Thursday, October 3, 2013
Autorun.inf Description
Autorun.inf is a generic file used to determine basic computer behavior for CDs. Although harmless in and of itself, Autorun.inf may also be used to run harmful Trojans and other malware. Since the probability of infecting other systems with a CD infected by a malicious Autorun.inf file is very high, you should make every effort to delete the infection before using the CD further. An Autorun.inf infection is rarely the only case of infection in a system, and will usually only be a symptom of other malware problems that should also be taken care of.
Getting to Know Autorun.inf
Legitimate software use Autorun.inf to run program menus instantly when the CD is placed in the computer’s drive. The Autorun.inf file can also determine the kinds of menu commands shown when right-clicking the drive icon, as well as icons that show up when the CD is being read. Autorun.inf is a simple text file that takes up negligible space and has no real functionality besides the above mentioned capabilities.
In most cases both benign and malware-based, Autorun.inf will be set to have the Hidden attribute. This will make Autorun.inf invisible to any users who’ve retained default file viewing settings that prevent Hidden files from being seen.
If you want to see whether a CD has an Autorun.inf file or not, alter your file viewing settings appropriately.
Legitimate software CDs don’t spontaneously acquire Autorun.inf, but have the Autorun.inf file included along with all other basic program files. If a CD was previously lacking in an Autorun.inf file but suddenly shows one, then it’s highly likely that this was caused by a Trojan or other kind of malware.
Autorun.inf’s Fall to Malware
Unfortunately, despite its useful applications, Autorun.inf can also be created and used by malware. Typically this will cause the CD in question to run the malware instantly as soon as the CD is inserted into any computer’s drive. This allows infections to spread very rapidly if not identified quickly. Infections will not necessarily show any obvious signs of interfering with the new victimized computer, since many kinds of malware are designed to stay hidden even during installation.
The original malware that creates the abusive Autorun.inf file may or may not allow you to delete Autorun.inf directly. In most situations, one should reboot into Safe Mode and use security software to scan for and delete the infection in all its forms. Only once the infection is deleted are you guaranteed the ability to remove the corrupt Autorun.inf file permanently.
Since Autorun.inf is a text file, one may be able to inspect the contents of the file to discern whether Autorun.inf’s an infection or a legitimate inclusion. As a commonly-used software element, Autorun.inf’s presence isn’t necessarily harmful. However, one shouldn’t neglect the possibility of infection when Autorun.inf’s present, and be ready to use anti-malware programs to remove corrupt Autorun.inf files whenever reading a new CD.
