AUTORUN.INF VIRUS REMOVAL

Autorun.inf can pose a security threat, when the user does not expect or intend to run the software, such as in the case of some viruses, which take advantage of this feature to propagate, especially on USB FLASH DRIVES.

EFFECTS OF AUTORUN.INF VIRUS

For instance, an attacker with brief and casual physical access to a computer can surreptitiously insert a disc and cause software to run. Alternately, malicious software can be distributed with a disc that the user doesn't expect to contain software at all -- such as an audio compact disc. Even music CDs from well known name-brand labels have not always been safe.

HOW TO REMOVE AUTORUN.INF VIRUS

To erase this, restart your window to Safe Mode Command Prompt. (Do this by rebooting your computer and pressing F8 before windows go out and select from the boot menu). On drive C and other drives type the following commands: 1. attrib -h -r -s autorun.inf    2. del autorun.inf

Do this steps to other drives to disable the autorun.inf.

Now,Disable autorun.inf from Registry.

Now you can disable the AUTORUN for all drives by configuring the registry. Open the registry by typing regedit.exe to the command prompt (if your still at the command prompt) or execute it in Run. Look for the HKEY_CURRENT_USER\Software\ Microsoft\Windows\CurrentVersion\Policies\Explorer as shown below:

Double-click the NoDriveAutorun DWORD entry and type the value HEX: FF (255 in Decimal). (If the NoDriveAutorun does not exists, you can creat it by right-clicking the right side area of the regedit window, then click New->DWord Value -> type NoDriveAutorun) Close the registry and restart the computer. This procedure will disable all the autorun for all drives of your computer and at least will prevent the autorun function of infected USB drives or CDs and avoid the infection of viruses like the Bacalid and RavMon.exe.

If you want to prevent viruses that uses autorun.inf  to infect your USB flash drive, try to do this:

1. Open your flash drive via Command Prompt (do this via Start->Run->cmd.exe)

2. Change your logged drive to your USB flash drive (e.g. if your drive is at drive E: then type E: on the command prompt then press enter)

3. Create a folder named: AUTORUN.INF on the root directory of your flash drive. (to do this type the command: MD\AUTORUN.INF). If an error: a subdirectory already exists… shows, try to follow the instruction above to remove existing autorun.inf before doing this instruction.

The reason why this will avoid future infection is that autorun.inf viruses usually generates a file autorun.inf. Having an AUTORUN.INF folder on the root directory of your drives will make virus programs unable to create their own autorun.inf file, virus can’t even overwrite it because it’s a folder and not a file.

WIN32 AUTORUN.GEN REMOVAL

This detection is for a worm that attempts to copy itself to the root of any accessible disk volumes.
Additionally it attempts to place an Autorun.inf file on the root of the volume so that it is executed the next time the volume is mounted.

EFFECTS OF WIM32 AUTORUN.GEN WORM

This detection is for a worm.It attempts to spread to removable drives by creating an autorun.inf file, which will run the worm automatically, if a systems which use the removable drive are set to Autorun.

The following files are written to root of writable volumes:
AdobeRd9.0.exe
autorun.inf
scene.exe

The following files are also written to the infected system:

• %WinDir%\services.exe

(where %WinDir% is the default Windows directory, for example C:\WINNT, C:\WINDOWS etc.)

The following registry keys are created:

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnabled: "FALSE"
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Update Client: "%WinDir%\services.exe"
• HKEY_USERS\S-1-5-21-746137067-299502267-1547161642-1003\Software\Microsoft\Windows NT\CurrentVersion\Windows\Run: "%WinDir%\services.exe"

The following files are written to root of writable volumes:

• AdobeRd9.0.exe
• autorun.inf
• scene.exe
• Symptoms

Existence of mentioned files and registry keys
Method of Infection

This worm may be spread by its indented method of infected removable drives.
Alternatively this may be installed by visiting a malicious web page (either by clicking on a link, or by the website hosting a scripted exploit which installs the worm onto the user's system with no user interaction.

HOW TO REMOVE WIN32 AUTORUN.GEN WORM

It is suggested to use strong worm killer software.Download it.