Thread: Beware the infected ALDI MP3 Player - and a fix

My son just bought one of those generic Chinese MP3/WMA players from ALDI for about $20. Specs look ok - 4GB memory and similar look to the old iPod Shuffle, FM radio, and even an eBook app that would be totally useless on the tiny screen.

So he plugged it in to his PC last night and it created 2 virtual USB drives - a CD containing install files and a drive for holding the music.

Upon autorun of the virtual CD, BitDefender detected a generic trojan in 3 files, but obviously couldn't do anything to remove them.

Tonight I plugged the device in to another PC with Symantec EndPoint Protection and got pretty much the same message.

The 3 files on the virtual CD are:
autorun.inf (just launches start.exe)
start.exe (infected file)
amt.sn (an archive file that contains amtsetup.exe and amthook.dll - both infected).

There is a workaround:

• you don't need this infected application, so switch it off. On the MP3 player, navigate to the System menu, scroll to "Audio Auto Transform" (yeah Transform not Transfer) and select "close". This will stop the virtual CD from being created.
• just drag and drop your music files/folders over to the device drive letter that does appear.
• if you want to compress the files, you could probably use Win Media Player to synch the device.

Cheers, Paul.

Think the message here is don't buy cheap Chinese crap no matter what it is.
A few bucks saved somewhere is a lot more spent elsewhere.....