What threat does Generic!atr pose?

About 6 months ago I got a trojan/worm on my flash drive. I started having problems opening it - I couldn't click on it to open; I had to go through auto play each time. When I plugged my flash drive into my own laptop, Norton Antivirus alerted me that there was a virus on it. I went through the steps to clean it, and even double-checked and went through the system restore files. I never had NAV detect it again, but I kept having trouble opening my flash drive. Eventually my hard drive got old and broke, so I just got a new computer that has McAfee trial software on it instead of NAV. When I plugged in my flash drive McAfee told me that I had Generic!atr and removed it. Now I am able to open my flash drive normally again. So I'm wondering why didn't my NAV clean it like it said it did, why the trojan wasn't detected again, and what harm could it have done these past 6 months? I always kept my NAV updates current. I couldn't even find info on Generic!atr on Symantec's site. Thanks.

The trhreat is low for such worms.

All it done is to copy some lines in JavaScript in autorun.inf folder located on the flash drive.
This info then copy onto your hard drive and execute everytime you access your flash drive.

Windows by default has autorun option enable, so they read automatically any flash drive, CD/DVD disk etc.BY READING INFO containing in AUTORUN.INF file.

When this file changed by a worm, swindows execute this worm first when you put a CD/DVD disk, or a flash drive,before read any other info and that makes the autostart of a CD/DVD or flash drive hard.

a typical autorun.inf file contain this:

[autorun]
open=setup.exe
icon=setup.exe,0
so windows run automatically setup.exe located on a CD/DVD,

OR

[autorun]
open=explorer.exe
so windows will open explorer to see the files from a disk or FLASH Drive.

If this change to something like:

[autorun]
open=worm.exe
shell/execute=worm.exe
open=setup.exe
icon=setup.exe,0

then wormexecuted before other info, and that has as a result you can't access disk properly.

Antivirus companies called it generic!atr worm, cause it's a worm with generic attributes, and threat of this worm is LOW. You just can't access your drive properly.

NAV found this threat and probably delete it and DISABLE AUTORUN from Windows. So Autorun.inf files couldn't be a threat and you could see contains of a flash drive properly.

When you got your new PC, AUTORUN option was ENABLE by default, again windows read the autorun.inf file from your flash drive, and that made acces to the drive difficult.

Ofcource AUTORUN.INF FILE can contain more commands than the simple examble I gave you above,(write something to registry, execute a program etc. so worm can cause more damage.

A general protection is to disable WINDOWS AUTORUN OPTION.

See here how to disable it in VISTA:l

http://forums.pcw.co.uk/thread.jspa?thre...

For windows XP see here:

http://www.pcdoctor-guide.com/wordpress/...

Another way, if you want AUTORUN OPTION ENABLE, is to :
START/SEARCH search for autorun.inf files, open each one with notepad and delete from there any line such :

"open=worm.exe
shell/execute=worm.exe" or simillar, when "worm.exe" is a name you don't know.

Best of Luck