The Virus Total website no longer detects this as an infected file; one anti-virus agent on that site did detect it as having a trojan on 2008-12-23. eEye's Blink tool also detected it as having a trojan, but as of 2008-12-26, it does not. False positive.

ClamAV reports:

/media/Lexar/CONFIG/S-1-5-21-1482476501-1644491937-682003330-1013/Cfg.exe:
Trojan.Inject-1865 FOUND

Contents of autorun.inf:

[autorun]
open=CONFIG\S-1-5-21-1482476501-1644491937-682003330-1013\Cfg.exe
icon=%SystemRoot%\system32\SHELL32.dll,4
action=Open folder to view files
shell\open=Open
shell\open\command=CONFIG\S-1-5-21-1482476501-1644491937-682003330-1013\Cfg.
exe
shell\open\default=1

Blink Anti-Virus reports the trojan "FakeAV.VY" in the WinSCP 4.1.8 installer file at: https://winscp.net/download/winscp418setup.exe/download

I will assume this is a false positive.