Removing the FlashDrive autorun.inf Virus

Flash drives have become cheap and a preferred choice of data transfer for everybody these days. And in my college almost every system even with the best antivirus protection offered by NOD32 or Kaspersky is infected. Since I’ve been asked by many about this problem and how to fix it, Im writing a detailed account of the steps I follow to remove the infection. Ill also be writing some workarounds so even if you cant remove the virus you can get along with your life. Ill be updating this page often.

As of now my system is free from all infections and working perfectly well, but this is not the first that Im saying something like this immediately before my whole system crashes. But Ive always managed to fix it, never had to format my computer, however severe the infection. So if you have any trouble, follow instructions and then drop in with your details, I might be able to help.

Some of the symptoms of an infected computer:

• Hidden files cannot be viewed. Changing options in Tools/Folder Options has no effect. Changing registry values has no effect. No restriction removal tools like RRT etc are able to fix the problem.
• Regedit cannot be found when you try to invoke it from the RUN box.
• Task Manager has been disabled by Administrator.
• You cannot enter a particular drive ie when you click on your drive letters(C, D, E etc) in My Computer nothing happens.
• Computer has become slow and there is noticeable delay in characters to appear on screen when you press in keyboard. The left and right strafing keys in Counter Strike 1.6 dont work. They work on CS: Condition Zero tho.

Virus Removal Strategy that works for me:

Full System scan

A full system scan using any of the following Antiviruses/antispyware tools usually do the trick.

1. Eset NOD32 or Eset Smart Security Business Edition.
2. DOS mode virus scan using the antivirus tools in HirensBootCD*
3. Spyware Doctor and AdAware.

Identifying the Virus manually
Most of the time a virus gets detected but the antivirus software is unable to remove it. This is because either the virus is currently running on your system as one of the processes or is being protected by the Operating System Itself. So before doing the virus scan you have to take a few precautions:

1. Download ProcessXP if you Task Manager is disabled.
2. Download HijackThis from TendMicro

Both of these tools are helpful in revealing and killing hidden processes running on your system or those which have recently make changes. If you find something like:

1. monit.exe– runs under explorer.exe, keylogger app, creates problems with Counter Strike
2. scvhost.exe or 713xRMTmon.exe – not to be confused with svchost.exe, an important windows process.
3. wscript.exe – a harmless process which can be made to execute harmful VBScripts like mswin32.dll.vbs
4. amvo.exe or amva.exe
5. autorun.inf – Its actually a harmless file. more info. But can be used to invoke a virus when you click a folder/drive which has this file.
   

Its best to kill/terminate them by Right Click/End Process Tree. Also a good practice is to EndProcessTree** Explorer.exe as well. And starting the antivirus executable from TaskManager/File/Run. And then run a system scan. Explorer can be started again from TaskManager/File/Run/ Type explorer [enter].

Several antivirus support forums help out people who submit their HijackThis log files.

Viruses usually invoke at startup. So its a good idea to check the startup list by StartMenu/Run/msconfig/Startup where you should find something suspicious Uncheck them(only if suspicious ones!)like scvhost.exe. Uncheck them(only if suspicious ones!). Restart your PC. Do system scan.

So how do you findout which process is malicious? Google them. If your data is important to you and you really want to remove the virus without formatting, you have to do this bit. When you familiar with which System processes you should be able to isolate the culprit by just seeing the list.

You can also goto the command prompt StartMenu/Run/command and then CD\ now you should be at the C:\ prompt. Now write type autorun.inf You should be able to see the contents of the autorun.inf file which for me was like

Deleting** Identified Virus files – Harddisk, Registry

Now that you have identified a file say like autorun.inf or mswin32.dll.vbs in the root of all drives or in your system drive. Immediately delete all instance of it on your system. If its protected download GiPo@MoveOnBoot locate the file and delete it. For more details read my article to Restore access to drives under My Computer.

You can also delete a file from DOS. the command DIR /w/a displays all hidden files and folders. with command attrib -s -h -r <filename>. Then delete <filename>

A virus also hides itself in the System Volume Information and PREFETCH folder. So it might be a good idea to turn off System Restore for a while. Doing so will delete all you previous system.

Another thing that I do this remove all traces of the virus file from the windows registry. Start regedit – StartMenu/Run/regedit. If your system cant find regedit. Copy it from C:\WINDOWS\system32\dllcache to C:\WINDOWS\system32\ or download it. After you open regedit Edit/Find/search for all entries of names of virus files mentioned earlier. Keep pressing F3 key to look for next result and delete** all of them.

To prevent future infections in your USB Drive, what you could try is create an empty autorun.inf file and set read only attribute to it. This should prevent a malicious autorun.inf taking its place. I tried it on some systems, it works!

Ive deleted the virus, But why is my task manager still disabled and files hidden?? … etc

This is because a virus/trojan/worm is the mother alien which an antivirus can remove. But the the settings and changes which they make does not concern an AV. You will have to change them back manually. If you still cant, that means there is some virus file enforcing those settings, like disabling Task Manager, Hiding files etc.

• TaskManager disabled – Use RRT, or Follow instructions on mentioned here.

• Files and Folders Hidden – Use RRT, or Goto registry
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ Explorer\Advanced\Folder\Hidden\NOHIDDEN “CheckedValue”=0 “DefaultValue”=2
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ Explorer\Advanced\Folder\Hidden\SHOWALL “CheckedValue”=0 “DefaultValue”=2

or download and run this regitry key.

In the end, there are a few golden rules that I find are always true. A virus is harmful while it is running. If you cant change your settings, that means something is blocking it or continuously enforcing it. So stop the virus from running. Delete all traces of the virus. Change back the settings manually.

Warnings!
* Contains illegal compilation of shareware softwares. Im not encouraging you and take no responsibility if you go ahead and use them.
** Be very careful while deleting or modifying system files/registry entries, your system may not even boot the next time you restart your computer. Something might go wrong anyway, thats how it is with these things.

updated: 18th April