'While the autorun functionality in operating systems does provide some convenience (it saves a couple of clicks), it has single-handedly revived the 1980s model of hand-carried malware propagation. 'During the last couple of years we have seen malware authors increasingly incorporate the autorun.inf infection vector into malware families–with stunning success,' Thomas wrote. If an admin account is signed in instead of the user, select User in the top menu. When looking for malware, it helps to be signed in as the user that got infected. When Autoruns opens, press Esc to cancel the current scan. Thomas noted that the tactic brings back memories of some of the earliest computer viruses, which in the days before the internet spread themselves by infecting floppy disks shared over multiple systems. Open the zipped folder and run Autoruns.exe for 32-bit operating systems or Autoruns64.exe for 64-bit operating systems. The infected drive can then either spread to the malware to a new host or re-install itself on a recently-cleaned system. Many have chosen to target thumb drives and other removable media by directing the trojan to not only infect the target system, but to also re-install the trojan on removable drives along with a specially-crafted auto-run file.

Still, however, the use of the autorun feature has become a potent way for malware writers to spread infections. The feature can be disabled, and Microsoft recently released an update for Windows which allows users to better set autorun permissions for each drive to prevent devices from automatically launching code.

Autorun malware