How to Remove Autorun.inf virus Completly from System & Flash Drives

How to Remove Autorun.inf virus Completly from System & Flash Drives using CMD

20 July 2009 Comments

Hello there! If you are new here, you might want to subscribe to the RSS feed for updates on this topic.

Is your PC a victim of the Autorun.inf virus? How to Remove Autorun.inf completely explains the simple way of removing Autorun.inf virus by using Autorun.inf Eater software. Deleting autorun.inf is effective only if the computer you are using is clean otherwise the autorun.inf will simply bounce back.

Using CMD to Remove Autorun.inf Virus from the System & Removable Drives

Method One

Open command line (CMD) and write the following:

del /a:rhs [driveletter]:autorun.inf

Simply Replace [driveletter] with your drive. If the virus is on the D drive the commad will be

del /a:rhs D:autorun.inf

Restart the computer & Done.

Second Method

Genreally when you refresh the windows explorer view a bounded virus process recreates this file. This file is attached to many events of windows explorer including OPEN, REFRESH, etc.
You must close opened explorer windows.

1. Open up a command prompt (i.e. cmd.exe) >> to load it go to Run, type cmd, enter.
2. Now to remove virus’s attributes (in order to delete it type following line by line and execute them pressing enter.

F:
F:attrib -s -r -h *.*

If there are any malicious EXE files those are now visible so if unnecessary delete them too.

F:del autorun.inf

3. After finishing above, quickly remove the pendrive as soon as posible (just after executing del command).
4. Now your pen is without virus activation config. file. Now you can safely delete unnecessary EXE files on it.

Method Third

Download Flash_Disinfector.exe from here and save it to your desktop.
Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear.
The utility may ask you to insert your flash drive and/or other removable drives including your mobile phone.
Please do so and allow the utility to clean up those drives as well.
Wait until it has finished scanning and then exit the program.
Reboot your computer when done.

Note: Flash_Disinfector will remove any autorun.inf files, create a hidden folder named autorun.inf in each partition and every USB drive plugged in when you ran it. Don’t delete this folder. It will help protect your drives from future infection.

Find that interesting. Suscribe us & Follow us on Twitter to get more tips & information.

Enjoyed this post? Don't miss out on what's to
come. Sign up for free via RSS or email.

Search

Contact Hemanth

actually the easiest way is to stop explorer.exe from taskmanager, then " x:/ del autorub.inf " will solve the pblm.

Blitzkreig

try this command as well it shud work
open command prompt and type
del c:\autorun.* /f/s/q/a and hit enter .Simultaneously replace c with the drive letter correspondingly.

Juju

hea simple method to protect USB..open notepad-> save it as "autorun.inf" in desktop..a icon display in desktop..copy the icon n paste in USB..it ask replace option..click YEs..n now ur USB is safe,,get enjoy

Riddhi Mohan

Thanks, Juju for sharing this here , but it will not work in most of the cases where Hard drives or the system is infected with autorun.inf. But one can try this for sure.

seo

Thank you, very much.

richelle

well this is nice, it helped me. get rid of those unwanted autorun

Memory Stick

Very thorough post which has no doubt helped many people already. Thanks.

Remove Spyware

Thanks for solving my headache. My USB often has autorun.inf.

Heinlein

What is the name of this virus so far? I mean, everybody names it "autorun.inf" It should have a "more formal" name like "W32somthing" (for example as Symantec Co. names viruses ). I'd like to remove this from the system, not a mere USB, the virus keeps respawning.

Swarupgraphics

Thanks to 3 rd options works !!!!!! great!

ram

hmmm thanksssss

loday

thanks a lot.......it was great.......

Al

When I double click the Flash_Disinfector it doesn't do anything....

alphaton

how can i save autorun.inf, when the exist autorun.inf can,t be access??? help me!!!

solomonbrarty

Just use linux mint 8

Prakhar

thanks a lot dude
the third method is just so simple
the virus was driving me crazy and flash_disinfector removed it in seconds
even avast wasn't able to do that
thanks a ton

dembu

wow!
was aware of the first two methods, but to no avail
but the third method really worked!
nice post dude

Oliver Muller

Thanks soooo much!! that .inf virus kept pissing me off, now its done for, thanks to you guys!!! you do good work.. thanks again..

Arvind

hey... i have already tried deleting autorun through command prompt using erase command, but either it shows could not find autorun.inf...and if my antivirus detects and deletes it ...it is back as soon as i connect my pendrive next time to my computer,...
hey can u tell me something to get rid of it permanently...

triplexity

It couldn't find autorun.inf because the file is hidden and you need to use "attrib -h -r -s" command before applying "del".This video explains you how to get rid of it for good:
http://www.youtube.com/watch?v=vdVhxpkmX4Y

Riddhi Mohan

You can turn off the Windows Autorun Feature. It can be a great help in prohibiting entry of various autorun virus that can harm windows.

http://inforids.com/turn-off-autoplay-feature-in-windows-without-any-tool/

Riddhi Mohan

Use the third method, download & run Flash Disinfector. I think that will solve the problem permanently.

