Frequently Asked Questions

This is the online version of the Frequently Asked Questions(FAQ) pertaining to Autorun Eater. If you have downloaded Autorun Eater, it is already included in the help file.

This list will be updated from time to time. You can add a question to any of the replies section. New questions will be added to the help file and available for download monthly, if possible.


    1. How does Autorun Eater determine which ‘autorun.inf’ file is suspicious?
    2. Do I need to manually scan each drive for suspicious ‘autorun.inf’ files?
    3. Are drives A: and B: monitored as well?
    4. Are suspicious files removed as well when I choose to remove the suspicious ‘autorun.inf’ file?
    5. I have enabled ‘Malware Scan’ but nothing happens after I remove the suspicious ‘autorun.inf’ file?
    6. Why are random numbers used for the detection window title? Is it a bug?
    7. How do I remove a suspicious ‘autorun.inf’ file?
    8. When attempting to remove a suspicious ‘autorun.inf file’, why do I get the message ‘Error deleting autorun.inf file from (X:)XXXXX’?
    9. How does the ‘Close Autoplay’ function protect me from executing the malware?
    10. What does the ‘Ignore autorun.inf’ option do in the detection window?
    11. What does the ‘Ignore Drive’ option do in the detection window?
    12. How many drives can I choose to ignore?
    13. Why is the ‘Ignore Drive’ option disabled when I plug in my removable storage device?
    14. I have accidentally ignored a suspicious ‘autorun.inf’ file! How do I undo it?
    15. How do I stop ignoring a drive?
    16. I have chosen to remove the suspicious ‘autorun.inf’ file but another warning appears straight away for the same file and drive! Why is this happening?
    17. What happens to the ‘autorun.inf’ file when it is removed?
    18. Where can I check the removal results and view the backup copies of the removed suspicious ‘autorun.inf’ files?
    19. Why are there 2 suspicious file results in the detection window?
    20. I’m confused, what is the difference between ‘Suspicious autorun.inf’ and ‘Suspicious file’?
    21. Will there be a conflict between Autorun Eater and my antivirus/antispyware software?
    22. Why is my antivirus software detecting Autorun Eater as a malware?
    23. Is Autorun Eater compatible on all operating systems?
    24. What does ‘Registry Fix’ do?
    25. Why are some of the tray menu options ‘greyed-out’ when I start Autorun Eater, is this a bug?
    26. Is it possible to pause Autorun Eater?
    27. Why can’t I remove my removable storage device when Autorun Eater is started?
    28. Can I make Autorun Eater launch and scan automatically everytime I start my computer?
    29. How do I uninstall Autorun Eater?
    30. Why are there leftover files and folders after uninstalling?



1. How does Autorun Eater determine which ‘autorun.inf’ file is suspicious?

Autorun Eater determines whether an ‘autorun.inf’ file is malicious or not by checking for certain strings in the file. You are then warned and asked for further action if the ‘autorun.inf’ file containing those strings are detected.

Back To Top


2. Do I need to manually scan each drive for suspicious ‘autorun.inf’ files?

You don’t need to manually scan a drive. Autorun Eater actively monitors all drives(except drives A:, B: & CD/DVD drives). When a suspicious ‘autorun.inf’ file is detected in any of those drives, a detection window immediately appears to warn and ask you for further action.

Back To Top


3. Are drives A: and B: monitored as well?

No, drives A: and B: must be manually scanned using the options available in the tray menu.

Back To Top


4. Are suspicious files removed as well when I choose to remove the suspicious ‘autorun.inf’ file?

By default Autorun Eater will not help you remove the suspicious file but if you have Microsoft Security Essentials installed, you can set Autorun Eater to use MSE to scan and clean the infected storage device.

Back To Top


5. I have enabled ‘Malware Scan’ but nothing happens after I remove the suspicious ‘autorun.inf’ file?

You must have Microsoft Security Essentials (2.1.1116.0 and above) installed for it to work.

Back To Top


6. Why are random numbers used for the detection window title? Is it a bug?

No, it isn’t a bug. It is a measure used to prevent malwares from attempting to close the window.

Back To Top


7. How do I remove a suspicious ‘autorun.inf’ file?

It depends on your ‘Removal Method’ settings. If it is set to ‘Ask For Confirmation’, then there are options to either ignore or remove it. If it is set to ‘Auto-Remove’, then the suspicious ‘autorun.inf’ file is automatically removed. Suspicious ‘autorun.inf’ files are always auto-backup’ed before they are removed.

Back To Top


8. When attempting to remove a suspicious ‘autorun.inf’ file, why do I get the message ‘Error deleting autorun.inf file from (X:)XXXXX’?

This problem usually happens when the ‘autorun.inf’ file is in use or locked by a process. The file could also be on a write-protected storage device.

You can try any of the following suggested solutions:

  • Perform a full system scan using your updated anti-virus application
  • Turn off the storage device’s write-protection
  • Restart the ‘explorer.exe’ process(make sure all your works are saved)

Back To Top


9. How does the ‘Close Autoplay’ function protect me from executing the malware?

Certain ‘autorun.inf’ files contain instructions that attempt to trick you into executing the malware file via the AutoPlay window. When this is enabled and Autorun Eater detects such an instruction, the window is closed to prevent execution of malware.

Back To Top


10. What does the ‘Ignore autorun.inf’ option do in the detection window?

If Autorun Eater detects your legitimate ‘autorun.inf’ file as suspicious, you can used these option to ignore it.

Back To Top


11. What does the ‘Ignore Drive’ option do in the detection window?

If Autorun Eater detects your legitimate ‘autorun.inf’ file as suspicious, you can use these option to ignore that specific drive. You should only choose the ‘Ignore Drive’ option when the ‘Ignore autorun.inf’ option does not work.

