Access denied to autorun.inf

Hi folks.

I have a USB thumbdrive ("G:"), which picked up an "autorun.inf" when a colleague borrowed it this morning. I already have autoplay disabled (and all the options set to Take no action). So when I saw that file, out of curiosity I tried to open it using Notepad - only to receive an Access Denied error.



Naturally, being the suspicious type, this immediately changed my casual curiosity to concern. So I tried to simply delete it, which resulted in a "you need permission" error.



A quick look with google showed that I had to "take ownership" of said file, so I searched the tutorials here and found what I was looking for in this post: Take Ownership Shortcut

Then I right-clicked on the file and used the new Take Ownership context menu entry, and saw the command line window open briefly (too fast to make out whether it worked or not). However, when I tried to delete the file again I still received the same permission error.

A little poking here and there later it seems I should be seeing a "Security" tab in the file/folder options. Hmm, I don't seem to have it. Again, the tutorials section here came to the rescue: Security Tab - Add or Remove from Properties

Bad news: right clicking on the file showed no such tab, nor did right clicking on the thumbdrive ("G:") itself. (On a side note, I do see the Security tab when viewing other folders and files, so the regfix did work. I just don't get why it's not working for this bugger.)


So... I guess the question is, what now? I'd settle for being able to nuke the file, but I don't get why I can't even look at it with Notepad. Suspicious and annoying. I'm already using an administrator-level account for this, and as mentioned above I've tried Taking Ownership of the file.

Help, ideas, comments, all greatly appreciated.

UPDATE:

Okay, it turns out my colleague "helpfully" used a feature in Panda Antivirus to "vaccinate" or "innoculate" the thumbdrive. Presumably this works because malware would get stumped trying to put in their own autorun instructions like I was stumped trying to modify/delete the file.

He couldn't figure out how to un-vaccinate it, so he simply copied the files out, formatted the thumbdrive, then copied the files back in. Huh. The brute force way always works. Mystery solved, I suppose.

-
Just one thing though, I wonder if you guys are familiar with similar protection procedures? It seems likely if one vendor (Panda Antivirus) does this, there should be others out there doing the same thing as well.

Most of the time, one also can Safe Mode boot and delete that pesky file.

kseldon said:

Apparently Trend Micro antivirus blocks the access to, creation of and modification of autorun.inf files on USB drives as well. I've been trying to build myself a bootable USB for two days and getting the same "access to autorun.inf blocked" problem every time I started copying the files, even after completely formatting the thumb drive.... and this thread inspired me to try temporarily turning off my antivirus.

Et voila! Problem solved. Thanks!

Thanks for mentioning that Trend Micro does this. The simplest solution to being able to delete an Autorun.inf file when running trend micro is to right click its icon in the start tray and disable the protection, then delete the file and enable the protection. Still if you hadn't mentioned trend does this I would not have been able to fix the problem quickly. Many thanks. It would seem i've been having this problem on all my systems running trend. Windows 7 through 10 have been doing this because of this.