But in some rare cases autorun.inf files are also created by malware. Few malwares create their autorun files and if present in CD or pen drive, they infect the system to which it is connected. Most of the antivirus do not really help to get rid of such malware autorun files.

To remove this virus there are more than one ways to do so. I am going to talk about two ways here to remove this virus. First is that one may use a software already designed for the purpose of removing autorun.inf from the system. Another is the manual method of removing the virus.

METHOD 1

A great software for this purpose is the Autorun Eater. It is not exactly a anti virus but a application that detects and removes the autorun virus in real time before it could be executed as autorun.inf. Some key features of autorun :

·Scan and remove suspicious autorun.inf files found in the root directory of all drives, C-Z, in real-time
· Scan priority(normal/high)
· Scan results are logged
· Add and remove from startup entry
· 3 optional registry fixes (Task Manager, Regedit & Folder options).
· Users are informed whenever a suspicious “autorun.inf” file is detected.
· Backup copies of suspicious “autorun.inf” file(s) are created before the original copy is removed for easy recovery.
· Status tooltip to get tool info easily without right-clicking on tray icon.

One of its most important option is Close Autoplay which prevents the execution of malware via the AutoPlay window.

METHOD 2

This method deals with removing the virus from the USB drive. Follow the steps below to remove the virus.

1. While the computer is still off, plugin the USB Drive.

2. Insert the Windows  CD-ROM into the CD-ROM drive. It must be the bootable Windows Installer.

3.  Start the computer from the CD-ROM drive. It will start Windows Setup screen. When the “Welcome to Setup” prompt appears.Press “R” to start the Recovery Console.

4. If asked “Which Window installation would you like to logon to” select the number. Type “1″? then Enter, if only one installation of Windows is present.

5. It will bring you to command prompt, C:\Windows>

Proceed with the following command:
- Type d: (This is the drive letter of USB. It can be e: or f: defending on how many hard disk or cd drive is installed)
- Type attrib -h -r -s autorun.inf
- Type “edit autorun.inf” it will open DOS Editor and display contents as follows

==========================
[autorun]
open=file.exe
shell\Open\Command=file.exe
shell\open\Default=1
shell\Explore\Command=file.exe
shell\Autoplay\command=file.exe
==========================
Take note on the file that it called to open (in above example it is file.exe)

6. Exit DOS Editor and return to command prompt.

7. Delete the file that was called to open on DOS Editor
- Type del /f /a file.exe

8. Delete autorun.inf file
- Type del /f /a autorun.inf

9. Exit Recovery Console by typing exit.

Use the method you think is fine for you. This should get you rid of the problem of autorun.inf

Editing registry values is not a task you would want to do without any prior knowledge or guidance. If you alter any other values by mistake, it might lead to catastrophic situations. It is better to back up your registry.

You can disable AutoRun through Group Policy, but this method doesn’t work on Windows Vista Home or XP Home. So registry editing option is the easiest means.

Lets now come to the registry tweaking part,

1. Go to ‘run’ and type ‘regedit’ to open the registry editor.

2. Navigate to the key :

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer.

3. Create a DWORD (32-bit) value named NoDriveTypeAutoRun., if it doesn’t already exist.

4. Right click on the new value and click modify.Set the hexadecimal value to 000000FF(the decimal equivalent of 255). Now you can type all preceding zeros, or you can just type FF.

This will disable AutoRun on all types of drives, but you can be a bit more selective in which drives you choose. There are several options in which you can type in specific values to disable autorun only on specific drives.

[via:techrepublic.com]