How to delete virus "autorun.inf" for su [Solved/Closed]
Mr. Bridge - - Latest reply: mr. ripjaws04 - Feb 24, 2013 at 07:38 AM
Related:
- Unable to change attribute autorun.inf
- Cannot delete autorun.inf - Best answers
- How to remove autorun.inf virus permanently from pc - Best answers
- How to remove autorun.inf virus , open hidden ✓ - Forum - Viruses/Security
- Hot to delete autorun.inf ✓ - Forum - Viruses/Security
- Shortcut virus on flash drive ✓ - Forum - Viruses/Security
- Attrib command ✓ - Forum - Windows
- Unable to change date format in excel ✓ - Forum - Excel
20 replies
Best answer
approved by Jean-François Pillou
first run your system in safe mode, then go to your my computer properties and enable the system restore function.
then restart your computer and run in command prompt mode. in the command mode type the following.
ATTRIB Autorun.inf -H -S -R.
if the file is found in the Drive then give.
DEL Autorun.inf.
<similarly you can do it for all drives. but you have to restart your system for each drive.>
then restart your computer and run in command prompt mode. in the command mode type the following.
ATTRIB Autorun.inf -H -S -R.
if the file is found in the Drive then give.
DEL Autorun.inf.
<similarly you can do it for all drives. but you have to restart your system for each drive.>
A few words of thanks would be greatly appreciated. Add comment
4646 users have said thank you to us this month
YOU CAN USE THE ABOVE MESSAGE TO DELETE RECYCLER
BUT IF YOU DID NOT REMOVE, BECAUSE ITS HIDDEN FILES USE THIS
START---> RUN ---->> CMD ENTER
location of "recycler" OR "system volume information" ///// LIKE THIS LOCATION E: ,, F:,, G:,, D:,, C:
1. attrib -r -a -s -h *.*
attrib -h -r -s autorun.inf
del autorun.inf
then use this
2.attrib -s -h /S /D
3.attrib -r /S /D
4.rd "system volume information" /S OR rd "RECYCLER" /S
5system volume information are you sure Y/N TYPE "Y"
6.then repeat 4 and steps
ALL SPACE IS ONLY ONE
BUT IF YOU DID NOT REMOVE, BECAUSE ITS HIDDEN FILES USE THIS
START---> RUN ---->> CMD ENTER
location of "recycler" OR "system volume information" ///// LIKE THIS LOCATION E: ,, F:,, G:,, D:,, C:
1. attrib -r -a -s -h *.*
attrib -h -r -s autorun.inf
del autorun.inf
then use this
2.attrib -s -h /S /D
3.attrib -r /S /D
4.rd "system volume information" /S OR rd "RECYCLER" /S
5system volume information are you sure Y/N TYPE "Y"
6.then repeat 4 and steps
ALL SPACE IS ONLY ONE
I'm never infected by an USB Stick virus because I use a french software : Anti-Autorun.inf : http://delphiblog.site.voila.fr/pages/programme_135_anti_autorun_inf.html, I still launch this program before I connect an USB Stick. If this program see an "Antorun.inf", this program destroy it. For Start the program, click on "Demarrer".
Hey I tried everything, but didn't work & did the following.
Booted my computer in DOS, had the virus in D:
D: & entered dir /ah to view the hidden file.
Then keyed "attrib -r -s -h autorun.inf"
Then "del autorun.inf"
Check for the folder recycled
cd recycled
you will find autorun.dll
key "attrib -r -s -h autorun.dll"
Then "del autorun.dll"
"attrib -r -s -h recycled"
"del recycled"
If you don't have any other data, then format the drive or reboot.
Booted my computer in DOS, had the virus in D:
D: & entered dir /ah to view the hidden file.
Then keyed "attrib -r -s -h autorun.inf"
Then "del autorun.inf"
Check for the folder recycled
cd recycled
you will find autorun.dll
key "attrib -r -s -h autorun.dll"
Then "del autorun.dll"
"attrib -r -s -h recycled"
"del recycled"
If you don't have any other data, then format the drive or reboot.
Open Command Prompt -> Type the drive name say G: -> Type ATTRIB -H -R -S AUTORUN.INF -> Type EDIT AUTORUN.INF -> A new window appears; delete all the contents and click on File -> Save and click on File -> Exit
On command prompt -> Type ATTRIB +H +R +S AUTORUN.INF -> Type EXIT
Remove and reinsert the pen drive.
Now, The virus is completely removed.
Regarding any queries or any new problems , viruses or solutions contact me Darkhk3rAmit@H0TMAIL.CoM
On command prompt -> Type ATTRIB +H +R +S AUTORUN.INF -> Type EXIT
Remove and reinsert the pen drive.
