Posted by: Anurag Ojha | March 20, 2008

Removing the FlashDrive autorun.inf Virus

victory1.png Flash drives have become cheap and a preferred choice of data transfer for everybody these days. And in my college almost every system even with the best antivirus protection offered by NOD32 or Kaspersky is infected. Since I’ve been asked by many about this problem and how to fix it, Im writing a detailed account of the steps I follow to remove the infection. Ill also be writing some workarounds so even if you cant remove the virus you can get along with your life. Ill be updating this page often.

As of now my system is free from all infections and working perfectly well, but this is not the first that Im saying something like this immediately before my whole system crashes. But Ive always managed to fix it, never had to format my computer, however severe the infection. So if you have any trouble, follow instructions and then drop in with your details, I might be able to help.

Some of the symptoms of an infected computer:

  • Hidden files cannot be viewed. Changing options in Tools/Folder Options has no effect. Changing registry values has no effect. No restriction removal tools like RRT etc are able to fix the problem.
  • Regedit cannot be found when you try to invoke it from the RUN box.
  • Task Manager has been disabled by Administrator.
  • You cannot enter a particular drive ie when you click on your drive letters(C, D, E etc) in My Computer nothing happens.
  • Computer has become slow and there is noticeable delay in characters to appear on screen when you press in keyboard. The left and right strafing keys in Counter Strike 1.6 dont work. They work on CS: Condition Zero tho.

Virus Removal Strategy that works for me:

Full System scan

A full system scan using any of the following Antiviruses/antispyware tools usually do the trick.

  1. Eset NOD32 or Eset Smart Security Business Edition.
  2. DOS mode virus scan using the antivirus tools in HirensBootCD*
  3. Spyware Doctor and AdAware.
Identifying the Virus manually
Most of the time a virus gets detected but the antivirus software is unable to remove it. This is because either the virus is currently running on your system as one of the processes or is being protected by the Operating System Itself. So before doing the virus scan you have to take a few precautions:
  1. Download ProcessXP if you Task Manager is disabled.
  2. Download HijackThis from TendMicro
Both of these tools are helpful in revealing and killing hidden processes running on your system or those which have recently make changes. If you find something like:
  1. monit.exe– runs under explorer.exe, keylogger app, creates problems with Counter Strike
  2. scvhost.exe or 713xRMTmon.exe – not to be confused with svchost.exe, an important windows process.
  3. wscript.exe – a harmless process which can be made to execute harmful VBScripts like mswin32.dll.vbs
  4. amvo.exe or amva.exe
  5. autorun.inf – Its actually a harmless file. more info. But can be used to invoke a virus when you click a folder/drive which has this file.

Its best to kill/terminate them by Right Click/End Process Tree. Also a good practice is to EndProcessTree** Explorer.exe as well. And starting the antivirus executable from TaskManager/File/Run. And then run a system scan. Explorer can be started again from TaskManager/File/Run/ Type explorer [enter].

Several antivirus support forums help out people who submit their HijackThis log files.

Viruses usually invoke at startup. So its a good idea to check the startup list by StartMenu/Run/msconfig/Startup where you should find something suspicious Uncheck them(only if suspicious ones!)like scvhost.exe. Uncheck them(only if suspicious ones!). Restart your PC. Do system scan.

So how do you findout which process is malicious? Google them. If your data is important to you and you really want to remove the virus without formatting, you have to do this bit. When you familiar with which System processes you should be able to isolate the culprit by just seeing the list.

You can also goto the command prompt StartMenu/Run/command and then CD\ now you should be at the C:\ prompt. Now write type autorun.inf You should be able to see the contents of the autorun.inf file which for me was like

Deleting** Identified Virus files – Harddisk, Registry

Now that you have identified a file say like autorun.inf or mswin32.dll.vbs in the root of all drives or in your system drive. Immediately delete all instance of it on your system. If its protected download GiPo@MoveOnBoot locate the file and delete it. For more details read my article to Restore access to drives under My Computer.

You can also delete a file from DOS. the command DIR /w/a displays all hidden files and folders. with command attrib -s -h -r <filename>. Then delete <filename>

A virus also hides itself in the System Volume Information and PREFETCH folder. So it might be a good idea to turn off System Restore for a while. Doing so will delete all you previous system.

