NOD32 did not detect virus, virustotal shows it is a virus.

Discussion in 'ESET Smart Security' started by hayythere, Nov 12, 2007.

Thread Status:
Not open for further replies.
  1. hayythere

    hayythere Registered Member

    Joined:
    Nov 12, 2007
    Posts:
    3
    Just had a virus infection on my USB disk which then transfered to my PC. NOD32 (Smart Security specifically) did not detect it as a virus. I only noticed it when an unfamiliar exe file wanted internet access.

    I then upload the file to virustotal.com and it came back 22 out of 32 virus scanners detected it as a virus.

    Kaspersky detected it as Worm.Win32.AutoRun.aw, which is what im using now to scan my computer after the discovery of this virus.

    Im surprised (and a bit worried) NOD32 did not detect this virus. :(
     
  2. BlueZannetti

    BlueZannetti Administrator

    Joined:
    Oct 19, 2003
    Posts:
    6,590
    From the name it looks to be potentially a simple autorun file - do you have potentially unsafe applications checked in NOD32 and is it a genuine flag or a "potentially unsafe" type alert? What does the drive autorun.inf file look like?

    Blue
     
  3. hayythere

    hayythere Registered Member

    Joined:
    Nov 12, 2007
    Posts:
    3
    Ive deleted the autorun.ini file, but from what I remember it ran the exe file (named MircSoft.exe) whenever you inserted the USB stick. The exe file was then copied to your system32 folder and tries the access the internet. :doubt:
     
  4. solcroft

    solcroft Registered Member

    Joined:
    Jun 1, 2006
    Posts:
    1,639
    I believe the specified behavior falls under the the definition of a worm, not a PUA - who would "potentially" want something like this?
     
  5. KFBeaker

    KFBeaker Registered Member

    Joined:
    Nov 9, 2007
    Posts:
    33
    Over the weekend I had this odd thing happening where whenever i plugged in a USB thumb drive, this large dialog box would pop up offering to sync my windows media songs with the USB drive. This even happened on a USB thumb drive which was blank.

    Then after a day the phenomenon just stopped.

    Does this sound like what you had?
    Might I be infected too?
     
  6. BlueZannetti

    BlueZannetti Administrator

    Joined:
    Oct 19, 2003
    Posts:
    6,590
    Well, given the expanded description, probably nobody, but you never know.

    Blue
     
  7. hayythere

    hayythere Registered Member

    Joined:
    Nov 12, 2007
    Posts:
    3
    Not really. What I had was totally silent. :blink:

    If 22 out of 32 virus scanners on virustotal.com detected it as a virus, im pretty certain it is one.
     
  8. Bubba

    Bubba Updates Team

    Joined:
    Apr 15, 2002
    Posts:
    11,271
    Chances are real good that you are indeed correct and with this particular malware it is one of those that is heading thru the alphabet double time with only a slight difference with each and every variance. This is where it's important for all users to send a sample to their respective AV's as soon as possible so they can be analyzed and entered if found to be malicious.

    Bubba
     
Thread Status:
Not open for further replies.