Weird 'autorun' option on removable drives

peaz · 10th Apr 2007, 09:22 AM

Hey guys. Have anyone of you encountered this before? It's appearing on both my win2k3 notebook and my work winxp notebook.

It seems like all removable disks will have this weird problem. I can't double click it cos it will cause an access denied error because of that invalid default action.

Hmmm. Don't seem like a worm or virus yet at the moment. Scans shows nothing so far. ANyone have any idea?

NoFormz · 10th Apr 2007, 10:01 AM

Have you used your removable disk on any new or public PCs?

I suggest to run a scan first though.
The symbols looks like unreadable chinese characters...
Bah.. I have no idea...

BTW, you still can access it through the Explore option right?

Chai · 10th Apr 2007, 10:30 AM

LOL, I've seen this before. But I forgot what I did to those. Should be one of the software.

peaz · 10th Apr 2007, 10:40 AM

Yup. still have access. local hard disk no issues. only USB disks and removable drives. Weird. Scanned, dun look like any worm or viruses

zy · 10th Apr 2007, 11:05 AM

ermm .. i dont have that

pfelelep · 10th Apr 2007, 01:48 PM

Yes, one of the software you have installed has modified the right-click options menu for removable disks.

Use a regcleaner app to locate the software wich is responsible for this.

Or ask your memory.
Strange that your explorer cannot display the right characters associated with the option menu.

peaz · 10th Apr 2007, 06:23 PM

All is good now. It's a damn worm attempt to infect my machine. Now that I remember it, it created some info.exe file in a recycler directory in it which was blocked by my antivirus scanner.

but i think it managed to create an autorun.inf file and that's the stupid file that's giving me that stupid option.

Phew...

Looks like this is the worm.. or a version of it. http://www.sophos.com/security/analy...sillyfdce.html

NoFormz · 11th Apr 2007, 07:16 AM

How did you find out 'bout it?
Since you said nothing much appeared in the scan?
You said the "Recycler Directory" is blocked by your Antivirus? How's that?
You meant as in the directory is quarantined?

Anyway, glad that you managed to find the source of your problem.

peaz · 12th Apr 2007, 06:27 PM

Google helped. Searched the net for access denied on removable disks and someone posted about checking for some worm that writes itself to any USB disk by creating a hidden recycler folder (which is actually valid for normal hard disks - which also makes things more confusing initially cos a USB hard disk shows up as a local drive and will have a valid recycler folder)

Anyway, that reminded me of a time when my antivirus prompted me on a info.exe virus found in the recycler folder and quaratined the just the file.

well, goes to show how important a good AV and spyware detector is... phew!

Adrian Wong · 14th Apr 2007, 11:39 AM

Wow.. That's good to know. Must watch out for it.

10th Apr 2007, 10:01 AM	#2 (permalink)
NoFormz Warming up Join Date: 25 May 2005 Location: Selangor, Malaysia Posts: 114 Reputation: 19 Rep Power: 4	Have you used your removable disk on any new or public PCs? I suggest to run a scan first though. The symbols looks like unreadable chinese characters... Bah.. I have no idea... BTW, you still can access it through the Explore option right? __________________ Last edited by NoFormz : 10th Apr 2007 at 10:07 AM.

10th Apr 2007, 10:30 AM	#3 (permalink)
Chai Administrator Join Date: 6 Oct 2002 Location: Maranello Posts: 26,041 Reputation: 3845 Rep Power: 70	LOL, I've seen this before. But I forgot what I did to those. Should be one of the software. __________________ Chai (Contributor & Forum Admin) http://www.techarp.com/ Intel E8400 @ 4GHz \| Abit IP35 Pro \| Corsair TWIN2X4096-6400C5DHX \| Asus EN8800GTS 512MB \| WD Raptor WD740 \| WD 5000AAKS x2 \| Antec TPII-480 \| EMU 0404 PCI \| Dtek FuZion CPU \| Swiftech MCW60 \| Swiftech MCR320QP \| Swiftech MCP350 \| Dell 2001FP \| BenQ G2400W \| Logitech G5 \| Logitech G25 \| Microsoft Natural Ergonomic Keyboard 4000

10th Apr 2007, 10:40 AM	#4 (permalink)
peaz ARP Webmaster Join Date: 13 Oct 2002 Location: http://atpeaz.placidthoughts.com/ Posts: 8,462 Reputation: 1633 Rep Power: 30	Yup. still have access. local hard disk no issues. only USB disks and removable drives. Weird. Scanned, dun look like any worm or viruses __________________ Ken Ng Tech ARP Visit my web gallery - Ken's Digital Canvas Shoot and Earn Money from Stock Photography Sterling@PJ Community Forums