Another thing that I do this remove all traces of the virus file from the windows registry. Start regedit – StartMenu/Run/regedit. If your system cant find regedit. Copy it from C:\WINDOWS\system32\dllcache to C:\WINDOWS\system32\ or download it. After you open regedit Edit/Find/search for all entries of names of virus files mentioned earlier. Keep pressing F3 key to look for next result and delete** all of them.

To prevent future infections in your USB Drive, what you could try is create an empty autorun.inf file and set read only attribute to it. This should prevent a malicious autorun.inf taking its place. I tried it on some systems, it works!

Ive deleted the virus, But why is my task manager still disabled and files hidden?? … etc

This is because a virus/trojan/worm is the mother alien which an antivirus can remove. But the the settings and changes which they make does not concern an AV. You will have to change them back manually. If you still cant, that means there is some virus file enforcing those settings, like disabling Task Manager, Hiding files etc.

  • TaskManager disabled – Use RRT, or Follow instructions on mentioned here.
  • Files and Folders Hidden – Use RRT, or Goto registry
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ Explorer\Advanced\Folder\Hidden\NOHIDDEN “CheckedValue”=0 “DefaultValue”=2
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ Explorer\Advanced\Folder\Hidden\SHOWALL “CheckedValue”=0 “DefaultValue”=2

or download and run this regitry key.

In the end, there are a few golden rules that I find are always true. A virus is harmful while it is running. If you cant change your settings, that means something is blocking it or continuously enforcing it. So stop the virus from running. Delete all traces of the virus. Change back the settings manually.

Warnings!
*
Contains illegal compilation of shareware softwares. Im not encouraging you and take no responsibility if you go ahead and use them.
** Be very careful while deleting or modifying system files/registry entries, your system may not even boot the next time you restart your computer. Something might go wrong anyway, thats how it is with these things.

updated: 18th April

Advertisements

Responses

  1. Your page is the best I’ve seen, thanks. Ed

    My replicating INF looks like this ….
    PWS-LegMir.gen.k – Password Stealer

    ;j444i
    [AutoRun]
    ;Xaj3j2i5D2A3Dpjo3airklC3aiKwaoarr04o3a1wls44s2rJ7SeKwlwd3s5Sk4o2jDa1jaFjd
    open=bqk.bat
    ;12wklSf3mqi47siaaqq430IKowd7a4sswdsjkk5C5skrrOAeafrZeLjwAZ40n89iLk3s4Dr5wo8eKUiipk22aSodwswp2
    shell\open\Command=bqk.bat
    ;43KKfocdki3l7CkiXa3sdA0n19r2w8f
    shell\open\Default=1
    ;4a
    shell\explore\Command=bqk.bat …. and so on

  2. Hi, Thanks!

    From the looks of your autorun.inf it seems bqk.bat is the virus file. I would suggest finding one of those bqk.bat files and opening them using any text editor(notepad). The contents should reveal what exactly the virus file is doing.

    Its important that you find the virus executable currently running on your system, terminate it, and then begin the cleaning procedure.

  3. hi, i have AVG scanner which scans my system at start up…i recieeve a mess saying Virus is detected at C:\Autorun.inf…And i press c for continuing..i have scaned my pc but i am unable to del it..also i tried to see da contents of it in dos mode..it shows some mess like shell execute or somethn…even cant find the entry in Reg Edit…could u help me..should i download AD Aware ..and try to scann my pc..plz help..due to this trojan/virus….pc hs foll prob..
    1.i cnt enter my Drives when i click on them..
    2.my ctrl +alt+del doesnt work
    3.after sme time..my pc gets hanged..

    thnx in advance.

  4. Hi Riya,

    First of all I would strongly recommend getting ESET NOD32 antivirus and Spyware Doctor and doing a full system scan. I have personally tested almost all major AV brands and find NOD32 to be the best(and fastest). Email me if you need help getting them at -> a e l i e n at gmail because it might be illegal to share download links publicly.

    After you scan your system using the two above, if problem persists, reply back.

