hjt analysis needed

Hi Dan,

It may be a good idea to help prevent malware on your USB drives and other portable drives as well.

Download Flash_Disinfector.exe by sUBs from HERE and save it to your desktop.

• Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear.
• The utility may ask you to insert your flash drive and/or other removable drives including your mobile phone. Please do so and allow the utility to clean up those drives as well.
• Wait until it has finished scanning and then exit the program.
• Reboot your computer when done.

Note: Flash_Disinfector will create a hidden folder named autorun.inf in each partition and every USB drive plugged in when you ran it. Don't delete this folder…it will help protect your drives from future infection.

well, i hate to say this, but the program Flash Disinfector did not solve the problem. i tried it on a usb stick, inserted it again after reboot and no autoplay or prompt. i was informed by AntiVir that the autoplay function on the stick was blocked because of security reasons. i googled and found out that AntiVir has an option to block ALL drives' autoplay feature. so i went in to AntiVir configuration, unchecked "block autoplay" feature and rebooted the computer. sorry to say my autoplay function is still not responding on any/all drives :-( what now?

Hi Dan,
I understand how you can enjoy the convenience of using the Autoplay feature, but it can cause more harm than help in the future. Leaving it disabled will certainly help with stopping the spread of malware on your system if you get infected at a later point in time. I can not stress to you enough the importance of leaving the autoplay feature disabled on your system. If you would however still like to have it enabled let me know as there is another option that we can try.


1. Go to Start–>Run type gpedit.msc

2. Move to Computer Configuration –> Click Administrative Templates–> System select Turn off Autoplay

3. Move to settings tab in Turn off Auto Play properties

4. Select the drives, which you need to enable/disabled Autoplay.

Let me know how that works for you.

ok, i understand the importance of leaving autoplay disabled. i do. BUT, i am also someone who is bothered when things don't work properly. at the very least my dvd/cd rom drive should be able to autoplay-for example for audio cds, picture cds, game cds, dvds/movies. at the very least that drive should be able to autoplay. something is obviously missing from windows to not allow this option to work, even though all settings and registry entries are saying otherwise. and that is what is bothering me-i want/need to know WHY i can't enable autoplay. alright, did what you suggested, the settings were set to "not configured", i set it to "disabled"(disables turn off autoplay)-did not change, still no autoplay on usb or dvd/cd rom drive :-(

Hi danszczerba,

I am sorry that we have had to go through so many steps, but we need to cover all the bases to make sure your system is best protected. I assure you that it is not just me that is making the recommendation to leave it disabled but Microsoft as well for the safety of your system. The autoplay feature is disabled by ComboFix as a preventative measure to help with future malware protection. If you feel that you still want to have the auto play function enabled please do the following:

Please download ERUNT (Emergency Recovery Utility NT). This program allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed. **Remember if you are using Windows Vista as your operating system right-click the executable and Run as Administrator.
———-

I would like you to take the following steps:

• Click Start then Run type Notepad and click Ok
• Copy and Paste the contents of the Code box below into Notepad
  
  

  REGEDIT4
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom]
  "AutoRun"=dword:00000001
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer]
  "NoDriveAutoRun"=dword:00000000
  "NoDriveTypeAutoRun"=dword:00000000
  
  [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
  "NoDriveAutoRun"=dword:00000000
  "NoDriveTypeAutoRun"=dword:00000000

• Save as regfix.reg to your Desktop
• Make sure to save file type as All Files
• Now right-click regfix.reg and select Merge

Once that has completed let me know if that has fixed the auto play feature.

ok, autoplay is working again. THANKS!!! :-) still have a tiny tiny problem though. here it is:
i have all my drives set-up to prompt with an action to take. and that is good, that's the way i want it.
all drives do this EXCEPT for my dvd/cd rom drive-it automatically opens a windows explorer screen of the contents of the cd/dvd.
-when music original music cds are read i am presented with a "take action" prompt
-when reading, for example "windows xp(software cd) or Gothic 3(pc dvd-rom), it opens the windows explorer view of the contents :-(

my question is-how can i set up my cd/dvd drive to automatically launch these software cds. for example, the way my computer USED to handle this was when i put a game dvd-rom in my drive, the game launcher would launch, showing the game start screen, asking me if i wanted to play, install, visit website etc. etc. or if i layed a software rom in, like, norton security suite, i would be presented with the norton screen and the options install, visit website etc. etc. NOW i only get the windows explorer breakdown of the cd or dvd, and have to look for setup.exe or launcher.exe or html pages etc. etc.

how can we get this back the way it was before my malware cleansing?

and also, when i downloaded ERUNT it came with NTREGOPT-what is NTREGOPT and do i need it? if it is a hdd defragger, i use Perfect Disk.

Hi danszczerba,

If you want to have the cd/dvd player automatically start please do the following:

Go to Start > My Computer > right-click CD/DVD > Properties > AutoPlay > For each entry in the Drop Down Click Select Action to Perform > Select program to open media type (ie: Windows Media Player) > Apply

Let me know if that helped.

yes, i figured that, but this is where my novice shines through-what do i select for example , to autoplay a game-rom? or a software-rom? the only choices i have are photo files, music files, video, music cd, dvd movie, hd dvd movie, or mixed content(and this only offers my photolab as an option). sorry for such a noob question, but i'm lost :-(

Hi Dan,
You should select the music CD setting for game play. That should get you up and running again. Sorry it took me some time to get back.

ok, i don't think you understand what my problem is. here goes:
when i insert, for example, my windows xp cd in my drive, i should be presented with a welcome screen or a list of options for this software or something for the eyes. instead i get this:
[external image: Posted Image]

when i open the autorun.inf, this is what it says:
[external image: Posted Image]

if you ask me, something is missing from that inf file-no icon, no software name AND, no matter what software or game i lay in my drive, EVERY autorun.inf file has the same two lines-that can't be right either.
i inserted a pc dvdrom GOTHIC 3-normally, i would be presented with a small welcome screen asking if i want to play, install, visit website, view read me file, etc. instead i get a windows explorer screen showing the contents of the pc dvdrom. and the autorun.inf file is exactly like the one pictured above-no icon, no software name.
please tell me something isn't right? could it be that Flash Disinfector has something to do with it? just guessing, i have no idea, what i do know is that this isn't correct :-(

on the other hand, my cd/dvd drive is set to prompt me for an action. IF this is wrong, and IF i should set autoplay to "select an action to perform"-which action should i be selecting? depending on the file choice, i am only offered choices like-open with media player, open with itunes, or open with ACDSEE PHOTO-there is NO choice/selection/file/option for software or dvdrom/cdrom autorun :-(

Hi Dan,

If you notice in the autorun.inf file it shows icon=Setup.exe, 0 it should read icon=Setup.exe, 1. Make that change in the file, save it and see how that works for you.

at the risk of sounding stupid-are these "autorun.inf" files only found on the cd/dvd rom? or is there a universal autorun.inf file located in windows somewhere? i ask because, as i described in the post before this, i tried two different cd/dvd roms, and they both had the same .inf file= "icon=Setup.exe, 0". i tried changing the .inf file like you requested, but being that it is located on the cd it is a "read only" .inf file, i can't change anythig….or am i looking in the wrong place???

Hi Dan,

At this point I think that it would be best advised to start a new thread at our Tech Forum found here. They will be better able to assist you with these problems. Be sure to put into your thread the link to the work we have done here so that they will be able to reference what has been done. The link is http://forums.whatthetech.com/index.php?showtopic=118669

ok, thank you jeff for all your help

You are quite welcome Dan!!