This question already has an answer here:
I have Windows XP SP2 installed on my laptop, its been infected by a virus, which creates
autorun.inf in each of my drives as read-only, hidden and system file attribute being set, and which generates some EXE file and PIF file. I tried some free versions of anti-rootkit, anti-malware, registry scanning softwares but of no use. For most of them it denies installation. I also tried online scanning but it disconnects the process. Then I deleted them using Live Ubuntu running on a bootable USB. But after rebooting the laptop in Windows XP they were autogenerated again. I think the registry is being affected by the virus which is restoring them. I dont want to format my laptop. Earlier the safemode was also being disbled but anyhow I enabled it then, I tried deleting the
autorun.inf files from there
Is there any way to check what is causing them to be autogenerate.