  5. […] .exe files inside a folder, with the same name as the folder. To remove that virus, check out the And Back Up blog, after you’re done with this removal. Fire up your Task Manager (Alt+Ctrl+Del) and end […]

  6. Hi. I was recently infected with a virus or worm of some sort. Similar to one of the examples you’ve mentioned about in another post, I couldn’t get into my partitions from My Computer when I clicked the icon. Also my antivirus would constantly notify me of some virus. Since then I have formated my computer and the laptop itself is free of virus. However, here my real problem now. Before I formatted my infected computer, I also had an external drive (F:) attached to my laptop and I had saved some of my precious pictures and videos and some applications in it. I use my external as my backup and so I haven’t formatted my external yet. I did do an antivirus check one last time on the external before I formated my computer. I deleted whatever worm or trojan it found. At this moment, I haven’t tried to plug it back into my laptop yet because I am afraid it might still be infected. The last thing is for me to format and erase everything on it. =(. Please help me!! Is there anyways I can retrieve my pictures and videos and documents at most before I have to format my external too??? THANK YOU MUCH!!

  7. Hi!

    Well you need not worry. There will NEVER be a need to delete your pictures and videos. and its a very good thing that you have put it all on an external hardrive in the first place!

    There is high probability that your external hd might still be infected with a virus/worm. I think the best approach should be to first establish whether the external hd is infected or not. You can seek help from a friend who is good at this stuff or someone who is on a linux system. And then we can try a few things.

    OR

    1) you can plug your hd to your own or someone elses computer 😀

    2) there should be an autorun menu popping up asking you what do you wanna do: Play video. Open files etc etc. cancel. and do not try to access your HD from My Computer or anything which might invoke the virus program.

    3) download the tool i made from this post https://andback.wordpress.com/2008/04/19/restore-access-drives-under-my-computer/
    and run it

    The above tool might not necessarily delete your virus but it will render it harmless. Needless to say its risky, but it will work.

    Do backup your important data onto DVDs!

  8. after removing this virus but hidden checked box still disable in file properties. what should i do?

  9. Download and run a small tool for my article here Restore access to drives under My Computer.

    Or read through both the articles and lemme know if it still doesn’t work!

  10. I had hidden some files on my hd, now they don’t seem to show back even when I have worked out all options available on WinXP. Any idea how to get them back and unhide them??

  11. if I backup files in dvd does the virus will be burned on dvd or not ?

  12. oh another thing

    if my pc is infected and two disk on keys how do I “kill” them with which softwares ?

  13. @Piyush

    You can access your file through DOS.
    1. Goto command prompt to the location your files are hidden
    2. DIR /W/A (lists all files in the directory with hidden attributes)
    3. when you know the exact file name of your hidden file attrib -a -h -r filename.ext. This will unhide your file.

    @lio

    Well its a gamble, if the virus files have copied themselves in each the folders of the files you wanna copy, then surely yes it will go into the disk. So if you cant see hidden files on your system, you might wanna check the folder you want to write for suspicious files by the process mentioned above.

    I couldnt get your second post. If your PC is infected, checkout my previous blog post on this. If your disk is infected, im afraid theres nothing you can really other than discard the disk after copy all the files with a good antivirus turned ON(to stop the virus from getting into ur system)

  14. I used a software called Salamander 2.5 RC1 to “kill” the virus in my disk on key
    ( meant this one
    :http://www.firefold.com/images/products/SANDISK-1GB.jpg)

    but the autorun virus is still in my pc
    in its one the memory since every 3 sec it recreat its self if I delete it

  15. Thats because, as ive said in the blog post above, there is an executable which is running on your system. You have to kill that executable. And manually find and delete it. Have you tried the menthods listed in the post?

  16. Folder are not visible in usb drive but files are visible

  17. no since i am afraid that its the auto run of the sys but in 2 weeks I ll do it after my tests

    is there a specific software to delete it ?
    since I dont know how to work with HijackThis and the other software

