Question about Microsoft Windows XP Professional SP2

3 Answers

Winplayer.exe and autorun.inf virus

I have a virus that puts a Winplayer.exe file and a autorun.inf onto any add on/external drive that is attached to the computer. I i dont keep these deleted it eventually causes my computer to crash. I have updated synamtics antivirus and it doesnt catch anything to do with it. Need help to get rid of this.

Posted by on

Ad

3 Answers

  • Level 2:

    An expert who has achieved level 2 by getting 100 points

    All-Star:

    An expert that got 10 achievements.

    MVP:

    An expert that got 5 achievements.

    Vice President:

    An expert whose answer got voted for 100 times.

  • Expert
  • 184 Answers

You probably have the virus on your registry and that is a tough one. it depends on the type of virus you have, it may not allow you to install an anti-virus, but you can give it a try. download ad-ware or malwarebytes from the internet, the free version and enable all the settings. start with the malwarebytes its good for problems like this and see if it can get the virus out.

Posted on Jun 23, 2009

Ad
  • Level 2:

    An expert who has achieved level 2 by getting 100 points

    MVP:

    An expert that got 5 achievements.

    Vice President:

    An expert whose answer got voted for 100 times.

    Sergeant:

    An expert that has over 500 points.

  • Expert
  • 150 Answers

Malwarebytes and Ad-aware should be able to help you out here. If they're unable to, then I suggest getting combofix and running it while your computer is in safemode. It will clear out any problems you may have, and should get your computer up and running fine again.

Posted on Jul 05, 2009

Ad
  • Level 2:

    An expert who has achieved level 2 by getting 100 points

    MVP:

    An expert that got 5 achievements.

    Governor:

    An expert whose answer got voted for 20 times.

    Scholar:

    An expert who has written 20 answers of more than 400 characters.

  • Expert
  • 88 Answers

Try Lavasoft Ad-Aware Free Version: http://www.lavasoft.com/products/ad_aware_free.php

I would advise you to disable "System Restore" on All drives, then reboot, install Ad-Adware, update and scan complete system.
If it presists, you will need to fight it in command prompt mode, first use Microsoft's Autoruns.exe to try locate the entry point of the virus, delete the associated files, search whole Windows folder for the same filename in registry, delete them... it's a long procedure.
Let me know if Ad-Aware cannot clean it (you may have to help it by disabling System Restore and delete very similar files that the virus can come back with, but becareful not to delete legimate Microsoft files).

Posted on Jun 23, 2009

1 Suggested Answer

6ya6ya
  • 2 Answers

SOURCE: I have freestanding Series 8 dishwasher. Lately during the filling cycle water hammer is occurring. How can this be resolved

Hi,
a 6ya expert can help you resolve that issue over the phone in a minute or two.
best thing about this new service is that you are never placed on hold and get to talk to real repairmen in the US.
the service is completely free and covers almost anything you can think of (from cars to computers, handyman, and even drones).
click here to download the app (for users in the US for now) and get all the help you need.
goodluck!

Posted on Jan 02, 2017

Add Your Answer

Uploading: 0%

my-video-file.mp4

Complete. Click "Add" to insert your video. Add

×

Loading...
Loading...

Related Questions:

1 Answer

What is the process for cleaning autorun.inf


Method One
  • Open command line (CMD) and write the following:
del /a:rhs [driveletter]:autorun.inf
  • Simply Replace [driveletter] with your drive. If the virus is on the D drive the commad will be
del /a:rhs D:autorun.inf
  • Restart the computer & Done.
Second Method

Genreally when you refresh the windows explorer view a bounded virus process recreates this file. This file is attached to many events of windows explorer including OPEN, REFRESH, etc.
You must close opened explorer windows.
1. Open up a command prompt (i.e. cmd.exe) >> to load it go to Run, type cmd, enter.
2. Now to remove virus's attributes (in order to delete it type following line by line and execute them pressing enter.

F:
F:attrib -s -r -h *.*

If there are any malicious EXE files those are now visible so if unnecessary delete them too.

F:del autorun.inf

3. After finishing above, quickly remove the pendrive as soon as posible (just after executing del command).
4. Now your pen is without virus activation config. file. Now you can safely delete unnecessary EXE files on it.
Method Third

  • Download Flash_Disinfector.exe from here and save it to your desktop.
  • Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear.
  • The utility may ask you to insert your flash drive and/or other removable drives including your mobile phone.
  • Please do so and allow the utility to clean up those drives as well.
  • Wait until it has finished scanning and then exit the program.
  • Reboot your computer when done.



