How to remove autorun.inf from USB Drive

External drives like USB Flash drive, USB hard disk and MP3 Players are among the top spreader of computer Worms. If any of the given devices is compromised, the worm quickly looks for any drive it can infect that is attached to the same system.

Worms spreads by creating a copy of itself and starts by an autorun.inf files. It is essential to remove the malicious autorun.inf files not only from computers but also from the source, and that is the USB Drive.  If you already tried Flash Disinfector but have no success in removing the virus, this procedure can help delete malicious files on infected drives.


How to remove autorun.inf from USB Drive Using Windows:
1. While the computer is still off;
2. Plugin the USB Drive
3. Insert the Windows CD-ROM into the CD-ROM drive. It must be the bootable Windows Installer
4. Start the computer from the CD-ROM drive. It will start Windows Setup screen
5. When the “Welcome to Setup” prompt appears.Press “R” to start the Recovery Console
6. If asked “Which Window installation would you like to logon to” select the number. Type “1” then Enter, if only one installation of Windows is present
7. Enter the administrator password, press Enter
8. It will bring you to command prompt, C:\Windows>
9. Proceed with the following command:

– Type d: (This is the drive letter of USB. It can be e: or f: defending on how many hard disk or cd drive is installed)
– Type attrib -h -r -s autorun.inf
– Type “edit autorun.inf” it will open DOS Editor and display contents as follows:

==========================
[autorun]
open=file.exe
shell\Open\Command=file.exe
shell\open\Default=1
shell\Explore\Command=file.exe
shell\Autoplay\command=file.exe
==========================
Take note on the file it will run. In the  above example it is file.exe

10. Exit DOS Editor and return to command prompt, D:\>

11. Delete the file that was called to open on DOS Editor
– Type del /f /a file.exe

12. Delete autorun.inf file
– Type del /f /a autorun.inf

13. Exit Recovery Console by typing exit.

 Also see: Malwarebytes Flash Scanner and Flash Drive Worm Killer

You might find these helpful:

94 Comments

  1. Robert George
    Feb 20, 2008 @ 20:00:45

    The ultimite anti-virus 2007 scammed me out of $49.95 and I would like a phone number to their customer service so I can get my money.

  2. vfd
    May 06, 2008 @ 16:36:39

    Wht if v dont have the CD now??

  3. webmaster
    May 16, 2008 @ 12:31:59

    If you dont have the recovery cd, you can go to Start>Run, type CMD

  4. moh
    Jun 19, 2008 @ 11:20:36

    i do that but i receiv access deny to drive when i try to excute del command .i am login as administrator
    but i receive this message again
    please help me
    i able to see every folder in my flash

  5. Aris
    Jul 15, 2008 @ 16:15:35

    If I will do it. Is it affecting to an other programs and files? I mean just like restoring the computer. will I lose the files and additional programs? thanks

  6. Nishant Srivastava
    Jul 16, 2008 @ 16:37:25

    Dude…i tried it out….but the access to the autorun.inf file is denied so u can’t change the attributes & thus can’t delete it………n one more thing……the edit command was nt accepetd as a valid command in the Recover Console’s DOS Prompt…….hard luck….
    Thanks Newayz……

  7. boris
    Aug 28, 2008 @ 14:50:04

    this works but keep in mind that your computer might be infected already, not just the usb stick. if you delete teh virus from the usb, the computer can infect it right after again. i’m running the latest anti-virus by symantec so that picked up the worm and deleted it right away. i only had to clean the autorun.inf from my usb stick.

    you don’t have to go to the recovery console to do that, there’s a way straight from windows. in an explorer window navigate to Tools/Folder Options/View and make sure “Show Hidden Files” is ON and “Hide Protected Operating System Files” is OFF. i had to reselect those options on my computer to take effect. after that “autorun.inf” shows up along with the virus files. to delete them right-click on them and go to Properties then remove the “Read-Only” flag. now you can delete it.

  8. Abin Mathew
    Sep 18, 2008 @ 03:25:48

    yes i tried it out
    i think there is no need of using the bootable cd or something like that. Just go to the command prompt in the os itself and change the attribute of the autorun.inf file. After that delete the same. Before deleting that u have to check for the file that is executing while autorun. Search for it and delete that too..

  9. lepau
    Sep 30, 2008 @ 04:47:58

    i can’t perform the del /f /a file.exe part… it canot find “file.exe” can you please send me an alternative.. i also did the remove the read only flag” way but autorun still show up..

    can you please reply on my email.. thanks in advance

  10. lepau
    Sep 30, 2008 @ 04:48:29

  11. clement
    Oct 09, 2008 @ 04:07:02

    the only way 2 delete the file is to do it using the win bootable disk while booting itself…. u will not be able to del the file once logged in…..It stops the administrative privillege to view hidden files…….

