Page 1 of Free with every Tesco Photo CD - Brontok.X virus!!

Just got a PhotoCD back from tesco, and while trying to move the picture folder onto my hard drive, AVG flashed up a warning that the CD conatins the i-worm Brontok.X.

Obviously, this file has been put on the CD deliberately by someone at my Tesco. What I want to know is, before I return to my branch and start shouting at minimum wage minions, is this file on the CD as a part of the Tesco `photo package`, or is it purely malicious?

I`ve had a look around and it appears to change registry values, restarts itself on startup, and spreads itself via e-mail.

============================
Curse this infernal alcohol...


Writer`s Release
My Collection

Quote:
I`ve had a look around and it appears to change registry values, restarts itself on startup, and spreads itself via e-mail
there`s no reason why a "photo cd" should be changing registry values... most have
a simple flash type plugin which allows them to autoexecute and run.

fairly typical worm activity. might not be overly malicious, but a pain in the arse
nontheless. before you go guns blazing though, are you absolutely positive it`s
on the cd?

Ste.

This item was edited on Tuesday, 31st March 2009, 08:24

Is it also possible that someone has taken in one of their own CD`s/memory cards of photos that had the virus on it then Tesco have created a disc for them and unknowingly landed the virus?

Obviously they should have virus protection in place but if their checker missed it and it repopulated etc etc?

Might be worth some freebie if you point out they have an infected machine lol

Jimbo : oÞ

"Making Teenagers depressed is like shooting fish inna barrel"

Quote:
are you absolutely positive it`s on the cd?
Positive. The CD contains 6 files and a folder. the files are their normal autoplay gubbins. The picture folder on the CD is titled 266976AMORR +0 (part of my surname and the rest is a serial number). As well as the images it also contains a file 266976AMORR+0.exe. This file contains the virus(es). This file has been named as match the folder name, making an unsuspecting viewer feel it`s safe to open. Luckily I`m not unsuspecting anymore.

Quote:
Is it also possible that someone has taken in one of their own CD`s/memory cards of photos that had the virus on it then Tesco have created a disc for them and unknowingly landed the virus?
Unlikely. it`s an .exe, you`d have to physically open the file for it to infect their system. If it was active on their system, from what I`ve read about this worm, it would be semi inoperable. I can only conclude that it`s been deliberately put on there by a member of staff, or the CD burning system itself (updated from head office) had been compromised.

============================
Curse this infernal alcohol...


Writer`s Release
My Collection

I used to run that photolab many years ago, from what I gather they simply select your photos and the machine does it for them now. (Not like back in my day)

It could be AVG falsely reporting it or they do have it on their on their hardware. To get freebies complain instore and to get answers complain to customer services at Kodak. (It`s a Kodak outlet)




Is that the time? Damn you PSWii60!!!!
Wii code: 6823 3219 8002 6573
PSN & XBL: Ailegs

Quote:
It could be AVG falsely reporting it or they do have it on their on their hardware
Possibly, but as someone who`s worked there, why would there be an exe file INSIDE the image folder, when the Tesco picture viewing software is outside the image folder as per normal?

============================
Curse this infernal alcohol...


Writer`s Release
My Collection

I don`t know as we used to send them to Kodak but guessing from a software perspective (Work in IT now) maybe to execute the Kodak viewer to then load your images contained within the disc. Are they loading in your default image viewer or a Kodak one?




Is that the time? Damn you PSWii60!!!!
Wii code: 6823 3219 8002 6573
PSN & XBL: Ailegs

This item was edited on Tuesday, 31st March 2009, 23:24

I never use the Viewer on the CD as I find it clumsy. I just go into the disc and choose the image I want. We always get physical photos as well anyway, but always get a CD in case we want to sent any images to Canada

============================
Curse this infernal alcohol...


Writer`s Release
My Collection

Just been to tesco and spoke to a nice bloke called Simon. Turns out the CD`s come from a supplier semi-burned, and the image folder is burned in-store. Wether or not the virus was added at either stage is unclear, they`re looking into it. But as the virus was within the image folder and was named as stated before, i`d say it`s instore.

Their self-printing service was out of order too - curious...

============================
Curse this infernal alcohol...


Writer`s Release
My Collection

im very wary of these photo cd services i dont trust it i burn my own photo cds/dvds for my family using cdrwin it works well may be something to consider.



the memory of you will bloom like the flower in the garden of my heart