Solved MSE unable to detect infection on an infected usb flash

I just ran a scan of my wife's infected flash (she gave it to a friend at work to copy her movie) using an up-to-date MSE on Win7 Home Premium 64-bit and it DID NOT detect anything at all. When I opened the flash I see duplicates of its original contents that have their icon's edge sort of blurry so I know the infection is still there so I quickly (just pulled it out) unplug it. I ran a full system scan and "...winmaximizer" was detected as a severe threat and fortunately MSE was able to remove it.

now I am afraid to use this flash again since I am sure it is still infected. i've already tried to remove its infection using MSE again on my HP Vista Home Premium 32-bit and got the same result. i will run a full system scan on my vista laptop later BUT please assist on how to detect and remove infection from potentially infected usb flashes.

many thanks in advance.

Hello Zeamann,

You might see if doing a full scan of it and your system, along with any other system it was connected to, with MalwareBytes free may help. However, if there's nothing on the USB flash drive that you must have, formatting it should wipe it clean of malware as well.

Hope this helps,
Shawn

If you have a infected flash drive wipe the drive is the normal thing to do but when you plug it into a computer to wipe it it can infect your computer in micro seconds. My self I would just bite the bullet and throw it away.It's not worth the trouble to wipe the flash drive and repair the computer you plugged it into.
People who put infection on flash drive don't intend to infect flash drives only; they intend to infect the computers they get plugged into. If it was me I would smash the flash drive and throw it away and then run scans on any computer it was plugged into and what ever network the computer was on.

Hi,

Panda will allow you to vacinate your computer prior to plugging in the USB drive. After that, you can use it to vacinate the USB drive to avoid it being infected in the future.

http://www.pandasecurity.com/homeusers/downloads/usbvaccine/

Regards,
Golden

thank you all guys for the help and tips. surprisingly, this morning MSE able to find "trojan:win32/otran" and removed it except several shortcuts of original flash content and a few other alien files so i just deleted them. anyways, does having both MSE free and MalwareBytes free running on 1 PC okay? pls respond on this.

tho my wife and i are happy now, i am still curious as to why MSE couldn't detect any infection yesterday. thank you all again and God Bless,

oh, 1 more thing. i've been scanning/cleaning a lots of my friends usb flashes and mp3 players so i'm kinda familiar with worm/trojan names but this one is really new to me. it is the first time i see "otran"

That's great news Zeamann.

Yes, it's fine to have both MSE and MalwareBytes running at the same time.

There could be a number of reasons why MSE didn't detect it right away. It may not have been included in the MSE definitions until the last update before it was detected, or it just didn't trip any red flags for MSE until then.

thanks a lots again u all and especially you Brink. I will now download MalwareBytes free and have it running on all 6 laptops. thanks again guys and God Bless,

Zeamann.

Malwarebytes is a great program. Keep in mind the free version is a stand alone product. It only runs when you tell it to. You have to tell it to update and scan. It doesn't run in the background protecting your computer like MSE does. In order to get live protection you must update to Malwarebytes Anti Malware Pro. IMHO which ever one you choose Malwarebytes is a great program and has saved many computers.

you are right Layback Bear. comparing it with MSE, MalwareBytes was smoothly installed and updated the first time I ran it on a HP Pavilion p6617 PC two days ago while MSE, I tried to update it for almost 4 days earlier to no avail. It was able to get fully updated only after Malwarebytes had cleaned the PC. Running MSE's full scan after updating did not find anything at all.

I believe MSE and MalwareBytes must be married for better protection. thanks again you all and God Bless,

Zeamann.

Another program I found effective isn't free however except for the 30 day trial. I use this for everything these without the need for several program. When plugging in any flash drive since I two cases full of them you will immediately be prompted to scan the flash drive itself.