By this way you can remove

Jan 28, 2011 | Computers & Internet

Tip

Make ESET NOD32 Anti-Virus Auto Scan Flash Drive


Everyone doesn't want computers infected with a virus. The question is, where the virus entered into the computer. There are two possibilities, may be infected from the Internet or external device (flash drive, memory cards, external hard drives, etc). Flash drives are external devices that are often used. When we insert the flash drive to the infected computer, flash drive will be infected with the virus. In a flash drive that is infected, will form the autorun.inf file. Autorun.inf files will work automatically, every flash drive is inserted. Setting the default operating system is windows autorun when inserted an external device. Autorun windows, used by the autorun.inf, to enter into the computer. To protect your computer from viruses, there are a few things done:
1. Update anti-virus
2. Setting anti-virus in the guard position
3. Turn off windows autorun
4. Make anti virus auto scan flash drives

Turn off autorun Windows

Win Xp : Press START - run - regedit - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer - NoDriveTypeAutoRun - Value Data - Type = ff - OK

Win Vista / 7 : Press START - Control Panel - Hardware and Sound - Autoplay - uncheck "Use Autoplay for all media devices" - SAVE.

Make ESET NOD32 Anti-Virus Auto Scan Flash Drive

Using software USB Safely Remove. Open software USB Safely Remove - click View - Options - Global Autorun - After device plugging - click Add process to launch list - click browse, open directory C:\Program Files\ESET\ESET NOD32 Antivirus\ecls.exe - Open - then double click the drive letter, to add parameter %DriveLetter% - then, on the tab File name and parameters, write /log-file=c:\report.txt /log-rewrite /aind - OK. Then. click Add process to launch list - write "C:\report.txt" - then unchecked "Wait for the process to finish" and "Launch the process for drives only" OK - FINISH.




on Sep 26, 2011 | ESET NOD32 Antivirus

Tip

How to remove Autorun.inf


Here are some typical malware which can install autorun.inf.exe file to your computer and give your computer a critical strike.
Autorun.inf virus contains three execute files which are kavo.exe, ntdelect.com and autorun.inf. All of them are hidden files. You cannot find the by showing hidden files. The only way to find them is to use DOS command.

Not all user have computer savvy. I was suffered from this virus a lot. Success got rid of it using RegTool and want to share it with you.

To remove Autorun.inf

Tools you need RegTool and AVG anti-virus.

Also here is an easy way to remove Autorun.inf manually!

click Start>Run>enter “CMD” them you will see and command window. In the command prompt, you can search for any exe.files. First we can disable “read only” and “hidden” attributes.
Enter the word in prompt.
Check C drive: key in dir c:\/a/w
2 then
attrib -s -h -r c:\autorun.inf
attrib -s -h -r c:\ ntdelect.com
You can use the same way to disable attributes of other drive such like D, E, etc.
3 OK, everything is done, we can now remove these two files.
For C drive, you can enter
del c:\autorun.inf
del c:\ntdelect.com

The same to D drive
How about kavo.exe? You need to repeat step1 and step 2 to disable attributes.
The delete command is different with them.
attrib -s -h -r c:\windows\system32\kavo.exe
del c:\windows\system32\kavo.exe

last thing you should do:
Open registry editor by entering Regedit.
Go to HKEY_LOCAL-MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Remove Kavo value.

on Jun 01, 2010 | Computers & Internet

1 Answer

I am using a Transcend 8GB USB Pend Driver. when i scanned it, it showed me that, find "rahulvirusprotection.vbe". Hence i delete it immediately. After deleting the virus, i tried to access the...


It is virus which uses autorun feature of the removable devices such as USB Pen Drive. These type of viruses usually have two files. (a) autorun.inf and (b) the executable (.exe) or script file. Some Antivirus programs delete the exe file but the autorun files remains. In your case, the exe file (rahul's virus protection.vbe) has been removed but the autorun entry is there, which is run everytime you try to access your pen drive. First, plug-in the drive and DONT OPEN IT. Open 'My Computer' , right click the pen drive and choose explore. (This would by-pass the autorun feature).

Download Flash Disinfector and save it to your desktop. Double-click Flash Disinfector.exe to run it and follow any prompts that may appear. The utility may ask you to insert your flash drive. Please do so and allow the utility to clean up those drives as well. Wait until it has finished scanning and then exit the program.
Reboot your computer when done.

(Flash_Disinfector will remove any autorun.inf files, create a hidden folder named autorun.inf in each partition and every USB drive plugged in when you ran it. Don't delete this folder. It will help protect your drives from future infection)


Let me know if any further clarification/ assistance is required.

Good Luck!
Appreciate generously, if the solution could have been of any help!
CreativeTECH

Dec 24, 2010 | Office Equipment & Supplies

1 Answer

Worm.win32.autorun.blw virus appear in my system i already use kesper sky, but not solved. please advise a solution. thanx


When the executable is run on the victim's machine, the worm copies itself to the following locations:
  • %Application Data%\remove.exe (Copy of itself)
  • %Application Data%\autorun.inf
Where %Application Data% = c:\Documents and Settings\All Users\Application Data
Autorun.inf has following command
Exp: [autorun]
shellExecute=remove.exe
The worm adds a Run entry in registry so that it executes itself at every startup:
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    "(Default)" = "%Application Data%\remove.exe"
Symptoms -
  • Presence of above mentioned files.
  • Presence of registry entries mentioned above.
Method of Infection Method of Infection - This worm spreads by using autorun.inf on shared drives and removable devices.
Removal - A combination of the latest DATs and the Engine will be able to detect and remove this threat. AVERT recommends users not to trust seemingly familiar or safe file icons, particularly when received via P2P clients, IRC, email or other media where users can share files.


