Here's How to Delete Autorun Worms

What Autorun INF Viruses Are and How to Remove Them

An "autorun worm" is a virus that hijacks an autorun.inf file and runs on your computer without your consent. They might spread over a network through mapped drives or from computer to computer via USB/thumb drives. 

Autorun worms might pretend to be legitimate programs that look authentic or they might be tucked away behind the scenes and only run as scripts. They also usually download additional malware too, like backdoors and password stealers.

 

How to Remove an Autorun Virus

Before starting these steps, scan your computer for malware. If the antivirus software can remove the virus automatically, you can avoid following the steps below. If you are able to delete the autorun worm using the information from that link, go ahead and complete Step 1 below just for added protection.

  1. The first step in removing an autorun worm is to disable the autorun function that allows programs to automatically start. This will prevent the same thing from happening as you follow these steps.
  2. Next, search the root of every drive plugged in to your computer for a file called autorun.inf. This includes looking through any and all flash drives and external hard drives.

    Tip: One really quick way to do this is to use a file search utility like Everything. They're sometimes much faster than the default searching capabilities of Windows.

    Note: You might have to show hidden files in order to see the INF file. 
  1. Open the autorun.inf file with a text editor like Notepad or Notepad++
  2. Look for any lines that start with Label= and shellexecute=. Note the name of the file designated by these lines.
  3. Close the INF file and delete it from the drive.
  4. Locate the file that was designated in Step 4 and delete that file as well.

    It's best to use the Everything program mentioned above to do this since it searches all hard drives in a matter of seconds.

    Note: If you are unable to delete the malware files, or they reappear after deleting, use a bootable antivirus program to run the antivirus program before Windows starts up and before the malware has a chance to run; you should then be able to safely delete the target files.
  1. Repeat the above steps for all local, mapped, and removable drives.

Important: If you find an autorun worm yourself and realize that your antivirus program didn't catch it, you should anticipate other infections that might be on your computer, as well as realize that your antivirus software or firewall program may have been disabled and/or tampered with. Make sure your antivirus application is working properly by testing it against the EICAR test file.

Was this page helpful?