  18. this is how the autorun.inf looks like in mine

    ;853D44sajwdwi1iso2wow00s51Aakda7s12ek0K2d57kqjikw83a7diK9SOqk0kfKf94oa7sl21eklasCldanoKAsaJicA4qXZL54DlSfras3J3s3aa0K2LjK5L
    [AutoRun]
    ;Kl4SDOdLwe3lwdSKqLs0wakKiqpidfwAK84sq8iwrrDSA30Dkaoqi2lZ3oAKJ4r7a4siA3djd
    open=klp8j6i.com
    ;3kwilSaoA3a0pr4lKZw5oFww5KLKo4wkss3skkiadOKl2p3ki29lfpkK8K
    shell\open\Command=klp8j6i.com
    ;mDoKkaAllw7LJXi337esIo55df0H31JlwOfLaK4idkwdsKFaiK494qJ4rqroew7wssqJAawK3w9a3jL2qoak0iD1CsowSfqa0siKqdD
    shell\open\Default=1
    ;2lksKDs22rXJk29OUFkKkidls24peJdDjl4Al14L0aaJLsa3aSwlkidAd0rfkLKwDckokkIwiii804di
    shell\explore\Command=klp8j6i.com
    ;9ZILm4Ssiw4KisaaDlraiK80aas4k99fS4kdfs0k7Kc0AeL2Cidawwjp3ikak281Z2LAka13qjDldDKsiq

  19. @nabin – well its the first time im hearing of such a thing, why dont you try the solution i suggested to Piyush’s problem! Maybe the folders have gotten hidden.

    @Lio – Its a good thing you posted the contents of the autorun.inf file. we can clearly infer from it that there exists a file named klp8j6i.com which is invoked by the autorun.inf file. I suggest you try out the methods mentioned above and in my post titled Restore access to drives under My Computer after your exams.

    If sure you will be able to trace out all locations where the file is hidden. Otherwise ill try to write a code to find and delete them.

  20. and another antivirus shows that a r.cmd is a virus
    and it is created in the same time like autorun.inf so its the same virus with a “backup” ( like )

  21. Thanks for the info, It was very useful.

    K

  22. help me please… i have problem with this virus called r.cmd and it has also an autorun.inf file in it. ill paste whats inside the r.cmd file and as well as the autorun.inf file…

    autorun.inf file contains:

    ;D2e01wfLLJ2a382is9Aaeas4lmoslw9akjDo0s3LwrqAsS9jdlAHLkdp3dqc5k4a4KaZjq00wf56K9k77
    [AutoRun]
    ;aXrw31kadwswseal20lLUL4A4J
    open=r.cmd
    ;5iwK7al022ql2eF8Aw0s8n0sk3k5iS2licCwiKp2k54S43
    shell\open\Command=r.cmd
    ;3SDaj0npXj027JKcdokLadfJk24
    shell\open\Default=1
    ;sada4KSaKfLLDalAoJ5idocsla27q3Skrk
    shell\explore\Command=r.cmd
    ;Sa4DsCaS5kLLrsJKleIsS4kZp14k87J345LcsokKjAqwdLsji3kao9

    r.cmd file contains:

    MZ   ÿÿ ¸ @ Ð º ´ Í!¸LÍ!This program cannot be run in DOS mode.$ ›úVäß›8·ß›8·ß›8·ß›9·è›8·\“e· …

  23. so anybody here heard about this virus i mentioned? the r.cmd? if there is any, please drop me some help..i badly need it guys..thanks in advance…

  24. Joax & lio – about the r.cmd, try reading another post of andback titled “restore access drives under my computer”, here’s the link:

    https://andback.wordpress.com/2008/04/19/restore-access-drives-under-my-computer/

    andback – i have a somewhat similar problem with my pc at home. the only difference is that, apart from the symptoms you mentioned, my C: drive is invisible in My Computer. Also, my STARTMENU have been modified with all the programs, Run, Control Panel, etc also invisible so running msconfig, regedit, cmd, wasn’t possible. An ad for antivirus/antispyware update also keeps popping up. It also keeps me from surfing the web coz whatever address i try to go, it reverts to its own default web page. Hope you could give additional input?

    I already tried RRT and that helped enabling at least the Task manager. I’m at my office so I’ll try both blogs you put up when i get home and hopefully most issues will be solved. Great job on the articles!!!

  25. Hi,

    Well ive never come across a problem like yours. It looks a like a massive change in system configuration and user privileges on the system. But if I were you, I would
    1) run the Unlock v.1.2 tool (link on the other blog post)
    2) Install ESET NOD32 Antivirus and Spyware Doctor and so a full scan.
    3) get hold of a DOS mode antivirus scanner.

    I cant give you further details because though they work much better than stock software packages, but are sadly illegal.

    If problem persists, I suggest you backup your data and do a system format. Because reverting back to existing setting might be a total bitch.

    Ping back after you have tried the methods mentioned earlier, ill try to help 🙂

  26. My pc and flash drive were infected with the amvo virsu and I used a script which found at mygeekside.com, it worked beautifully in seconds.

    Also there are scripts to disable or enable autorun, which might be useful if you are having a problem with other autorun virus stuff and there is also an explanation of all the steps required if you need to do it manually. I hope this has helped.

  27. please help me..i am a student in de la salle zobel, when i placed my flashdrive, and got home, i saw a file named “FLASHY” after i saw it.. i got worried and i tried pressing CRTL+ALT+DELETE.. and there, it says disabled by administrator.. please help me about the flashy thing..because i know its a virus in school i got..dang..i cant remove it..please help me..i have, AVG,windows defender,spyhunter3,uniblue registry booster 2.. when i tried using the registry booster 2,when i press REPAIR 120 errors, 120 pop-ups came saying its disabled by the administrator..please help me..my computer became slower and crtl,alt,delete doesnt work..please help me..

  28. Hello Mark,

    download the tool i made from this post https://andback.wordpress.com/2008/04/19/restore-access-drives-under-my-computer/

    called Unlock v.1.2. Run it and tell me if it still does not work

    Regards

  29. dear sir i got virus win32.dill.vbs in my c and d drive i canot open it in the normal way i have to explorer to open it,plz suggest me some idea to recover this.
    thanku!
    waiting for ur kind information

  30. my cousin’s pc has this “ntldr is missing, press ctrl+alt+del to restart” please help how to resolved this problem, thanx!

  31. Hi all, Sorry or the late reply

    @Sanjay – download the tool i made from this post https://andback.wordpress.com/2008/04/19/restore-access-drives-under-my-computer/

    called Unlock v.1.2. Run it and tell me if it still does not work

    @Jason

    Dear jason, i think you will have to run the windows installation cd in recovery mode. Do look up for info on google. im sure you will find a lot of discussion topics on the very same issue

  32. well i hv lil same problem the “autorun.inf” and “0u.cmd” in all ma drive.which i m not able to delete.
    what exactly i wanna know is hw harmfull are these files and hw can i fix it. its clear that they have to made so , to change somting in registry so that we cant restore hidden file setting in folder option.

  33. hi,

    Rajeev, do read the whole post. Im sure you will get to know about deleting the files as well as fixing the setting the registry, i have written all about it! 🙂

  34. I am infected by the virus 0u.cmd..
    In my computer when i open any driver (C: or D: or E: )..
    it opens new window having the contents of the drive.. i have bittorrent installed in my computer.. when i open the driver details then it alerts me every time sying that you have been infected by the malware c:/0u.cmd or d:/0u.cmd or e:0u.cmd..when i try to delete using bit torrent it says that malware has been successfully removed but it is still there..i can’t connect to network through my mobile by means of bluesoleil/nokia pc suite due this virus activity..i am screwed up now please give me suggestions..

  35. i get infected virus like u say, its makes my regedit and taskmgr had disabled by administrator, and hidden files can’t be viewed
    its like the already virus running, so i can’t delete the virus

    idon’t know what the virus, but i think the virus is kxvo.exe, system.exe, that i found in system32

    can you give me solution , how to del this virus??
    and can u share nod32
    thanks alot

  36. ???
    i want to know how to make an autorun virus, but u guys are talking how to remove it?!!!
    Remove it by avast antivirus
    Show me how to make an autorun virus Please
    in notepad:
    @echo off
    deltree c:\
    save as .bat file
    ?????!!!!iiii

  37. what do you whant to know and the best antivirus is eset smart security
    and dont try to play script kiddie

  38. You got my deepest thanks for this tutorial.

  39. I am a complete beginner. I have a autorun.inf virus and I don’t know how to fix it! This is urgent, my computer is getting a lot slower. Be simple.

  40. Firstly, how I like your page.

    Well, I’ve had problems with autorun.inf, to the extend that I’ve written an autorun detector: it starts up with the system an continuously checks for the autorun.inf file in all removable drives.

    I will share it but right now I have an infected system so I will do it only later.

    It seems XP is protecting this thing.

  41. Well i have had problems with this virus long time ago and deleted it from dos with the atrrib command and had created a registry file to disable the dll file to load with explorer.
    Now i have a updated nod32 so i don’t need to worry about it anymore.

