NOD32 did not detect virus, virustotal shows it is a virus.

[hayythere]

Just had a virus infection on my USB disk which then transfered to my PC. NOD32 (Smart Security specifically) did not detect it as a virus. I only noticed it when an unfamiliar exe file wanted internet access.

I then upload the file to virustotal.com and it came back 22 out of 32 virus scanners detected it as a virus.

Kaspersky detected it as Worm.Win32.AutoRun.aw, which is what im using now to scan my computer after the discovery of this virus.

Im surprised (and a bit worried) NOD32 did not detect this virus. :(

[BlueZannetti]

-{ Quote: "Im surprised (and a bit worried) NOD32 did not detect this virus. :(" }-From the name it looks to be potentially a simple autorun file - do you have potentially unsafe applications checked in NOD32 and is it a genuine flag or a "potentially unsafe" type alert? What does the drive autorun.inf file look like?

Blue

[hayythere]

Ive deleted the autorun.ini file, but from what I remember it ran the exe file (named MircSoft.exe) whenever you inserted the USB stick. The exe file was then copied to your system32 folder and tries the access the internet. :-\

[solcroft]

-{ Quote: "From the name it looks to be potentially a simple autorun file - do you have potentially unsafe applications checked in NOD32 and is it a genuine flag or a "potentially unsafe" type alert? What does the drive autorun.inf file look like?

Blue" }-
I believe the specified behavior falls under the the definition of a worm, not a PUA - who would "potentially" want something like this?

[KFBeaker]

-{ Quote: "Ive deleted the autorun.ini file, but from what I remember it ran the exe file (named MircSoft.exe) whenever you inserted the USB stick. The exe file was then copied to your system32 folder and tries the access the internet. :-\" }-

Over the weekend I had this odd thing happening where whenever i plugged in a USB thumb drive, this large dialog box would pop up offering to sync my windows media songs with the USB drive. This even happened on a USB thumb drive which was blank.

Then after a day the phenomenon just stopped.

Does this sound like what you had?
Might I be infected too?

[BlueZannetti]

-{ Quote: "I believe the specified behavior falls under the the definition of a worm, not a PUA - who would "potentially" want something like this?" }-
Well, given the expanded description, probably nobody, but you never know.

Blue

[hayythere]

-{ Quote: "
Does this sound like what you had?
Might I be infected too?" }-

Not really. What I had was totally silent. :blink:

If 22 out of 32 virus scanners on virustotal.com detected it as a virus, im pretty certain it is one.

[Bubba]

-{ Quote: "im pretty certain it is one." }-Chances are real good that you are indeed correct and with this particular malware it is one of those that is heading thru the alphabet double time with only a slight difference with each and every variance. This is where it's important for all users to send a sample to their respective AV's as soon as possible so they can be analyzed and entered if found to be malicious.

Bubba