How to remove USB-spreading worms that create autorun.inf files

Autorun worms have been a persistent nuisance for Australian computer users since the early 2000s, and they still surface in homes and offices from Adelaide to Perth. The attack relies on a small text file called autorun.inf that Windows reads automatically when a removable drive is inserted, tricking the operating system into launching malicious code without the user clicking anything. Whether you plug a thumb drive into your work laptop in Brisbane or your home PC in Sydney, the infection can spread in seconds if autorun is enabled.

Understanding how these worms operate is the first step toward removing them and stopping them from coming back. The sections below walk through the warning signals, the manual cleanup procedure, the tools that help automate the process, and the habits that reduce exposure in everyday Australian settings. Even users who rarely swap USB sticks benefit, because infected drives often reach them through friends, technicians, or second-hand hardware bought at local markets.

How autorun.inf worms infect removable drives

The mechanism behind this category of malware is simple and effective. When a USB drive is formatted with NTFS or FAT32, Windows looks for a file named autorun.inf in the root directory and follows the instructions inside it, which usually point to a hidden executable with a random name. The worm drops this file alongside other payloads, then relies on the victim's curiosity or habit of double-clicking the drive icon to trigger the infection chain.

Several families follow this pattern, including variants of W32/Autorun, Conficker remnants, and the older SillyFDC and Ramnit strains that occasionally reappear on drives shared between Australian small businesses. The infection usually hides the user's folders, replaces them with shortcut icons, and copies itself to any new drive inserted into the machine. Because the worm lives on the removable media rather than the host operating system, simply scanning the computer often misses it until the infected stick is plugged in again.

Warning signs that point to an autorun worm

Indicator	What it usually means
Drive opens in a window instead of a folder view	The autorun.inf entry is overriding the default behaviour
Folders replaced by shortcuts pointing to .lnk files	A worm has hidden the originals and substituted malicious links
Unknown processes in Task Manager with random names	Payload executables running from the USB root
Antivirus alert naming W32/Autorun or similar	Signature match against a known autorun worm family
Recurring infections after a clean-up	The source USB drive has not been disinfected

The symptoms above often appear together, which makes diagnosis easier than for stealthier malware. A Sydney-based design studio reported that every workstation started showing shortcut folders within an hour of a single infected drive being passed around during a client meeting. Australian technicians working on second-hand computers bought at office liquidators in Melbourne see the same pattern on machines that have been stored without internet access but still carry old worms on internal drives.

Isolating the infected drive before cleanup

Pulling the USB stick out the moment you notice suspicious behaviour stops the worm from reaching network locations or other removable media. Avoid clicking any prompts that ask to scan, open, or fix the drive, because those dialogs can trigger the autorun payload on systems that have not yet been patched. If you must verify the contents, do it from a clean Linux live environment or a sandboxed virtual machine that does not auto-mount removable media.

Once the drive is out, write down the model and serial number if you plan to return it to the supplier or report the issue to a managed service provider in your state. Many Australian IT support firms, from national chains to local partners in Hobart and Canberra, keep logs of infected hardware so they can warn other clients who might have received the same shipment. Labelling the drive as quarantined with a sticker and a date also prevents well-meaning colleagues from plugging it back in to "check what is on it".

Removing autorun.inf worms step by step on Windows

Boot the affected computer into Safe Mode with Networking so that the worm's payload cannot start automatically. Open File Explorer, enable the viewing of hidden files and protected operating system files, then navigate to each removable drive letter and delete the autorun.inf file along with any executable that has a random eight-character name and a .exe extension. The same cleanup needs to happen on the local C: drive, particularly in the root folder, the Recycle Bin, and the Temp directories under each user profile.

After the visible files are removed, open the Registry Editor and look for suspicious entries under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run, removing any reference that points to a removable drive letter. A full-system scan with Windows Defender Offline or a reputable standalone scanner such as Malwarebytes finishes the job by catching copies that load from alternate data streams. For systems that have already been hit by a more aggressive payload, the CryptoLocker removal walkthrough explains how to handle encryption components that some autorun worms drop as a secondary attack.

Restoring files and verifying that the worm is gone

Reboot into normal mode and reconnect the cleaned USB drive to confirm that autorun.inf no longer appears and that the original folders are visible. If shortcuts are still present, run the command attrib -h -r -s /s /d X:\* from an elevated prompt to strip the hidden, read-only, and system attributes from your real files. This trick is widely used by Australian support technicians and is often faster than running a third-party undelete tool.

When backups have been touched by the infection, recovering them requires extra care because some worms deliberately corrupt snapshot copies. The advice on encrypted backup recovery walks through restoring from clean offline media and validating checksums before bringing the backups back online. Once the system is clean, change passwords for email, banking, and any service you accessed while the machine was compromised, and enable multi-factor authentication through the Australian Government's myGovID or your bank's app where available.

Preventing reinfection across Australian homes and offices

The most effective long-term defence against autorun worms is to disable the AutoPlay prompt entirely through Group Policy or the Settings app, which prevents Windows from reading autorun.inf on any future drive. Pair that with a habit of right-clicking every new USB stick and choosing "Scan with Windows Defender" before opening it, a routine now promoted in the ACSC's Essential Eight maturity guidance for small businesses. Australian organisations that handle sensitive client information under the Notifiable Data Breaches scheme are encouraged to formalise this habit through written removable-media policies.

USB drives bought from local suppliers such as those stocked by Officeworks, or received as conference swag at events like the Sydney Build expo, should be treated as untrusted by default and formatted before use. For users who regularly swap files with colleagues in regional centres such as Darwin or Cairns, encrypted drives with hardware PIN pads add a strong second layer even if the worm returns. Finally, keep an eye on the related email worm behaviours because the same malware families often pivot from USB propagation to contact-list hijacking once they gain a foothold, which is why staying alert across both vectors matters.