Blocking the virus from the U disk Autorun.inf (1)

Speaking of Autorun.inf file, I believe that everyone is no stranger, it is widely used in CD production. Its main role is to enable automatic playback of the disc, but this application has been exploited by some viruses, making our hard drives, especially the U disk, suffer. Today we will join everyone to block this abominable practice.

First, how to find the virus

This virus has very obvious external features, but it is often easy to be abrupt. It's easy to ignore because it doesn't slow down the computer, so many people don't notice it. But if we double-click to open the USB flash drive, instead of opening it in the current window, but opening it in a new window, it may be poisoned. At this time, you can right-click the drive letter in "My Computer" to see what is the top command. If it is "Auto" instead of the normal "Open" (Figure 1), then the possibility of poisoning is Further increase; but to confirm the poisoning, we also need to enter E:\\autorun.inf in the address bar (the E disk needs to be replaced with the actual drive letter), if the file opened in the open file is followed by the file sxs. A file like xls.exe, then it is definitely poisoned.

Tip: In fact, the prevention of viruses is a very complicated matter, and especially QQ is the target of many hackers. In the article "Safety First, IM Software Security Collection", the protection methods of common software such as QQ and MSN are introduced in great detail.

Second, how to remove the virus

After discovering this virus, don't worry, there are many ways to clear it. Here are some simpler practices to introduce to you.

1, manual removal

Because the principle of the virus is to use the automatic play autorun.inf file to complete, so we can manually delete it. Open the "Folder Options" window, switch to the "View" tab, cancel the "Hide Protected Operating System Files" item, and then set "Show all files and folders" so that we can view the root directory of the disk. Autorun.inf file, open it, view the file followed by the open line, under normal circumstances should be sxs.xls.exe, but there are some variants are other file names, such as tel.xls.exe, fun.xls. Exe and so on. First delete the file followed by the open line, and then delete the autorun.inf file. In general, as long as there is a drive letter infection, other partitions will be infected, so do the same for all partitions (Figure 2).

It should be noted that manual removal is only applicable to some objects. If you make a backup file to the system, you can use the backup file to recover. After the recovery, the C drive is safe, and then delete the above files of other disks in the resource manager, which is more thorough.