autoplay starts when windows loads

For weeks now when I turn on the pc, windows loads and then an autoplay dialogue box shows up on the screen. I have 2 usb external drives, each partitioned into 4 drives. Autoplay goes through 3 or 4 of these partitions, but not always off the same external drive. eg: 1 drive has the letters Q, R, S, T and the other U, V, W, X. It usually goes from T to U, to W and occasionally to X. They all have music on them except for T, so the audio/video starts to play, plays half way through and then moves onto another track, not necessarily on the same drive. I ran avg, malwarebytes, superantispyware & spybot & destroy in safe mode, but only a few tracking cookies were found. After running Autoruns Ztrucker suggested deleting these entries: HP Software Update ExitLauncher2.lnk HP Digital Image Monitor.lnk DriverCure mso-offdap mso-offdap11 FileShredder All AusLogics entries Folder Marker YsiShellExt Yahoo (all) Autoplay still started. I got rid of avg and started using mse, at which time the problem seemed to be solved. But a few nights later, autoplay started again. The pc had been switched on since that morning and no-one was using it at the time. Ztrucker thought it would be an idea to post here in case this is malware at work. Today, before I did, I ran avg, malwarebytes, superantispyware & S&D. All were clear except S&D which found a trojan 'win.autoplay'. I removed it. I decided I would wait for a while to see what happened and had occasion to restart my pc today. As soon as the pc started so did autoplay. The drives that the video & audio play from do not show up on the screen, so don't know which drive/s they belong to. Two other drives then open showing the autoplay options, with the option to open to view files. Sorry if this is longwinded, but I thought I'd better say what had happened so far. If any other information is needed, please ask. Thanks for reading and in advance for any help offered. hedley

Try this:

Download this file
http://download.bleepingcomputer.com/sUBs/…Disinfector.exe


For all of your USB or external drives:

Open the drive.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Uncheck "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Uncheck "Hide protected operating system files."
Click Apply, and then click OK.

Look for the file autorun.inf and rename it if found.
Also look for a Folder that's named resycled, make sure of the spelling and delete the folder if found. DO NOT delete the Recycler folder.

Now run the Flash_Disinfector.exe.

Be sure to insert any flash drives or USB devices that you use.

Do this for every USB / external drives:

Once finshed:

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Check "Hide file extensions for known file types."
Under the "Hidden files" folder, Uncheck "Show hidden files and folders."
Check "Hide protected operating system files."
Click Apply, and then click OK.

Thanks for the reply. Clicking on the link you have given I get a blank page. Didn't notice this the first time I tried, but the file appeared to be saved on the desktop. The icon is there, but the programme will not run. Tried using the link a couple more times, same result. With the page being blank, would the programme have downloaded anyway? In any case is there something else I can try. Thanks for the help hedley

go to Start Menu \ Run and type in:

gpedit.msc


You will see the Group Policy window. You should select Administrative Templates \ System in the tree view:

You will see an item in the right side pane called “Turn off Autoplay”


Double click the item, and set the radio button to Enabled, and change the “Turn off Autoplay on” to All Drives.

Thanks for the reply. Followed your instructions. (Found Turn Off Autoplay under windows components). I'll see how things go from here. Thanks again for the help. Much appreciated, as always. hedley

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.