autorun.inf virus
Posted by cognoscis on December 13th, 2008
One day suddenly I faced a new problem, when ever I double clicked on any drive, it started opening in new a window. I tried to fix it with the usual methods.
Open the explorer and in that choose
Tools >> Folder Options.
In the General tab, uder the browse folder option select “open each folder in same window”
Click Apply and then Ok
I tried the registry fixes too but that didnt work!
Then I digged deep and found that there is a “autorun.inf” file that was created in all the drives. You have to use “show hidden system files” option from folder options menu to be able to see it. Then, I tried to search the net and found a solution that I like to share here
- First, click on start >> run
- Type “cmd” (without quotes) and press enter
- Go to root, meannig, type “cd..” (without quotes) till you reach the command prompt “C:\>”
- There, type “attrib -h -r -s autorun.inf” (without quotes) and press enter
- Type “del autorun.inf” (without quotes) and press enter
- Type “md\autorun.inf ” (without quotes) and press enter
- This must be repeated on all drives. To change the drive just say “d:” (without quotes) or “e:” (without quotes) and so on.
What the above does is that it deletes the autorun.inf file from all the drives and creates a directory by the same name. So, when the virus tries to copy itself into the drives again, it cannot do it as the directory already exists. Do the same to your pen drives to avoid being infected by the virus. After the spreading of virus is limited, you now need to reset the values of registry it has changed. To do that follow these steps
- Click on start >> run
- Type “regedit” (without quotes) and press enter
- In the registry editor, navigate as shown below. To navigate, just press on the “+” mark behind the name specified on the left side of the editor
HKEY_CURRENT_USER\Software\ Microsoft\Windows\CurrentVersion\Policies
- In policies, click on explorer
- Now, on the right side, find the value NoDriveAutorun. If its not there, right click on the empty space below the present values, click on new >> DWORD
- Rename it as NoDriveAutorun and press enter
- Double click on the value and chage the value to “FF” or “255″ and press enter
Now, colse the registry and restart the system. This solved my problems. I then made those autorun.inf folders as hidden. Now, this works well but doesnt remove the virus entirely. Scanning the system with a godd antivirus will help. But, there are simply too many viruses that create autorun.inf after infecting. Also, not all viruses are detected and deleted. I use AVG and it failed to delete this particular virus. Even Avast failed. So far this is the best fix I have. If anyone else has other tweaks, please comment
August 5th, 2009 at 3:40 pm
[...] autorun.inf virus [...]