Fixed: Win32.autorun.avi

tinamay

New member
Ran a scan with version 1.4 before upgrading to 1.5, nothing was found then, but version 1.5 gave a warning about a registry entry " WIN32.AUTORUN.AVI but I can not get anymore information on it . First time I have ever had spybot find anything and not sure how concernd I should be . Is it a threat or just a notice of a change from "normal "
 
UPDATE TO win32.auotrun.avi

Operating system is Windows XP
Browser IE 6.0.290
Spybot version 1.5.2 update 2008-05-07
Date of "false positive" May 11, 2008 result of Scan

Ran a scan with version 1.4 before upgrading to 1.5, nothing was found then, but version 1.5 gave a warning about a registry entry " WIN32.AUTORUN.AVI but I can not get anymore information on it . First time I have ever had spybot find anything and not sure how concernd I should be . Is it a threat or just a notice of a change from "normal
 
hello,

Win32.Autorun.aiv is a trojan horse, if this is found it is not normal.
Please do the following:
  • scan with Spybot S&D
  • right click the scan results screen
  • choose to save a full report to file
  • attach this file to you next post

we will analyse the report file to determine if there are other traces of the trojan horse of if this is a false positve.
 
Win32.Autorun.aiv update with file

I tried to upload the full report but the when I tried to upload it , it said the file size (222Kb) was to big for this forum, so I uploaded the smaller results file. Ran my Adaware (2007) and Norton anti-virus program they don't report this Auto run thing.
 
hello,

the scan results show that a service named wwSecSvc has been flagged as Win32.AutoRun.aiv. Since the targeted associated file was not flagged as well this is most likely a false positive, or at least it does not flag what is supposed to. Unfortunately wwSecSvc can be both legit and malicous. To have a better look at this issue please attach you full report to an email to detections@spybot.info refering this thread.
 
Hello,

we received the mail and could confirm that this is a false positive which occurs with webroots windows washer version 6 . Version 6.5 is not affected.

Corrections have been made and will be effective with the next update scheduled for next Wednesday.
 
Back
Top