file on your computer.
http://forum.avira.com/thread.php?threadid=28088
since the page is entirely in german I placed the link down below, so you don’t have to read all that ;) …
http://member.file-upload.net/KarlKarl/btask-fix.reg
PS: I tried it on my computer since I had the very same problem and have to say: it works. so have fun
Thanks I just remove it from my usb flash drive. I got infected after checking my cousin’s PC. At that time I didn’t know how to remove it. But i found something wierd at my cousin’s PC. If you click “Tools” at tehe toolbar on any folder, you shuld see the option “Folder options”, but I can’t see it on my cousin’s PC. Therefore he will not be able to eliminate the DK. What’s happenning???????
This message is for Jeremy and all those experiencing the same as him..
Your cousin has more than just DiskKnight on his PC, he has the virus Brontok as well… The brontok virus removes the Folder Options from the Tools menu so that you cannot see hidden files and also prevents you from running regedit… http://www.bitdefender.com/VIRUS-157247-en–Win32.Brontok.A@mm.html
This tool should be able to help you out
My pc got infected through a memory stick and I simply went into settings and uninstalled it. Is that sufficient? Furthermore, my memory stick is no longer working. When I go into my computer to click on it, an “open with” list pops up. It seems to think it is a document or image or something. All ideas welcome. Is the stick destroyed? Norton antivirus seems to be picking up nothing.
how to remove the knight virus from my mobile phone? i tried the steps above but still to no avail. my mobile model is Sony Ericsson W580i. is there any way for me to remove the virus..?
My anti virus is not working anymore thanks to disk knight.
how can i fix this problem? i tried re-installing the anti virus but it was no use.An error message keeps popping out.HELP!
email me @ bernard_cgjr08@yahoo.com
thanks.
hellllp! i duno if my drive c: and d: are infected with disk knight the icon harddrive wont come out. and every time i click drive c: what pops out is my drive d: i need help i dOnt know whats happening with my pc.
thank you so much people!!!
the link that niklausfmm gave works!
use it.
but i still cannot fix the virus on the flash drive?
it cannot open, asks me to select the program form a list?
i cants seem to find autorun.inf… on C, C:windows or the USB drive…
Alleged security software, named Disk Knight, is developed by a Bangladeshi student and its idea is simple: if a USB key is protected by Disk Knight the program will prevent the launch of any other process on the computer and display a message prompting the user to block or allow the starting process.
Since USB malware is typically launched when the USB key is inserted, Disk Knight can prevent any virus from infecting the computer via that route. This sounds like a good idea.
However, the problem is in the implementation. Once the Disk Knight program is installed and starts protecting the computer, it will copy itself to every inserted “unprotected” USB key, making it “protected”. Furthermore, if the newly protected USB key is subsequently inserted into another computer, Disk Knight will run and install itself onto the computer, all without the user’s consent. This behaviour and the lack of control from the user side makes Disk Knight a computer virus.”
(-Buckeye042, Yahoo! Answers)
I have already been infected, again, by this alleged security software a few days ago… Fortunately, I have already known how to remove it including the installed components in my PC, like in the registry and windows folder.
First, make all files visible and unhide protected operating system files.
Second, go to Windows Folder, look for the Knight.exe file and delete it.
Third, open your disk (USB) and look for the Knight.exe and the autorun.inf files, delete them.
Fourth, Open the Ccleaner sofware, (you can download it from www.ccleaner.com for free). Run the Cleaner, then Scan and fixed Issues that will be detected.
Fifth, disconnect your USB then reinsert.
Sixth, after you have tried all these steps and Knight.exe is still in view, e-mail me @ friendly_bug_x2@Yahoo.com
I have also known some risk upon the removal of disk night.exe - other applications installed in your computer will no longer work. It seems like when you open an application, the “open with…” window will pop up. And I have no other idea to fix this problem than this…
Start menu>run> then type “recover.reg” then press Ok.
Have a great day!…
So happy!
niklausfmm’s link worked perfect!
thanks a lot!
The “Open with…” issue can be easily corrected.
The solution can be found on the Microsoft site: http://support.microsoft.com/kb/555067
oh no!If you click “Tools” at the toolbar on any folder, i can’t see the option “Folder options”. i can’t delete DK!!!!!please help me. if you know what to do, please email me. here’s my email address.
joynikz10@yahoo.com
thank you so much!(^_^),V
Joynikz, please see this to show folder options.
http://www.precisesecurity.com/tools-resources/troubleshooting/how-to-enable-a-hidden-folder-options/
Hi everyone!
My USB stick got infected with DiskKnight today, but somehow, when I inserted it (unknowlingly at that time) into my mother’s PC it’s anti virus programm (dunno what she uses) popped up and deleted DiskKnight from that stick. However at that point it had already spread to my computer and my digital camera. Now I think what worked for the stick will work for the camera as well (that is,having my mom’s program deal with it), but that hardly helps with my own computer.
