Prevent and remove autorun virus from USB drive, hard disk

Removal instructions

Remove autorun.inf virus on USB drive

1. plug the USB drive into your computer, a window dialogue may appear, don’t click on Ok , just choose ‘Cancel’.
2. Go to command prompt and type your USB drive letter.
3. Type dir /w/a and press enter, this will display a list of the files in in your flash drive. Remove the files: Ravmon.exe, ntdelect.com, New Folder.exe, kavo.exe  svchost.exe, autorun.inf  If you find them.
4. To delete the virus just type del and the filename example. F:\del autorun.inf and hit enter.
5. Run a antivirus scan on your USB drives just to make sure that all threats are removed successfully

Delete autorun.inf on hard drive of computer

1. Boot your system in the safe mode and then open a command prompt.
2. Delete the following files:
   %System%\config\csrss.exe
   %WinDir%\media\arona.exe
   %System%\logon.bat
   %System%\config\autorun.inf
   C:\autorun.inf
   D:\autorun.inf
   E:\ autorun.inf
   F:\autorun.inf
   autorun.inf files in all drives.
3. Open the registry editor and delete following parameters:
   [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System]
   DisableTaskMgr = 1
   [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
   NoFolderOptions = 1
   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
   "Worms" = "%System%\logon.bat"
4. Reboot your computer
   
   See more information about Win32.AutoRun.

How to remove autorun recycler virus completely

Sometimes, you may see an Recycler folder in the root of each drive in USB drives or
hard disk and you may treat it as recycler virus. The Recycler folder is an system folder that used to keep the deleted files, when you want to recover the deleted data before, the system will recover them from the Recyclers folder. You can click into the folder, and find the deleted files, picture, folders in it.
The attribute of Recycler folder is hidden, only when the 'show hidden files and folders' option is checked, you can see it.
Also System Volume Information is a system folder, it save the system restoration information.

However, more and more autorun virus hide themselves in the recycler bin folder, if you find any executable file such as RECYCLER.exe, or vbs file in it, and autorun.inf file in the root of the drive, and the content as
[AutoRun]
open=RECYCLER.exe
shellexecute=RECYCLER.exe
shell\Auto\command=RECYCLE.exe






      



That means your computer and USB sticks have been infected with virus.

Remove viruses in Recycler folder

Update antivirus software such as AVG, kaspersky, Nod32 to the latest version, do a thorough scan of the computer and USB storage devices. If the virus/worms come back again after removal, or the antivirus software could not detect the virus even, try to remove the virus manually.

1. Reboot your system and tap F8 to enter safe mode;
2. Close the RECYCLER.exe process in the task manager;
3. Delete the autorun.inf and other suspicious exe files in the recycler folder
4. Open registry editor and modify the NoDriveTypeAutoRun key with 03ffffff in following key: HKEY_LOCAL_MACHINE\SOFTWARE\ and HKEY_CURRENT_USER\SOFTWARE
5. Using the antivirus product to scan again.

The manual removal of the infection is not recommended because it requires an expertise to edit registry. In case you modify a registry entry wrongly, that may cause damage to the system. Therefore, it is always better to remove virus with a specialized removal tool.

Using Recycler Virus Removal Tool to delete the virus automatically

Autorun Remover is a specialized autorun removal tool to clean the autorun type virus including recycler virus, with it, you can get rid of the autorun.inf and recycler.exe easily and quickly.

1. Download and install Autorun Virus Remover;
2. if you USB drives has autorun.inf folder in it, insert it into computer;
3. Execute the tool, Click 'Start' to execute the scan.