[Resolved] autorun.inf virus

Every time I plug in my USB thumb drive Avast pops up with "autorun.inf virus". I have gone to safemode, deleted the autorun.inf file from my thumb drive, edited my registry settings to stop autorun, but the darn thing keeps coming back. I am sure I am missing a step somewhere, but not sure where. The file that the autorun.inf is directed to open is svchost.exe. What can I do to fix this? My computer comes up clean on all scans provided the thumbdrive is not installed. So I have no idea what is causing the problem. Please advise if you would like an HJT log. Thanks, wndy26

Hi,

NOTE:

• Malware removal is NOT instantaneous.
• Most infections require more than one round to properly eradicate.
• Absence of symptoms does not always mean the job is complete.
• You can be certain that I will advise you when the computer is clean.
• Kindly follow my instructions in the order posted.
• Please resist the urge to run further scans or fix items on your own without my direction.

Please do the following:

Download Flash_Disinfector.exe from HERE and save it to your desktop.

• Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear.
• The utility may ask you to insert your flash drive and/or other removable drives including your mobile phone. Please do so and allow the utility to clean up those drives as well.
• Wait until it has finished scanning and then exit the program.
• Reboot your computer when done.

NEXT

Please download DDS and save it to your desktop.

• Disable any script blocking protection
• Double click dds.pif to run the tool.
• When done, two DDS.txt's will open.
• Save both reports to your desktop.

—————————————————
Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.



NEXT


Download the GMER Rootkit Scanner. Unzip it to your Desktop.
Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.
Double-click gmer.exe. The program will begin to run.
**Caution**
These types of scans can produce false positives. Do NOT take any action on any "<— ROOKIT" entries unless advised!
If possible rootkit activity is found, you will be asked if you would like to perform a full scan.

• Click NO
• In the right panel, you will see a bunch of boxes that have been checked … leave everything checked and ensure the Show all box is un-checked.
• Now click the Scan button.
  Once the scan is complete, you may receive another notice about rootkit activity.
• Click OK.
• GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "GMER.txt"
• Save it where you can easily find it, such as your desktop.

Post the contents of GMER.txt in your next reply.


Please describe how your computer is behaving at the moment, listing any symptoms and problems that you are experiencing.

Big problems here. I ran both of the suggested logs - they are saved on my desktop. I ran the rootkit scan and it locked up once it finished and would not allow me to save a log. Now my pc won't reboot to anything other than in safe mode. I can not access the two log files. I am getting a services error that instantly reboots my pc. I did not have any problems before I ran that GMER.exe file you sent me to. One thing I noticed during that scan was that I got a ton of pop-ups during the scan from a variety of websites. Before this, I never had any pop-ups at all. I have no idea what to do now. I didn't have any issues with my pc until I inserted my thumb drive and got that virus - and I was on a fresh reinstall of windows.

Ok…I deleted several files that I noticed from the scan that I googled and found were malware/problems - list below. c:\ofmmfqd.exe c:\pnjb.exe c:\snojrk.exe c:\vpulel.exe After doing this I was able to restart into my normal profile. I will attempt rerunning the gmer.exe scan to see if I can get that log you wanted. For now, I have attached the other two logs.

Did you run the flash disinfector file that I gave you to disinfect your portable media?

Try running GMER in safe mode. there is possibly a rootkit on your system that is hidden and is causing all the issues you are experiencing,
the way I had asked you to run GMER is only as a diagnostic tool.

Please advise if you are able to run it and produce a log?

If not run this program:

Download Rooter.exe to your desktop

• Doubleclick it to start the tool
• A Notepad file containing the report will open, also found at %systemdrive%\Rooter.txt (Where %systemdrive% is usually C: or the drive that you have installed Windows).
• Post that in your next reply.

CatByte, I am sorry. I got really frustrated with the whole idea of having another dang virus as I just reformatted it a month ago. Since I didn't have anything critical I needed to save I went ahead and reformatted yet again. I should now be fully virus and rootkit free. Nothing but Windows, OpenOffice, and Mozilla on my pc now. Thank you very much for your help. By the way, I did run the disinfector file for my thumb drive. Should that completely clear up my thumb drive problem or will I need to do anything further for it?

Hi, Running the flash disinfector should help prevent future problems, but it's always a good idea to run it every now and then. Thanks for letting us know. I shall close the thread. Thank-you CB

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.