Author Topic: AutoPlay Virus  (Read 40602 times)

0 Members and 1 Guest are viewing this topic.

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89667
  • No support PMs thanks
Re: AutoPlay Virus
« Reply #60 on: April 14, 2008, 08:25:33 PM »
I don't think WMP is really in the equation as if you put a CD in that WMP had the codecs for it would have played.

The fact that you would have got the same pop-up, that indicates that you have the Prompt me each time to choose an action selected. This makes the folders that are being spawned even more strange as there should be no autonomous action taken.

The only things left really is the driver issue that oldman mentioned as the hardware (optical drive) appears to be working. Hardware and driver issues are notoriously difficult to resolve and short of re-installing the driver or swapping the optical drive (if a friend has one you can borrow or you have a spare.

I don't know if you have reinstalled a driver before or not as it isn't a simple procedure as you have to have a new driver available. Either windows should recognise the optical drive and use one it has or it would ask for one. If it did that you would need the CD that came with the drive and if you don't have that you need to find the exact drive model and try to get one from the manufactures web site.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD - 27" external monitor 1440p 2560x1440 resolution - avast! free  24.9.6130 (build 24.9.9452.762) UI 1.0.818/ Firefox, uBlock Origin Lite, uMatrix/ MailWasher Pro/ Avast! Mobile Security

RajaValor

  • Guest
Re: AutoPlay Virus
« Reply #61 on: April 14, 2008, 08:52:05 PM »
I don't think WMP is really in the equation as if you put a CD in that WMP had the codecs for it would have played.

The fact that you would have got the same pop-up, that indicates that you have the Prompt me each time to choose an action selected. This makes the folders that are being spawned even more strange as there should be no autonomous action taken.

The only things left really is the driver issue that oldman mentioned as the hardware (optical drive) appears to be working. Hardware and driver issues are notoriously difficult to resolve and short of re-installing the driver or swapping the optical drive (if a friend has one you can borrow or you have a spare.

I don't know if you have reinstalled a driver before or not as it isn't a simple procedure as you have to have a new driver available. Either windows should recognise the optical drive and use one it has or it would ask for one. If it did that you would need the CD that came with the drive and if you don't have that you need to find the exact drive model and try to get one from the manufactures web site.

So it basical boils down to seeing if HP has a driver on ther website for my laptop and to try to reinstall it if possible; which I have never done.

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89667
  • No support PMs thanks
Re: AutoPlay Virus
« Reply #62 on: April 14, 2008, 11:29:44 PM »
Before you do any of that you could check if the driver is reported as working correctly. If there are any problems with that driver there would be a yellow circle with an ! in it, if not it will be similar to my image, so the driver might be OK.

The driver is for the optical drive and not your laptop and I don't know if they might have that driver, did you not get any CDs with your laptop as these may contain all necessary device drivers. The problem being correctly identifying the exact model of optical drive on your laptop. You can go to the My Computer, System Information, Hardware, Device Manager and look for DVD/CD. That may give information on the drive model which you might be able to do a google search.

Well the only other option is to uninstall the existing driver and reboot your system, the operating system should then detect new hardware and try to install a suitable driver. This may not go as planned and windows might not have a driver and you have to provide one, so it is advisable to already have obtained one.

I also don't know if it is advisable for you to do this on your own as it could make things even worse and trying to talk someone through this on something like the forums is not good.

Lets assume you enable autoplay for the optical drive, how much hassle are the folders being opened ?
If you leave it disabled, then when you put a music CD, etc. you would have to right click the Drive letter for the optical drive in windows explorer and from that menu select AutoPlay. Neither situation is by any means ideal.

I'm honestly out of ideas as to why this whole problem is occuring but it isn't malware as you first suspected.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD - 27" external monitor 1440p 2560x1440 resolution - avast! free  24.9.6130 (build 24.9.9452.762) UI 1.0.818/ Firefox, uBlock Origin Lite, uMatrix/ MailWasher Pro/ Avast! Mobile Security

RajaValor

  • Guest
Re: AutoPlay Virus
« Reply #63 on: April 15, 2008, 02:35:01 AM »
Before you do any of that you could check if the driver is reported as working correctly. If there are any problems with that driver there would be a yellow circle with an ! in it, if not it will be similar to my image, so the driver might be OK.

The driver is for the optical drive and not your laptop and I don't know if they might have that driver, did you not get any CDs with your laptop as these may contain all necessary device drivers. The problem being correctly identifying the exact model of optical drive on your laptop. You can go to the My Computer, System Information, Hardware, Device Manager and look for DVD/CD. That may give information on the drive model which you might be able to do a google search.

Well the only other option is to uninstall the existing driver and reboot your system, the operating system should then detect new hardware and try to install a suitable driver. This may not go as planned and windows might not have a driver and you have to provide one, so it is advisable to already have obtained one.

I also don't know if it is advisable for you to do this on your own as it could make things even worse and trying to talk someone through this on something like the forums is not good.

