Frequently Asked Questions
This is the online version of the Frequently Asked Questions(FAQ) pertaining to Autorun Eater. If you have downloaded Autorun Eater, it is already included in the help file.
This list will be updated from time to time. You can add a question to any of the replies section. New questions will be added to the help file and available for download monthly, if possible.
- How does Autorun Eater determine which ‘autorun.inf’ file is suspicious?
- Do I need to manually scan each drive for suspicious ‘autorun.inf’ files?
- Are drives A: and B: monitored as well?
- Are suspicious files removed as well when I choose to remove the suspicious ‘autorun.inf’ file?
- I have enabled ‘Malware Scan’ but nothing happens after I remove the suspicious ‘autorun.inf’ file?
- Why are random numbers used for the detection window title? Is it a bug?
- How do I remove a suspicious ‘autorun.inf’ file?
- When attempting to remove a suspicious ‘autorun.inf file’, why do I get the message ‘Error deleting autorun.inf file from (X:)XXXXX’?
- How does the ‘Close Autoplay’ function protect me from executing the malware?
- What does the ‘Ignore autorun.inf’ option do in the detection window?
- What does the ‘Ignore Drive’ option do in the detection window?
- How many drives can I choose to ignore?
- Why is the ‘Ignore Drive’ option disabled when I plug in my removable storage device?
- I have accidentally ignored a suspicious ‘autorun.inf’ file! How do I undo it?
- How do I stop ignoring a drive?
- I have chosen to remove the suspicious ‘autorun.inf’ file but another warning appears straight away for the same file and drive! Why is this happening?
- What happens to the ‘autorun.inf’ file when it is removed?
- Where can I check the removal results and view the backup copies of the removed suspicious ‘autorun.inf’ files?
- Why are there 2 suspicious file results in the detection window?
- I’m confused, what is the difference between ‘Suspicious autorun.inf’ and ‘Suspicious file’?
- Will there be a conflict between Autorun Eater and my antivirus/antispyware software?
- Why is my antivirus software detecting Autorun Eater as a malware?
- Is Autorun Eater compatible on all operating systems?
- What does ‘Registry Fix’ do?
- Why are some of the tray menu options ‘greyed-out’ when I start Autorun Eater, is this a bug?
- Is it possible to pause Autorun Eater?
- Why can’t I remove my removable storage device when Autorun Eater is started?
- Can I make Autorun Eater launch and scan automatically everytime I start my computer?
- How do I uninstall Autorun Eater?
- Why are there leftover files and folders after uninstalling?
Autorun Eater determines whether an ‘autorun.inf’ file is malicious or not by checking for certain strings in the file. You are then warned and asked for further action if the ‘autorun.inf’ file containing those strings are detected.
You don’t need to manually scan a drive. Autorun Eater actively monitors all drives(except drives A:, B: & CD/DVD drives). When a suspicious ‘autorun.inf’ file is detected in any of those drives, a detection window immediately appears to warn and ask you for further action.
No, drives A: and B: must be manually scanned using the options available in the tray menu.
By default Autorun Eater will not help you remove the suspicious file but if you have Microsoft Security Essentials installed, you can set Autorun Eater to use MSE to scan and clean the infected storage device.
You must have Microsoft Security Essentials (2.1.1116.0 and above) installed for it to work.
No, it isn’t a bug. It is a measure used to prevent malwares from attempting to close the window.
It depends on your ‘Removal Method’ settings. If it is set to ‘Ask For Confirmation’, then there are options to either ignore or remove it. If it is set to ‘Auto-Remove’, then the suspicious ‘autorun.inf’ file is automatically removed. Suspicious ‘autorun.inf’ files are always auto-backup’ed before they are removed.
This problem usually happens when the ‘autorun.inf’ file is in use or locked by a process. The file could also be on a write-protected storage device.
You can try any of the following suggested solutions:
- Perform a full system scan using your updated anti-virus application
- Turn off the storage device’s write-protection
- Restart the ‘explorer.exe’ process(make sure all your works are saved)
Certain ‘autorun.inf’ files contain instructions that attempt to trick you into executing the malware file via the AutoPlay window. When this is enabled and Autorun Eater detects such an instruction, the window is closed to prevent execution of malware.
