What is a Win32/Agent.ONB Trojan virus?
I Bought a few shuffle style mini MP3 Players and have had the following problems PLEASE HELP!!!When the MP3 Player is plugged into a USB port on our computer, it is
identified by Windows XP home as two devices :- 1) AMT_CDROM , a read only drive 2) MP3_PLAY, a drive which contains mp3 files to be played by the player. The AMT_CDROM drive contains some files which try to run as soon as the player is plugged in using the Windows AUTORUN function. These files are in a chip on the player and cannot be deleted. These files are autorun.inf AMT.sn start.exe The result of this is that Windows tries to run the file "start.exe", and as soon as this happens it is flagged by the anti-virus software (NODS32) as containing the Win32/Agent.ONB Trojan virus There are some references to this virus on the web, but nothing very useful which I have found so far - the following has been translated from Italian on a forum and relates a similar experience. "Hello everyone I have a question to be asked: I bought an mp3 player similar to your shuffle from china 2 gi The problem is that if I connect off with usb cable to PC then turn fits ... you see, it works and everything is ok ... But if the spengo and then riaccendo tells me "device not recognized" and then at the end asks me to reboot the PC. But the main problem is that my view on the PC in addition to "removable disk" also similar to a disc player that if I clicked on from the antivirus (nod 32) recognize a file start.exe. " "G: \ AMT.sn 'cabinet' BackupTool.exe - probably a variant of Win32/PSW.Agent horse tr ** a" the presence of a file infested by trojan. The result is this: "G: \ start.exe - Win32/Agent.ONB horse tr ** a - error while deleting - file is locked - error while deleting - file is locked - error while deleting - file is blocked. " of course I can not remove in any way .... this disc (AMT_CDROM) despite the low level formatting does not delete them ... but still active ... I do is safe to use? You can delete? " I can't find any details on what the virus does, if it really exists, does. Has anyone come across this before ? If there is a virus present, it seems to be encoded into the rom chip on the mp3 player during it's manufacture. I can't imagine the presence of the virus pattern is a coincidence because the function of the start.exe must be fairly simple in this use . Look forward to hearing of any similar incidents or anything else about this one you can tell me. Thanks, |
Re: What is a Win32/Agent.ONB Trojan virus?
Upload start.exe for inspection, and have http://virusscan.jotti.org/ check it out as well. Viruses in MP4 players are not uncommon.
|
| All times are GMT -7. The time now is 1:31 pm. |
Powered by vBulletin® Version 3.8.6
Copyright ©2000 - 2015, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO 3.6.0 RC 2