Having used first VIPRE Home Premium av now called VIPRE Internet Security 2012 the program's initial scan found trojans hidden inside zip files downloaded supposedly being older XP Utilities that for some reason were never opened. No other program MS Security Essential, AVG, Malwarebytes, Avast, Spyware Terminator, and several others over a several year period ever detected anything!

VIPRE will scan, quaranteen, and have the option to delete any bugs uncovered as well as any new ones you encounter. I used to have to run 3 or 4 programs for what only one does now. I now never have to worry about passing a bug from one machine to the next when going to transfer files. No need to toss flash drives if you find another program that will do the same.

Night Hawk said:

Another program I found effective isn't free however except for the 30 day trial. I use this for everything these without the need for several program. When plugging in any flash drive since I two cases full of them you will immediately be prompted to scan the flash drive itself.

Having used first VIPRE Home Premium av now called VIPRE Internet Security 2012 the program's initial scan found trojans hidden inside zip files downloaded supposedly being older XP Utilities that for some reason were never opened. No other program MS Security Essential, AVG, Malwarebytes, Avast, Spyware Terminator, and several others over a several year period ever detected anything!

VIPRE will scan, quaranteen, and have the option to delete any bugs uncovered as well as any new ones you encounter. I used to have to run 3 or 4 programs for what only one does now. I now never have to worry about passing a bug from one machine to the next when going to transfer files. No need to toss flash drives if you find another program that will do the same.

Click to expand...

i already tried to install vipre on an infected system as a follow-through step provided for by another site which also include fakerean but it never got installed successfully. anyways, thanks a lots for the tip and i'll be testing vipre's effectiveness on one of my 6 laptops. God Bless,

Let us know how things work out with that flash drive cleaning and if your computer gets infected.

zeamann said:

i already tried to install vipre on an infected system as a follow-through step provided for by another site which also include fakerean but it never got installed successfully. anyways, thanks a lots for the tip and i'll be testing vipre's effectiveness on one of my 6 laptops. God Bless,

Click to expand...

Sorry to hear you had problems trying to get it on. But that may have how badly the malware effected the OS side of things!

VIPRE is about the best one going now for detection as well as prevention by detection on malicious coding. I was able to get the trial onto a few fake antispyware program infected machine where it swept all that right off and got each Windows installation up and running again as far as no further traces. Unfortunately the malware had already done other things irreversable.

One other thing to know about VIPRE is you won't even know it's running in the background. It will at times already have quaranteened a malware without being a pain with notifications popping up on you! When going into check the Manage>Quarantine section I discovered it had already contained a bug some site apparently tried to stuff on the machine here.

I saw the program go onto three other machines here once an older XP Desktop and a Vista laptop were cleaned off plus a brand new 7 laptop before it was used for any period of time. Not one problem since on any of them.

We are also using Malwarebytes free in our office and no other anti-virus program. It is totally okay. But if you think you wanted to have a better security, then try installing anti virus or your choice. But its quite expensive though.

It depends on how good the software is to start with. One discouragement I had over 13yrs. ago was when choosing the wrong one! (Not to name McAfee! ha ha)

Over the years I tried out the various shareware downloads as well as free for home versions and always ended up running at least 3 or 4 which at times included things like IE security addons. The AVG toolbar option and later the Crawler Security toolbar for IE are a few examples.

When comparing another program when adding along with AVG I was finding the Spyware Terminator was finding far more data miners and other bugs faster then AVG which seemed to miss the minor ad/spy bots and other things while AVG had sprung to life to flag a bug coming from one bad site and Avast failed! I kept running into the need for those other extra programs to fill in the gaps regardless of which main program I had on!

For the purchase of VIPRE in May 2010 for a two year license some would think the price might be a bit high until finding out what I was seeing here with VIPRE finding what every other program tried out and ran over several years has missed! Cleverly hidden malwares in what was supposed to have been free utility programs for XP!

VIPRE was found to have the highest detection capability. And the reviews generally would be looking mainly at programs that have been on the market longer seeing regular newer versions but not built on an updated platform for an av program.

