Worm in phone tools?

I just bought phone tools v. 5.0 to use with my Razr v3, and prior to
installation I scanned the disk and found that a worm named
"worm.win32.autorun.k" was on the disk. Obviously, I didn't install the
program. Kaspersky calls this a "High Risk" item.

Anyone know how or why this would be there, or is this a false-positive?
--
Dave T.


"Your attitude serves as a lens through which you see life, and it's
best when that lens is focused on the positive possibilities." - Ralph
Marston

---

› See More: Worm in phone tools?

"Dave T." <[email protected]> wrote in news:16fMj.1327$7Z2.1181
@newssvr12.news.prodigy.net:

> worm.win32.autorun.k

Do you have Yahoo Instant Messenger?

Symantec says it's a very low risk worm:
http://www.symantec.com/security_res...d=2007-060717-
3202-99&tabid=1

http://www.trendmicro.com/vinfo/viru.../default5.asp?
VName=WORM_AUTORUN.K
So doesn't trendmicro, which is one of the many sources that gave me the
Symantec name for it.

Dave T. schrieb:
> I just bought phone tools v. 5.0 to use with my Razr v3, and prior to
> installation I scanned the disk and found that a worm named
> "worm.win32.autorun.k" was on the disk. Obviously, I didn't install the
> program. Kaspersky calls this a "High Risk" item.
>
> Anyone know how or why this would be there, or is this a false-positive?

Where did you buy from? Might be you fell for a scam, esspecially since
Motorola still advertises MPT 4, not 5.

Andreas

Larry wrote:
> "Dave T." <[email protected]> wrote in news:16fMj.1327$7Z2.1181
> @newssvr12.news.prodigy.net:
>
>> worm.win32.autorun.k
>
> Do you have Yahoo Instant Messenger?
>
> Symantec says it's a very low risk worm:
> http://www.symantec.com/security_res...d=2007-060717-
> 3202-99&tabid=1
>
> http://www.trendmicro.com/vinfo/viru.../default5.asp?
> VName=WORM_AUTORUN.K
> So doesn't trendmicro, which is one of the many sources that gave me the
> Symantec name for it.
>

Larry,

it's odd, Kaspersky called it a high risk.

My ISP is SBC/Yahoo, but I have not installed yahoo messenger.

I'm wanting to suspect a false positive, because A-Squared detected it,
but Avast did not.

--
Dave T.


"Your attitude serves as a lens through which you see life, and it's
best when that lens is focused on the positive possibilities." - Ralph
Marston

Andreas Wenzel wrote:
> Dave T. schrieb:
>> I just bought phone tools v. 5.0 to use with my Razr v3, and prior to
>> installation I scanned the disk and found that a worm named
>> "worm.win32.autorun.k" was on the disk. Obviously, I didn't install
>> the program. Kaspersky calls this a "High Risk" item.
>>
>> Anyone know how or why this would be there, or is this a false-positive?
>
> Where did you buy from? Might be you fell for a scam, esspecially since
> Motorola still advertises MPT 4, not 5.
>
> Andreas

Andreas,

Thanks for the response.

I got this from Best Buy, and it is Motorola branded so I assume it's
the latest version.

I'm hoping this is a false positive because A-Squared detected it but
Avast does not.

Anybody out there have a disk you can scan to see if it shows up for you?

--
Dave T.


"Your attitude serves as a lens through which you see life, and it's
best when that lens is focused on the positive possibilities." - Ralph
Marston

"Dave T." <[email protected]> wrote in message
news:[email protected]...
> I just bought phone tools v. 5.0 to use with my Razr v3, and prior to
> installation I scanned the disk and found that a worm named
> "worm.win32.autorun.k" was on the disk. Obviously, I didn't install the
> program. Kaspersky calls this a "High Risk" item.
>
> Anyone know how or why this would be there, or is this a false-positive?
> --
> Dave T.
>
>
> "Your attitude serves as a lens through which you see life, and it's best
> when that lens is focused on the positive possibilities." - Ralph Marston


The Best Buy in Ogden, UT has been notified and they are looking into it.

Have you contacted the store you bought it from about it as they will want
to know so they can take action.

TeddyBare wrote:
>
>
> "Dave T." <[email protected]> wrote in message
> news:[email protected]...
>> I just bought phone tools v. 5.0 to use with my Razr v3, and prior to
>> installation I scanned the disk and found that a worm named
>> "worm.win32.autorun.k" was on the disk. Obviously, I didn't install
>> the program. Kaspersky calls this a "High Risk" item.
>>
>> Anyone know how or why this would be there, or is this a false-positive?
>> --
>> Dave T.
>>
>>
>> "Your attitude serves as a lens through which you see life, and it's
>> best when that lens is focused on the positive possibilities." - Ralph
>> Marston
>
>
> The Best Buy in Ogden, UT has been notified and they are looking into it.
>
> Have you contacted the store you bought it from about it as they will
> want to know so they can take action.

