NOD32 did not detect virus, virustotal shows it is a virus.

[hayythere]

Just had a virus infection on my USB disk which then transfered to my PC. NOD32 (Smart Security specifically) did not detect it as a virus. I only noticed it when an unfamiliar exe file wanted internet access.

I then upload the file to virustotal.com and it came back 22 out of 32 virus scanners detected it as a virus.

Kaspersky detected it as Worm.Win32.AutoRun.aw, which is what im using now to scan my computer after the discovery of this virus.

Im surprised (and a bit worried) NOD32 did not detect this virus.

[BlueZannetti]

Originally Posted by hayythere

Im surprised (and a bit worried) NOD32 did not detect this virus.

From the name it looks to be potentially a simple autorun file - do you have potentially unsafe applications checked in NOD32 and is it a genuine flag or a "potentially unsafe" type alert? What does the drive autorun.inf file look like?

Blue

[hayythere]

Ive deleted the autorun.ini file, but from what I remember it ran the exe file (named MircSoft.exe) whenever you inserted the USB stick. The exe file was then copied to your system32 folder and tries the access the internet.

[solcroft]

Originally Posted by BlueZannetti

From the name it looks to be potentially a simple autorun file - do you have potentially unsafe applications checked in NOD32 and is it a genuine flag or a "potentially unsafe" type alert? What does the drive autorun.inf file look like?

Blue

I believe the specified behavior falls under the the definition of a worm, not a PUA - who would "potentially" want something like this?

[KFBeaker]

Originally Posted by hayythere

Ive deleted the autorun.ini file, but from what I remember it ran the exe file (named MircSoft.exe) whenever you inserted the USB stick. The exe file was then copied to your system32 folder and tries the access the internet.

Over the weekend I had this odd thing happening where whenever i plugged in a USB thumb drive, this large dialog box would pop up offering to sync my windows media songs with the USB drive. This even happened on a USB thumb drive which was blank.

Then after a day the phenomenon just stopped.

Does this sound like what you had?
Might I be infected too?

[BlueZannetti]

Originally Posted by solcroft

I believe the specified behavior falls under the the definition of a worm, not a PUA - who would "potentially" want something like this?

Well, given the expanded description, probably nobody, but you never know.

Blue

[hayythere]

Originally Posted by KFBeaker

Does this sound like what you had?
Might I be infected too?

Not really. What I had was totally silent.

If 22 out of 32 virus scanners on virustotal.com detected it as a virus, im pretty certain it is one.

[Bubba]

Originally Posted by hayythere

im pretty certain it is one.

Chances are real good that you are indeed correct and with this particular malware it is one of those that is heading thru the alphabet double time with only a slight difference with each and every variance. This is where it's important for all users to send a sample to their respective AV's as soon as possible so they can be analyzed and entered if found to be malicious.

Bubba