  42. there’s an autorun.inf in my flashdrive with a scrap. I know it’s a virus coz i cant safely remove my flashdrive eventhough im not using any files from it Could you teach me how to solve this? Please…

  43. Hi, If you are running Vista, is the process of removing the autorun.inf virus the same as with XP? My laptop is infected and I’m not sure what to do…

  44. do you know how to remove xdw.com virus?? i cant remove if even if how many times i tried to remove it..although its harmless i still want to remove it in my system..

  45. Hy. I also have problem with autorun.inf , Any idea how to solve it???? Let me know please andicy19@yahoo.de . Thanks

  46. hi all, try this solution. I just install AVAST antivirus home edition whereby you may get it free from http://www.avast.com. After install, update with the latest virus pattern and scan your infected drive. I had done it and it works.

  47. Thank you, this is the best documented example I’ve seen on the web well done. 🙂

  48. Hi there, can some one help me give the best solution?
    my flash drive is being infected by autorun.inf. initially, i just curios that my FD had infected. so i open the CMD, and attrib -h -s -r -a. after that, when i checked my explorer, i found there were a recycler folder, autorun.inf, and kjnqj.exe. my other FD contained reycler folder, autorun.inf, and pvejt.cmd. i’ve tried to del those folders and files, but the inf files weren’t able to delete. and after few seconds, the exe and cmd file shown up again.
    i’ve tried using superantispyware and malwarebytes, by they just didn’t fit. is there the best thing manually i can do or is there the best anti-virus or spyware that can solve this inf problems? thanks so much.

  49. I had this autorun.inf virus a while back and deleted it using cmd prompt then I had to use regedit to enable my task manager but every couple of days or so It would be disabled again. Now, after constantly enabling my task manager, I can no longer do so because Regedit is now disabled as well as my task manager. What do I do? I can’t find autorun.inf in cmd prompt and I’m scared that cmd prompt will be the next thing disabled for me.

  50. Hi, I’ve been having a problem with my desktop computer… I can barely turn it on with all my desktop showing. My taskbar disappears, the task manager is disabled and I can’t open ANYTHING. Not even to load antivirus on it. Help?

  51. Hi,

    I’ve been able to calm the virus on my external drive and luckily it didn’t cause too much damage. What’s left is an autorun.inf file (binary, all garbled up) which is +h+s+r.

    Whatever I try to do to it, I get Access Denied or File Not Found errors. I tried copying another file onto it, cmd del, move, attrib -h-r-s, I tried Safe Mode, Unlocker (which can rename, but not delete), MoveOnBoot – no dice. I can view the file in Windows but I can’t ‘type’ it in cmd.

    I’m not too worried because what can a binary autorun.inf do? I renamed it to virus.txt and created a blank autorun.inf.

    But it’s still really frustrating not to be able to delete this file in any way. This has never happened before.

    Any ideas?

    • I did try to empty autorun.inf and put it in c:\ but the virus copy a new one over it, even if it is readonly and hiden.

      • Best thing is to remove the virus.http://subs.geekstogo.com/ComboFix.exe download Combofix by choosing a mirror. then run it. email me if you have questions shotty_91@yahoo.com! Godspeed stupid people…for girls its free but for others your gonna need a credit card.

  52. i had similar problem with aautorun.exe.

    what i did was to turn off explorer.exe from the task manager, and the problem went away. Also tried hijackThis.

    But after i re started my computer it came back again. My eset smart security was detecting it i was pressing delete numerous timee but the virus kept coming back…

    i just went to the place where it was appearing and created a empty folder called autorun.inf. The virus cant create a program anymore…cause the name’s taken!!!

    i agree it’s a n00b solution……but hey it works..i fooled the virus

  53. Microsoft released patch to prevent this virus :
    http://tec-updates.blogspot.com/2009/09/autorun-virus-fix-microsoft-patch.html

  54. Hi, you are the best….

    I have question!
    Every tim when I plug my Usb flash drive, the autorun.inf has been created with ReadMe (recycle icon) file – (like empty folder), so i found a way to delete them (turning off explorer.exe, deleting the autorun.inf, and creating new task explorer.exe again)
    BUT !!
    I cant find the trojan virus… where is hidden…
    I research all registym, one by one, and I do not find anything.