10th Apr 2007, 11:05 AM	#5 (permalink)
zy Dead Join Date: 16 Dec 2002 Location: Penang,Malaysia - Buffalo,New York Posts: 12,795 Reputation: 1998 Rep Power: 37	ermm .. i dont have that __________________ current: P4-3.2\|P4P800-Deluxe\|512x4-DDR\|NV6600 WD2500KS\|WD5000AAKS\|AD-7191A\|1860NX\|Z2300\|MP470 home (malaysia): P4C-2.6@3.1-StockHSF\|AI7\|256x2-BT-D43\|512x2-DT-D43\|A9600XT-VIVO WD1200JB\|2xWD2500KS\|DRU-800A\|DVD-E616P\|LTR-52327S\|152x\|V.S.4121\|iP1500 laptop: M1210\|T7200\|2GBDDR667\|160GB5K160\|GO7400

10th Apr 2007, 01:48 PM	#6 (permalink)
pfelelep Warming up Join Date: 15 Nov 2005 Location: hongkong Posts: 118 Reputation: 318 Rep Power: 6	Yes, one of the software you have installed has modified the right-click options menu for removable disks. Use a regcleaner app to locate the software wich is responsible for this. Or ask your memory. Strange that your explorer cannot display the right characters associated with the option menu. __________________ Pfelelep I'm french, so excuse my english.

10th Apr 2007, 06:23 PM	#7 (permalink)
peaz ARP Webmaster Join Date: 13 Oct 2002 Location: http://atpeaz.placidthoughts.com/ Posts: 8,462 Reputation: 1633 Rep Power: 30	All is good now. It's a damn worm attempt to infect my machine. Now that I remember it, it created some info.exe file in a recycler directory in it which was blocked by my antivirus scanner. but i think it managed to create an autorun.inf file and that's the stupid file that's giving me that stupid option. Phew... Looks like this is the worm.. or a version of it. http://www.sophos.com/security/analy...sillyfdce.html __________________ Ken Ng Tech ARP Visit my web gallery - Ken's Digital Canvas Shoot and Earn Money from Stock Photography Sterling@PJ Community Forums

11th Apr 2007, 07:16 AM	#8 (permalink)
NoFormz Warming up Join Date: 25 May 2005 Location: Selangor, Malaysia Posts: 114 Reputation: 19 Rep Power: 4	How did you find out 'bout it? Since you said nothing much appeared in the scan? You said the "Recycler Directory" is blocked by your Antivirus? How's that? You meant as in the directory is quarantined? Anyway, glad that you managed to find the source of your problem. __________________

12th Apr 2007, 06:27 PM	#9 (permalink)
peaz ARP Webmaster Join Date: 13 Oct 2002 Location: http://atpeaz.placidthoughts.com/ Posts: 8,462 Reputation: 1633 Rep Power: 30	Google helped. Searched the net for access denied on removable disks and someone posted about checking for some worm that writes itself to any USB disk by creating a hidden recycler folder (which is actually valid for normal hard disks - which also makes things more confusing initially cos a USB hard disk shows up as a local drive and will have a valid recycler folder) Anyway, that reminded me of a time when my antivirus prompted me on a info.exe virus found in the recycler folder and quaratined the just the file. well, goes to show how important a good AV and spyware detector is... phew! __________________ Ken Ng Tech ARP Visit my web gallery - Ken's Digital Canvas Shoot and Earn Money from Stock Photography Sterling@PJ Community Forums

14th Apr 2007, 11:39 AM	#10 (permalink)
Adrian Wong Da Boss Join Date: 10 Oct 2002 Location: In front of my BenQ Joybook 7000 notebook! Posts: 29,390 Reputation: 2830 Rep Power: 63	Wow.. That's good to know. Must watch out for it. __________________ Dr. Adrian Wong Tech ARP \| Blog @ Tech ARP \| The Free Trade Zone DYKT : The only offshore account I have is at the sand bank? Keep Tech ARP free! Visit our sponsors! We need PROGRAMMERS and TECHNICAL WRITERS! Contact us if you are a hot shot programmer or technical writer! My items for sale : 50x SD Card \| Memory Stick PRO \| Cyclone Energy Saver \| Seiko SS watch \| Tiger/Carlsberg beer jugs \| Travel Speakers \| Motorola V600 \| Nokia N90 SOLD! \| New Lowepro Mini Trekker AW Other items for sale @ the FTZ : Zalman CNPS9500 LED @ $20 \| Zalman CNPS7700 Cu @ $20 \| Zalman CNPS7000 Cu @ $20 \| Swarovski bracelet watches \| Dell 17" LCD \| Hi-Fi speakers \| English DIVX movies \| HP LaserJet toners! \| Office chairs

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Super Talent Announces SATA Solid State Disk Drives	Dashken	News	0	20th Mar 2007 09:03 PM
Seagate Ships World's First 160GB Notebook PC Hard Drives with Perpendicular Recordin	Dashken	News	0	17th Jan 2006 11:17 PM
Seagate Introduces New Family of Barrucuda Hard Drives with up to a Half Terabyte of	Dashken	News	14	13th Oct 2005 12:45 AM