  12. mr x
    Oct 10, 2008 @ 03:34:10

    i failed. nothing occur
    no effect at all

  13. Khalid
    Oct 14, 2008 @ 10:45:17

    I tried removing the file , everything is ok , but as soon as I restarted the computer everything returns as it was , big Problem

  14. Maanit
    Nov 14, 2008 @ 03:39:56

    i have flash drive , i have repeated the steps again almost 7 times now. i delete the files called lky.exe and autorun.inf and then run avg antivirus to remove other virus. I also format the drive to clean it completly. still if i see lky.exe and autorun.inf replicates its self and they seems to not removing. :( somebody help !!!

    maanit ([email protected])

  15. V-guy
    Nov 14, 2008 @ 12:14:31

    lky.exe is a bitch to remove, but I think I know how you can contain it. Download and run combofix (you’ll find it if you need it) and run it. When you do it will remove the autotun.inf file from all drives.

    Then allow hidden folders to be viewed again (through folder options) and then go to the c: drive. You should see that autorun.inf is no longer there (although lky.exe probably still will be). Now here’s the tricky bit – create a new folder called “autorun.inf” in the c: drive. That will stop the autorun.inf file from being created the next time you reboot.

    You will need to do this for all drives attached to your computer (not the scan, just the folder). Remember that all your usb drives will be infected too so be smart about what you do – don’t just re-install them.

    I think if you do this first and then follow the steps mentioned here it should work as a temporary fix and lky.exe won’t be able to run unless you double-click it.

    My 2 cents worth…

  16. Kostas
    Nov 14, 2008 @ 14:13:51

    I had the same problem, the simplest way is to use Windows system restore in order to restore your registry to an older data.
    (Start->All Programs->Accessories->System Tools->System Restore and select a date prior to the infection)
    This way you may loose some recently installed programs (and programs only, no data loss) but you are clean once and for all.
    If you have usb disks you may also want to check them as well and using a command console (Start->Run->cmd.exe) go to the usb disk root and give:
    del /F /A autorun.inf
    del /F /A lky.exe
    The last step is better to be done in safe mode.

  17. Maanit
    Nov 15, 2008 @ 02:21:11

    V-Guy and Kostas,

    You both are great, it was a great advice.

    1. I ran combofix, it deleted autorun.exe from my all drives partitions.

    2. i restarted computer in safe mode, usb drive was plugged in..

    3. went to usb disk root from cmd, and attrib -r -s -a -h *.*
    del /F /A autorun.inf
    del /F /A lky.exe

    moreover,
    c:\ del /F /A lky.exe
    d:\ del /F /A lky.exe
    and so on till what partitions are….

    guess what :) it did not replicate lky or autorun.inf it seems all good…and V-Guy 2 cents worth… :P Thanks a lot

  18. vishal patel
    Nov 19, 2008 @ 06:26:31

    i get successfully remove autorun file

    thanks

  19. Stephanie
    Nov 19, 2008 @ 18:46:54

    I had a really nasty trojan infection which I suspect came from a friends USB, and I first tried messing around with Registry keys, going to cmd, changing the folder options, totally screwed up my laptop (made it so that even my antivirus couldn’t detect the trojan anymore, and I couldn’t even open my C or D drives cos it immediately got infected)

    So I used Kostas’ method. Didn’t know why but I decided to just try system restore to an older date (a week before) and the trojan miraculously disappeared! Mine was the kxvo.exe virus/trojan. My laptop is now in perfect condition and boy am I glad :D

  20. Mark
    Nov 25, 2008 @ 12:04:47

    Hi,

    I’m having real problems deleting autorun.inf from my Maxtor 500GB external USB drive. I think this file is a virus as the drive locks up the PC every time I access it. I have tried disabling the power management option so it can’t be that. I have also run combofix and that cannot delete it either. HELP!!!

  21. BigU
    Nov 25, 2008 @ 14:09:40

    I tried your registry modification on my Win XP machine, but it did not work AT ALL.

  22. vahid from iran
    Nov 26, 2008 @ 07:23:25

    in iran i have bought nod32 mcafee norton … and many other up to date virus scans for only 1 dollar and none of them were able to delete my usb viruses . i dont know why?

  23. Jesse
    Dec 03, 2008 @ 20:03:16

    I have seen this time and time again. What a pain! You will need ComboFix – hxxp://download.bleepingcomputer.com/sUBs/ComboFix.exe

    Download it to your desktop and run it WITH your external drive plugged in. Make sure you’re currently viewing hidden files/folders and protected operating system files. Look for hidden CONFIG and SYSTEM folders on your C: and your external drive. Thats where the culprit hides, and the autorun is executing the culprit.

    The ComboFix log will be displayed when it’s done. Look at it, and specifically for an entry near the bottom of the log that might show ROX.exe. DELETE that entry from the registry.