When looking at a retail purchase rather then going for bust simply grabbing the free version that comes along for an av program this would be something to look for whether it was VIPRE or any other paid for software. In your circumstance there flashdrives you are in an office environment where email scanning/detection of worm types viruses can be accomplished by any of several av and email security programs along with a good firewall.

As for the home user unfortunately the security measures are not always inplace and people get "too comfortable" not even realizing the malwares are out there to be stung by! If you are using rewritable media or other options for transferring data between machines without a means to detect and block any malware being spread then you have to look at what is more costly in the long run. The 1-2yr. typical software license? or the downtime you would find yourself facing in particular if the office machines were infected?!

For the novice home user without experience at removing bugs or even installing an OS where does that leave them? The local pc repair shop might just charge "an arm and a leg"!

Meanwhile there was one other thing I should mention here I had forgotten to mention before about zeamann's trouble when trying to install the main program. You could try running the stand alone VIPRE Rescue Program if you are still stuck with the malware situation there. VIPRE Rescue - VIPRE Computer Recovery Solution from Sunbelt Software

You can download that directly to a flash drive and when running it the tool will create and run out of a temp folder without any new registry values to get Windows back running again. On one machine I had an owner boot up in safe mode long enough to create a desktop shortcut when a virus created a new admin account locking him out.

The VRP took care of the I-Worm infection and gave him a normal desktop again but unfortunately the worm had already done more then first thought. But when seeing Windows running normally again on any other better circumstance then you would run the 30 day in order to see the drive(s) sweeped totally of any traces.

zeamann said:

tho my wife and i are happy now, i am still curious as to why MSE couldn't detect any infection yesterday.

Click to expand...

Hi Zeamann.
It's only my personal experience, but it's been helping me away of viruses trouble for years. Having any antivirus program is totally a must though each of it has its hole.
Aside from that. There are some habit I use to do it just for myself or even help friends. Most viruses in flashdrive try to self load just at the second it plugged in. Some of it even boldly create a fake autorun.inf, fake recycler folder, fake folder-like icon on exe files (to attract us to double click it), etc.

Some friends come to me with totally worst flashdrive, but they beg me to have it recovered as much as possible though it might compromise my PC.

Here are what I usually do:

1. Always have setting which reveal hidden files and folder.
2. Never put files into flashdrive root. (unless it's a flashdrive with special purpose, boot drive, or else)
3. When finished scanning flashdrive with any AV program but still suspect it, I navigate the flashdrive with explorer in a way that always do a click on the left pane of explorer (which only single click needed instead of harmful double click on right pane, it's what viruses want).
4. Delete any any seen shortcuts, any folder named recycler, any unknown exe files, any unknown dll files, any files with no extension but having system icon on it, any unknown autorun.inf (some won't, as it belongs to some AV program). Most of them appear as hidden (or sometimes read only) things.
5. Some viruses hide the real folder by putting permanent hidden attribute to it, but not the files in it. I usually create new folder and move the content from those hidden folder to it, and later return their attribute.

Note: It won't work with infected system

It worth reading I think.

it depends on how good the software is to start with. One discouragement i had over 13yrs. Ago was when choosing the wrong one! (not to name mcafee! Ha ha)

Click to expand...

:d lol

With VIPRE on here more then once it found one bug in a zip and later when simply opening up a folder still seeing a few older XP tools ALERT! Automatic quarantine with the option to delete from computer! When finding out the names and looking them up sure enough every other program for the last 5-6yrs rough estimate had walked right past and never flagged those are malicious.

The more recent if not the latest version of a retail program is most likely to see additional protections like an active shield over the system registry as well as IE protections at least for the premium edition of a particular software. With many older programs that did spot something you often had to go in and manually remove something when a program didn't place a bug in a quarantine virus vault! With the ever increasing number of more involved malwares you want to find a program or two that will cover all bases.