Trojan.DownLoader UFO.EXE

[Lisandro]

So sorry for my previous post. I have hold discussions with colleague that care on it and i understand him badly. I will next time better thing then write.

Don't worry that much. The worse thing will be if that was true and not only a matter of explanation

[Akumasama]

The file got finally detected by Avast (on the USB pendrive) and removed. Next time I plugged it in, it was still inside, still appearently Avast doesn't detect it on the PC.

What is this virus? A virus? A worm? A trojan? A rootkit? Is it somewhere on my PC as well? Can it be seen and manually removed without a rootkit tool?
This file has probably been on my PC for several weeks already, I'd like to know what it has been doing all this time, and what do I have to do to be completely sure it has been removed from both my USB pendrive AND my two PCs.

[Lisandro]

What is this virus? A virus? A worm? A trojan? A rootkit? Is it somewhere on my PC as well? Can it be seen and manually removed without a rootkit tool?

Maybe, but using a rootkit won't be that bad.
Try other tools... I suggest:

AVG Antispyware
SUPERantispyware
Spyware Terminator
AVG antirootkit
Trend Micro RootkitBuster

[Akumasama]

Thanks, I'll try to check tonite (it's on my GF's PC, as usual...).
Oh, due to a lack of internet connection she couldn't update Avast for the last 2 days, maybe the solution is already there but she couldn't check it due to lack of update.

Still it sounds strange that Avast finally detected UFO, but only removed it from the pendrive, not from the PC...

It just bothers me I'll have to waste 1 more day of my time removing this virus, I bet she won't be able to use any online AV systems, nor install Ccleaner, F-Secure Blacklight, HijackThis, Ewido and everything else. -_-'

[Akumasama]

Any news on this file? Has it been added to Avast Database?

Sounds pretty strange that Avast appearently detected it once after the update around november the 27th, and now it doesn't detect it anymore (while the virus/worm is still there, since it continues to infect USB pendrives plugged into the notebook)

[Maxx_original]

follow the instructions to disable autoruns on fixed disks and USB devices as described here http://forum.avast.com/index.php?topic=31671.60 this should stop the re-infecting.. another detections for newer variants of autorun viruses are ready to be processed...

[nimd4]

Google search for avast UFO.exe, the second result down for me Remove Virus newheur_pe - Topic Buzz by Omgili, second link on that page led here.. UFO.exe that resides on my USB is not being detected by Avast! Sux0rz.

[DavidR]

Then send the sample to virus@avast.com zipped and password protected with the password in email body, a link to this topic might help and undetected malware in the subject.

Or you can also add the file to the User Files (File, Add) section of the avast chest where it can do no harm and send it from there (select the file, right click, email to Alwil Software). No need to zip and PW protect when the sample is sent from chest. A copy of the file/s will remain in the original location, so any further action you take can remove that.