Not disinfecting Worm.Win32.AutoIt.u

One of our Laptops was infected by a virus from USB pen drive

There is an exe running called KHATARNAK.exe. The Virus signature shows as Worm.Win32.AutoIt.u

The registry editor is disabled,
Internet explorer & firefox browsers infected with messages,
Folder options from Windows explorer disabled
Task Manager is disabled

A whole lot of exes are created: eg
Songs.exe, New Folder.exe, Jokes.exe, Files.exe, Program Files.exe, windows.exe, etc


NOD32 tried to quarantine the exe, but failed to detect & remove the virus.


We uninstalled NOD32 & installed Kaspersky which immediately detected the virus & removed it.

 

Refer these pictures of Kaspersky Scan result


http://img.photobucket.com/albums/v663/eapen/tech/KasperskyDetected.jpg


http://img.photobucket.com/albums/v663/eapen/tech/KasperskyDeleted.jpg


Kaspersky detects changes to registry & gives warnings whether to allow or deny the changes

 

The point is the trojan is detected. It sounds like you managed to run it before NOD32 quarantined it (e.g. you installed NOD32 after your computer got infected, or you hadn't kept the signature database up to date, or had the real-time protection disabled).

I don't think there is an antivirus that reverses registry changes as it might reverse changes intentionally made by an administrator. There are hints on the web as how to enable certain system features in the registry.

 

Kav/Kis alert you (if you set it) of any change in the registry an ask for your permision to allow it or not.

 

I think that's because of KAV's PDM (behavioral heuristic? or HIPS?).

thanatos

 

you know the drill, reboot into safe mode and run NOD32

 

We have a 100 user license bought 1 1/2 years back when NOD32 was becoming popular. We switched from Norman which we having for 4 years to NOD32

The Laptop was a fresh Windows XP install (one month back since Hard disk was replaced) with NOD32 v3 regularly updated from local Anti-virus update Server.


Real-time protection was enabled. Meaning NOD32 was installed & configured prior to the system getting infected.

The user had administrative privileges.

NOD32, 'I repeat' failed to disinfect the Laptop. It tries to quarantine the exes created like songs.exe, new folder.exe, etc but again the exes are created, failing to remove the root infection.


After searching the internet for good Anti-virus', Kaspersky caught my attention for high detection & disinfection rates. So I thought I will give it a try.

Kaspersky was installed after the system was infected by uninstalling NOD32.


Kaspersky 'I repeat' disinfected the system even after installing after the Laptop was infected.


Yes I am know of editing the registry & modifying through scripts. Also using 'Group Policy Editor' gpedit.msc - but would be tedious job editing infected systems. For the above mentioned laptop, Kaspersky only removed the infection. I enabled 'folder options', task Manager through group policy settings


Joseph Eapen

 

Yes I am thorough with the drill, maintaining both Windows & Linux systems for 10 years.

Let me repeat, even in Windows 'safe mode' NOD32 DOES NOT remove the root infection. The exes appear back after the Laptop is re-booted !


So how many times should I go through the drill again Sargent ?

 

it remind me a day when i was infected by this trojan
this trojan only came using usb flash drives