New virus? (attached to this message)

Viruses and worms
1

I’ve got Avast Home installed on my PC and it has just removed a worm called Win32:confi
I’ve noticed that on my usb pendrive there is an “autorun.inf” which isn’t a text file (and is also hidden and with ntfs permissions that deny access to everyone)
But Avast doesn’t recognize this file as a virus (my VPS is version 090524-0)

I had to reset ntfs permissions on the root folder of my pendrive (propagating to child objects), then removed hidden and readonly attributes and finally i could remove the file.

The file is attached

Hope this will be of some help

Apo

2

Sorry if the forum isn’t the right place to post this type of messages, but i checked the website (italian version) and found nothing about reporting a possible virus

Apo

3

Please remove attachment so that anyone will not accidentally click on it.

Download and Run Flash Disinfector

* Please download [url=http://download.bleepingcomputer.com//sUBs/Flash_Disinfector.exe]Flash_Disinfector.exe[/url] by sUBs and save it to your desktop.
* Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear.
  Note: Some security programs will flag Flash_Disinfector as being some sort of malware, you can safely ignore these warnings
* The utility may ask you to insert your flash drive and/or other removable drives including your mobile phone. Please do so and allow the utility to clean up those drives as well.
* Wait until it has finished scanning and then exit the program.
* Reboot your computer when done.
4

you should apply all windows updates… the autoruns related to Win32:Confi are padded with a lot of binary garbage, so they seem to be not a valid text, but they are (after the normalisation)… they are unicode, as far as i know… i’ll forward the sample to someone, who will take a look…

5

Info about the Win32 Confi Virus…

http://www.avast.com/eng/win32-confi.html

Just click the link and it should be ur path to victory over the malware^^

Hope this helps^^

And about the autorun thingy, follow Jtaylor83’s post^^also dnt forget the advice of maxxx^^

-AnimeLover^^