We have multiple users that use mobile phones that run of varying versions of Android and often plug the phones into PCs running Windows and Linux that are attached to a wider network. Can an infected mobile phone affect PCs and laptops running Windows and/or Linux and what is the best way to avert further infection?
An app that runs on Android cannot run on any other OS - other than via an emulator. So if we are talking about a malicious android application, then there is no risk.
If on the other hand we are talking about a Windows virus that has copied itself onto a phone from an infected PC (because a phone attached to a PC can present itself as a storage device), then you have the possibility for that virus to be copied to another Windows PC, perhaps via an auto-sync process (lots of phones come with Windows software that comes with the ability to automatically sync various content types. If this happened, then the virus would have made it to another PC. At this stage it is just a file. It would then take someone to execute the file in order to run the virus program and infect the PC.
They could do this without it being copied of course, they could plug the phone in and browse to it with explorer and run the virus executable.
This vector for infection is really no different from a usb flash drive. That it is a phone doesn't really make much difference, it is that it is a storage device. So you would use the same process to prevent it - remove user permissions to add usb devices.
Yes infected android phones and tablets can infect the windows operating system. The below link talks about an older type of malware that does exactly that.
When installed, the apps ask for a group of permissions from sending SMS to enable the WiFi network, handle the owner personal data including SMS, photos, contacts, GPS coordinates and also any data or file in the SD card!
After installed in the Android device, the apps download files to the SD card (autorun.inf, folder.ico and svchosts.exe). When the device was connected to a computer as an storage mass media (USB), the file svchosts.exe could be automatically executed in the computer, spreading the infection. Once in the system, the malware could activate the microphone and store the surroundings audio, encrypt it and send it to a FTP remote server.
source: Avast Blog
Yes, this is what happened to me.
I just plugged in my old android micro SD into my card reader in my PC. Within four min I had a log file copied into my windows folder. Six files and a folder created. PC now requires restart to update windows message came up. PC will not allow to remove change or erase text and save in those folders and files. log file contains list of executables. Six lines are 'log' and 'transmit' of different c drive folders and files. It seems the sites I've been too on my phone want to know what and where my PC is. I cannot remove these files. My computer was not connected to network. Only files on card were android files. I was trying to format the card. never opened or clicked on anything.
All i did was plug card in.
drweb on android trivially renames autorun.inf on SD card... and actually it is windows which should not be configured to pull non-trusted code and execte at high privileges, and take care about its own security... (i think it is the fact since Vista that RW media is not auto-run....) Namely there is no cross-platform infection that could spread between android and windows.