    Reboot and see if those hidden folders CONFIG and SYSTEM exist on your C: or external drive. Delete if so. Ultimately you need those removed as well as the autorun.inf from the external.

    Hope your USB drive hasn’t been plugged into any other PC because that one will have it too.

    Good Luck!

  24. joeven
    Dec 05, 2008 @ 06:29:22

    thank you… i got it.. its very simple!
    have a nice day!
    just clear the file attributes and delete.

  25. hahahah
    Dec 13, 2008 @ 10:10:22

    [autorun]
    open=shutdown.exe
    shell=!@#$%
    &shell=%^&*

    TRY THAT!!!to remove
    cmd and then type the drive letter where autorun is
    and then type autorun.inf
    attrib autorun.inf -h -r -s
    del autorun.inf
    tada!!

  26. hahahah
    Dec 13, 2008 @ 10:13:07

    soooooooooo simple!!
    2 create a virus tut by me:[email protected]

    just email me!!

  27. hahahah
    Dec 13, 2008 @ 10:17:27

    watch my vid OTENVIRUSKIKO on youtube!!

  28. hahahah
    Dec 17, 2008 @ 09:37:41

    ahm,download my autorun remover/detector now

    download:########.### just scratch it :p

  29. pheap
    Dec 20, 2008 @ 09:40:23

    I am hard to clean this virus! Autorun.exe and Autorun.inf

  30. julius
    Dec 24, 2008 @ 07:50:35

    I’m surely it works… but sometime deleting the virus will leave some script… if you open c: in my computer i notice that it run some open with.. this really pain in the a$%*
    by the way i try to figure it out.. so try this

    •click run
    •type regedit
    •ctrl+f
    •in the registry find mountpoints2
    •delelete all mountpoints2 in regedit
    •works?
    •email me….

  31. arthi sankar
    Jan 04, 2009 @ 05:00:03

    but while editing its telling as the file s read only.. wat can i do? plz help..

  32. Ravi Kumar
    Jan 08, 2009 @ 05:12:26

    I have windows vista, how to remove “autorun.infi” from the USB

  33. Dheeraj Kumar
    Jan 14, 2009 @ 18:36:04

    Thanks a lot “V-guy and Kostas” Ur tricks working.

  34. Hesoyam
    Feb 14, 2009 @ 04:04:00

    My computer s not able to detect autorun.Inf in dos

  35. me
    Feb 15, 2009 @ 18:17:00

    One genius boris in his comment advised that there is no need to edit the autorun.inf in command prompt.
    How stupid

    [autorun]
    open=file.exe
    shellOpenCommand=file.exe
    shellopenDefault=1
    shellExploreCommand=file.exe
    shellAutoplaycommand=file.exe

    The line shellExploreCommand=file.exe tells what will happen if you explore the usb drive – it will execute the virus.So you will get infected.

    The last line is the reason why you have to do it the way it was described.Or you can just disable autorun function in Windows.And then use the command prompt.
    Or you can boot in linux live cd and do the whole thing there.Then you can explore the usb drive without any fear of getting infected.

    The main reason of editing the autorun is to see the location of the virus on the USB drive and its name.Some aoutoruns are written in weird codings so you can not read them.
    Anyway if you know the name and the location of the virus, simple rename it and delete it.Autorun file is just for background execution of the virus file once you have open your drive, or use the autorun function of Windows.

  36. MisterHighway
    Feb 19, 2009 @ 03:40:27

    I had the following issue:

    Recycler & Autorun.inf on all of my USB drives. I used a program called “Flashdrive Cleaner” or something. It worked…sorta. What it does is creates a a file on all of your drives (hard disks and flash drives) called Autorun.inf instead of the actual inf file. This works (I did this prior) except the worm still tries to write constantly to your disk. I narrowed down what file was causing it by using “UsbSpy”. It comes with 15day evaluation trial. After installing it and rebooting your pc, launch the program. I selected my flash drive (mass storage device at the bottom of the list for me) and started capturing the file access. It showed me that “svchosl.exe” (NOT SVCHOST.EXE!!) was access and trying to write about every second. This was my worm. So I googled its removal and downloaded a program call SDFix. It is about 1.5mb and worked like a charm. You install it, reboot in safe mode and go to Start>Run>C:\SDFix\runthis.bat – It takes about 10-15 minutes to go through this and then it reboots. Afterwards it indicated that it found and removed the worm (svchosl.exe) on both pc’s I used it on. I believe I got this worm from a new SDHC flash card I got because I had no problems before I stuck it in there. I tried it in another pc and it infected that one too before I figured out what it was. This worked for me and I hope this helps or fixes your problem! Best of luck.

