Infected Autorun.inf

christopher2405 · 06-06-2009, 05:55 AM

I don't use this computer very often, but I know that it hasn't had a virus scan ran for a while, so I scanned today. Avast detected an infected autorun.inf file that it couldn't repair, and obviously I don't want to delete it, so I set it too ignore and came here for help.

The contents of the autorun file are:

Code:

[autorun]
;zuktydhikljsxeksaejwnyhxrlsxzahspbcfxcbmg
shellexecute="c:\"
;oybwezbbmymqebrgfwtpmhataotgovtealbjykb
shell\Open\command="c:\"
;vhpkcqztsgccopxlpgpncvphcnjqxnzklgloxnxlctghzcvvesuqkfizxtkeytykeoqxcanpcjowlwjwvbzhbrgwjyvsxvnkubeygyyupt
shell=Open

There were lines of text before the "c:\" parts pointing to \recycler\S-5-0-88-100002712-100017628-100002386-8777.com , but I deleted them because I immediately knew they were part of the problem (whenever I click on the hard drive in my computer, it brings up and error message about that particular file being missing and won't move on [although I can still access the hard drive through typing c:\ in the run box]). I re-scanned the file with Avast, and it didn't show up any problems, however the error message when I click on the hard drive still appears - why?

If someone could explain this, or even just provide a sample autorun.inf file that should be appropriate, I would appreciate it. Thanks in advance.

EDIT: Restart fixed original problem, but now when I click c:\ from My Computer, it opens in a new window, how can I stop this?

tetonbob · 06-06-2009, 09:14 AM

Hello -

These are signs of an autorun worm. You may also have USB devices which are infected.

As stated at the top of this forum, we do not assist with malware removal in this section of the forums. This is a general discussion section.

Please follow our pre-posting process outlined here:

NEW INSTRUCTIONS - Read This Before Posting For Malware Removal Help

After running through all the steps, please post the requested logs in the Virus/Trojan/Spyware Help forum, not here.

If you have trouble with one of the steps, simply move on to the next one, and make note of it in your reply.

Please note that the Virus/Trojan/Spyware Help forum is extremely busy, and it may take a while to receive a reply.

06-06-2009, 05:55 AM	#1 (permalink)
christopher2405 Registered User Join Date: May 2007 Location: Sunderland Posts: 156 OS: Windows XP Home SP3, Windows Vista Home Basic My System	Infected Autorun.inf I don't use this computer very often, but I know that it hasn't had a virus scan ran for a while, so I scanned today. Avast detected an infected autorun.inf file that it couldn't repair, and obviously I don't want to delete it, so I set it too ignore and came here for help. The contents of the autorun file are: Code: [autorun] ;zuktydhikljsxeksaejwnyhxrlsxzahspbcfxcbmg shellexecute="c:\" ;oybwezbbmymqebrgfwtpmhataotgovtealbjykb shell\Open\command="c:\" ;vhpkcqztsgccopxlpgpncvphcnjqxnzklgloxnxlctghzcvvesuqkfizxtkeytykeoqxcanpcjowlwjwvbzhbrgwjyvsxvnkubeygyyupt shell=Open There were lines of text before the "c:\" parts pointing to \recycler\S-5-0-88-100002712-100017628-100002386-8777.com , but I deleted them because I immediately knew they were part of the problem (whenever I click on the hard drive in my computer, it brings up and error message about that particular file being missing and won't move on [although I can still access the hard drive through typing c:\ in the run box]). I re-scanned the file with Avast, and it didn't show up any problems, however the error message when I click on the hard drive still appears - why? If someone could explain this, or even just provide a sample autorun.inf file that should be appropriate, I would appreciate it. Thanks in advance. EDIT: Restart fixed original problem, but now when I click c:\ from My Computer, it opens in a new window, how can I stop this? __________________ "Those who can, do; those who can't, teach; those who can't teach, teach PE" Last edited by christopher2405; 06-06-2009 at 06:04 AM.

06-06-2009, 09:14 AM	#2 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,552 OS: 2000 Pro; XP Pro; XP Home	Re: Infected Autorun.inf Hello - These are signs of an autorun worm. You may also have USB devices which are infected. As stated at the top of this forum, we do not assist with malware removal in this section of the forums. This is a general discussion section. Please follow our pre-posting process outlined here: NEW INSTRUCTIONS - Read This Before Posting For Malware Removal Help After running through *all* the steps, please post the requested logs in the Virus/Trojan/Spyware Help forum, not here. If you have trouble with one of the steps, simply move on to the next one, and make note of it in your reply. Please note that the Virus/Trojan/Spyware Help forum is extremely busy, and it may take a while to receive a reply. __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009