Where Did My Virus Come From?

[markg]

I am wondering where i picked up my latest two viruses from.

I installed Easy CD extractor from a friend over a year ago, and virus checked the zipped up files before installation. (It was clear). I have used CD extractor on and off with no problems for over a year.

My up to date AVG anti virus software has never picked up a virus in its daily scans.

Then suddenly today, it picks up two viruses. One is a trojan horse called 'burnrights.exe' located within Easy CD extractor, and another one was another trojan, with lots of random characters for its name.

So where have they come from? I use Zone Alarm Pro as a firewall, and i scan using AVG pretty regularly.

Is it a case of AVG finding an innocuous file and 'claiming' that it is a virus to show what a good job its doing?

Or has one really slipped in under the radar?

I'm using Win XP with the latest service pack and i use broadband internet with a modem/router.

[Guest Reimar]

May you get it with some CD or at the time you copy a CD with your computer. Some of the Game CD copies "flying" around here are infected with this Trojan you mention and an Internet Cafe in our Mobaan was just infected a few days ago and have to format and reinstall all computer! But I don't remember which Game was ist.

[markg]

May you get it with some CD or at the time you copy a CD with your computer. Some of the Game CD copies "flying" around here are infected with this Trojan you mention and an Internet Cafe in our Mobaan was just infected a few days ago and have to format and reinstall all computer! But I don't remember which Game was ist.

I had my suspicions about the install files which is why i scanned them before installing. Actually, i scan anything before installing.

Anyway, its been working for over a year until this morning when AVG picks up that there is a virus.

I just cant understand where its come from.

[doctormann]

I've had exactly the same thing with burnrights.exe being picked up by AVG. It happened after I 'backed up' a music CD for a friend. If there was a virus on the CD it was not detected by AVG - I did check. The 'backup' copy is apparently virus-free as well.

I had been using Easy CD Extractor 10 to do the 'backup', as I have done on many occasions before with no trouble. AVG stuck the infected file in its vault but didn't seem able to repair it. I uninstalled ECDE 10 and tried to re-install (cleaned the registry before re-installation) but the same virus warning kept popping up and the installation aborted itself. I gave up and installed ECDE 9 instead. No problems.

I have subsequently done complete system scans using AVG, Spybot S&D and Adaware Pro (all in safe mode with System Restore turned off). Nothing found and the Hijack This log doesn't show anything untoward either. I think that the system is probably clean.

Interestingly, there is little mention of burnrights.exe on the www and what there is is not in English. Nothing on the AVG site either when I looked (2 weeks ago). Doesn't seem to be a widespread problem, if indeed it isn't just a false positive.

DM

I am wondering where i picked up my latest two viruses from.

I installed Easy CD extractor from a friend over a year ago, and virus checked the zipped up files before installation. (It was clear). I have used CD extractor on and off with no problems for over a year.

My up to date AVG anti virus software has never picked up a virus in its daily scans.

Then suddenly today, it picks up two viruses. One is a trojan horse called 'burnrights.exe' located within Easy CD extractor, and another one was another trojan, with lots of random characters for its name.

So where have they come from? I use Zone Alarm Pro as a firewall, and i scan using AVG pretty regularly.

Is it a case of AVG finding an innocuous file and 'claiming' that it is a virus to show what a good job its doing?

Or has one really slipped in under the radar?

I'm using Win XP with the latest service pack and i use broadband internet with a modem/router.

[Priceless]

I just googled burnrights.exe and got 324 hits. It is apparently a legitimate software, produced by a company called Poikosoft. Probably what you've got is a false positive. By the way, a lot of the hits I got were in English, from zdnet and others, so I don't quite understand the last paragraph of doctormann's post.

Priceless

[doctormann]

Well, if you use 'burnrights.exe + trojan' as your search string you will get all of 6 hits!

Point taken but I was assuming that I was searching for info. on a Trojan and, as I said, very little info. out there on that one. Nice to know that it almost certainly was a false positive though - also explains why AVG could not repair it.

DM

I just googled burnrights.exe and got 324 hits. It is apparently a legitimate software, produced by a company called Poikosoft. Probably what you've got is a false positive. By the way, a lot of the hits I got were in English, from zdnet and others, so I don't quite understand the last paragraph of doctormann's post.

Priceless

[onethailand]

There's a pretty high likelihood that AVG has just recently classified burnrights.exe as a trojan, which would explain it only popping up recently. More than likely Easy Cd Extractor has some sort of auto-update feature which sends information back to the site - and this is what would cause the problem.

Not technically a false-positive - but probably something I wouldn't be too concerned about if Googling doesn't provide any bad information.

[marcus]

I installed Easy CD extractor from a friend over a year ago, and virus checked the zipped up files before installation. (It was clear). I have used CD extractor on and off with no problems for over a year.

In one way you can compare a computer virus with a human virus : it infects something. If you have a virus in, let's say your lungs, it doesn't mean that you were born with bad lungs... The virus came afterwards. It is the same with a computer virus, it nestles in a trusted program. in your case Easy CD Extractor.

It's almost impossible to determine where it comes from, but probably you just downloaded it. Virus scanners are not perfect - every day new viruses are discovered, and their "virus database" can never be 100 % up to date, that's why they report many false positives. If they "see" something which behaves itself the way a virus might do, they will report.

[markg]

It's almost impossible to determine where it comes from, but probably you just downloaded it. Virus scanners are not perfect - every day new viruses are discovered, and their "virus database" can never be 100 % up to date, that's why they report many false positives. If they "see" something which behaves itself the way a virus might do, they will report.

Thanks guys. Things are making a bit more sense now.

AVG has virus vaulted 'burnrights.exe' so if i do need it again i guess i can get it back.