    [MisterHighway]

  37. ebbudy erbess
    Mar 16, 2009 @ 17:41:28

    dEAR ALL plz help me
    i have autorun.inf in disk c d and e
    i do
    dOs:
    attrib autorun.inf -s -r -h
    but
    message showed
    ACCESS IS DENIED
    plz help me
    note : no antivirus can help me
    abed lebanon

  38. jilani
    Mar 19, 2009 @ 02:54:11

    the best way to remove autorun.inf from ur flash drive.
    insert ur flash drive in ur computer and restart ur computer..
    using a windows vista bootable dvd and start booting from dvd and you noneed to format but just as u see all local drives in the system u can also able to see ur flash drive or usb drive then u just need to format it from ur dvd and keep in mind that it should be fat32 format there is an option to format fat32 or ntfs use fat32 format to format ur usb drive and then ur usb is clean from viruses..

    sorry i don ‘t know what do if u don ‘t have vista bootable disk..
    Thanks for reading this article..

  39. A
    Mar 20, 2009 @ 05:56:58

    how exactly do u go to the usb disk root ? i tried and reply is there is nO such command…. maybe i am doing things wrong, HELP

  40. jagdish
    Mar 24, 2009 @ 05:33:15

    how to break windows xp passwrod which administrator and all users are password protected.
    i cant enter in windows without enter password.
    pls help me

  41. sudhakar
    Mar 27, 2009 @ 20:20:24

    i did one type of experiment on my non format able USB,
    here it goes…go to run> cmd > format k: /v /q
    and press enter..this formats the drive forcefully.here k denotes the drive letter. v is volume and q is quick type…njoy with this..no need of any extra software..jjust try our own dos commands…
    thank u

  42. John
    Apr 01, 2009 @ 06:52:01

    lol try using cmd to remove autorun.inf
    but still not remove lol i try many times
    to delete but still can’t.. i have delete but
    when i open my drive still can’t delete that
    aurorun.inf help me someone!

  43. Ankit
    Apr 01, 2009 @ 08:16:41

    I hav tried a lot bt still no results.
    autorun.inf is not been visible in usb drive & whenever i plug it in the comp,the virus tries to access Explorer.exe into WINDOWS folder.
    what to do??? I m having nod32 antivirus.

  44. Turn
    Apr 02, 2009 @ 18:34:00

    Can Anyone help me out here ??
    I have try all the way to delete my autorun.inf file from my external hard disk, but it seems cannot function at all.
    In CMD , attrib the autorun file is all get Access Is Denied, can anyone here help out me to del this ?? i have try to reformat hard disk, but it still always shows up after i plug in into the computer.

    Any good suggestion on delete this autorun.inf in new way??

    email me, [email protected]

    Thanks alot.

  45. dod
    May 10, 2009 @ 14:25:15

  46. Alexis Nunez
    May 12, 2009 @ 05:38:36

    autorun.inf problem can be fix using this simple walktrough.

    start->run->gpedit.msc

    ***Group policy window
    User Configuration-> Administrative Template-> System -> Disable Autoplay

    ***Properties Window
    Select ENABLED then Disable Autoplay on “ALL DRIVES”

    then OK and Close the Group Policy Window

    ***Restart Your PC
    After Restart
    Start->Run->Notepad
    ***Copy below and paste to notepad
    *** Start Here
    attrib -h -a -r -s c:\autorun.inf
    del c:\autorun.inf
    attrib -h -a -r -s d:\autorun.inf
    del d:\autorun.inf
    attrib -h -a -r -s e:\autorun.inf
    del e:\autorun.inf
    attrib -h -a -r -s f:\autorun.inf
    del f:\autorun.inf
    attrib -h -a -r -s g:\autorun.inf
    del g:\autorun.inf
    attrib -h -a -r -s h:\autorun.inf
    del h:\autorun.inf
    *** End Here

    *** Save as C:\KILLAUTO.BAT

    *** To execute for KillAuto.bat
    Start->Run->C:\KILLAUTO.BAT

    This process will delete autorun.inf in drive c,d,e,f,g,h

  47. Emraan Rehman
    Jun 25, 2009 @ 16:01:58

    Use Flash Disinfector.exe
    I hope you like it, it remove all effected auto run.ini & .exe file by All drives

  48. Emraan Rehman
    Jun 26, 2009 @ 06:27:19

    Start->Run->Notepad
    Copy below and paste to notepad

    Start Here

    attrib -h -a -r -s c:\autorun.inf
    del c:\autorun.inf

    attrib -h -a -r -s c:\s.exe
    del c:\s.exe

    attrib -h -a -r -s d:\autorun.inf
    del d:\autorun.inf

    attrib -h -a -r -s d:\s.exe
    del d:\s.exe

    attrib -h -a -r -s e:\autorun.inf
    del e:\autorun.inf

    attrib -h -a -r -s e:\s.exe
    del e:\s.exe

    attrib -h -a -r -s f:\autorun.inf
    del f:\autorun.inf

    attrib -h -a -r -s f:\s.exe
    del f:\s.exe

    attrib -h -a -r -s h:\autorun.inf
    del g:\autorun.inf

    attrib -h -a -r -s h:\s.exe
    del g:\s.exe

    attrib -h -a -r -s i:\autorun.inf
    del h:\autorun.inf

    attrib -h -a -r -s i:\s.exe
    del h:\s.exe

    attrib -h -a -r -s j:\autorun.inf
    del h:\autorun.inf

    attrib -h -a -r -s j:\s.exe
    del h:\s.exe

    End Here

    Save to .BAT file extension (KillAuto.bat)

