Removing worm autorun.inf

Viruses and worms
1

Can anyone please assist me of how to remove autonrun.inf on my PC. I’m not a computer Fundy so please explain so that i can understand the basic :cry:

2

Some information wouldn’t go amiss:
What is your OS and is it up to date ?
What is your antivirus ?

What is detecting it ?

What are the contents of one of the autorun.inf files ?
Don’t execute it, but open it with notepad and copy and paste the contents in your next post.

Flash Drive Disinfector
Download Flash_Disinfector.exe by sUBs from >here< and save it to your desktop.
[*] Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear.[*] The utility may ask you to insert your flash drive and/or other removable drives including your mobile phone. Please do so and allow the utility to clean up those drives as well.[*] Wait until it has finished scanning and then exit the program.[*] Reboot your computer when done.
Note: Flash_Disinfector will create a hidden folder named autorun.inf in each partition and every USB drive plugged in when you ran it. Don’t delete this folder…it will help protect your drives from future infection.

Also see this link for more information on Flash Disinfector, http://experi3nc3.wordpress.com/2007/05/10/flash-disinfector-by-subs/

3

My antivirus is avast. before was avg.
I run ice Sword and keep on picking up 2 files, name auronrun.inf and gi2ky.exe My antivirus pickup this file as well gi2ky.exe, but every time i delete it just come back. I don’t know what to do any more.

4

2 more virus have appear now. nmdfgds1.dll and gi2ky.exe what now?

5

Information about … nmdfgds1.dll … is that it is associated with worms and/or cloaked malware :

http://www.prevx.com/filenames/423825869584501986-X1/NMDFGDS12EDLL.html

Information about … gi2ky.exe … is that it is associated with cloaked malware :

http://www.prevx.com/filenames/X3145328086758014881-X1/GI2KY2EEXE.html

6

You could also check the offending/suspect file at: VirusTotal - Multi engine on-line virus scanner and report the findings here the URL in the Address bar of the VT results page.

If multiple scanners detect malware then - Send the sample to virus@avast.com zipped and password protected with the password in email body, a link to this topic might help and undetected malware in the subject.

Or you can also add the file to the User Files (File, Add) section of the avast chest (if it isn’t already there) where it can do no harm and send it from there. A copy of the file/s will remain in the original location, so you will need to take further action and can remove/rename that.

Send it from the User Files section of the chest (select the file, right click, email to Alwil Software). It will be uploaded (not actually emailed) to avast when the next avast auto (or manual) update is done.

Run that tool I suggested to help prevent autorun infection in the future.

If you haven’t already got this software (freeware), download, install, update and run it, preferably in safe mode and report the findings (it should product a log file).