How to get rid of Autorun.inf

[Avinash]

Today i got a email from one of the guys "Sharad" about his problem :

i recoverd autorun.ini in my pc and its hidden file.which is not removed by any of antivirus n even any autorun remover,i have even tried dos n registries but nothin works.can u please suggest me what to do?
hopin 4 reply.

MY reply : Sharad, i need some more details like what method failed (as u said u did some dos and registry stuff) before i can tell you what to do precisely. May be you can post some screenshots.

Otherwise, you can easily get rid of autorun.inf by changing the attributes of the file and then deleting it.

[rocker]

May be you can post some screenshots.

Otherwise, you can easily get rid of autorun.inf by changing the attributes of the file and then deleting it.

Yes, you can get rid of autorun.inf as he said and if you still got a problem then post it here. We will try to find the solution

[Avinash]

i got the email again from sharad

Atually ur forum is needing my username and passwrd n i frgot both,,well using dos comand i first found that hidden autorun.ini n den its running file i.e kgji.exe,,bt once i give del comand it says cud not fine autorun.ini and kgji.exe?
using removal tools its finding n deleteing them ,but it again recycles.
n yes once i go 4 changing attributes it gets back to previous one.
hope nw u undrstnd my prb?
i'll b vry thnkful if u suggest me a working solution.

Sharad, just make a new user id at forum, it doesnt take more than few seconds.

well, regarding your problem, if you are able to delete autorun.inf and then it creates itself again, then it seems your system is infected with some virus or trojans.

You should better scan your system with a good antivirus and clean it.

I would recommend, download trial version of Kaspersky internet security and scan your system. (i am assuming you dont have a good anti virus on your system)

Just for some info, U are infected with some malware.

KGJI.EXE has been seen to perform the following behavior:

* The Process is packed and/or encrypted using a software packing process
* Executes a Process
* Adds a Registry Key (RUN) to auto start Programs on system start up
* This process creates other processes on disk
* This Process Deletes Other Processes From Disk
* Writes to another Process's Virtual Memory (Process Hijacking)

KGJI.EXE has been the subject of the following behavior:

* Added as a Registry auto start to load Program on Boot up
* Executed as a Process
* Created as a process on disk
* Deleted as a process from disk

[mike1]

yup, i too think you need to completely scan your system with KIS 2010. It will solve your prob.

[jaan]

yes, Autorun.inf recreation means your system is infected. Do a full system scan with a good antivirus

[junky]

Guys should post here if the problem is solved or still unsolved so that others can be benifitted later if same problem occurs