    Execute for KillAuto.bat

    Start->Run->C:\KILLAUTO.BAT

  49. Piyush
    Jul 07, 2009 @ 11:07:58

    in safe mode go to main screen——–>
    go to run->cmd->advanced->autorun.inf->remove->settings->disable

    nothing will happen……….go n do ur work

  50. BHARGOB
    Jul 26, 2009 @ 17:20:45

    Help me guys !!!!
    My computer is completely infected with autorun.inf file “p.exe”. i am not a computer expert. tried “autorun eater”. “autorun virus remover v2.3″. “kaspersky”, “quickheal”. No result at all.

    Quickheal shows- “Detected: W32.Autorun.Gen in” and “file was repared”

    Autorun eater shows-
    [AutoRun]
    open=p.exe
    shell\open\Command=p.exe
    “Remove autorun.inf

    tried all, but no result…

    PLZ PLZ PLZ
    HELP ME SOME ONE………..

  51. Rhinx
    Jul 30, 2009 @ 09:14:18

    Hi,
    Would like seek assistance re this:
    1.) Task Manager is disabled
    2.) Typing “virus” word would close internet explorer…
    3.) Tools –> Folder Options, can’t change any settings
    4.) I always find bi mat.exe in all of my drives
    5.) Can’t install antivirus.
    6.) I don’t have the option to reformat because i have files which i can’t lose.

    btw… first time here… ill try combo fix first if it works…

  52. Dodz_Cybernotic
    Oct 09, 2009 @ 08:02:00

    Is all the post comment answer is true?!

  53. Dodz_Cybernotic
    Oct 09, 2009 @ 08:04:14

    Is it safe to apply the method that they post in the command prompt?! tnx..

  54. Anonymous
    Oct 17, 2009 @ 09:27:16

    Some steps were not required, at my perspective anyway, Just run Cmd as administrator by rightclicking cmd.exe>runas>administrator/password etc.
    ->type: G: (or F: C: etc. if whatever is your usb Dir.)
    ->then type: attrib -s -h -r autorun.inf (works also to…attrib -s -h -r zPharaoh.exe)
    ->Then type: del autorun.inf (del zPharaoh.exe)
    ->remove your usb then connect it again and check if its still there…

  55. himadry
    Oct 23, 2009 @ 12:01:25

    Help me, Plzzzz

    i’ve problem with my usb drive, that files & folders are not copied from PC but its easy to copy from pen drive or CD drive. when i want to copy from PC to Pen drive then the report shows file was n’t copied. Don’t know why? What should I do now? Plz somebody help me.

  56. dess
    Oct 24, 2009 @ 22:59:34

    Trying to get solution. I will post if I found ana answer.

  57. altkey
    Oct 26, 2009 @ 07:25:34

    i am having same problem here with autorun.inf / ctfmon.exe and other related viruses/worms on my pc. and currently trying all the advices i got here thanks. but i have questions, it happens to you guys that u cannot unhide the hidden files? and got a problem of alt-key not working? alt key is so important. how to re-do the damages caused by this things using the “format”cmd as the last option… :D -)cebu(

  58. x-x
    Nov 18, 2009 @ 02:58:58

    ok, here’s the problem
    after removing the autorun.inf
    i can’t autoplay the removable drives,
    any solution?

  59. jon
    Dec 30, 2009 @ 05:55:04

    Help!!! I have the problem with the virus ghost.exe which hiding inside the recycle folder in my usb drive. whenever i try to delete it comeback again, like replicate. I can’t see the ghost.exe in the explorer, even i already change the view options. But when i start winrar the ghost.exe is there. The autorun.inf in my usb drive keep coming on and off, and when i run cmb it wont appear.

