Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

autorun.inf in external devices


  • Please log in to reply
2 replies to this topic

#1 Aniki15

Aniki15

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:04:50 AM

Posted 04 October 2009 - 07:01 AM

Uhm... I don't know if this is the right site to ask but if anyone knows how to remove the autorun.inf in their notebook. it happens that whenever i place a flash drive or memory card in my pc, a file "autorun.inf" appears. first, i tried to delete it but it won't delete because it was being used by c:\WINDOWS\Explorer.exe. then, i used a program called "Unlocker" to delete it. it actually allowed me to delete it but the autorun.inf still appears whenever i return any usb device back. is my system infected by a virus? actually, i tried avira and avast but they both seem to have detected nothing.

please help.

Edited by The weatherman, 04 October 2009 - 08:26 AM.
Moved from introductions to a more appropriate forum. Tw


BC AdBot (Login to Remove)

 


#2 garmanma

garmanma

    Computer Masochist


  • Members
  • 27,809 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cleveland, Ohio
  • Local time:04:50 PM

Posted 04 October 2009 - 03:56 PM

Did you by chance run Combofix or Flash Drive Disinfector?

Note: As part of its routine, Flash_Disinfector will create a hidden folder named autorun.inf in each partition and every USB drive that was plugged in when you ran it. Do not delete this folder...it will help protect your drives from future infection by keeping the autorun file from being installed on the root drive and running other malicious files.
-------------------------------

What it does:

The vaccination is two fold. If the computer's autorun settings are enabled, then files can spread to any drive that's plugged in. If the drives themselves are vaccinated, all the tool does is prevent the autorun.inf file from executing any of the malicious content that may have been copied to the drive when it's plugged in.

In other words, say you vaccinate your USB drive. The tool writes an autorun.inf file that's harmless. When it's inserted in a computer that does not have autorun disabled, the computer will attempt to read and process the autorun.inf file from the inserted drive. If an infection that spreads to network or USB drives is present on the computer, the infection may very well succeed in putting the files on the drive, but they will not be able to overwrite the autorun.inf file and as such the files will not run without user input (i.e. actually clicking on them).

If the computer's infected and that infection tries to multiply to external drives, then yes, it'll likely copy some files to it. You could then remove those as they wouldn't be running automatically once the drive's inserted in another PC. Nothing you do will stop files from being copied over to an external drive if an infection of that type is present on the system. Well, technically you can prevent that by setting the write protect mode, but not every USB drive has one of those and it prevents writing anything to the drive.
Mark
Posted Image
why won't my laptop work?

Having grandkids is God's way of giving you a 2nd chance because you were too busy working your butt off the 1st time around
Do not send me PMs with problems that should be posted in the forums. Keep it in the forums, so everyone benefits
Become a BleepingComputer fan: Facebook and Twitter

#3 Aniki15

Aniki15
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:04:50 AM

Posted 19 November 2009 - 09:25 AM

Sorry for the late reply but no, I am not using Combofix or Flash Drive Disinfector.

Thanks for the vaccination notes. It really helpful since I know now that some programs will create autorun.inf automatically.

However, I have used a2Freeware antivirus and has detected a virus in my system C:\RECYCLER\S-1-5-21-0680268795-9067282562-201332953-1762\MsMxeng.EXE

The infection was called a Virus.Win32.CeeInject!IK

Ive placed it in quarantine and the autorun.inf never again occured in any usb device of mine.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users