Own your autorun.inf

9 October 2009

When travelling around the world I plug in my USB devices in countless public computers.

Many viruses use the autorun.inf file to spread themselves around. When plugging in a USB device into an infected computer the virus copies itself into a hidden location, often the Recycler directory and adds a autorun.inf file in the root of the device to automatically start itself on the next computer.

An easy way to notice whether you may have a virus on your device is to create your own autorun.inf and assign an icon to the device.

Create a text file with the name autorun.inf and place it into the root of your device. The content should look like this:

[autorun]
icon=panama.ico

Now place the icon file "panama.ico" into the root of the device as well. The next time you plug in your device the Windows dialog will look like this:

Windows New Device dialog

Notice the icon in the top left corner. If you do not see your icon, you know something has overwritten your autorun.inf, most likely a virus.

What to do in this case? Check my post Manually finding and removing malware

I prepared some icon files in case you do not have any:

icons

icons.zip (27.17 KB)

Pages in this section

Categories

ASP.Net | Community | Development | IIS | IT Pro | Security | SQL (Server) | Tools | Web | Work on the road | Windows