I tried using the guide above (which isn’t easy since my PC is German and the words are all different), but I can’t find the autorin.inf file OR diskknight.exe, even though I did manage to make hidden files visible.
Any ideas what might be the problem?
Thx a lot!
my registry editor has been disabled,
how can i enable it?
Kiko, visit this link:
http://www.precisesecurity.com/tools-resources/troubleshooting/how-to-enable-registry-editor/
To Jeeves…
If your memory stick doesnt work you just have to right click and then click “open” which is further down on your right click list.
Thanks all person made this web. this web help me. again thanks and any help me about safely use my computer.
thanks
Kaisar Hasan
Rangpur
Bangladesh.
I tried to remove the disk knight from my computer but when I go to the Tools I can´t open the option «Options» because It doesn´t exist.
I think the virus removed it from my computer so I can not see the hidden folders.
Can someone help me?
Adriano
Portugal
Hello!
I’ve read most of the replies and it seems that following them the virus has left the bulsing around here… Thank you so much!
Rafael Garcia from Brazil
Obrigado amigos lusitanos, enfim resolvi meu problema!
Diego
São Paulo - Brasil
how i delete diskknight from my mobile phone?
I have had the same problem with disk night untill i installed avast,
and to my suprise it picked it up and deleted it.
i did u r all think those u r wrote on this page but i couldnot removed knight virus in my usb drive & computer what should i do can u give me any instraction for remove knight virus
does disk knight virus affect drive c?
there are several things you need to do to remove disk knight from your c:/ drive. Yes it does infect it. Often diskknight has the adverse affect of stopping you from running exes. This tutorial fixes all of the regkeys that can run into problems because of diskknight:
http://windowsxp.mvps.org/exefile.htm –> THIS IS WHAT THEY MISSED in the original tutorial. Afterwards, look at your C:/ drive, go to folder options in tools and show hidden files and folders AS WELL AS unticking the box hiding system files. The disknight exe is located at C:/Windows/knight.exe . You have to delete this as well, but before you can u must open task manager (ctrl + alt + delete), open the processes tab and end knight.exe . If anyone wants to know how to remove disknight from flashdrive please post comment.
when infected, open task manager and kill Knight from the process.
Update to AVG 8.0 v
Plug your infected USB keeping shift pressed down
scan ur pc, after AVG picks up disk night as a Worm VB.BVK, heal it,
scan all removable pen drives, heal them with AVG,
run regedit, find ‘Knight’ and delete all registry entries made by knight
run msconfig , check if knight is there in the start up list
check USB drives in DOS for knight.exe
Format the usb drives
and thats it.
HELP cause this, disk knight
my usb said, ‘usb not regocnize,one of the usb attacted to computer,malfunction,……..’. it cann’t be open, what can i do to recovered it, that say no driver
when i open in usb root an klick the unknown device , in device status
said that ‘ No drivers are installed for this device.
If you are having problems with this device, click Troubleshoot to start the troubleshooter.’
how can i recover my flash disk (removabel disk)
HELPPPP -> please send to jackdoraemon2000@yahoo.com
case have important data in there.
berfore that, becase the autorun.inf keep showing up with
command to execute knight.exe, i give %%%%/* [autorun] ……(command to execute knight.exe) */%%%
cause i don’t know how to make it don’t work,so i try to use command icon in programming >.
Thanking people whose responsible for site.
How can we follow step in MS DOS? My PC not have Microsoft’s window.
Knight virus kill my stiffy disk, it not work. Please help.
I am at internet cafe and it expensive help quick
Thanking in advanced
Hi confused, This is a common problem that we are experiencing with this kind of virus. To follow are the steps one can use to rid the stiffy of this horrible virus:
1) Insert the stiffy into the drive.
2) Change to the drive where the stiffy is located, usually A:\
3) Type “remove knight.exe from this stiffy”
4) Reboot the computer.
I hope this solves your problem.
Good luck.
Thanking you. My PC say:
“‘REMOVE’ is not recognized as an internal or external command, operable program or batch file.”
Now stiffy work! And stiffy disk size bigger! Advice good!
Thanking precisesecurity, can now store 1.6MB. That lots space!
I not confused any more!
When i go to folder options and check the “SHOW HIDDEN FILES” and uncheck the “HIDE PROTECTED OPERATING SYSTEM FILES”, they go back to “DO NOT SHOW HIDDEN FILES” so i won’t be able to locate the disk knight. How am i going to fix this problem and delete the disk knight for good?
And how can i find the disk knight inside my mobile phone? The phone rejects any installation of any application i want for my phone..