Wormbot on my flashdrive?

Elaine Margarett

High and Dry
Super Member
Registered
Joined
Jun 24, 2007
Messages
1,718
Reaction score
282
Location
chasing windmills
Hi,

I'm getting a message from Mcafee (even though it's expired) when I plug my flashdrive into my laptop. It says that it has identified and isolated a wormbot. I don't get this message when I use the flash on my desktop.

Is it even possible to have a virus/bot on a flashdrive? It's my writing flashdrive so I use it frequently to back up and transfer files between my two computers.

Thanks!
EM
 
Last edited:

Elaine Margarett

High and Dry
Super Member
Registered
Joined
Jun 24, 2007
Messages
1,718
Reaction score
282
Location
chasing windmills
<<<Yes its possible and embedded in something you down loaded... >>>

So...does this mean I need to get rid of the flashdrive?


<<<Check it out with something else>>>

Checking it out withsomething else...does this mean plug it in elsewhere and see if I get the message I see on my laptop? If I do this, am I running the risk I could be contaminating someone else's computer?

I'm in the midst of submitting...Could I be spreading a virus unknownlingly? How do I get rid of it at this point? Since I use this flash on other devices am I contaminating all my files? Some? How can I tell?

BTW, Matera, I spent a year or so on the thumb. Loved it!
 

BigWords

Geekzilla
Super Member
Registered
Joined
May 22, 2009
Messages
10,670
Reaction score
2,360
Location
inside the machine
So...does this mean I need to get rid of the flashdrive?

One step at a time. Don't do anything rash.

Checking it out withsomething else...does this mean plug it in elsewhere and see if I get the message I see on my laptop?

Use another antivirus program to identify the exact problem. There are a number of free ones (some better than others), just make sure you aren't running two at the same time.
 

thothguard51

A Gentleman of a refined age...
Super Member
Registered
Joined
Oct 16, 2009
Messages
9,316
Reaction score
1,065
Age
75
Location
Out side the beltway...
Elaine,

What active security system do you use? Surfing the net without an active system is very dangerous...

Any active system should be able to identify and isolate the worm and then get rid of it...
 

peace

&#8195;
Super Member
Registered
Joined
Nov 11, 2011
Messages
63
Reaction score
5
Hi Elaine -- which wormbot is it? Once we know that, we can help with removal and determining how it spreads
 

Elaine Margarett

High and Dry
Super Member
Registered
Joined
Jun 24, 2007
Messages
1,718
Reaction score
282
Location
chasing windmills
Hi Elaine -- which wormbot is it? Once we know that, we can help with removal and determining how it spreads

I just now put my flashdrive in my laptop to see, and the window from McAfee didn't appear. Twice, when I plugged in my drive on my laptop I got the McAfee warning box. If I remember correctly it called it a wormbot 32 and then a bunch of letters and numbers. McAfee said it eliminated it, yet I rec'd the same message the second time I plugged in, so I was concerned.

Could I be unknowingly passing it along? I have a few fulls out that I sent as attachments. Also some partials pasted into the body of an email. Is it possible my submissions would get eaten by a virus blocker? I haven't heard back from the agents I submitted to, but it is early.<g>
 

Elaine Margarett

High and Dry
Super Member
Registered
Joined
Jun 24, 2007
Messages
1,718
Reaction score
282
Location
chasing windmills
Elaine,

What active security system do you use? Surfing the net without an active system is very dangerous...

Any active system should be able to identify and isolate the worm and then get rid of it...

Arrghh, I know I'm tempting fate. :-(

I had McAfee on both computers but I've let it laspe. I'm on dialup and can't support any of the updates because they take so long to load. When I wanted to renew, it was over the net and I knew it'd get frustrated with downloading it.
I don't download anything, ever. However, I know my kids sometimes do on the desktop; everything takes so long it's a lesson in patience.

It didn't use to be so bad, but as technology has advanced it's made it more difficult to utilize it with dialup.
 

Torgo

Formerly Phantom of Krankor.
Kind Benefactor
Super Member
Registered
Joined
Apr 7, 2005
Messages
7,632
Reaction score
1,204
Location
London, UK
Website
torgoblog.blogspot.com
I just now put my flashdrive in my laptop to see, and the window from McAfee didn't appear. Twice, when I plugged in my drive on my laptop I got the McAfee warning box. If I remember correctly it called it a wormbot 32 and then a bunch of letters and numbers. McAfee said it eliminated it, yet I rec'd the same message the second time I plugged in, so I was concerned.

Could I be unknowingly passing it along? I have a few fulls out that I sent as attachments. Also some partials pasted into the body of an email. Is it possible my submissions would get eaten by a virus blocker? I haven't heard back from the agents I submitted to, but it is early.<g>

Flash drives are pretty nasty as malware vectors because a lot of systems are (or at least used to be) set to just AutoPlay anything that you plug in to them - CDs, USB sticks, etc. It's possible your laptop has Autoplay disabled, so the malware isn't trying to execute, I guess. It's also possible it's a false positive, or that the AV on the laptop just isn't any good, or that the AV on the desktop isn't actually cleaning the file. It's hard to tell.

If you're infected, you could be passing it along in any number of ways. First thing would be, don't plug that flash stick into anything else until you know it's clean. I would suggest downloading Malwarebytes Anti-Malware and using that to scan both computers. I'd also bin McAfee and replace with something free and reasonably good (Microsoft Security Essentials seems pretty OK.)

See if you can get a note or a screen shot of the virus warning next time? If you hit the Print Screen button (top row of your keyboard, next to F12) that will stick a screen shot in your clipboard - you can paste it into an email or a Word doc in the usual way.
 

Elaine Margarett

High and Dry
Super Member
Registered
Joined
Jun 24, 2007
Messages
1,718
Reaction score
282
Location
chasing windmills
Okay, I uploaded the Malwarebytes free upload. It only took 30 minutes! (I'm not being sarcastic; that's fast for dialup.) When I ran the scan it showed 28 affected/infected files; mostly adware. Two files had the wormbot and two files were something else (I'd have to check the log for the name).

While not everything was removed, those that weren't, were quarentined. I left my flashdrive plugged in during the scan and selected from the options to have my C, D and E drives scanned.

Computer seems to be running much better! So...am I good to go?

And if I was sending stuff out to agents with these affected files would virus/adware blockers on their end eliminate my emails before they could reach their destination?

Thanks! I'm so glad I found AW all those years ago, and by extention, all of you. Yay!