Lets assume you enable autoplay for the optical drive, how much hassle are the folders being opened ?
If you leave it disabled, then when you put a music CD, etc. you would have to right click the Drive letter for the optical drive in windows explorer and from that menu select AutoPlay. Neither situation is by any means ideal.

I'm honestly out of ideas as to why this whole problem is occuring but it isn't malware as you first suspected.
There was no CD with the laptop no.
Iunno; the folders are VERY annoying to just let the autoplay back on to the CD/DVD drive.
If I just keep autorun off for that drive all Im losing is the auto prompt basicaly right?

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89667
  • No support PMs thanks
Re: AutoPlay Virus
« Reply #64 on: April 15, 2008, 09:09:55 PM »
If you keep things as they are that is the only impact you should experience.

All you would need to remember is to right click on the optical drive in explorer and select autoplay.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD - 27" external monitor 1440p 2560x1440 resolution - avast! free  24.9.6130 (build 24.9.9452.762) UI 1.0.818/ Firefox, uBlock Origin Lite, uMatrix/ MailWasher Pro/ Avast! Mobile Security

RajaValor

  • Guest
Re: AutoPlay Virus
« Reply #65 on: April 16, 2008, 02:38:14 AM »
If you keep things as they are that is the only impact you should experience.

All you would need to remember is to right click on the optical drive in explorer and select autoplay.

Alright then.
What about deleting the autoplay.infs?
Would Windows remake the needed ones automaticaly or would deleting those make the whole system explode?

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89667
  • No support PMs thanks
Re: AutoPlay Virus
« Reply #66 on: April 16, 2008, 01:16:48 PM »
You haven't got any in the root folders (C:\ is a root as is D:\, yours are situated within program folders if I remember rightly) or they would have been detected by the numerous tools used to analyse your system.

Windows doesn't create them in the first place so wouldn't recreate them. Windows doesn't need them, programs/malware need them to run program setup files/malware. They are normally only on CD/DVD Media. It is only the use by malware that puts them in the root folders on HDDs or on USB flash drives so they run automatically, infecting your system.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD - 27" external monitor 1440p 2560x1440 resolution - avast! free  24.9.6130 (build 24.9.9452.762) UI 1.0.818/ Firefox, uBlock Origin Lite, uMatrix/ MailWasher Pro/ Avast! Mobile Security

RajaValor

  • Guest
Re: AutoPlay Virus
« Reply #67 on: April 16, 2008, 06:47:56 PM »
Ok; so since those files are not nessasary to Windows for running.
What if I tracked down the files to see which goes to what program?

For instance; looking at the autorun.inf files, theres one labled C:\SWSETUP\SonicDMP\MYDVD_62.
Sonic was a video editing program that came with the laptop; I delted it b/c it was a useless trail version. Deleteing that would be just fine b/c the program is no longer; but if the program WAS installed still like my Logitech Quick Cam; it would not be wise to delete that one, right?

If I dont need them I dont want them there.
Id just rather ask someone with way more experience b4 I ruin this thing.

Its a control freak issue x;

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89667
  • No support PMs thanks
Re: AutoPlay Virus
« Reply #68 on: April 16, 2008, 07:22:48 PM »
Why track them down, haven't you already don that with the search I asked you to do and  I said that those ones related to the associated programs, check your posts again.

You mention deleting, when I hope you mean uninstalling and that should remove the program folder related to the program. That is the correct action for programs you don't use remove them using add remove programs. If it doesn't remove program folders then you would have to remove it manually.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD - 27" external monitor 1440p 2560x1440 resolution - avast! free  24.9.6130 (build 24.9.9452.762) UI 1.0.818/ Firefox, uBlock Origin Lite, uMatrix/ MailWasher Pro/ Avast! Mobile Security

RajaValor

  • Guest
Re: AutoPlay Virus
« Reply #69 on: April 16, 2008, 10:21:40 PM »
Why track them down, haven't you already don that with the search I asked you to do and  I said that those ones related to the associated programs, check your posts again.

You mention deleting, when I hope you mean uninstalling and that should remove the program folder related to the program. That is the correct action for programs you don't use remove them using add remove programs. If it doesn't remove program folders then you would have to remove it manually.

Yes I have already given you a full listing of all the autorun files I was just saying "track down" as a term of "research/ re-find".

I unistalled Sonic from add/remove programs yes; but the autorun for that program is still in a folder called C:\SWSETUP\SonicDMP\MYDVD_62 apprently. I will remove it manualy then if its just not needed.

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89667
  • No support PMs thanks
Re: AutoPlay Virus
« Reply #70 on: April 16, 2008, 10:27:53 PM »
Yes if you have done the add remove programs, just clean up after it.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD - 27" external monitor 1440p 2560x1440 resolution - avast! free  24.9.6130 (build 24.9.9452.762) UI 1.0.818/ Firefox, uBlock Origin Lite, uMatrix/ MailWasher Pro/ Avast! Mobile Security