Kalai

THank you team,

It is very useful for all IT Guys.

Trip

I took some stuff to printing and when I cam home I discovered two new files on my pendrive: autorun.inf and a folder that looks like recycle bin. These were hidden by I always keep the option to see hidden files enabled. When you click on the folder you just get to your recycle bin and see the files you have deleted, nothing more. But if you rar the folder and open the archive you can see that it contains an exe file and Desctop.ini file. I noticed that when I stick the pendrive into USB csrss.exe process appears in task manager for a moment under my user name. csrss.exe shoulb appear only as a system process and be located at system32 directory, otherwise it's a virus. So I made a search for csrss.exe and besides the legit one I found another at C:/ Documents and Settings/ My username directory. It's a little bit different type of autorun virus. That's how you deal with it:
1. Open Run
2. Open CMD
3. Terminate explorer.exe process in task manager. This virus uses explorer's process therefore you won't be able to delete it as long as explorer is running.
3. Navigate to pendrive and use "del autorun.inf" command.
4. Navigate to C:/ Documents and Settings/ Your username directory and use "del csrss.exe" command
5. Restore explorer by typing explorer.exe in RUN, go to the pendrive and delete the recycle bin folder.

To prevent pendrive viruses in the future download a free program called "Autorun Eater".

Adeel Khan

Wow! It's done by 3rd method. Thanks!

Trip

When executing "del autorun.inf" command I get a message: "The process cannot access the file because it is being used by another process". However, after killing Explorer.exe process in task manager the file can be deleted. BUT... Each time I insert a pendrive into my PC a new copy of the virus is placed on it. Apparently this virus created a backup somewhere on the system and it's not in the root directories.

Riddhi Mohan

That can be a reason, a backup copy of autorun.inf is replicating itself to your pendrive. Use latest antivirus like Avast's Boot time Scan. Its the best I have ever seen.

Blog4Boys

Nice post to be safe from usb virus

Munjaal

follow my instructions to protect your pendrive or removable forever from autorun.inf
1st open notepad and type @echo off
del *.inf
2nd save this in the infected directory(directory containing autorun) as something.bat
3rd on saving start it once.
4th then as quick as possible open notepad again and type: [Autorun]
open=
ACTION=
5th save this in with the previous file(save this file as autorun.inf)

DONE----now autorun virus will never infectthat drive ever.

3rd

Titan

thanxxxxxxxxxxxxxxxxxx a lot,it helped me!!!!!!!!!!!

Kristenne

OMG thanks so much! I've been having problems with the autorun worm..i'm so happy it's all ok now thanks to this article! :)

Riddhi Mohan

I am also happy that these methods are helping many people.

gaurav

but i cant able to delete it from my sd card....

Riddhi Mohan

In Sd Card Autorun.inf is a requirement itself. Why do you want to remove it? It cant be removed as it is need to autoplay automatically when use din the SD device.

Cosmo23459

But the same happens to me, in my SD Card, Autorun.inf is detected as a threath, and I cant delete nor reformat my card...what does this mean?

nafeeeee

i just didnt work for me...huhu T_T

Riddhi Mohan

Download Disinfecter form the above link provided & it will do the job.

praveen

thank u man.........

shoaib

Nice tips.
bOOkmarked this page who knows when will my pc next get infected.
thnx

Sleek

Thanks a lot man, this saved me a whole lot of issues, and made my Monday

Riddhi Mohan

Keep in Touch, Sleek.

TechChunks

Great tips! I'm sure it will help someone. :)

Riddhi Mohan

Thanks, Nice to see you here , TechChunks

Rajesh Kanuri

Thanks for tips..

Kasi

hii rajesh diz is kasi....how to instal windows xp with pendrive.

govardhankini

Thank You. I have tried other methods on other websites, but, your 3rd one helped me and get rid of it. THANKS A LOT ONCE AGAIN.

grdstriker14

THANK YOU!! I really appreciate your help! I was desperately trying to find a solution to this problem and the use of flash disinfector simply helped me to get rid of it in just a few seconds!!

Viral

Excellent article... its very very useful for me....
Thanks

Renz

Great article indeed. I also suffered from this kind of attack but I usually reformat the drive rather than cleaning it. Anyway, it's just a flash usb drive.

Riddhi Mohan

Thanks, Renz
Nice to see you here.

techprism

@ Viral
Thanks, Keep in touch of http://inforids.com/ to be informed in tech tips & tools.