Thanks for using fixya..

Sep 14, 2009 | Computers & Internet

Tip

Windows Cannot Find "Copy.exe"


When i installed AVG Free last time it removed few virus including "copy.exe". so whenever i go to "My Computer" (win key + E) and double click on any hard drive then i find an error stating that (Windows cannot find "Copy.exe").
Solution:
Well the solution for this "copy.exe" conundrum is to get rid of a file called autorun.inf in each of the infected hard drives. here's the solution for the problem......

Make sure you or the virus scanner is run through the infected hard drives/flash drives. to make sure the virus files is gone.
Now, some forums said you could just select "Show Hidden Files" from the option and this would enable you to see "autorun.inf" file.
Also, some entries in the "autorun.inf"may be legitimate. so to check the file (even when you can't see the file) do this: Type in the infected hard drive label followed by autorun.inf for example f:\autorun.inf
This will load autorun.inf file in notepad.if the only entry is that incriminating copy.exe then this is what i did. i tried to overwrite the file with the same name autorun.inf. that din't work because autorun file was readonly. so i saved that blank file on the desktop and simply cut it and pasted it into the drive, then selecting the overwrite option. that should stop that annoying windows cannot find "copy.exe" message every time you double click into a drive. this will solve the problem!
Read more: http://comsguru.blogspot.com/2009/12/windows-cannot-find-copyexe.html#ixzz0nMpOFGpo

on May 08, 2010 | Computers & Internet

1 Answer

How to remove write protect on my usb flash drive


Maybe you are infected with a virus. Run CMD on rrun command or get to run the Windows Dos Prompt. Goto flash drive drive letter. Then type DIR/AH, this will show you list of hidden files in your flash drive usually if you get an autorun.inf you are infected with a virus. Type TYPE AUTORUN.INF with the space in between.This will show you the script if it will run an exe command usually untrusted one. Usually the autorun.inf and the linked exe is attributed to be hidden, system, and read only.

If the files in your flash drive is not so important you can try to delete the autorun.inf only. But you will gonna do this first. In its drive letter type ATTRIB -H -R -S AUTORUN.INF hit enter. Then type DEL AUTORUN.INF. trying to access the flash drive in windows screen you can get that something is cannot be found. But you could actually delete and load files into it. Or try to access the drive rightclicking it then select EXPLORE.

Hope this help. Post comments if this does not help.

May 31, 2009 | iLO (2 GB) MP3 Player

10 Answers

Usb flash drive icon changes into folder icon


This issue may have resulted from a virus infection on the machine the drive was plugged into.

You’ll need to delete the file autoruns.inf located on your flash drive.

By default, Windows hides this file, so before you can delete it you must make a couple of changes (you may reverse these after you’ve finished):

Open My Computer
Tools
Folder Options…
Click on the View tab
Under “Hidden files and folder” choose “Show hidden files and folders”
Remove the tick from “Hide protected operating system files (Recommended)
OK

Go back to My Computer and click on your flash drive. If you can’t open it that way, try right clicking on it and choose “Explore.”

Find the autoruns.inf file, right click on it and choose “Delete.” Confirm “Yes.”

Unplug and re-plug the drive in. You should be back to normal.

Hope that helps.

Feb 26, 2009 | LG KU250 Cellular Phone

2 Answers

Unable to delete the autorun.inf


hi azhar here form Karachi it is very easy. do, the below steps
reboot ur PC in safe mode with command prompt
when u bring a dos screen just move to ur drive mostly virus stayed in d: drive got d: drive and type
d:dir/ah and press enter
if u see there any auto run.inf file there also should be another file like .exe file or .bat or any kind of unknown , file so for delete the auto run file type attrib -s -h -r autorun.inf and press enter
then type del autorun.inf and hit enter here u go u have done.
do the samr process in all drives because mostly autorun.inf file make copy in all drives
remember autorun inf is just a file which help the virus to run autometicly

Feb 12, 2009 | Microsoft Windows XP Professional With...

5 Answers

To remove virus from pen drive


Open Command.
type the drive name say H:
then type ATTRIB -H -R -S AUTORUN.INF
then type EDIT AUTORUN.INF
then a new window appears, delete all the contents and click on File -> Save and click on File -> Exit
in the command prompt
type ATTRIB +H +R +S AUTORUN.INF
then type EXIT
Remove the pen drive and reinsert it.
The virus is now been deleted.
My mail id is overthehedgerj@gmail.com
Contact me if you need my help. Thank You

Oct 24, 2007 | LG KU990 Viewty

Not finding what you are looking for?
Microsoft Windows XP Professional SP2 Logo

210 people viewed this question

Ask a Question

Usually answered in minutes!

Top Microsoft Computers & Internet Experts

micky dee

Level 3 Expert

2775 Answers

Piyal Perera
Piyal Perera

Level 3 Expert

528 Answers

Les Dickinson
Les Dickinson

Level 3 Expert

18394 Answers

Are you a Microsoft Computer and Internet Expert? Answer questions, earn points and help others

Answer questions

Manuals & User Guides

Loading...