Not certain at this point what to do. I get absolutely no response from
Motorola, but they are famous for that.

I scanned the file at Virusscan.jotti and virustotal, and only one or
two engines threw up a flag on each of them, and they all warned of a
different piece of malware. I am beginning to feel that it is a
false-positive, but paranoia has me in it's grip. d8(>

What I find REALLY odd is that on the Motorola forum no one has ever
heard of Version 5.

--
Dave T.


"Your attitude serves as a lens through which you see life, and it's
best when that lens is focused on the positive possibilities." - Ralph
Marston

"Dave T." <[email protected]> wrote:

> What I find REALLY odd is that on the Motorola forum no one has
> ever heard of Version 5.

Correct. I searched Best Buy's site and they do NOT have Version 5,
they are expecting it soon and are accepting orders for it.

http://www.bestbuy.com/site/olspage....=1200702767026

Or: http://preview.tinyurl.com/5qcrn3




--
XS11E, Killing all posts from Google Groups
The Usenet Improvement Project:
http://improve-usenet.org

XS11E <[email protected]> wrote:

> "Dave T." <[email protected]> wrote:
>
>> What I find REALLY odd is that on the Motorola forum no one has
>> ever heard of Version 5.
>
> Correct. I searched Best Buy's site and they do NOT have Version
> 5, they are expecting it soon and are accepting orders for it.
>
> http://www.bestbuy.com/site/olspage....&st=Motorola+P
> hone+tools+5.0&type=product&id=1200702767026
>
> Or: http://preview.tinyurl.com/5qcrn3

OOOOOPS, my bad, they are NOT accepting orders but you can add it to
your wish list.

Anyway, it's certainly a mystery! A Google search shows it's available
from Warez sites so... Where exactly did Best Buy get whatever they
sold you?

--
XS11E, Killing all posts from Google Groups
The Usenet Improvement Project:
http://improve-usenet.org

Dave T. wrote:
> TeddyBare wrote:
>>
>>
>> "Dave T." <[email protected]> wrote in message
>> news:[email protected]...
>>> I just bought phone tools v. 5.0 to use with my Razr v3, and prior to
>>> installation I scanned the disk and found that a worm named
>>> "worm.win32.autorun.k" was on the disk. Obviously, I didn't install
>>> the program. Kaspersky calls this a "High Risk" item.
>>>
>>> Anyone know how or why this would be there, or is this a false-positive?
>>> --
>>> Dave T.
>>>
>>>
>>> "Your attitude serves as a lens through which you see life, and it's
>>> best when that lens is focused on the positive possibilities." -
>>> Ralph Marston
>>
>>
>> The Best Buy in Ogden, UT has been notified and they are looking into it.
>>
>> Have you contacted the store you bought it from about it as they will
>> want to know so they can take action.
>
> Not certain at this point what to do. I get absolutely no response from
> Motorola, but they are famous for that.
>
> I scanned the file at Virusscan.jotti and virustotal, and only one or
> two engines threw up a flag on each of them, and they all warned of a
> different piece of malware. I am beginning to feel that it is a
> false-positive, but paranoia has me in it's grip. d8(>
>
> What I find REALLY odd is that on the Motorola forum no one has ever
> heard of Version 5.
>

Dave;

I took a look at my MPT (version 4.5.6a August 07) and found a file
named MPT_TEST_info.exe (marked as version 3.1.1.0). I submitted it to
jotti and it came back clean, no malware alerts whatsoever. The md5
hash on the file is: c9345168269bf47b722a92f22f321beb.

Interestingly, MPT_TEST_info is compiled by AutoIt
<http://www.autoitscript.com/autoit3/compiled.html>. The author of
autoit talks about getting false positives pretty regularly. He's
asked that anyone who gets a false positive to follow up w/the developer
and to feel free to drop him a line as well...
<http://www.autoitscript.com/autoit3/compiled.html> (the contact linky
is busted but here's one that works:
<http://www.autoitscript.com/email_us.shtml>

Fwiw, I've used bvrp's MPT for a few years now and find the quality &
flexibility of the s/w to be seriously lacking. I don't use Outlook nor
Lotus Notes so the whole experience has been... kludgy. The support's
been ok for me but it just adds to this feeling that my data is being
managed by a black box. Because of my experience w/MPT, my next choice
of phones will depend on an open source project being available to
support it. Either that or, at the very least the "semi-open" S60 OS.

