stubborn autorun.inf

[ARD]

Guys, I desperately need help with this, its driving me up the wall!

If I format an SD card, or delete all files on it, an autorun.inf file and a folder called Control (actually the control panel) gets created automatically within 5 to 10 seconds. I can delete them, but they get re-created again in a few seconds.

Scanned the drive(s) for viruses; none found. In my desperation to solve this, tried a number of packages Avast! (my default anti-virus), Autorun eater, Ad-aware and so on. I'm now convinced its not a virus, but *something* thats creating these to 'protect' my system.

The autorun.inf has this message if opened "; This file is created to protect your flash drive from viruses"

If the system is booted in the safe mode, this file does not get created on the SD card; so I presume its one of the files / services booted in by Windows that is causing this. However, I dont see anything in the 'Applications' or 'Processes' list that looks suspicious, or is unaccounted for.

Becuase of this situation, I cannot create my own autorun.inf file. (If I do so in the safe mode, it promptly gets overwritten by the old 389 byte file as soon as I boot Wondows normally)

Any idea of what is causing this? And how to get rid of it?

Incidentally, my system runs XP Pro.

Any help would be HUGELY appreciated!

Regards,

Anand Dhuru

[MANEMAN]

Hi there and welcome.

Download and run *** Flash Disinfector *** Specifically used for the problem you are having.

Read the instructions and run it. I had the same problem quite a while back and found that it cured the problem.

I have now left a copy of this on every seperate partion and drive, plus thumb flash drives just in case I get caught out with this particular infection again. At one time this trojan was coming down with some .flv videos. I do not think this is the case now though.

As far as I can remember (I may be wrong though) when I ran it, the screen went black a couple of times in the process.

Just let it run. Do read the instructions, and realise that it will perhaps rename some files (Autorun.inf)

Hope this is of some help. (Come back and let us know for the benefit of others. Thanks)

John.

[ARD]

Thanks, Maneman.

I did run the Flash_Disinfecetant, and it did indeed get rid of the Control folder and the autorun.inf file. However, it produced its own autorun.inf floder on the partition (presumably to prevent any malware from generating a new autorun.inf). Now, this kind of brings me back to square-one; I'd like the partition to have NO autorun.inf, unless I deliberately create one! The end idea being to be able to create an automounting truecrypt volume.

I wonder if I now use a force-deleting utility to remove the autorun.inf created by FI, would it be a happy end to this issue? Or would I find the original 389 byte autorun.inf popping up again? Time to find out...

[ARD]

Time to find out...

Just as I feared...

I removed the autorun FOLDER created by FD (per http://www.myantispyware.com/2009/01/13/how-to-remove-flash-disinfector-protection-autoruninf-folder/), and sure enough, within a few seconds a new 'Control' folder and an autorun.inf file got created.

Back where I started :(

[MANEMAN]

JOHN SAID: Read the instructions

ARD SAID: However, it produced its own autorun.inf folder on the partition

The instructions on the download page say:

Reboot your computer when done.

Note: Flash_Disinfector will create a hidden file named autorun.inf in each partition and every USB drive

plugged in when you ran it. Don’t delete this folder. It will help protect your drives from future infection.

If you need help with the instructions, then post your questions in our Anti spyware forum.

Thanks for coming back with a reply ARD. Much appreciated.

Just follow it through now onto their forum and I think you will find the answer you require. :)

John. ;)