Trojan Horse Generic12.YAO

I plugged in my external USB hard drive and when I double click the drive icon I get an access denied warning, and AVG shows a pop up saying that Ive been infected with the Generic12.YAO trojan. I then proceed to heal the infected file. When I try to access the drive again, I still get the access denied warning but no warning about the trojan. I can still access the drive by right-clicking and choosing explore.

I ran a full system scan with AVG which showed no viruses or trojans are on my computer. I then ran MalwareBytes' Anti-Malware program and AVG popped up showing that I was infected with the same trojan. I healed it again and Anti-Malware showed no infected files. I still can't access the drive when double-clicking the icon.

Here's a pic of the AVG warning that came up while running Anti-Malware:


Thanks for any help.

Edited by CobraCommander, 16 January 2009 - 02:28 AM.

The file location shown in the image you posted is "system restore".
You can remove what AVG is reporting by deleting all restore points. Instructions on how to do that are
in the links below. Be sure to reset system restore after removing the restore points.

XP guide
http://www.bleepingcomputer.com/tutorials/windows-xp-system-restore-guide/
Vista guide
http://www.bleepingcomputer.com/tutorials/windows-vista-system-restore-guide/

You should also permanently delete the items in AVG's quarantine "safe" or whatever they call it.
If AVG reports the same problem again, you should run an online scan with Kaspersky online scanner. Instructions for using it are in the link below. Post back with what Kaspersky finds if you use it.
http://www.bleepingcomputer.com/forums/ind...t&p=1045589

Thanks for replying.

I did what you posted and scanned again with AVG without any warnings of viruses/trojans.

However, I still can't access my usb drive through double clicking.

Did you allow MBAM or AVG to scan the external drive for malware?

Oops. I should have thought about that.

I scanned the drive with AVG and it detected worm/autorun.inf/Autorun.EK.

I removed it and when i reinstalled the drive I scanned again with AVG and MBAM with no infections detected. Normal use of the drive has also been restored.

Btw, is the most likely cause of the worm from the USB drive itself? My brother did borrow the drive from me awhile ago and only yesterday did I install it.

Thanks for all the help!

Yep, your brother's computer is likely infected as well.
Read the info in the links below.
http://www.bleepingcomputer.com/forums/ind...t&p=1082754
http://miekiemoes.blogspot.com/2008/11/ple...torun-asap.html

Thanks for the additional info.