Now, The virus is completely removed.
Regarding any queries or any new problems , viruses or solutions contact me Darkhk3rAmit@H0TMAIL.CoM
You cannot remove the autorun.inf and scrap files from you usb drive because you system has been infected by a worm. This worm installs kbdrv16 at startup and runs fake services.exe and lsass.exe it also runs keyboard.exe.
That is, it creates multiples processes in your computer that is not easily removed.
You can follow Lemniscatus' method in removing the worm at http://www.ozzu.com/mswindows-forum/please-check-hijacked-thanks-t96506-15.html
Good luck!
That is, it creates multiples processes in your computer that is not easily removed.
You can follow Lemniscatus' method in removing the worm at http://www.ozzu.com/mswindows-forum/please-check-hijacked-thanks-t96506-15.html
Good luck!
Whenever you plug a USB drive in your computer, a window will appear (if your autorun is enabled).
Don’t click on Ok , just choose ‘Cancel’.
Open your command prompt. Type ‘cmd’ in the run box or on the search panel if you are using vista
In the command prompt type the drive letter of your usb device and press enter. ex. C:\F: <— then press enter
Type dir /w/a and press enter. ex F:\ dir /w/a <— then press enter
This will display a list of the files in in your flash drive. Check if the following files present on your USB device.
* Autorun.inf
* Ravmon.exe
* New Folder.exe
* svchost.exe
* Heap41a
* or any other exe file that you find suspicious.
If you spotted any of the above files, then most probably your drive is infected.
To remove the virus, type in to your command prompt “attrib -r -a -s -h *.* and press enter. This will remove the Read Only, Archive, System and hidden file attribute from all the files.
To delete the virus just type del and the filename ex. F:\del virus.exe and hit enter.Delete all the files that you suspected is a virus. After deleting the virus, run a virus scan on your USB device just to make sure that your device is clean.
Remove the USB drive and plug it again. In most cases, the real culprit is “Autorun.inf” file which gets executed when someone clicks Ok in the dialog window which appears above. Thus the infections can spread.
Don’t click on Ok , just choose ‘Cancel’.
Open your command prompt. Type ‘cmd’ in the run box or on the search panel if you are using vista
In the command prompt type the drive letter of your usb device and press enter. ex. C:\F: <— then press enter
Type dir /w/a and press enter. ex F:\ dir /w/a <— then press enter
This will display a list of the files in in your flash drive. Check if the following files present on your USB device.
* Autorun.inf
* Ravmon.exe
* New Folder.exe
* svchost.exe
* Heap41a
* or any other exe file that you find suspicious.
If you spotted any of the above files, then most probably your drive is infected.
To remove the virus, type in to your command prompt “attrib -r -a -s -h *.* and press enter. This will remove the Read Only, Archive, System and hidden file attribute from all the files.
To delete the virus just type del and the filename ex. F:\del virus.exe and hit enter.Delete all the files that you suspected is a virus. After deleting the virus, run a virus scan on your USB device just to make sure that your device is clean.
Remove the USB drive and plug it again. In most cases, the real culprit is “Autorun.inf” file which gets executed when someone clicks Ok in the dialog window which appears above. Thus the infections can spread.
Sir/Madam,
Kindly suggest me how to remove autorun.inf file which is hidden in pen drive. I have formatted the same but still unable to remove autorun.inf file. Thanks
Kindly suggest me how to remove autorun.inf file which is hidden in pen drive. I have formatted the same but still unable to remove autorun.inf file. Thanks
At first ,
1. click on Start Button
2.then Click on Run
3. write down "cmd" in the Run box
then u can see a CMD box.
Here, u will write down cd...(Change directory)
u can see like this C:\>
then write c:\> attrib
when u will write this command "attrib" it will show u all of your affected file.
but u should only attentive for SHR autorun.inf and SHR AUTOTEXT.bat(these are virus)
then follow this instruction>>>
C:\>attrib -s -h -r autorun.inf
C:\> del autorun.inf
and then restart your computer. if u see this problem again then just delete autorun.inf. you should do samething for all of your drivers......
Thanks...
Tomal
BEXIMCO GROUP(Bangladesh)
1. click on Start Button
2.then Click on Run
3. write down "cmd" in the Run box
then u can see a CMD box.
Here, u will write down cd...(Change directory)
u can see like this C:\>
then write c:\> attrib
when u will write this command "attrib" it will show u all of your affected file.
but u should only attentive for SHR autorun.inf and SHR AUTOTEXT.bat(these are virus)
then follow this instruction>>>
C:\>attrib -s -h -r autorun.inf
C:\> del autorun.inf
and then restart your computer. if u see this problem again then just delete autorun.inf. you should do samething for all of your drivers......
Thanks...
Tomal
BEXIMCO GROUP(Bangladesh)
Solution from Search-and-destroy.
If you own a computer, you must have antispyware to keep it running at its best. The problem is choosing a scan that works. I have tried many different types of scans in the past and then I ran across Search-and-destroy Antispyware. I have to say that the antispyware solution from Search-and-destroy is the best that I have used to date. It gets the job done and keeps my computer working like new. If you are interested in seeing for yourself just how good this antispyware works you can click on http://www.Search-and-destroy.com/antispyware.html to learn more. I'm sure it would be worth your time to check it out.
If you own a computer, you must have antispyware to keep it running at its best. The problem is choosing a scan that works. I have tried many different types of scans in the past and then I ran across Search-and-destroy Antispyware. I have to say that the antispyware solution from Search-and-destroy is the best that I have used to date. It gets the job done and keeps my computer working like new. If you are interested in seeing for yourself just how good this antispyware works you can click on http://www.Search-and-destroy.com/antispyware.html to learn more. I'm sure it would be worth your time to check it out.
1) Go to Command prompt then go to C drive then type the command "dir/ah" then enter u see their Autorun.inf file.
after that start the system in Safe mode.
In safe mode go to Command prompt type the Command " attrib -h -r -s autorun.inf " then type the Command "del autorun.inf" so successfully this virus is remove.
2) Disable autorun from registry
go to run type the command "regedit" then enter , after that r registry edit window open , then going to HKEY_ CURRENT_USER\User\software\Microsoft\windows\current version\policies\explore. In right side area " NoDriveAutorun" value are their just double click on this value and insert value data FF and select hexadecimal.
then close the window and restart the computer .
after that start the system in Safe mode.
In safe mode go to Command prompt type the Command " attrib -h -r -s autorun.inf " then type the Command "del autorun.inf" so successfully this virus is remove.
2) Disable autorun from registry
go to run type the command "regedit" then enter , after that r registry edit window open , then going to HKEY_ CURRENT_USER\User\software\Microsoft\windows\current version\policies\explore. In right side area " NoDriveAutorun" value are their just double click on this value and insert value data FF and select hexadecimal.
then close the window and restart the computer .
to delete autorun virus:
1) check in root directory of all drives i.e(c: , d: etc.)with the help of winrar, if there exist autorun.inf file in every partion of ur hard disk then there is autorun virus..
2)download a program called usb firewall by typing in google or http://download.cnet.com/USB-FireWall/3000-2239_4-10817831.html
3) install it and then start the sytem in safe mode.
4) run this program in safe mode...it will remove the virus from all partions..
1) check in root directory of all drives i.e(c: , d: etc.)with the help of winrar, if there exist autorun.inf file in every partion of ur hard disk then there is autorun virus..
2)download a program called usb firewall by typing in google or http://download.cnet.com/USB-FireWall/3000-2239_4-10817831.html
3) install it and then start the sytem in safe mode.
4) run this program in safe mode...it will remove the virus from all partions..
based on your suggestion I have removed autorun from my pendrive
M. Kannan
Govt. Hr. Sec. School-Vaitheeswarankoil &
K. Kannan
D.B.T.R. National Hr. Sec. School-Mayiladuthurai.
but when you find this file in a Drive, Hard Disk Drive or Removable
drive (USB Flash Disk Drive), where there are no Setup.exe for an
installer, then it is definitely a file created by Computer Worm
or Computer Virus, that when you autoplay it and execute the
autorun.inf, then the Worm or Virus will be triggered and then
it activates.
use Avast! Antivirus (Avast! Home Edition - free - should be
sufficient. then use Avast boot scan.
Microsoft affiliated Antiviruses like AVG, Avira, McAfee,
Norton Symantec, ESET NOD, Panda and other
microsoft affiliated antiviruses only slows down your system
and they are the ones giving your computer a Malware.
If after deleting autorun.inf, and you still don't see your files,
that is because the viruses did somethings in your file,
like it made your files Hidden (it's a file property).
Viruses/Worms make your files:
- Hidden files
- System files
after deleting autorun.inf and the virus/worm from your computer,
this doesn't show your hidden files. because it is an effect
that the virus did to your files.
to see your files, go to Folder and Search Options.
Or if you have a Menu bar, go to Tools>Folder Options.
a dialog box pops out, go to View tab.
choose the "Show hidden files, folders, and dirves" option...
then uncheck the boxes
- Hide extensions for known file types
- Hide protected operating system files (Recommended).
after doing these steps, then you'll be able to see your hidden
files that your previous worm/virus did to them.