How to delete autorun.inf file from USB. It says “Access denied”

Question

My system has been infected by autorun.inf trojan. inorder to remove this trojan, i need to delete the autorun.inf file from my usb drive(i am using USB drive to connect to internet). But when i tried to delete the same, it says "access denied". I am unable to uncheck the read-only option. I have tried all the solutions by googling, but no luck. Can you help me out?

Answer 1

I presume, you're using Windows?

With error you are getting, looks like your system is still infected so you should first disinfect host computer and after that delete autorun.inf on USB drive (keep SHIFT pressed while plugging USB drive to avoid autostarting). Note that deleting autorun.inf will not remove trojan so you should examine contents of autorun.inf file and find out where on your USB drive executable part of trojan resides (and delete it, too - usually in root dir with hidden attr or in Recycler dir).

Also, did you try to boot into Safe mode and delete autorun.inf? Did you try to use other computer to disinfect USB drive?

Maybe you should get some LiveCD/LiveUSB Linux distro and boot system into Linux and clean USB drive of malware from there - this solution never fails ;) But, that will free you of infection on USB drive - I'm 99% sure that you must disinfect your Windows installation, too.

P.S. I apologize for my poor English.

Answer 2

The reason you cannot delete the file is probably because some process (the trojan) is running and has the file still open. It most likely does this specifically to make it harder to get rid of the file.

As firusvg has suggested, reboot (without the USB drive), then hold SHIFT when inserting the drive.
This will prevent Windows auto-running the program.

It may be that the trojan is already set up to run whenever Windows is started, so you may need to prevent this: visit the Microsoft Sysinternals site, and look for Process Explorer and Autoruns.

Process Explorer

In Process Explorer, choose Find > "Find Handle or DLL" and enter "autorun.inf" in the search box; Process Explorer will list any programs which are using that file.

Double-click on a process in the list, right-click on the highligted entry in the lower pane. and choose "Close Handle".
If that doesn't work, Tab to the upper half of the window, and the suspect process will be highlighted. Press Delete to kill the process.

Autoruns

Once you know which process (the trojan) is causing the problem, you can look for it in Autoruns (CtrlF), and uncheck it's startup entry.

Answer 3

Prevention is always better than cure.

You should always avoid autorun if you are not sure if the device is safe.

Few years back I wrote an article on my blog on how not to get infected, and if you are infected, how to remove the autorun.inf. Its pretty easy to remove autorun.inf viruses.

http://www.zuhaib.in/how-to/preventing-or-removing-autoruninf-virus

Answer 4

Try using Unlocker: http://ccollomb.free.fr/unlocker/

Answer 5

To me seems more that you have an Vaccinated File, that was created by PANDA USB or something like that... You cant access, change properties or delete it, as it shows "ACCESS Denied" but not "This file is in use" message, that would imply in file being used. In that case, it can only be removed by a format. Se below excerpt explaining this from site http://research.pandasecurity.com/panda-usb-and-autorun-vaccine/:

USB Vaccination

The free Panda USB Vaccine can be used on individual USB drives to disable its AUTORUN.INF file in order to prevent malware infections from spreading automatically. When applied on a USB drive, the vaccine permanently blocks an innocuous AUTORUN.INF file, preventing it from being read, created, deleted or modified. Once applied it effectivelly disables Windows from automatically executing any malicious file that might be stored in that particular USB drive. The drive can otherwise be used normally and files (even malware) copied to/from it, but they will be prevented from opening automatically. Panda USB Vaccine currently only works on FAT & FAT32 USB drives. Also keep in mind that USB drives that have been vaccinated cannot be reversed except with a format. (sorry if my English is not pretty good, I am trying to improve it. ^.^ )

EDIT: Seems that you CAN remove the file from others OS. For example, using Knopix Linux CD, but not sure as i haven't tested. o.o''