eScan - Antivirus & Content Security Forum

Dear Sir,

I am facing some strange problem. Whenever I am attaching the pen drive in computer escan found some viruses and clean some files. It also renaming some files. After that when i double click the pen drive it not opened. I have scanned the pen drive with Quick Scan command.

After scanning it shows fujeck virus.
below is the log list of mwav:-

Sat Jun 07 19:11:22 2008 => ***** Scanning Drive H:\ *****
Sat Jun 07 19:11:22 2008 => [Scanning Folder: H:\]

Sat Jun 07 19:11:22 2008 => [Scanning Folder: H:\RECYCLER]

Sat Jun 07 19:11:22 2008 => [Scanning Folder: H:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013]
Sat Jun 07 19:11:22 2008 => Scanning File H:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\Desktop.ini (????)
Sat Jun 07 19:11:22 2008 => Scanning File H:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\sys32.exe (????)
Sat Jun 07 19:11:22 2008 => Scanning File H:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\S-1-5-21-1482476501-1644491937-682003330-1013.exe (????)
Sat Jun 07 19:11:23 2008 => H:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\S-1-5-21-1482476501-1644491937-682003330-1013.exe possibly infected and removed by background antivirus package!
Sat Jun 07 19:11:23 2008 => File H:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\S-1-5-21-1482476501-1644491937-682003330-1013.exe tagged as "IM-Worm.Win32.VB.as". Action Taken: File Deleted.

Sat Jun 07 19:11:23 2008 => Scanning File H:\RECYCLER\desktop.ini (????)
Sat Jun 07 19:11:24 2008 => File H:\RECYCLER\desktop.ini infected by "VB.CO.Leftover" Virus! Action Taken: File Deleted.

Sat Jun 07 19:11:24 2008 => H:\RECYCLER\INFO.exe.mwt File already Scanned once... not able to clean.
Sat Jun 07 19:11:24 2008 => Scanning File H:\RECYCLER\INFO.exe.mwt [**]
Sat Jun 07 19:11:24 2008 => Scanning File H:\RECYCLER\INFO.exe (????)
Sat Jun 07 19:11:25 2008 => H:\RECYCLER\INFO.exe possibly infected and removed by background antivirus package!
Sat Jun 07 19:11:25 2008 => File H:\RECYCLER\INFO.exe infected by "Virus.Win32.Small.r" Virus! Action Taken: File Renamed.

Sat Jun 07 19:11:25 2008 => Scanning File H:\RECYCLER\RECYCLER.exe (????)
Sat Jun 07 19:11:26 2008 => H:\RECYCLER\RECYCLER.exe possibly infected and removed by background antivirus package!
Sat Jun 07 19:11:26 2008 => File H:\RECYCLER\RECYCLER.exe tagged as "IM-Worm.Win32.VB.as". Action Taken: File Deleted.

Sat Jun 07 19:11:26 2008 => Scanning File H:\Billing.rar
Sat Jun 07 19:11:26 2008 => ERROR!!! ScanFile fails for H:\Billing.rar
Sat Jun 07 19:11:26 2008 => Scanning File H:\data.bak [**]
Sat Jun 07 19:11:26 2008 => Scanning File H:\prjConstruction030608.rar
Sat Jun 07 19:11:27 2008 => ERROR!!! ScanFile fails for H:\prjConstruction030608.rar
Sat Jun 07 19:11:27 2008 => Scanning File H:\wrar362.exe (????)
Sat Jun 07 19:11:28 2008 => *** File H:\vimmi.zip having Size Restriction ***. Filesize 29366 kb > 3072 kb...
Sat Jun 07 19:11:28 2008 => Scanning File H:\vimmi.zip [**]
Sat Jun 07 19:11:28 2008 => Scanning File H:\prjConstruction.rar
Sat Jun 07 19:11:28 2008 => ERROR!!! ScanFile fails for H:\prjConstruction.rar
Sat Jun 07 19:11:28 2008 => H:\RavMon.exe.mwt File already Scanned once... not able to clean.
Sat Jun 07 19:11:28 2008 => Scanning File H:\RavMon.exe.mwt [**]
Sat Jun 07 19:11:28 2008 => Scanning File H:\prjConstructionVV.rar
Sat Jun 07 19:11:28 2008 => ERROR!!! ScanFile fails for H:\prjConstructionVV.rar
Sat Jun 07 19:11:28 2008 => Scanning File H:\RavMon.exe (????)
Sat Jun 07 19:11:29 2008 => H:\RavMon.exe possibly infected and removed by background antivirus package!
Sat Jun 07 19:11:29 2008 => File H:\RavMon.exe infected by "Virus.Win32.AutoRun.df" Virus! Action Taken: File Renamed.

Sat Jun 07 19:11:29 2008 => Scanning File H:\prjCons.rar
Sat Jun 07 19:11:29 2008 => ERROR!!! ScanFile fails for H:\prjCons.rar
Sat Jun 07 19:11:29 2008 => Scanning File H:\MS32DLL.dll.vbs (????)
Sat Jun 07 19:11:30 2008 => H:\MS32DLL.dll.vbs possibly infected and removed by background antivirus package!
Sat Jun 07 19:11:30 2008 => File H:\MS32DLL.dll.vbs infected by "Worm.VBS.Solow.b" Virus! Action Taken: File Deleted.

Sat Jun 07 19:11:30 2008 => Scanning File H:\AutoRun.inf (????)
Sat Jun 07 19:11:30 2008 => Scanning File H:\AnandRathi.doc

Could you kindly check the system log in Event viewer and see if there is any error message.

No Sir, There is no error message. The pen drive icon chnaged to folder icon in explorer window.

Is the icon the same even if the pen drive is plugged in a different system.

No. for first time it is not. But when i attach this to my PC and then move to another PC then USB icon become folder icon

I kindly request you to scan the Machine with our latest MWAV and send the pinfect and the debug file to samles@mwti.net .