Autorun.inf + Recycle Bin virus - removal and prevention

To remove the virus
1. Open Run
2. Open CMD
3. Terminate explorer.exe process in task manager.
3. Navigate to pendrive and use "del autorun.inf" command. If it says "Can't find autorun.inf" type "attrib -h -r -s" and repeat the command.
4. Navigate to C:/ Documents and Settings/ Your username directory and type "attrib -h -r -s"
5. Type "del csrss.exe". If it says "access is denied" terminate every process running under your username and repeat the command.
6. Restore explorer by typing "start explorer", go to the pendrive and delete the recycle bin folder.

To prevent pendrive viruses in the future, download a free program called "Autorun Eater" from http://oldmcdonald.wordpress.com/

Alternatively you can disable the AUTORUN feature:

1. Click Start, click Run, type regedit in the Open box, and then click OK.
2. Locate and then click the following entry in the registry:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\No­DriveTypeAutorun
3. Right-click NoDriveTypeAutoRun, and then click Modify.
4. In the Value data box, type 0xFF to disable all types of drives. Or, to selectively disable specific drives, use a different value as described in the "How to selectively disable specific Autorun features" section.
5. Click OK, and then exit Registry Editor.

Category:

Howto & Style

Tags:

• autorun
• autorun.inf
• virus
• recycle
• bin
• removal

[MacMillanDAN]

Help me!!!When i type del csrss.exe nothing hapens!!!(And csrss.exe is in my system32)...i cant get rit of this virus!Its in the processes from the Task Manager (name is : some weird numbers)Could you help me please!!?!?!??

[Triplexity]

@MacMillanDAN

If csrss.exe is located in system32 then it's a legit file. You have some other virus.

[TheMHazell]

@hellboy29999 Hope it worked.

[hellboy29999]

@TheMHazell ok thanks good to know i will try it now :P

[TheMHazell]

@hellboy29999 Try running Microsoft Security Essentials. If you try to insert that drive again, it will delete the autorun file and the virus off of the drive. MSE caught the virus. I got it when it jumped onto my USB drive when I was at a school.

microsoft(dot)com/security(und­erscore)essentials

[TheMHazell]

@yUsReE96 But that is not the best solution when you got important files on there, and don't want to have to recopy them over.

[TheMHazell]

I got hit by that virus, but Microsoft Security Essentials caught the autorun file and caught the fake recycle bin and deleted that. I love Microsoft.

[wilc23]

Hi Triplexity, I downloaded the Autorun Eater 2.5. So can the Autorun Eater prevents the virus in the External Hard Disk from trespassing my computer? I'm weary to plug in the Ext. Hard Disk to my computer. :(

[joesinister]

cmd doesn't work for me. Whenever i press enter after typing it in, i get the "open with" dialogue box...

[yUsReE96]

dude, the easiest way to remove this virus is by formating your usb

[hellboy29999]

FUCK MY LITTLE BRO HE PUT A FUCKING USB IN MY NEW FUCKING EXPENSIVE PC :S now i don't know how to remove this damn virus i have windows7 so it's kind of hard to find something you are talking about :(