g'luck & please keep us up-to-date

-Craig

XS11E wrote:
> XS11E <[email protected]> wrote:
>
>> "Dave T." <[email protected]> wrote:
>>
>>> What I find REALLY odd is that on the Motorola forum no one has
>>> ever heard of Version 5.
>> Correct. I searched Best Buy's site and they do NOT have Version
>> 5, they are expecting it soon and are accepting orders for it.
>>
>> http://www.bestbuy.com/site/olspage....&st=Motorola+P
>> hone+tools+5.0&type=product&id=1200702767026
>>
>> Or: http://preview.tinyurl.com/5qcrn3
>
> OOOOOPS, my bad, they are NOT accepting orders but you can add it to
> your wish list.
>
> Anyway, it's certainly a mystery! A Google search shows it's available
> from Warez sites so... Where exactly did Best Buy get whatever they
> sold you?
>
Hard to say...Sometimes we get things on the left coast before others
do. That includes software and diseases.

--
Dave T.


"Your attitude serves as a lens through which you see life, and it's
best when that lens is focused on the positive possibilities." - Ralph
Marston

Dave T. wrote:
> Craig wrote:
>> Dave T. wrote:
>>> TeddyBare wrote:
>>>>
>>>>
>>>> "Dave T." <[email protected]> wrote in message
>>>> news:[email protected]...
>>>>> I just bought phone tools v. 5.0 to use with my Razr v3, and prior
>>>>> to installation I scanned the disk and found that a worm named
>>>>> "worm.win32.autorun.k" was on the disk. Obviously, I didn't install
>>>>> the program. Kaspersky calls this a "High Risk" item.
>>>>
>>>> Have you contacted the store you bought it from about it as they
>>>> will want to know so they can take action.
>>>
>>> Not certain at this point what to do. I get absolutely no response
>>> from Motorola, but they are famous for that.
>>>
>>> I scanned the file at Virusscan.jotti and virustotal, and only one or
>>> two engines threw up a flag on each of them, and they all warned of a
>>> different piece of malware. I am beginning to feel that it is a
>>> false-positive, but paranoia has me in it's grip. d8(>
>>>
>>> What I find REALLY odd is that on the Motorola forum no one has ever
>>> heard of Version 5.
>>>
>>
>> Dave;
>>
>> I took a look at my MPT (version 4.5.6a August 07) and found a file
>> named MPT_TEST_info.exe (marked as version 3.1.1.0). I submitted it
>> to jotti and it came back clean, no malware alerts whatsoever. The
>> md5 hash on the file is: c9345168269bf47b722a92f22f321beb.
>>
>> Interestingly, MPT_TEST_info is compiled by AutoIt
>> <http://www.autoitscript.com/autoit3/compiled.html>.
>>
>> Fwiw, I've used bvrp's MPT for a few years now and find the quality &
>> flexibility of the s/w to be seriously lacking.
>
> ...I am that guy you may have heard of who
> thinks that Vista is the greatest thing since sliced bread.

Damn! I'd heard of that legendary (& solitary) guy but I never thought
I'd meet him! <grin>

>
> I'm not looking to do a lot with MPT. Basically all I really want is to
> back up contacts and upload photos. Do you experience any difficulties
> with that?
>

You ought to be fine. I wander into the weeds when I start expecting
data portability for my calendaring...

hth,
-Craig

"Dave T." <[email protected]> wrote in message
news:[email protected]...
> TeddyBare wrote:
>>
>>
>> "Dave T." <[email protected]> wrote in message
>> news:[email protected]...
>>> I just bought phone tools v. 5.0 to use with my Razr v3, and prior to
>>> installation I scanned the disk and found that a worm named
>>> "worm.win32.autorun.k" was on the disk. Obviously, I didn't install the
>>> program. Kaspersky calls this a "High Risk" item.
>>>
>>> Anyone know how or why this would be there, or is this a false-positive?
>>> --
>>> Dave T.
>>>
>>>
>>> "Your attitude serves as a lens through which you see life, and it's
>>> best when that lens is focused on the positive possibilities." - Ralph
>>> Marston
>>
>>
>> The Best Buy in Ogden, UT has been notified and they are looking into it.
>>
>> Have you contacted the store you bought it from about it as they will
>> want to know so they can take action.
>
>
> That's probably the best way for me to go since I can't get any response
> from Motorola. To be fair, I think this is a 3rd party app simply marketed
> by Motorola, but they are the ones who have to take the heat. Anyone
> recall a little news item about electronic picture frames?
>
> --
> Dave T.
>
Here's a link to the actual software manufacturer's support forums:
http://www.bvrpforums.com/motorola/