Skip to main content
Skip to main content
Microsoft Security Intelligence
15 entries found.
Updated on Aug 04, 2010
Worm:INF/Vobfus.gen is a generic detectionĀ for an obfuscated Autorun script file named "autorun.inf" that is dropped byĀ variants ofĀ Win32/Vobfus, a worm that spreads via removable drives and downloads and executes arbitrary files. Detection of this script component is an indication of a Worm:Win32/Vobfus infection.
Alert level: severe
Updated on Aug 05, 2010
Alert level: severe
Updated on Sep 29, 2010
VirTool:INF/Autorun.gen!J is a generic detection for the "autorun.inf" configuration data files dropped by various worms, which perform automated actions associated with removable media drives.
Alert level: severe
Updated on Apr 29, 2010
Worm:Win32/Pushbot!inf is a detection for the autorun.inf configuration file dropped by variants of the Worm:Win32/Pushbot family when spreading via removable drives.
Alert level: severe
Updated on Aug 05, 2010
Worm:MSIL/Autorun.C!inf is detection for an autorun configuration file named "autorun.inf". TheĀ file is found on infected removable media with a copy of the worm Worm:MSIL/Autorun.C.
Alert level: severe
Updated on Oct 21, 2010
VirTool:INF/Autorun.gen!L is a detection for "autorun.inf" files that may be used by worms when spreading to local, network, or removable drives. When copying themselves to a drive, worms can create a file named "autorun.inf", which contains execution instructions for the operating system. When the drive is viewed using Windows Explorer, "autorun.inf" runs, thus executing the worm copy.
Ā 
It should be noted that "autorun.inf" files on their own are not necessarily a sign of infection, as they are used by legitimate programs and installation CDs.
Alert level: severe
Updated on Nov 16, 2009
TrojanSpy:Win32/Banker.OT!inf isĀ an autorun configuration file that runs a copy of the trojan TrojanSpy:Win32/Banker.OT. Win32/Banker.OT redirects user Web browsing away from certain online banking sites.
Alert level: severe
Updated on Dec 18, 2008

Worm:VBS/Autorun.R!inf is an "autorun.inf" file created by Worm:VBS/Autorun.BS in order for the worm to spread and infect other computers through network shares or removable devices.

Alert level: severe
Updated on Jun 19, 2009

Windows Defender detects and removes this threat.

This threat is an autorun.inf file created by the Win32/Yeltminky family of worms. The family creates this autorun file to help them spread and infect other computers through network and local drives, and removable devices, such as a USB flash drive. 

Autorun.inf files on their own are not necessarily a sign of infection. They are also used by legitimate programs.
Alert level: severe
Updated on Oct 20, 2010

Windows Defender Antivirus detects and removes this threat.

This is a detection for a file, called autorun.inf, that can be used by worms when they spread to local, network, or removable drives.

The file has instructions to launch the malware automatically when the removable drive is connected to a PC with the Autorun feature turned on.

This is a common way for malware to spread. However, autorun.inf files on their own are not necessarily a sign of infection; they are also used by legitimate programs.

See our infographic to the right which shows how these worms can spread. 

Alert level: severe
Updated on May 24, 2013

Windows Defender detects and removes this threat.

This threat is an autorun.inf file created by a worm so it can spread and infect other computers through network and local drives, and removable devices, such as a USB flash drive. 

Autorun.inf files on their own are not necessarily a sign of infection, as they are used by legitimate programs and installation media.
Alert level: severe
Updated on Nov 17, 2010

Worm:INF/Autorun.B is the detection for files with the name "autorun.inf" that may be used by worms when spreading to local, network, or removable drives. When the drive is viewed using Windows Explorer, "autorun.inf" may automatically run, thus running the worm copy.

Alert level: severe
Updated on Aug 14, 2019
Alert level: severe
Updated on Sep 07, 2023
Alert level: severe
Updated on Jan 22, 2010

Windows Defender Antivirus detects and removes this threat.

This is a detection for a file, called autorun.inf, that can be used by worms when they spread to local, network, or removable drives.

The file has instructions to launch the malware automatically when the removable drive is connected to a PC with the Autorun feature turned on.

This is a common way for malware to spread. However, autorun.inf files on their own are not necessarily a sign of infection; they are also used by legitimate programs.

See our infographic to the right which shows how these worms can spread. 

Alert level: severe