One of the most massive viruses spread through misuse of this file. Windows itself promoting this autorun.inf feature.
I can say that 99.9% viruses uses autorun feature as a main tool to kill the customer. To Stop the virus activities u need to kill autorun feature.
some funny symptoms, wanna say;-
if u delete autorun, it'll re-appear again.
if u move autorun, it'll came back again.
if u diasable autorun in registry , it'll enable again.
Autorun appear in all drive, you can't do anything.at all.
Victim usually do: following things - start the pc, the
startup will surely run, Next the victim surely open any of the drive of get a file, these are enough to trigger virus.
Just write these code on notepad and save it as anty.bat
reg delete "HKCR\*\shell\@=P=r=i=n=t=" /f
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /f /v "NoDriveTypeAutoRun" /d "000000FF"
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /f /v "NoDriveTypeAutoRun" /d "000000FF"
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /f /v "" /d "000000FF"
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /f /v "" /d "000000FF"
reg add "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf" /f /v "" /d "@SYS:DoesNotExist"
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf" /f /v "" /d "@SYS:DoesNotExist"
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /f /v "NoAutorun" /d "-"
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /f /v "NoAutorun" /t REG_DWORD /d "00000001"
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /f /v "DisableRegistryTools" /t REG_DWORD /d "0"
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /f /v "DisableTaskMgr" /t REG_DWORD /d "0"
ftype fakefile=C:\\iLEAP\\e.exe "%%1"
assoc .inf=fakefile
assoc .pif=fakefile
assoc .scr=fakefile
assoc .com=fakefile
assoc .dll=fakefile
assoc .img=fakefile
assoc .dos=fakefile
assoc .manifest=fakefile
assoc .vba=fakefile
assoc .vbs=vbsfile
assoc .vbe=fakefile
assoc .v=vbsfile
assoc .6=vbsfile
assoc .`=vbsfile
assoc .1=batfile
for %%c in (c d e f g h i j k l m n o p) do (if exist %%c:\nul (title Locking %%c:
pootam\u.o "%%c:\autorun.inf" /S /D
md %%c:\autorun.inf &echo Hi > "\\?\%%c:\autorun.inf\siva." ))
0t\lin.k "%userprofile%\Desktop\Firefox" "F:\a\o\MFF31\FirefoxPortable.exe" "" "" "" "" "f:\a\y\ico\mz.ico"
xcopy "F:\A\Y\0P\PHOTO_PRINT.CMD" "C:\Documents and Settings\Administrator\SENDTO\" /s/c/y
xcopy "F:\A\Y\0P\VLCRC" "C:\Documents and Settings\Administrator\Application Data\vlc\" /s/c/y
:f:\n.o service start winvnc
start f:\a\y\rain\rm.o &exit
exit
What these code do...
- Kill all trails of autorun from registry
- associate suspicious file extension to NIL
- 'pootam\u.o' is my favorite program 'unlocker'. u can use ur favorite force file deleter program or just disable explorer.exe when you run the .bat
- the term \\?\%%c:\ is actually creating an UN-delete-able file, which cannot be modify or delet by user or any program or any codes. its permenant
At the End. If virus cannot create an "Autorun" file at drive start. Then the virus become useless junkie ;-)
rest is your imagiantion... pls post if any doubts.