Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I discovered a file, named autorun.ini on my USB flash drive:

;jpId UagEbddsb PCjo
oPEn = efhcnu.exe
;utvDpsMqpT dDustbemW XyAy WeywFbvaVA eQnK
sHeLL\open\COmmanD = efhcnu.exe
ShEll\expLore\coMmANd = efhcnu.exe
;kdtrelceNy uEeF gFTf
shEll\autoPLAy\commAND = efhcnu.exe

Both it and the accompanying efhcnu.exe are hidden under windows and are visible only after "Show system files" is enabled.

efhcnu.exe has size 168kB.

My priorities are:

  • identify which computers were infected and what is the damage
  • remove the malware
  • report this incident to the public

enter image description here

How should I proceed?

share|improve this question
Could you please mail the exe to I have some spare time today and could analyze it for you. – lynks Apr 9 '13 at 10:21
you are awesome lynks – ebola virus Apr 9 '13 at 10:31
One AV IDed it. W32.Sality.AE;… – Vorac Apr 9 '13 at 10:53
@Vorac yeah I had a look, the only symptom that I was able to confirm from the W32.Sality definition was that it generates a random name for itself. It also changes a lot of registry keys relating to notepad, which is not mentioned anywhere regarding W32.Sality. Beyond that I was struggling; it's obfuscated and quite large. I will post my exact findings as an answer later, I'm away from them right now. – lynks Apr 20 '13 at 11:21
@lynks any news? – tbodt Jul 30 '14 at 2:02

Step 1 - Nuke your USB drive. Format the thing.

Step 2 - Nuke all the computers that you have used the USB drive with in the period which you suspect the drive has been infected.

Step 3 - Change your passwords.

Step 4 - Submit the malware to something like VirusTotal. It will ensure that most of the major antivirus vendors pick up on it.

Step 5 - Harden all Windows computers you work with by following guidelines posted by NIST, including disabling all autorun features for all types of media.

share|improve this answer
But how do I know if any of my online accounts are compromised? What about the backups? – Vorac Apr 9 '13 at 10:39
@Vorac Change all your passwords. Treat backups as you would a computer. If it has been in contact with the USB drive in the suspected period, it has to go. – Terry Chia Apr 9 '13 at 10:45

You can use a Linux OS (for example Ubuntu) to backup your files from USB and scan them with an antivirus, so you can save your files; then you will must format your USB stick!

share|improve this answer
Or alternatively, just make a permanent switch to a Linux OS (for example Ubuntu) rendering the virus on the USB stick (and any other Windows malware you come across) impotent. ;) – IQAndreas Sep 4 '14 at 11:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.