NOD32 did not detect virus, virustotal shows it is a virus.

Just had a virus infection on my USB disk which then transfered to my PC. NOD32 (Smart Security specifically) did not detect it as a virus. I only noticed it when an unfamiliar exe file wanted internet access.

I then upload the file to virustotal.com and it came back 22 out of 32 virus scanners detected it as a virus.

Kaspersky detected it as Worm.Win32.AutoRun.aw, which is what im using now to scan my computer after the discovery of this virus.

Im surprised (and a bit worried) NOD32 did not detect this virus.

 

From the name it looks to be potentially a simple autorun file - do you have potentially unsafe applications checked in NOD32 and is it a genuine flag or a "potentially unsafe" type alert? What does the drive autorun.inf file look like?

Blue

 

Ive deleted the autorun.ini file, but from what I remember it ran the exe file (named MircSoft.exe) whenever you inserted the USB stick. The exe file was then copied to your system32 folder and tries the access the internet.

 

I believe the specified behavior falls under the the definition of a worm, not a PUA - who would "potentially" want something like this?

 

Over the weekend I had this odd thing happening where whenever i plugged in a USB thumb drive, this large dialog box would pop up offering to sync my windows media songs with the USB drive. This even happened on a USB thumb drive which was blank.

Then after a day the phenomenon just stopped.

Does this sound like what you had?
Might I be infected too?

 

Well, given the expanded description, probably nobody, but you never know.

Blue

 

Not really. What I had was totally silent.

If 22 out of 32 virus scanners on virustotal.com detected it as a virus, im pretty certain it is one.

 

Chances are real good that you are indeed correct and with this particular malware it is one of those that is heading thru the alphabet double time with only a slight difference with each and every variance. This is where it's important for all users to send a sample to their respective AV's as soon as possible so they can be analyzed and entered if found to be malicious.

Bubba