Indian users affected by Goblin virus reports ESET

• Email
• Print
• ( 1 )
• 

Researchers from ESET received dozens requests from Indian PC users to help curing Win32/Goblin.B.Gen virus which had infected lacs of systems across India within last 2 weeks.

ESET researchers discovered that many infected users had been protecting their PCs with Net Protector AntiVirus.
Within past two weeks ESET India technical specialists received numbers of requests from PC users across India to help curing the infected computers infected by Win32.Goblin.B virus. At the same time, there was Net Protector AntiVirus (NPAV) software installed on all infected systems that suggested a possible connection between the malware infection and the mentioned software. 

Net Protector AntiVirus is originated in India, developed by a company in Pune, which claims to “have been actively involved in Research and Development of Anti-Virus software”.  However, in the market this software is known as, one not having its own scanning engine and virus signature database.

“It is difficult to understand the exact connection between this mass infection and the fact that all the systems we have inspected were having NetProtector installed. We assume that infection started on 29-30th January, 2012 after one of the updates of NPAV. Within several days NPAV posted some virus removal tools on their website, but even these files suggested for download were detected by ESET as malicious. I’ve heard complaints from NetProtector users and resellers that none of technical support or Toll Free numbers given by that company have been answering since the infection started”, says Pakaj Jain, Director at ESET India.
ESET analysts detect Goblin.B (also detected by some vendors as W32.Xpaj) as a virus that infects files with the following extensions : *.exe *.dll *.scr *.sys, by copying itself to these files. It spreads via removable media, shares and files to be burned to a CD. It is polymorphic virus which techniques are aimed to outwit the antivirus scanning engines. Nevertheless, most of genuine antivirus products are able to detect and clean this virus, though its cleaning is quite problematic. 

ESET advices all users in India having Net Protector AntiVirus , to scan their systems with any genuine and reliable antivirus, whose detection technologies are tested and proved by world-known independent testing organizations. In few cases we found the damage on this combo is beyond repairable, so even after scanning and disinfection, in case system’s performance is not improved or some other error messages, we advise to repair the operating system to avoid losing valuable data and sensitive information.