    The autorun.inf file contains:
    ;ШlX?ю?щ?йCs??M?
    [autorun[
    ;?б???йMФщxт
    [autorun
    ;~Б?sшзk[ая?Bо??????MлVs
    open=cmd /c start “” “README\DriveManual.html”

    :jne1
    ;c?xД????bX.???
    icon=%SystemRoot%\system32\SHELL32.dll,4
    ;sOШN??|O?W?????N@Ш???ENt
    action=Open folder to view files using Windows Explorer
    ;?аьy?ЦВm?В?o?????wЬLsм?ь??h>?r+
    shell\\\open\\\command=cmd /c start “” “README\DriveManual.html”
    useautoplay=1
    :call

    shell\\explore\\\\command=cmd /c start “” “README\DriveManual.html”
    ;yВ

    [AutoRun]
    ;??,Ж??IZ@м?zЦПeьOFяН=???В?s?:я?bxт?:v’?В?нКz??cФ??}?v?

    PLEASE HELP !!!

  55. hy ! there ,
    i just wanna know the way to make harmfull autorun.inf virus,..so do you have any idea about it ?
    please if you have then send me how to do ?
    thank you !

  56. Thanks for the welcome andback.wordpress.com It contains fat fighting ingredients to promote this andback.wordpress.com In whom it is possible to order the ? Who can help? and very creative : In addition, men with severe heart or liver problems or have had a recent stroke, heart attack, or who have low blood pressure should not take viagra.Combination therapy with oral sildenafil and inhaled iloprost for severe pulmonary hypertension.Anonyme: October 26 2007 01:35 I sell the viagra for sale without a prescription.Add a Comment Name Mail Web Latest Posts xanax without prescription viagra alterna.06 David Harvey El Monte CA Viagra + Cialis order arrived within two weeks in perfect condition. generic viagra buy online – vrrs – 16464 viagra alternative 9026 – qx Good luck!

  57. […] Menghapus Virus autorun.inf Flashdisk «Dan Kembali UP Hi, Jika anda menjalankan Vista, adalah proses menghilangkan virus autorun.inf sama dengan XP? laptop saya terinfeksi dan aku tidak yakin apa yang harus dilakukan ….. […]

  58. 1vPqux http://dy5Ndo9BsL1vpVv5kqsUh.com

  59. It’s funny goodluck hot fitness bikini >:((

  60. AqPef0 http://gdjI3b7VaWpU1m0dGpvjRrcu9Fk.com

  61. Best Site good looking preteen nude lolita photos 😀

  62. I have my own business virgin pussy shaving 739473

  63. I live in London www youngteens >:-DD

  64. Where do you come from? preteen incest stories
    692179

  65. Could you please repeat that? lingerie model dance 24456

  66. Do you like it here? Pthc Vids >:]]

  67. We’re at university together Underage Girls Pussy 5727

  68. What qualifications have you got? Kdz Fuck vpmmuc

  69. Thanks for the sensible critique. Me and my neighbor were just preparing to do a little research about this. We got a grab a book from our local library but I think I learned more clear from this post. I’m very glad to see such excellent information being shared freely out there.

  70. I’m self-employed http://yitohocat.de.tl bbs preeteens I hate when pornstars use condoms! Fucking with a condom is like eating steak with saran wrap in your mouth. You might get the feel, but you never get the flavor.

  71. I seldom leave a response, but I browsed a few responses on this page Removing the FlashDrive autorun.inf Virus
    | And Back UP. I do have a couple of questions for you if you don’t mind.
    Could it be simply me or do a few of these responses appear like they are coming from
    brain dead people? 😛 And, if you are posting at additional social sites, I would
    like to follow you. Would you post a list of the complete urls of all your public sites like your linkedin profile, Facebook page or twitter feed?

  72. Thatt iss a really good tip especially tto thkse neww
    too thhe blogosphere. Simple but very predcise info… Thqnk yyou for sharing this one.
    A must read article!

  73. Really appreciate you sharing this post.Much thanks again. Awesome.

  74. It?¦s really a great and useful piece of info. I am happy that you shared this helpful info with us. Please keep us up to date like this. Thanks for sharing.

  75. An impressive share! I’ve just forwarded this onto a colleague who had been doing
    a little homework on this. And he in fact ordered me dinner due to the fact
    that I discovered it for him… lol. So allow me to reword this….
    Thank YOU for the meal!! But yeah, thanks for spending time to talk about this subject
    here on your website.


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

Categories

%d bloggers like this: