Autorun.inf

CIS 3 use to automatically delete autorun.inf, but CIS 4 doesn’t even detect it.

  1. CPU Athlon II X4 620
  2. Windows 7 ultimate 64 bit
  3. CIS 4.0.138377.779
  4. Antivirus - default settings
  5. Firewall - custom policy mode
  6. Defense+ - clean PC mode
  7. Administrator account

CIS 4 detects worm created autorun.inf (i’ve just deleted 2 of these from 2 different type of pen drives), it is up to you if you want to delete it or no.

Last time I tried CIS didn’t detect it.
I’ll try again.

Maybe autorun is disabled? If possible, check out the source of the autorun.inf file with Notepad, so we can figure out what the problem is.

I deleted the file manually, so I can’t check.

Virus was on my USB stick. When I plugged it to a PC, CIS deleted the virus but not the autorun.inf file.
When I tried to open the USB, it didn’t opened, instead it gave me an option which program I want to use to open USB.

CIS 3 use to delete automatically virus and the autorun.inf file.

The autorun.inf file itself is not infecting, that’s a simple plain text file with some datas (e.g. what to run when you insert a plug in a drive/insert a cd). It is pointing to the the worm (aka. it will load the malware into the memory if there’s nothing to stop this behavior) file, which is usually a hidden file (maybe in a hidden directory).

I know it is not infecting anything, but it was much more convenient before when the file was automatically deleted.

I guess it would only delete malicious autorun.inf files on flash drives.

On a more serious note. Do you have malicious autorun.inf files that are not detected?

No it is not malicious. It just doesn’t open’s flash normally as I said in previous post.

Problem for me is that I have to this procedure every time when my friends bring me infected flashes.

  1. Go to Start>>Run and type cmd and press enter. This will open a command prompt window.
    In this command prompt window type the following steps.
  2. type cd\
  3. type d:
    (you can cut and paste the next command since spacing is important)
  4. type attrib -r -h -s autorun.inf (If it returns autorun.inf not found then this is NOT your problem)
  5. type del autorun.inf

I know it is not a virus and other antivirus programs such as Avira and others do not delete them as well (tested personally), but it was nice to see CIS 3 to remove it automatically.

May you send me a samples infected malware, which CIS 4 doesn’t delete. To send a samples you need archive it with passowrd “infected”, according to forum’s rules.

I was left for some weeks without internet connexion some months ago, and i regularly went to the internet shop where i also regularly came back with an autorun.inf virus.

Plainly deleting it was definitely not enough, as the “thing” denied the flash device exploration, writing files to the host computer temp files and registry as soon as it was plugged.