Tomtom go910 trojan virus warning on backup Forums

Loxley

hi all,

further to my problems with my tomtom posted elsewhere on the forum i have been searching the net for related issues and came across this 'current' problem on a satnav forum link from TomTom's own website

http://www.yournav.com/forum/index.php?showtopic=8333

i have put the salient points of the post below

basically it warns of a trojan virus which is in the hard drive and manifests when the 'backup' is operated.

i noticed this yesterday when backing up the hard drive to my office pc that it stopped at the two files listed, copy.exe and root.exe but i didnt get a virus warning. i just pressed 'continue'.

anyway, it may be worth investigating on your own pc's to be sure.

Mark

==========================================
Products News Reviews Specials Links Polls Forum Contact

Received a brand new Tomtom GO 910 this morning (still sealed in cellophane). Tried backing up data and the anti-virus software has picked up this virus Virus.Win32.Perlovga.a in the file copy.exe. There isn't any further information on the type of virus. I can't see how a virus has got onto a new TomTom so I'm guessing it's a false detection due to coding. Anybody got any info on this?

Thanks

Marc

I also just received a TomTom GO 910 from Future Shop in Lethbridge, Alberta. It was brand new, in a sealed box. I installed it on my laptop, and after following their instructions, I backed up the 910 to my laptop before updating anything. During the backup process, my anti virus program, AntiVir from Germany immediatly stopped everything and advised me that I had two viruses in the backup, copy.exe and host.exe. The viruses were W32/Perlovga.A.1 and TR/Drop.Small.qp/

In response to what the first responder said, NO, it isn't on my computer system, it was in the new GO 910 that was being backed up. The anti-virus software pointed to it in F:drive which was the hard drive in the 910 on my system.

I am going to be contacting TomTom in the morning to find out what gives. There shouldn't be a virus like a trojan on a new product! I am very discouraged to say the least.

Other than that the product works wonderfully, and so far I've only noticed a few road errors on my way back Hwy 3 from Lethbridge to BC. Also the downloaded voice of English comedian "Mikey" is hilarious..."Turn around, you're going the wrong way!!! had me laughing until tears were falling down my face!"

But, why the trojans on the hard drive? Anyone else??
lbolen

Its more likely your PC has the virus, check out this thread.

http://forum.kaspersky.com/lofiversion/index.php/t21881.html

And it's just as likely that the virus is actually on the CD that came from TomTom, they can pop up anywhere if someone is being careless with Windows. It's also the reason why I virus check everything, even cd's that come with magazines.

--------------------

I bought a 910 a couple of days ago and it did indeed have the Win32.Perlovga.a virus pre installed on the hard drive. Apparently Tom Tom is unaware of computer security issues. Win32.Perlovga.a is a trojan and if you're behind a router or firewall you should have no problem with Tom Toms special software feature. It will infect your computer instantly when you run the Tom Tom Home software. McAfee antivirus detected and removed the Tom Tom trojan and no further problems were detected.

Member No.: 5.025

I too got this virus when I purchased a second 910 on 12/12/06

F:\copy.exe
F:\host.exe

F:\copy.exe Threat win 32\perlovga. A virus
F:\host.exe win 32/ Trojan Dropper.small.APL trojan

I deleted it and reported it to TomTom.

Full Edit

My new one from amazon uk - £299.00 also infected.

files are hidden system read only in route of hard drive

autorun.inf (passes infection on by autorun when you connect it to your pc)
copy.exe (run by autorun.inf)
root.exe (payload)

from the command prompt you can check for these by selecting the tomtom drive (normally f Smile

then type attrib *.exe

if it list the above files SHR you have the problem.

I disabled my AV for 15 minutes
Then from the tom tom drive

attrib ???.exe -s -h -r
del copy.exe
del root.exe

attrib autorun.inf -s -h -r
del autorun.inf

The above steps are performed at your own risk.

You may wish to also check any other removable drives for the same infection.

I have also logged this with TT Support.

I assume this is the same kind of thing Apple had on some ipods (setup on a pc of course in the factory - not a mac) and McDonalds in Japan