  60. waybuot
    Dec 30, 2009 @ 08:48:35

    dude! I’m not in to it!can you share a removal software for autorun it makes life easier …(T T)

  61. Manish
    Jan 01, 2010 @ 18:00:18

    thanx Sudhakar buddy i saw ur 27th March post and i tried the same for removing my autorun.inf file from my USB and i finally succeed thanx to u…

  62. Kenneth Henning
    Jan 10, 2010 @ 19:10:45

    You guys are partially right, but I had the same symptoms and tried most of these procedures which didn’t detect anything on my flash drive. If you’re having the same problem that I had (with svhost.exe) do the fallowing

    1. perform actions to make all hidden files visible(start-> My Computer -> Tools -> View -> Show Hidden Files and Folders)

    2. Explorer the Flash Drive (If you don’t , you will run the worm which is pointless. Right click on drive and select Explore)

    3. Now that you should have your hidden files shown, click on “Autorun.Inf”

    4. In Notepad (default for editing Autorun files), you should see code that looks similar to this:
    [autorun]
    open=svhost.exe
    icon=autorun.ico
    (yours will be different)

    5. highlight and erase all code except the [autorun] line and click save.

    6. Now find the .exe it was loading during autorun and delete it.

    7. Take your Flash Drive out and insert it into the computer once again, that should fix the problem. do this for all infected flash drives you have before it’s too late. It already infected 3 of mine.

    =======================================

  63. yousuf
    Jan 17, 2010 @ 12:54:09

    please help me how can delet autorun.inf file

    my external HDD infected anbody help me

  64. whatinthebutt
    Jan 22, 2010 @ 13:19:08

    I went in CMD (run cmd in win start menu)

    typed G:/edit autorun.inf

    then in there i changed auto”someting”=1 to auto”something”=0

    then removed it in dos by g:/del *.*

    make sure u unmark “hide protected files operating system files” in folder options

    my AVG picked the files upp, but only removed the files, not the virus

  65. jake
    Jan 23, 2010 @ 12:23:16

    Use {Icesword} tool and force delete what ever you want! folks ..:)

  66. srikant
    Feb 04, 2010 @ 10:54:08

    Is there any tool for removing Autorun.inf

  67. Surjendu
    Feb 08, 2010 @ 05:44:53

    go to someones PC have linux platform and delete

  68. pupetmaster
    Feb 25, 2010 @ 16:28:38

    Even simpler, plug USB key into Mactintosh or macbook, delete all virus files (in my case, sep.exe-sud, ssow & others) then make sure autorun.inf is not locked & delete.

    This will also work on a boot disk of linux. That is how i clean my desktop’s hard disks.

  69. Basack
    Feb 28, 2010 @ 16:58:53

    hey guyz
    let me tell u a easier way 2 remove it….
    juz copy all ur files xecpt tht da Autorun.inf & RECYCLER into ur hard disk and just format ur USB flash drive….and thts it!!!! copy back ur files into USB drive…and u vl find no Autorun.inf & RECYCLER in your flash…
    (This can b done only if ur HDD is nt affectd by Autorun.inf worm)

  70. dam
    Mar 09, 2010 @ 19:04:52

    go to command prompt..
    edit Autorun file see the exe file name …
    now go to the dir where this exe file located.. if u r not abel to see the file then change the folder options as metion above…
    now go to the directory where exe file is located …
    type attrib -R -H -S filename.exe
    now type del filename.exe to delete the file
    now do the same steps to delete autorun.inf file :) .. It worked for me ….

  71. Jawwad Ahmed
    Mar 24, 2010 @ 07:19:45

    its too simple, just go to commond promt and format ur flash drive then come back to windows and del autorun file after that click on format from right click option on drive.
    i have resolve the matter just now.

  72. lili
    Mar 24, 2010 @ 13:05:57

    i found the autorun.inf is in my CD. How to remove the virus from my CD? Thanks in advance!

  73. vral
    Mar 24, 2010 @ 14:58:49

    This might work in some cases:

    Before plugging in your flash drive, first make sure you can view all hidden files and protected system files. Then, in your task manager, terminate the explorer.exe in the processes tab. Then run a new a process (also in the task manager), type winword. This should load your MS WORD.
    Next, use it to enter your flash drive ( if not yet plugged, plug it in first before searching it. Go to “FILE”, then “OPEN”. Locate your flash drive. Once inside, choose the file type to be “all files” then all of the contents of your Flash Drive should be viewable. Delete the malicious files!!!

    Note: Some malwares use the explorer.exe process, so disabling it will prevent them from executing.

  74. Micko
    Apr 11, 2010 @ 11:58:52

    I found some easy way, just go to Start>Run, type CMD
    an than type > cd.. and pres enter two times to retreat to c:\ command line, than type > I: (or witch letter is your plugged in USB) and than type > format I: , the computer will say to you that is not possible to format and would you like to force a dismount on this volume, just type > Y,
    and say goodbye to the virus, your USB is CLEAN

    Greetings from Serbia

  75. Amit Mittra
    Apr 13, 2010 @ 06:07:08

    don’t do anything…just serch ‘Autorun Eater’ in google and run…..

