Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Whenever I plug in my USB flash drive into my laptop running Windows XP, an AutoRun.inf file gets created inside it. Also a hidden folder called "Cache" which uses the Recycle bin icon gets created.

AutoRUn.inf file cannot be opened in Windows. Both the Autorun.inf file and the "Cache" folder cannot be deleted.

I opened the AutoRun.inf file using Ubuntu. I saw that it is trying to run a file Cache\TMP983.exe.

I ran all anti-spywares, anti-malwares, anti-viruses, USB autorun eaters, but to no avail.

How do I fix this?

share|improve this question
1  
Jeff is right, reinstall the OS; it's the root cause. But also remember to sanitize your USB drive too. Good luck. –  GeneQ Oct 23 '09 at 10:22
add comment

5 Answers

up vote 5 down vote accepted

For unknown viruses and stuff I use sysinternals.

With Process Explorer try to find strange process (or a process that has a handle on the EXE file in the cache folder.) With autoruns look at everything that is starting automatically. Remove suspicious entry's.

Be careful, before removing anything. Google it, it might be needed. You can wreck your system this way. Advantage of this is that you also might find that you have some kind of program running that has this behaviour, and all you might have to do is uninstall it.

Hope this helps.

share|improve this answer
    
Awesome! Autoruns helped me find the registry key that was running a program at startup. It was executing an exe in C:\recycler. Deleted the registry key, somehow deleted the the exe and an INI file. Problem solved! –  ashwnacharya Oct 23 '09 at 15:32
    
Okay but keep looking ! Sometimes there still is a process running that might recreate it. At least do a reboot and check. Nice I could help. –  KeesDijk Oct 23 '09 at 18:35
    
Process Explorer also lets you add columns to show the Image Path, which makes it easier to identify executables running from suspicious locations (anywhere in Documents and Settings, Temp or Recycler). Unfortunately doesn't help so much with DLLs or other items not directly executed. –  fencepost Mar 15 '10 at 21:10
add comment

Sadly, I recommend that you back up your data files, reformat, and reinstall Windows XP.

Clearly you're infected, because the USB drive is getting files written on it from Windows XP upon insertion.

If you've run a lot of security / anti-virus tools and can't detect anything, I think it's safest to format the machine and start fresh.

share|improve this answer
    
I'd go so far as to say even if something found it, still reinstall. Once infected, I wouldn't trust the system again. –  Zurahn Mar 15 '10 at 23:54
    
I agree with @Jeff and @Zurahn. –  Alexander Burke Mar 16 '10 at 0:20
add comment

Before giving up and reformatting and reinstalling Windows, here are some more options:

  1. Google for "antivirus online scan" and use a couple of the best-known ones to scan the computer (each takes some hours to complete).
    Some that I like are Trend Micro House Call and Kaspersky Labs Free Virus Scan.
    Please note that they might require you to use Internet Explorer as your browser

  2. Use a rescue live-CD virus scanner : I like best Avira AntiVir Rescue System because it gets updated several times a day and so the download CD is up-to-date.

I once had an infection problem, and I ran quite a few scans before I found the one that succeeded in finding the virus.

You're lucky in the sense that's quite easy for you to verify if the virus was really eradicated.

share|improve this answer
add comment

There always the option of going nuclear on the bad guys. Have you tried to reformat your USB flash drive from within Ubuntu? That should kill of the annoying things hiding in your boot sector.

Before proceeding copy all the data from the drive to somewhere on your Ubuntu and sanitize it using something like Clam AV.

To format your USB device, at the Linux command prompt type:

Step 1.

fdisk -l

The command above will show you a list of devices.

Assuming your USB drive is sda1, you'll need to unmount the flash disk, so:

Step 2.

umount /dev/sda1

Once done, enter the following command to format the flash device to FAT32

Step 3.

mkdosfs -F 32 -I /dev/sda1

I doubt anything can survive this. ;-)

But if it still persists, use this as a last resort:

dd if=/dev/zero of=/dev/hda bs=512 count=1

I will destroy the partition table of your device ... completely. Mutually assured destruction. Sweet.

Now repeat step 1-3 and the bad guys will be gone forever.

share|improve this answer
2  
but isn't the problem that Windows XP is infected, not the flash drive itseld? That's what is copying over, from XP to the flash drive. –  Jeff Atwood Oct 23 '09 at 10:03
2  
Reinstalling XP is a must. But often if you don't sanitize the flash drive it will reinfect your pristine XP. I've seen some nasty home grown stuff which resides within the MBR and that two mainstream AV can't remove. –  GeneQ Oct 23 '09 at 10:11
add comment

BleepingComputer has some great resources and several volunteers who can help you identify and remove any infections.

MalwareBytes' Anti-Malware and Microsoft Security Essentials are some good tools for detecting/removing spyware.

Trend Micro's HijackThis will create a report that can be used to identify spyware that's actively running.

SDfix is a lower-level tool that helped me nuke some very persistent malware a while back.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.