Solved Access denied to autorun.inf

[Trucidation]

Hi folks.

I have a USB thumbdrive ("G:"), which picked up an "autorun.inf" when a colleague borrowed it this morning. I already have autoplay disabled (and all the options set to Take no action). So when I saw that file, out of curiosity I tried to open it using Notepad - only to receive an Access Denied error.



Naturally, being the suspicious type, this immediately changed my casual curiosity to concern. So I tried to simply delete it, which resulted in a "you need permission" error.



A quick look with google showed that I had to "take ownership" of said file, so I searched the tutorials here and found what I was looking for in this post: http://www.sevenforums.com/tutorials/1911-take-ownership-shortcut.html

Then I right-clicked on the file and used the new Take Ownership context menu entry, and saw the command line window open briefly (too fast to make out whether it worked or not). However, when I tried to delete the file again I still received the same permission error.

A little poking here and there later it seems I should be seeing a "Security" tab in the file/folder options. Hmm, I don't seem to have it. Again, the tutorials section here came to the rescue: http://www.sevenforums.com/tutorials/81727-security-tab-add-remove-properties.html

Bad news: right clicking on the file showed no such tab, nor did right clicking on the thumbdrive ("G:") itself. (On a side note, I do see the Security tab when viewing other folders and files, so the regfix did work. I just don't get why it's not working for this bugger.)


So... I guess the question is, what now? I'd settle for being able to nuke the file, but I don't get why I can't even look at it with Notepad. Suspicious and annoying. I'm already using an administrator-level account for this, and as mentioned above I've tried Taking Ownership of the file.

Help, ideas, comments, all greatly appreciated.

 

[Trucidation]

UPDATE:

Okay, it turns out my colleague "helpfully" used a feature in Panda Antivirus to "vaccinate" or "innoculate" the thumbdrive. Presumably this works because malware would get stumped trying to put in their own autorun instructions like I was stumped trying to modify/delete the file.

He couldn't figure out how to un-vaccinate it, so he simply copied the files out, formatted the thumbdrive, then copied the files back in. Huh. The brute force way always works. Mystery solved, I suppose.

-
Just one thing though, I wonder if you guys are familiar with similar protection procedures? It seems likely if one vendor (Panda Antivirus) does this, there should be others out there doing the same thing as well.

 

[AN0NYM0USH4CK3R]

Format Your USB

what i did was copy all files except autorun.inf to desktop folder and then i went to my computer right clicked on my usb and clicked format which then got rid of it hope it helps!
Good Luck
AN0NYM0USH4CK3R

 

[kseldon]

Apparently Trend Micro antivirus blocks the access to, creation of and modification of autorun.inf files on USB drives as well. I've been trying to build myself a bootable USB for two days and getting the same "access to autorun.inf blocked" problem every time I started copying the files, even after completely formatting the thumb drive.... and this thread inspired me to try temporarily turning off my antivirus.

Et voila! Problem solved. Thanks!

 

[BMGRAHAM]

SEP Does this same

I had the same issue because of Symantec Endpoint Prevention

• Open a command prompt by clicking Start | Run | type "cmd.exe" within the Open field and press Ok/Enter.
• Type the following commands on the command line:
  • cd "c:\Program Files (x86)\Symantec\Symantec Endpoint Protection"
  • smc.exe -stop
• You now can access the file

 

[dpgood]

How to copy an autorun.inf with Symantec

In Semantic Endpoint Protection --> Change Settings -->Client Management-->Application and Device Control,
Uncheck the "Enable Application and Device Control" box. Copy the file. Re-check the box and save.

 

[RolandJS]

Most of the time, one also can Safe Mode boot and delete that pesky file.

 

[playsaver]

Apparently Trend Micro antivirus blocks the access to, creation of and modification of autorun.inf files on USB drives as well. I've been trying to build myself a bootable USB for two days and getting the same "access to autorun.inf blocked" problem every time I started copying the files, even after completely formatting the thumb drive.... and this thread inspired me to try temporarily turning off my antivirus.

Et voila! Problem solved. Thanks!

Thanks for mentioning that Trend Micro does this. The simplest solution to being able to delete an Autorun.inf file when running trend micro is to right click its icon in the start tray and disable the protection, then delete the file and enable the protection. Still if you hadn't mentioned trend does this I would not have been able to fix the problem quickly. Many thanks. It would seem i've been having this problem on all my systems running trend. Windows 7 through 10 have been doing this because of this.