  76. Dheeraj
    May 09, 2010 @ 15:51:15

    Just search google for COMBOFIX.exe latest version and run and problem solved..It works

  77. jovrax
    May 18, 2010 @ 22:14:17

    OK, many interesting suggestion have already been posted. But the problem (removing autorun.inf + RECYCLER) can be more complex than what has already been described.
    I have 10 external USB drives. I could remove easily the malware from 7, but 3 disks are resisting removel:
    2 identical Simpletech (150 Gigs) and 1 WD (1TB), for those: NOTHING works, I even have tried to boot from a Knoppix(liveDVD): I can see the files but when I say DELTE theses files (Autorun + Recycler), I get ” cannot delete … (but I can delete OTHER files).
    I have inspected these maalware files using FileScavenger, I learnt that actually the autorun.inf had the attribute value : DELETED (the file is hidden / read only / and deleted). This type of information is not consistent with what I know (humbly) about file system management. I suspect a rootkit (not yet found on my system) that has totally subverted explorer.exe (or any other mysterious program that controls the autorun.inf.
    BTW, I have also used UNLOCKER and learnet that there are no hooks/handles of the autorun.inf
    Working in safe mode did do anything!

  78. Dheeraj
    May 20, 2010 @ 09:47:06

    Just google for COMBOFIX.exe download the latest version and run and problem will be solved.. Even Kaspersky can’t remove that autorun.inf file.

    Please try it.

  79. sweet
    May 20, 2010 @ 16:30:55

    procedure to remove the autorun virus is tough tell an easy method or provide a software to download for removing auto run from usb

  80. haay
    Jun 01, 2010 @ 17:35:39

    I followed this comment: (my problem is: HOW DO I UNDO IT? I WANT AUTORUN BACK T_T)
    “Autorun.inf problem can be fix using this simple walktrough.

    start->run->gpedit.msc

    ***Group policy window
    User Configuration-> Administrative Template-> System -> Disable Autoplay

    ***Properties Window
    Select ENABLED then Disable Autoplay on “ALL DRIVES”

    then OK and Close the Group Policy Window

    ***Restart Your PC
    After Restart
    Start->Run->Notepad
    ***Copy below and paste to notepad
    *** Start Here
    attrib -h -a -r -s c:\autorun.inf
    del c:\autorun.inf
    attrib -h -a -r -s d:\autorun.inf
    del d:\autorun.inf
    attrib -h -a -r -s e:\autorun.inf
    del e:\autorun.inf
    attrib -h -a -r -s f:\autorun.inf
    del f:\autorun.inf
    attrib -h -a -r -s g:\autorun.inf
    del g:\autorun.inf
    attrib -h -a -r -s h:\autorun.inf
    del h:\autorun.inf
    *** End Here

    *** Save as C:\KILLAUTO.BAT

    *** To execute for KillAuto.bat
    Start->Run->C:\KILLAUTO.BAT

    This process will delete autorun.inf in drive c,d,e,f,g,h”

  81. manas ranjan senapati
    Jun 02, 2010 @ 05:18:34

    In most of the cases the above mentioned procedure have failed. so to delete autorun.inf and autorun.exe Macafee antivirus version 8.5.0 or above is the best. U can download it free from different sites, search the net to download macafee antivirus for free. After macafee removes the virus/malware , chk the folder (a special folder that was created by the virus) that contained the virus and delete it to be in the safe side which upcourse is not mandatory.

  82. manas ranjan senapati
    Jun 02, 2010 @ 05:21:33

    In most of the cases the above mentioned procedure have failed. so to delete autorun.inf and autorun.exe Macafee antivirus version 8.5.0 or above is the best. U can download it free from different sites, search the net to download macafee antivirus for free. After macafee removes the virus/malware , chk the folder (a special folder that was created by the virus) that contained the virus and delete it to be in the safe side which upcourse is not mandatory. in case of doubts mail me [email protected]

  83. Vishal Tandel
    Jun 28, 2010 @ 13:23:30

    To remove / delete the autorun.inf file from your drive
    Open the task manager
    Select the explorer.exe process & select End Process
    This will result in disappearing the desktop items.
    But do not worry.
    You will have a windows task manager window open
    GO TO File
    Select “New Task [Run]”
    Type” CMD”
    Command window will open type the command
    Del d:\autorun.inf [select the drive letter properly]
    Close the cmd
    GO TO File
    Select “New Task [Run]”
    Type” Explorer”
    Your desktop items will re-appear.

    Thanks

    Vishal Tandel

  84. PHA REN
    Jul 08, 2010 @ 04:00:27

    I have problem is delete autorun.inf in USB Drive
    you help me!

  85. beedman
    Jul 13, 2010 @ 13:55:25

    I have found that using an Ubuntu live CD is quite helpful for deleting the virus/trojan.exe files as well as deleting the associated autorun.inf. Linux doesn’t use the autorun.inf file, so the trojans can’t do anything. I simply delete them, the little buggers.

