How does the Ahnrpta.exe virus infect a machine

Question

My games and multimedia PC has twice now been infected with a virus that loads an executable called Ahnrpta.exe. This is with me being the only user and literally not downloading anything and not receiving any email on it.

I know my housemate has this virus on his laptop (he keeps telling me he'll get some antivirus) so I suspect it's coming from there (we use the same home network). The strange thing is though my work laptop which I use on the same network quite frequently has not been infected.

Both my work laptop and my games PC run WinXP and have no firewall other than the WinXP SP2 firewall.

Does anyone know how this virus spreads? I haven't been able to find a definitive answer from the antivirus vendor sites.

Answer 1

If seen many backdoor/trojans like the Ahnrpta.exe virus, spreading by running automatically when you insert a USB thumbdrive for example (autorun.inf).

See this tutorial how you can disable autorun for external media (CD-ROM, USB drives...)

Answer 2

If you didn't do a clean Windows install after the first infection it is likely you are simply reinfecting yourself. It is a bad trojan/backdoor and most likely brought rootkits into the mix. Due to the complexity of malware these days, nothing short of a clean install can ensure that you are not compromised. Who knows what this thing is doing on your network though depending on your settings, if it is on his computer it can have its way with yours on the same network.

Infections can occur now by simply visiting a bad website. You don't even need to click or download anything.

You need to make sure your version of Windows is currently patched and you are running a good Antivirus. My choice is NOD 32.