Back To Top


12. How many drives can I choose to ignore?

You can only choose 1 drive to ignore at any time. When a new drive is ignored, the previously ignored drive will no longer be ignored.

Back To Top


13. Why is the ‘Ignore Drive’ option disabled when I plug in my removable storage device?

You cannot ignore a removable storage device due to security reasons.

Because different removable storage devices can be assigned the same drive letter it is not safe to ignore it. Take for example flashdrive ‘A’ when plugged-in is assigned the F: drive letter. Autorun Eater then detects a suspicious ‘autorun.inf’ file in it but you choose to ignore that drive(F:). When flashdrive ‘A’ is removed and flashdrive ‘B’ is plugged-in, flashdrive ‘B’ can also be assigned the F: drive letter. For all we know flashdrive B: may be infected with malware but because it is assigned the same drive letter(F:) that was ignored previously, Autorun Eater does not detect anything! The user then happily accesses the drive and gets infected.

Back To Top


14. I have accidentally ignored a suspicious ‘autorun.inf’ file! How do I undo it?

You can stop ignoring the suspicious ‘autorun.inf’ files by either using the ‘Remove Ignore’ or the ‘Remove Ignore For All’ option in the tray menu.

Back To Top


15. How do I stop ignoring a drive?

To stop ignoring a drive, you can use the ‘Undo Ignored Drive’ option in the tray menu.

Back To Top


16. I have chosen to remove the suspicious ‘autorun.inf’ file but another warning appears straight away for the same file and drive! Why is this happening?

A malware is probably still running in the computer and it is recreating the suspicious ‘autorun.inf’ file. You can choose to ignore the file(not recommended) or you can exit Autorun Eater(recommended).

Update your antivirus and perform a full system scan to detect and remove any malware. After that, start Autorun Eater again, and see if the above problem persists. If it does, your antivirus probably did not remove the malware. If possible, send the malware sample to your vendor for them to add it to their malware detection list.

Back To Top


17. What happens to the ‘autorun.inf’ file when it is removed?

A backup copy of the suspicious ‘autorun.inf’ file is first made, and then the original copy is deleted.

Backup copies of the removed ‘autorun.inf’ file(s) can be viewed by opening the tray menu and going to ‘Autorun Backup > View Backup’ or you could manually navigate here:

Documents and Settings\All Users\Application Data\Autorun Eater\Autorun Backup

Back To Top


18. Where can I check the removal results and view the backup copies of the removed suspicious ‘autorun.inf’ files?

You can check the log file by opening the tray menu and going to ‘Results Log > View Log’.

To view the backup copies, go to ‘Autorun Backup > View Backup’.

Back To Top


19. Why are there 2 suspicious file results in the detection window?

Autorun Eater’s monitoring engine has a 2 level scanning system to make sure any suspicious files are detected and to determine if they are present in the drive. Normally 1 result is sufficient to determine if suspicious files are present.

Back To Top


20. I’m confused, what is the difference between ‘Suspicious autorun.inf’ and ‘Suspicious file’?

‘Suspicious autorun.inf’ refers to ‘autorun.inf’ files only, wherelse ‘suspicious files’ are the files that the ‘autorun.inf’ file attempt to execute when the drive is accessed.

Back To Top


21. Will there be a conflict between Autorun Eater and my antivirus/antispyware software?

So far we have not come across such a problem. Autorun Eater is designed to work side-by-side with your antivirus software.

Back To Top


22. Why is my antivirus software detecting Autorun Eater as a malware?

It is what you call a false positive detection due to certain codes in the application that may have been used by malwares but be rest assured that Autorun Eater does NOT contain any malware. If problem persists, please contact your respective antivirus vendor.

Back To Top


23. Is Autorun Eater compatible on all operating systems?

Autorun Eater have been tested and is compatible on Windows XP, Vista and 7.

Back To Top


24. What does ‘Registry Fix’ do?

Many at times, malwares will disable certain important functions like the Task Manager, Regedit and Folder Options. You can click on any of the 3 fixes to fix the related functions.

Back To Top


25. Why are some of the tray menu options ‘greyed-out’ when I start Autorun Eater, is this a bug?

No, it isn’t a bug. Unless certain conditions are met(presence of files/folders, registry keys), these options will be ‘greyed-out’.

Back To Top


26. Is it possible to pause Autorun Eater?

Yes it’s possible. A black colour transparent-looking bar will slide in from the bottom-right side of your screen when the ‘Pause/Unpause’ tray menu option is clicked or when your keyboard’s ‘Pause’ key is pressed. You can unpause by repeating the steps mentioned. No files will be detected when it is paused.

Back To Top


27. Why can’t I remove my removable storage device when Autorun Eater is started?

A harmless or previously ignored ‘autorun.inf’ file(probably made by you) may be present in your removable storage device. You have to pause or exit Autorun Eater before you can safely remove your removable storage device.

Back To Top


28. Can I make Autorun Eater launch and monitor automatically everytime I start my computer?

Yes you can. This can be done by clicking on the ‘Add Billy To System Startup’ option in the tray menu. You can also prevent it from launching automatically by clicking on ‘Remove Billy From System Startup’.

Back To Top


29. How do I uninstall Autorun Eater?

From the Start menu: ‘Start > All Programs > Autorun Eater > Uninstall Autorun Eater’.

From the Control Panel: ‘Control Panel > Add/Remove Programs > Autorun Eater(remove)’.

Back To Top


30. Why are there leftover files and folders after uninstalling?

Those are the backup files and logs that were created during the usage of Autorun Eater. They are retained for your reference and can be safely deleted at any time.

Back To Top


February 17th, 2012


Follow

Get every new post delivered to your Inbox.

Join 200 other followers

%d bloggers like this: