Autorun.inf

[Adnan]

i am using windows xp operating system. i have a virus autorun.inf in
my c root driectory. when i run the attrib command in the c root. it
shows me autorun.inf


can any body help me to remove this virus permanently.

thanks in advnace

 

[TaurArian]

Hi, provide more information about what the virus is if you can etc. You'll need to detail
your OS etc and post here:
Security - Viruses
OE client -
news://msnews.microsoft.com/microsoft.public.security.virus
or
Web client -
http://www.microsoft.com/technet/co...fault.mspx?dg=microsoft.public.security.virus

The more information you have, perhaps you'll get a response.

--
====================================
TaurArian [MVP] 2005-2008 - Australia
====================================
How to ask a question: http://support.microsoft.com/kb/555375
http://taurarian.mvps.org/index.htm
Emails will not be acknowledged - please post to the newsgroup so all may benefit.
Computer Maintenance: Acronis / Diskeeper / Paragon


|
| i am using windows xp operating system. i have a virus autorun.inf in
| my c root driectory. when i run the attrib command in the c root. it
| shows me autorun.inf
|
|
| can any body help me to remove this virus permanently.
|
| thanks in advnace

 

[Rajdeep]

Hi, Adrian,

Open command Prompt (Start> Run > CMD)
go to C:\ prompt and there type:

Del/ah/f Autorun.inf and do the same for all the drives that you have.

bad news is there is an infection thats creating the autorun.inf files. So
we have to detect the infection first. For this Download Process Explorer by
SysInternal and check the EXE processes that dont have company information.
Kill those processes as all the system processes and other valid 3rd party
processes wud be having their company information. However, before killing
that process see its property and see the path its running from. Mostly
viruses copy themselves inside Windows or System32 folders. If its the case
then open cmd again and go to that directory and type attrib. look for exe
files that have attributes SHR. once u know their names, type del/ah/f
<filename of that exe file>.

Hopefully the infection wud be removed but it can revert back incase it has
coppised itself in some other location. SO we would need proper logs from
your system to help u get rid of it.

FYI... autorun.inf gets initiated whenever u open a drive or folder. its
similar to the autorun.inf files that we used to have in CDs for autoplay
option.

Please revert back with ur findings.

 

[Gerry]

Adnan

Have you installed Autoruns as that can be the set up file for the
itility:
http://www.microsoft.com/technet/sysinternals/ProcessesAndThreads/Autoruns.mspx

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~