Thank you for the follow-up reply. I now have some more information:
The USB stick is a Kingston USB data-traveller
It was purchased in India
I myself took it out of the packaging (ie. it was BRAND new)
Then I put it in my computer and the grey box came up
It was then put into a Window$ XP computer after mine with Panda. Panda removed the file and now the only files left in the root directory are listed below (with their contents).
Right, that looks bad for users if a sealed stick is infected before you get it, though this has happened before with some hard disks infected at factory level.
So it pays to be on your toes, the first time you plug in a USB be that new or from another source, friend, etc.
Delete the autorun.inf on the root folder, do a search for VirusCleaner.vbe, if found:
Send the sample to virus@avast.com zipped and password protected with the password in email body, a link to this topic might help and false positive/undetected malware in the subject.
Or you can also add the file to the User Files (File, Add) section of the avast chest (if it isn’t already there) where it can do no harm and send it from there. A copy of the file/s will remain in the original location, so you will need to take further action and can remove/rename that.
Send it from the User Files section of the chest (select the file, right click, email to Alwil Software). It will be uploaded (not actually emailed) to avast when the next avast auto (or manual) update is done.
Submit to virustotal and report findings.
Don’t worry about wscript.exe that is a legit windows scripting function required to run the viruscleaner.vbe to start the ball rolling. The file viruscleaner.vbe by its name alone I suspect will have been a fake security alerts style rogue program. So if you aren’t getting any rogue alerts, which I doubt you are, it looks like it didn’t get established.
Again my sincere thanks for your time and support. I agree completely with your comments regarding my stupidity in letting my guard down. Stress and fatigue are no excuse. I will take heed of them for the future.
I have done a search for viruscleaner.vbe on my Windows XP SP3 system. It returned no matches. I selected ‘show hidden files and folders’ and deselected ‘hide protected operating system files’ in Windows Explorer.
Moreover I selected ‘search system folders’, ‘search hidden files and folders’ and ‘search subfolders’ under Windows search function.
I repeated the same procedure for ‘autorun’ and found only the following files (contents are listed below):
C:\Program Files\HP\Digital Imaging{4…E}\AUTORUN.INF
[content to long to post here - so here are the first few lines]
[autorun]
open=setup.exe
icon=setup.exe,0
[Version]
C:\Program Files\HP\Digital Imaging{5…5}\AUTORUN.INF
[content to long to post here - so here are the first few lines]
[autorun]
open=setup.exe
icon=setup.exe,0
[Version]
I have submitted the above files to virustotal.com and they all come back with no finding.
You are correct in that I am not getting any rogue alerts.
Has my system been compromised though? Is my system still compromised? Should I run the battery of tests again to double-check? Is there anything else I can do?
Thanks again for the help. I really appreciate it.
The autorun.inf files you listed all look legit, commonly they in image/restore or tools folders. So I’m not too surprised nothing was found.
The main area of concern would be if the autorun.inf file were in a root/partition folder, e.g. c:, d:\ or any other partitions you might have on your hard disk as these would be likely to auto run when you access that drive/partition.
To avoid the potential in the future you should run this tool on your hard disk, and then for all your USB sticks to prevent future infection.
Flash Drive Disinfector
Download Flash_Disinfector.exe by sUBs from >here< and save it to your desktop.
[*] Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear.[*] The utility may ask you to insert your flash drive and/or other removable drives including your mobile phone. Please do so and allow the utility to clean up those drives as well.[*] Wait until it has finished scanning and then exit the program.[*] Reboot your computer when done. Note: Flash_Disinfector will create a hidden folder named autorun.inf in each partition and every USB drive plugged in when you ran it. Don’t delete this folder…it will help protect your drives from future infection.
That sounds like a reasonable and appropriate strategy. I agree I have exhausted the arsenal of scanners which could have detected anything!
Personally I do not hold the more commercial programs like Norton and McAfee in high regard at all. The only reason I used Panda’s online scanner was that it detected something on the other computer.
Feel a little better know that a guru has judged my system to be clean to a high probability!!
Thank you for your patience, wise words and prompt advice. I hope you win the lottery or something this week.
There other on-line scanners that don’t deposit rubbish in the system folders.
RejZoR’s Website - Security Ops
On-line Virus Scanners and other useful Links Security-Ops.eu.tt.
But I think you only will establish the fact that your computer is clean and what you downloaded were the normal install routines for a pendrive that was ready for its initial install,
Take care and stay malware free and secure online, is the wish and command of,