  86. tulsi
    Jul 18, 2010 @ 14:06:21

  87. B Deepak kumar
    Jul 20, 2010 @ 09:01:04

    Most of the people have spoken about the problem ” Access denied ” which was faced by me too.

    I tried a trick to find the process which was accessing my pen drive using a software patch called “Who lock me?” (search in the google) and installed it.

    went to the particular file which refused to delete, right clicked on the file to get an option ” who lock me?”

    I got a window indicating the program which is accessing the file. I selected an option ” Kill process.”

    Later i was able to delete the file.

    But the problem is the file reloaded into the thunb drive.

    To solve the problem, i repeated the above steps to delete the file and now created a folder with name of the file which was deleted.

    For example the file deleted was with name “AUTORUN.INF” i created a folder with similar.

    Problem solved.

  88. I-hav-easiest-way
    Jul 23, 2010 @ 04:36:51

    1. Insert USB device
    2. It prompts autorun options. Do not open it, just close or cancel.
    3. Open
    4. Select then click from menubar
    5. Click on tab
    6. Choose and uncheck , click to prompted warning message
    7. Open C: drive to confirm. You will see some files AUTOEXEC.BAT, boot.ini etc.
    8. Run any program say Media player or MS word or whatever
    9. Now select File->Open. Brows your USB device. Select to
    10. Now you will see autorun.inf
    11. Right click on autorun.inf, then click and then make sure you have deleted it.
    12. Remove USB and re-connect
    ****
    and if you are a computer savvy then

    1. Show all type of hidden files including system files
    2. Brows USB device from any program
    3. Select File of Type to any file and delete autorun.inf

  89. pavan
    Jul 31, 2010 @ 12:27:44

    C:\>format h:
    Insert new disk for drive H:
    and press ENTER when ready…
    The type of the file system is FAT32.
    Verifying 3821M

    Format cannot run because the volume is in use by another
    process. Format may run if this volume is dismounted first.
    ALL OPENED HANDLES TO THIS VOLUME WOULD THEN BE INVALID.
    Would you like to force a dismount on this volume? (Y/N) Y
    Volume dismounted. All opened handles to this volume are now invalid.
    Cannot lock the drive. The volume is still in use.

    C:\>format H:
    Insert new disk for drive H:
    and press ENTER when ready…
    The type of the file system is FAT32.
    Verifying 3821M
    Initializing the File Allocation Table (FAT)…
    Volume label (11 characters, ENTER for none)? H
    Format complete.

    3,999,109,120 bytes total disk space.
    3,999,105,024 bytes available on disk.

    4,096 bytes in each allocation unit.
    976,344 allocation units available on disk.

    32 bits in each FAT entry.

    Volume Serial Number is 145D-A3FB

  90. Shane Naidoo
    Oct 09, 2010 @ 15:53:40

    The easiest way of removing the Autorun virus, on a pc or from a flash,
    Download a unlocker program, example Tizer unlocker.

    On windows show all hiden files, in you folder options.

    Search for the autorun file, it will look grayed out, then right click on the autorun file, and move you mouse to Tizer, there are three options, choose the delete option

    Thats it, it shoud be gone.

  91. Sunny
    Jan 13, 2011 @ 02:24:00

    The best solution is to Download USB Show this program will scan the files and folder and show wat ever hidden files were not showing in the usb Drive.

  92. rahul
    May 21, 2011 @ 07:36:46

    @ pawan
    thanks dude… i gone thru all above process… bt usless
    i tried all actions bt it couldnt delete … bt u r advise made it simple n useful

  93. chico@21
    Nov 24, 2011 @ 20:37:08

    OK, many interesting suggestion have already been posted. But the problem (removing autorun.inf + RECYCLER) can be more complex than what has already been described.
    I have 10 external USB drives. I could remove easily the malware from 7, but 3 disks are resisting removal:
    2 identical Simpletech (150 Gigs) and 1 WD (1TB), for those: NOTHING works, I even have tried to boot from a Knoppix(liveDVD): I can see the files but when I say DELTE theses files (Autorun + Recycler), I get ” cannot delete … (but I can delete OTHER files).
    I have inspected these maalware files using FileScavenger, I learnt that actually the autorun.inf had the attribute value : DELETED (the file is hidden / read only / and deleted). This type of information is not consistent with what I know (humbly) about file system management. I suspect a rootkit (not yet found on my system) that has totally subverted explorer.exe (or any other mysterious program that controls the autorun.inf.
    BTW, I have also used UNLOCKER and learned that there are no hooks/handles of the autorun.inf
    Working in safe mode did do anything!

  94. fasthits
    Jan 31, 2015 @ 09:35:36

    ??????????? ????? ? ?????? ? ??? fasthits.ru ??????? ???????????
    ?????? ???????? ??? ??????????. ????? ????? ?? ?????!
    ???? ?????? ???????? fasthits.ru

Leave a Reply

*

privacy policy