Autorun.inf can still effect Windows 7 [ i need help]

dbk47

Distinguished
Dec 4, 2008
68
0
18,630
hello guys i need a little help here i getting hard time solving how to remove autorun.inf in Windows 7 i follow some other website but most its from XP that some locations that parts from instruction are not present on Windows 7 i tried manually delete the Autorun.inf folder on my drive D and E but it saying "Could not find item this is no longer exist" and another problem is some .EXE file is still corrupted like Gears of War i downloaded from different site and main site when i try to run it an MSDOS window poped out and theres a weird running on taskmanager its "UPDATE~2.exe" description say "Update manager" and "oldmcdonald.exe"..i scan my computer using Avira PRO (updated) it always found clean,Kaspersky,and Avast , anyone knows about this virus?
 
Solution
Whenever you plug a USB drive in your computer, a window will appear (if your autorun is enabled).

Don’t click on Ok , just choose ‘Cancel’.

Open your command prompt. Type ‘cmd’ in the run box or on the search panel if you are using vista

In the command prompt type the drive letter of your usb device and press enter. ex. C:\F: <— then press enter

Type dir /w/a and press enter. ex F:\ dir /w/a <— then press enter

This will display a list of the files in in your flash drive. Check if the following files present on your USB device.

* Autorun.inf
* Ravmon.exe
* New Folder.exe
* svchost.exe
* Heap41a
* or any other exe file that you find suspicious.

If you spotted any of the above files, then most probably your drive is infected.

To...

dbk47

Distinguished
Dec 4, 2008
68
0
18,630
Malwarebytes. didn't help my problem..my drive C was freezed by Deepfreezed so i dont have to worry about Drive C and regedit and some stuff on Drive C however Drive D and E has Autorun.inf and i don't think how to remove it like on XP..
 

dbk47

Distinguished
Dec 4, 2008
68
0
18,630
thanks for replying saran008 but im deciding to reformat my entire driver i already backuped my stuff i already tried almost 30 types of anti viruses including anti malewares and force deleter ,i followed some removals but still i haven't got any chances the weirdest thing is none of them find anything this could be new Autorun virus? and

PS: the "oldmcdonald.exe" is from USB anti virus i figure its not part from Autorun.inf so its not a virus

 

jedimasterben

Distinguished
Sep 22, 2007
1,172
1
19,360

Glad you got it removed. I swear, malware is getting significantly sneakier these days, the bastards.
 

ricky_critic

Distinguished
May 27, 2010
183
0
18,710
Whenever you plug a USB drive in your computer, a window will appear (if your autorun is enabled).

Don’t click on Ok , just choose ‘Cancel’.

Open your command prompt. Type ‘cmd’ in the run box or on the search panel if you are using vista

In the command prompt type the drive letter of your usb device and press enter. ex. C:\F: <— then press enter

Type dir /w/a and press enter. ex F:\ dir /w/a <— then press enter

This will display a list of the files in in your flash drive. Check if the following files present on your USB device.

* Autorun.inf
* Ravmon.exe
* New Folder.exe
* svchost.exe
* Heap41a
* or any other exe file that you find suspicious.

If you spotted any of the above files, then most probably your drive is infected.

To remove the virus, type in to your command prompt “attrib -r -a -s -h *.* and press enter. This will remove the Read Only, Archive, System and hidden file attribute from all the files.

To delete the virus just type del and the filename ex. F:\del virus.exe and hit enter.Delete all the files that you suspected is a virus. After deleting the virus, run a virus scan on your USB device just to make sure that your device is clean.

Remove the USB drive and plug it again. In most cases, the real culprit is “Autorun.inf” file which gets executed when someone clicks Ok in the dialog window which appears above. Thus the infections can spread.
 
Solution

JessicaD

Distinguished
May 4, 2009
454
0
18,810
Have you tried Super Anti Spyware in addition to Mbam?

Are you trying to disable autorun or remove a virus that has attached itself to your autorun functionality?

Jessica
Microsoft Windows Client Team