Autorun.inf worm

[FlowiXx]

Hello guys.

The problem I am having now, is autorun.inf worm. It actually is on my Local Disk C and I have searched whole day on other forums about this and couldn't find a solution. All I found is solution with Command Prompt "attrib autorun.inf -s -r -h" and then "delete autorun.inf". But then it says that it can't delete it because it is being used by another process. I opened Task Manager to make sure virus isn't using it, I ended it, and tried again, but no luck. It still can't delete autorun.inf even when all processes are turned off. Something is still using it. Any advice what could be using Autorun.inf so I can stop it and finally delete it? Malware programs didn't helped either.

 

[KSoD]

What malware programs? There are quite a few of them out there. Your best bet is to use those commands in Safe Mode.

 

[FlowiXx]

I downloaded one from malwarebytes.org because many people suggested it, but it didn't removed it. Here we go, when I try to enter Windows in Safe Mode my PC restarts. It can't boot in Safe Mode, I don't know why. I am using Windows XP Professional SP3.

 

[KSoD]

When you are booting you need to hit F8 before the Windows XP loading screen comes up. That will get you into Safe Mode. If you are already doing that and all it does is restart then you have some issues with your install that go beyond the autorun.inf infection you are trying to get rid of.

 

[disaksen]

If you've ever been unable to delete a file in Windows, and can't figure out what
program's using it, there is a good possibility "Explorer.exe" may be using it. The
main reason files can't be deleted is "Explorer.exe" locks files that are in use, thus
preventing them from being deleted. Most of the time, when you try to delete a file
that's in use, you'll receive an error message similar to one of the ones listed below.

"Cannot delete folder: It is being used by another person or program"
"Cannot delete file: Access is denied"
"There has been a sharing violation"
"The source or destination file may be in use"
"The file is in use by another program or user"
"Make sure the disk is not full or write-protected and that the file is not currently in use"

Usually, these locked files should not be touched, but sometimes, .. situations arise
when you really need to delete files or folders that are the source of system
problems. When this is the case, A small utility named "Unlocker" is the fastest and
easiest way to delete the offending files. You can download "Unlocker" from one of
the many download sites. The link below is one of those sites.
Download Unlocker 1.9.1 - FileHippo.com

Follow these directions:
1] Download and install "Unlocker".
2] Start the "Unlocker" Utility.
3] Click "Ctrl" + "Alt" + "Del" to open the "Task Manager".
4] In the "Task Manager", click on the "Processes" tab and locate "Explorer.exe".
5] Right-Click on "Explorer.exe" and click "End Process", then "Yes". [your screen
should go blank]
6] Click "Alt" + "Tab" to cycle through any running programs/utilities, to bring
"Unlocker" to the screen.
7] Navigate to the file you want to delete with "Unlocker", and by following
directions, you should be able to delete the offending file from your computer.
8] After deleting all the offending files, click "Alt + "Tab" to bring "Windows Task
Manager" to the screen.
9] Click on "File", then select "New Task (Run...)".
10] Enter "Explorer.exe" in the "Open" box, then click "OK". [Your screen should
return to normal]
11] Delete the contents of the "Recycle Bin", and reboot. [IF the deleted files were
part of a virus or other malware, you should boot into "Safe Mode" and perform Anti
malware scans, OR set up a "Boot-Time" scan if your anti malware programs have
that option.
The offending, undeletable files should be gone.

 

[FlowiXx]

Thanks for your reply "disaksen". This utility helped me to remove autorun.inf , but somehow even after deleting it, it still comes back. I am planning to re-install OS to get rid of this problem, but if it can be removed, I'd be grateful to anyone who helps me with this.

 

[luke127]

Are you sure it's actually harmful? Some of them are actually helpful and if you delete them will just come right on back.

 

[carnageX]

Are you sure it's actually harmful? Some of them are actually helpful and if you delete them will just come right on back.

No worm is helpful..

 

[luke127]

No that's not what I am saying I am saying does he ACTUALLY KNOW IT'S A WORM????

Autorun.Inf is a file that is designed to automatically run an EXE file which in some cases is actually helpful! Example I have an autorun.inf file which runs my Truecrypt file to mount automatically. So when I login I have to enter the password and it mounts. Heaps easier than having to open truecrypt find the file and then mount it.

 

[carnageX]

No that's not what I am saying I am saying does he ACTUALLY KNOW IT'S A WORM????

Autorun.Inf is a file that is designed to automatically run an EXE file which in some cases is actually helpful! Example I have an autorun.inf file which runs my Truecrypt file to mount automatically. So when I login I have to enter the password and it mounts. Heaps easier than having to open truecrypt find the file and then mount it.

I know what an autorun file is .

Usually when you delete an autorun file, it doesn't come back. Even then, if you open the autorun file in a text editor you can tell exactly what's being run... and if you don't recognize the file, and it's running from a hidden directory, usually those are signs of a virus..