+ Post New Thread
Results 1 to 9 of 9
Windows Thread, Autorun.inf Virus - Help in Technical; We have been unfortunate enough to come accross this virus. It seems to reside in some of our shared folders.... ...
  1. #1
    craigg's Avatar
    Join Date
    Feb 2008
    Location
    Birmingham, UK
    Posts
    175
    Thank Post
    15
    Thanked 9 Times in 6 Posts
    Rep Power
    15

    Autorun.inf Virus - Help

    We have been unfortunate enough to come accross this virus.

    It seems to reside in some of our shared folders....

    As far as anti virus goes we have got sophos, but even when we do a full system scan it seems to come back.

    I have read that it spreads through UNC paths and that there is a possibility that it might be on every client so just cleaning the server wont work.

    Anyone had this?

    or solved it?

  2. #2

    SYSMAN_MK's Avatar
    Join Date
    Sep 2005
    Posts
    4,005
    Thank Post
    489
    Thanked 1,340 Times in 728 Posts
    Rep Power
    427
    Take a look here.

  3. #3

    bossman's Avatar
    Join Date
    Nov 2005
    Location
    England
    Posts
    3,905
    Thank Post
    1,186
    Thanked 1,057 Times in 749 Posts
    Rep Power
    328

  4. #4
    Sophos-Support-5's Avatar
    Join Date
    Jun 2007
    Location
    Abingdon, UK
    Posts
    48
    Thank Post
    0
    Thanked 7 Times in 6 Posts
    Rep Power
    16
    [QUOTE=craigg;299934]We have been unfortunate enough to come accross this virus.[QUOTE]

    We can sometimes class the autorun.inf file as part of a virus when we detect it's trying to call a viral file. The autorun.inf file on its own isn't harmful. Only that it's had its settings changed to load a virus that is (or was) on the removal device.

    What virus is actually being detected?

  5. Thanks to Sophos-Support-5 from:

    craigg (9th March 2009)

  6. #5
    k-strider's Avatar
    Join Date
    Oct 2006
    Location
    Gloucester
    Posts
    357
    Thank Post
    7
    Thanked 40 Times in 30 Posts
    Rep Power
    23
    i've seen sophos pick this up when kids stick memory sticks into the machiens... since sophos emails me about the threats its detected and cleaned....

    i guess the key is to use software restrictions policies to stop anything being executed from paths other than where you have "programs" that way it has less chance of getting in in the first place!

  7. #6
    rdk
    rdk is offline

    Join Date
    Sep 2008
    Posts
    128
    Thank Post
    2
    Thanked 16 Times in 15 Posts
    Rep Power
    31
    Someone recommended "autorun eater" a few weeks agos if you do a search. I installed it and it works a treat on USB drives etc to stop it getting into your system in the first place.

  8. #7

    mattx's Avatar
    Join Date
    Jan 2007
    Posts
    9,240
    Thank Post
    1,058
    Thanked 1,068 Times in 625 Posts
    Rep Power
    740
    Quote Originally Posted by rdk View Post
    Someone recommended "autorun eater" a few weeks agos if you do a search. I installed it and it works a treat on USB drives etc to stop it getting into your system in the first place.
    Good tool to use - may add it to the Admin Bar at some point.

    Download Autorun Eater 2.3 - Scan and Remove Suspicious 'autorun.inf' Files Automatically! - Softpedia

    is the link.

  9. 3 Thanks to mattx:

    craigg (9th March 2009), dhicks (8th March 2009), lionsl2005 (7th October 2009)

  10. #8
    ChrisH's Avatar
    Join Date
    Jun 2005
    Location
    East Lancs
    Posts
    4,999
    Thank Post
    120
    Thanked 280 Times in 258 Posts
    Rep Power
    106
    Our SRP stops this running for kids when they try and put it into one of our machines. I have found that our AV sometimes detects it and other times it doesn't. I can tell you for a fact the last one I had couldn't removed by Sophos or NOD. It was one that kept turning view hidden files off. Luckily my machine was dual boot with Ubuntu and clam seemed to nail it.

  11. #9

    Join Date
    Mar 2009
    Location
    Basingstoke
    Posts
    2
    Thank Post
    0
    Thanked 0 Times in 0 Posts
    Rep Power
    0

    Smile Conficker battle

    I wrote about our recent battle with the worm and our findings here.
    http://spchappell.blogspot.com

    Simon

SHARE:
+ Post New Thread

Similar Threads

  1. USB Flash Disk - autorun.inf - nightmare
    By meastaugh1 in forum Windows
    Replies: 8
    Last Post: 14th October 2008, 10:15 AM
  2. 2K8/vista compatible CMDHERE.INF (hurrah!)
    By PiqueABoo in forum Windows Server 2008
    Replies: 0
    Last Post: 4th October 2008, 12:05 AM
  3. Question on Sysprep.inf
    By dtakias in forum Windows
    Replies: 4
    Last Post: 19th February 2008, 10:03 AM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •