Memory Stick Pen Issue

[corolla315]

Hi guys,

I just received a Memory Stick Pen 16GB which I bought on Ebay, and after I plugged it in my USB drive, I copied some files in it just to try it. I then tried to open the pen's folder (drive H:) from My Computer to see my copied files, and all of a sudden, AVG popped up with a Resident Shield Alert saying "THREAT DETECTED - Virus Found VBS/Agent" in the filename "H:\Administrator.vbs". The threat was reported to be "Detected on Open". Then, AVG showed the usual options to either "Remove Threats" or "Ignore". I tried both. At the same time, a Windows Script Host alert also popped up saying "Loading Script H:\Administrator.vbs failed(access is Denied)".

When I tried to "Ignore" the alert from AVG and tried to access the folder again, both AVG and windows kept on giving me the 2 same messages continuously which I mentioned above. On the other hand, whenever I "Removed the Threat to the Virus Vault" and tried to open the memory stick pen folder from My Computer, the message "Can not find script file "H:Administrator.vbs" was reported by Windows Script Host. When I then tried to restore my file from AVG Virus Vault, AVG reported continuously that a Threat was Detected.

However, strangely enough, I managed to access and copy the files on my memory stick by right click on the memory stick folder(drive H: ) and select either Open or Explore. The folder was only reported to be access denied or gave me the problems as described above whenever I double clicked the relevant folder from My Computer. Having said this I still feel that the problem is not solved and I'm very concerned whether it truly contains a virus or not.

Also, it's very important to mention, that when I accessed the folder for the first time, there were no files in it. The file "Administrator.vbs" appeared for the frst time when I first removed it in AVG's virus vault and then restored it. It's now physically there and is a file of 34kb size.

Also, I'd like to mention that about 2 weeks ago I bought a memory stick pen from the same seller with same specs which is 100% identical to this one with no problems at all.

What can I do? Is the threat reported by AVG a false/positive? Is it a real virus?
Do you think that if I format my memory stick pen will solve the problem?

Finally, I'm attaching 2 images showing the different alerts I'm getting all the time which I talked about earlier.

Just to let you know, my system runs on 1.5GB Ram with Windows XP.

Thanks a lot for any kind of help and assistance.

Best Regards,

Corolla315

[recovering disk space -- attachment deleted by admin]

[evilfantasy]

VBS/Agent is a worm that infects flash drives.

Download Flash_Disinfector.exe by sUBs and save it to your desktop:
 

• Double-click Flash_Disinfector.exe to run it.
• Your desktop and icons may disappear. This is normal.
• It will do a cleanup of removable storage devices, and write a protected Autorun.inf file to help prevent re-infection.
  
• Follow any prompts that may appear.
• The utility may ask you to insert your flash drive and/or other removable drives including your mobile phone. Please do so and allow the utility to clean up those drives as well.
• Wait until it has finished scanning and then exit the program.
• There will be no GUI interface or log file produced.
• Reboot your computer when done.

.
 Note: Flash_Disinfector will create a hidden folder named autorun.inf in each partition and every USB drive plugged in when you ran it. Don't delete this folder...it will help protect your drives from future infection.

----------

It is possible that any computer that came in contact with the pen drive is now infected as well. I would suggest running this online scan on any PC that came in contact with the infected drive and post the log. If it is infected we will get it cleaned up.

Use the Kaspersky Online Scanner

In Microsoft Windows Vista, you must open the Web browser using the Run as Administrator command. From the Desktop right click the icon and choose Run as Administrator.

Click on SCAN NOW
Click on the Accept button and install any components it needs.

• The program will install and then begin downloading the latest definition files.
• After the files have been downloaded on the left side of the page in the Scan section select My Computer.
  
• This will start the program and scan your system.
• The scan will take a while, so be patient and let it run.
• Once the scan is complete, click on View scan report
  
• Now, click on the Save Report as button.
  
• In Save as type: click the drop arrow and select: Text file [*.txt]
  
• Then, click: Save
  
• Save the file to your desktop.

.
Post the Kaspersky log in your next reply.

Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.

[corolla315]

Hi Evilfantasy,

Thanks a lot for your reply. Sorry about the late reply but yesterday after I submitted my post I had to sleep as I had a long day ahead today at work and so unfortunaley I hadn't the time yesterday to follow the steps but only today...but anyway... things turned out to be lucky for me...

This morning I took the pen drive at work to try on my machine there and as soon as I plugged the pen drive in the USB drive, Mcafee immediately alerted me too about the threat but with the difference that it was able to disinfect it as well and fortunately my pen drive is now clean and the problem is now solved. I can use it even at home without any problems. The problem is gone.

AVG was able to detect it only and I didn't manage to solve the problem yesterday as I use AVG Free Edition on my home's machine.

Apparently the "good" guy who sold me the pen drive put also this Visual Basic Script file on the pen drive which contained some kind of virus/malware/trojan with the intention maybe to get access to personal data on my PC. The worrying thing is that he's a power seller and he's selling tens of thses pen drives everyday!!



Thanks a lot anyway for your time and assistance.

Best Regards,

Corolla315

[Carbon Dudeoxide]

Glad you managed to managed to remove the script but I strongly suggest you follow Evilfantasy's Suggestion with the Kaspersky Scanner. You will never know what it may pick up.
You can even do it in the background while it's scanning if you want.

[corolla315]

Thanks a lot Carbon,

I'm scanning my system right now with online Kaspersky AV.

I will get back.

Thank you for the advice.

Have agreat day.

Corolla

[Carbon Dudeoxide]

You too.

Don't forget to post back. 

[drmsucks]

Apparently the "good" guy who sold me the pen drive put also this Visual Basic Script file on the pen drive which contained some kind of virus/malware/trojan with the intention maybe to get access to personal data on my PC. The worrying thing is that he's a power seller and he's selling tens of thses pen drives everyday!!

Just to point out the obvious, there is no evidence that your seller infected the drive. The digital picture frame virus from a few months ago wasn't placed there by Best Buy and other sellers of the infected device - it was infected from the manufacturing plant.

Why not email him and let him know what you found with one of the two drives that you bought?