Kaspersky: Trojan.Win32.AutoRun.atq. Has it been detected on MSE yet?

[cheewongken]

Hey again guys..

This time its a virus problem I'm having. A friend of mine (A) who uses KAV2011 detected this (Trojan.Win32.AutoRun.atq) on his thumbdrive. His thumbdrive was passed to me, which i passed to another friend of mine (B), who passed it back to him.

A uses KAV2011 and no anti-malware and is on 32 bit (OS unknown)
B uses Mcafee (just uninstalled) and MSE and Malwarebytes, on Win 7 x64

I use MSE as my main protection with Malwarebytes and Spybot S&D as scanners while using Win 7 32 bit

I haven't scanned my computer since using the thumbdrive and I plan to do so when i get home tomorrow.

But right now I've spoken to B who've just done a partial scan with Mcafee, full scan with MSE and MBAM, with no results. Definitions were updated.

This is why I was wondering, has the trojan been detected by MSE or MBAM yet?

According to Kaspersky's site, they've detected it since Nov 09 (Trojan.Win32.AutoRun.atq - Securelist)

And as a site note, what does the trojan do to the computer anyway?

Anyway, thanks for all your time.

 

[Jacee]

That drive needs to be disinfected!! http://download.bleepingcomputer.com/sUBs/Flash_Disinfector.exe

*** Note: Be sure to insert your flashdrives before you begin!
Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear.
The utility may ask you to insert your flash drive and/or other removable drives including your mobile phone. Please do so and allow the utility to clean up those drives as well.
Wait until it has finished scanning and then exit the program.
Reboot your computer when done.
Note: Flash_Disinfector will create a hidden folder named autorun.inf in each partition and every USB drive plugged in when you ran it. Don't delete this folder...it will help protect your drives from future infection.

PS ... my antivirus was claiming that a virus wanted access to my computer when I clicked on the disinfector link. It's a direct download, and it's safe!

 

[cheewongken]

The thing is, the thumb's his and his AV managed to remove it successfully? I don't think I need it... All i'm worried about is the uncertainty if I, or B has it since MSE and MBAM had no results on B's computer.

 

[Jacee]

.Win32.AutoRun.atq is Backdoor.SDBot. This means that it is a password stealer, plus the worm provides an attacker remote access to the affected machine, and may also steal sensitive information and initiate Denial of Service attacks.

 

[erica647]

Encyclopedia entry: Trojan:Win32/Autorun - Learn more about malware - Microsoft Malware Protection Center

 

[cheewongken]

Encyclopedia entry: Trojan:Win32/Autorun - Learn more about malware - Microsoft Malware Protection Center

I saw that one already, but the one i posted above seems to be quite new. But guessing from that page, the new atp variant isn't detected yet?

 

[Jacee]

Did you see this? Browse the malware encyclopedia - Learn more about malware - Microsoft Malware Protection Center

 

[cheewongken]

yeah. its not listed.

I still haven't gotten an answer to my main question though..

Has it been detected on MSE?

 

[jimbo45]

Hi there
Since ANY AV software can NEVER be guaranteed to be 100% effective how can you assume that a VIRUS REMOVER is also 100% effective.

Especially for something like a password stealer -- I would have NO hesitation here about either doing a COMPLETE RESTORE of a KNOWN clean system backup or a COMPLETE DISK FORMAT via security erase ( write Binary zeros on every sector --not just the standard format) and then RE-INSTALL WINDOWS.

I certainly would NEVER EVER trust a previously infected computer that hat merely been cleansed by some AV software.

It's moot as to whether its been detected on MSE or not -- if you don't get Viruses in the first place its difficult to find out --

What IS more important is that your computer has been infected and what you should do about it.

Cheers
jimbo

 

[Airbot]

yeah. its not listed.

I still haven't gotten an answer to my main question though..

Has it been detected on MSE?

Only .atq variants listed for MSE are these 3. So sounds like possibly it hasn't yet.

Encyclopedia Search Results: atq - Learn more about malware - Microsoft Malware Protection Center

 

[cheewongken]

Bump.

Btw.. I just wanted to check securelist's listing of the virus again.. but now its gone.. any idea what happened?

Description - Securelist

Thats the link again(same as 1st post)

Could it be that it was a false positive?

 

[cheewongken]

Bump

 

[Jacee]

You can run an online anti-virus scan with Eset, if you're worried.

1. Hold down Control and click on the following link to open ESET OnlineScan in a new window.
   ESET OnlineScan
2. Click the
   
   button.
3. For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
   1. Click on
      
      to download the ESET Smart Installer. Save it to your desktop.
   2. Double click on the
      
      icon on your desktop.
4. Check
   
5. Click the
   
   button.
6. Accept any security warnings from your browser.
7. Check
   
8. Push the Start button.
9. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
10. When the scan completes, push
    
11. Push
    
    , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
12. Push the
    
    button.
13. Push