If Autorun Eater detects your legitimate ‘autorun.inf’ file as suspicious, you can used these option to ignore it.
If Autorun Eater detects your legitimate ‘autorun.inf’ file as suspicious, you can use these option to ignore that specific drive. You should only choose the ‘Ignore Drive’ option when the ‘Ignore autorun.inf’ option does not work.
You can only choose 1 drive to ignore at any time. When a new drive is ignored, the previously ignored drive will no longer be ignored.
You cannot ignore a removable storage device due to security reasons.
Because different removable storage devices can be assigned the same drive letter it is not safe to ignore it. Take for example flashdrive ‘A’ when plugged-in is assigned the F: drive letter. Autorun Eater then detects a suspicious ‘autorun.inf’ file in it but you choose to ignore that drive(F:). When flashdrive ‘A’ is removed and flashdrive ‘B’ is plugged-in, flashdrive ‘B’ can also be assigned the F: drive letter. For all we know flashdrive B: may be infected with malware but because it is assigned the same drive letter(F:) that was ignored previously, Autorun Eater does not detect anything! The user then happily accesses the drive and gets infected.
You can stop ignoring the suspicious ‘autorun.inf’ files by either using the ‘Remove Ignore’ or the ‘Remove Ignore For All’ option in the tray menu.
To stop ignoring a drive, you can use the ‘Undo Ignored Drive’ option in the tray menu.
A malware is probably still running in the computer and it is recreating the suspicious ‘autorun.inf’ file. You can choose to ignore the file(not recommended) or you can exit Autorun Eater(recommended).
Update your antivirus and perform a full system scan to detect and remove any malware. After that, start Autorun Eater again, and see if the above problem persists. If it does, your antivirus probably did not remove the malware. If possible, send the malware sample to your vendor for them to add it to their malware detection list.
A backup copy of the suspicious ‘autorun.inf’ file is first made, and then the original copy is deleted.
Backup copies of the removed ‘autorun.inf’ file(s) can be viewed by opening the tray menu and going to ‘Autorun Backup > View Backup’ or you could manually navigate here:
Documents and Settings\All Users\Application Data\Autorun Eater\Autorun Backup
You can check the log file by opening the tray menu and going to ‘Results Log > View Log’.
To view the backup copies, go to ‘Autorun Backup > View Backup’.
Autorun Eater’s monitoring engine has a 2 level scanning system to make sure any suspicious files are detected and to determine if they are present in the drive. Normally 1 result is sufficient to determine if suspicious files are present.
‘Suspicious autorun.inf’ refers to ‘autorun.inf’ files only, wherelse ‘suspicious files’ are the files that the ‘autorun.inf’ file attempt to execute when the drive is accessed.
So far we have not come across such a problem. Autorun Eater is designed to work side-by-side with your antivirus software.
It is what you call a false positive detection due to certain codes in the application that may have been used by malwares but be rest assured that Autorun Eater does NOT contain any malware. If problem persists, please contact your respective antivirus vendor.
Autorun Eater have been tested and is compatible on Windows XP, Vista and 7.
Many at times, malwares will disable certain important functions like the Task Manager, Regedit and Folder Options. You can click on any of the 3 fixes to fix the related functions.
No, it isn’t a bug. Unless certain conditions are met(presence of files/folders, registry keys), these options will be ‘greyed-out’.
Yes it’s possible. A black colour transparent-looking bar will slide in from the bottom-right side of your screen when the ‘Pause/Unpause’ tray menu option is clicked or when your keyboard’s ‘Pause’ key is pressed. You can unpause by repeating the steps mentioned. No files will be detected when it is paused.
A harmless or previously ignored ‘autorun.inf’ file(probably made by you) may be present in your removable storage device. You have to pause or exit Autorun Eater before you can safely remove your removable storage device.
Yes you can. This can be done by clicking on the ‘Add Billy To System Startup’ option in the tray menu. You can also prevent it from launching automatically by clicking on ‘Remove Billy From System Startup’.
From the Start menu: ‘Start > All Programs > Autorun Eater > Uninstall Autorun Eater’.
From the Control Panel: ‘Control Panel > Add/Remove Programs > Autorun Eater(remove)’.
Those are the backup files and logs that were created during the usage of Autorun Eater. They are retained for your reference and can be safely deleted at any time.
February 17th, 2012