I discovered a file, named autorun.ini on my USB flash drive:

;jpId UagEbddsb PCjo
oPEn = efhcnu.exe
;utvDpsMqpT dDustbemW XyAy WeywFbvaVA eQnK
sHeLL\open\COmmanD = efhcnu.exe
ShEll\expLore\coMmANd = efhcnu.exe
;kdtrelceNy uEeF gFTf
shEll\autoPLAy\commAND = efhcnu.exe

Both it and the accompanying efhcnu.exe are hidden under windows and are visible only after "Show system files" is enabled.

efhcnu.exe has size 168kB.

My priorities are:

  • identify which computers were infected and what is the damage
  • remove the malware
  • report this incident to the public

enter image description here

How should I proceed?

  • 3
    Could you please mail the exe to epsvpeqb@sharklasers.com I have some spare time today and could analyze it for you.
    – lynks
    Apr 9, 2013 at 10:21
  • you are awesome lynks Apr 9, 2013 at 10:31
  • 3
    One AV IDed it. W32.Sality.AE; symantec.com/security_response/…
    – Vorac
    Apr 9, 2013 at 10:53
  • 1
    @Vorac yeah I had a look, the only symptom that I was able to confirm from the W32.Sality definition was that it generates a random name for itself. It also changes a lot of registry keys relating to notepad, which is not mentioned anywhere regarding W32.Sality. Beyond that I was struggling; it's obfuscated and quite large. I will post my exact findings as an answer later, I'm away from them right now.
    – lynks
    Apr 20, 2013 at 11:21
  • 2
    @lynks any news?
    – tbodt
    Jul 30, 2014 at 2:02

2 Answers 2


Step 1 - Nuke your USB drive. Format the thing.

Step 2 - Nuke all the computers that you have used the USB drive with in the period which you suspect the drive has been infected.

Step 3 - Change your passwords.

Step 4 - Submit the malware to something like VirusTotal. It will ensure that most of the major antivirus vendors pick up on it.

Step 5 - Harden all Windows computers you work with by following guidelines posted by NIST, including disabling all autorun features for all types of media.

  • But how do I know if any of my online accounts are compromised? What about the backups?
    – Vorac
    Apr 9, 2013 at 10:39
  • 1
    @Vorac Change all your passwords. Treat backups as you would a computer. If it has been in contact with the USB drive in the suspected period, it has to go.
    – user10211
    Apr 9, 2013 at 10:45
  • Can you specify which of those publications you're referring to?
    – Ploni
    Jul 7, 2017 at 21:05

You can use a Linux OS (for example Ubuntu) to backup your files from USB and scan them with an antivirus, so you can save your files; then you will must format your USB stick!

  • 1
    Or alternatively, just make a permanent switch to a Linux OS (for example Ubuntu) rendering the virus on the USB stick (and any other Windows malware you come across) impotent. ;)
    – IQAndreas
    Sep 4, 2014 at 11:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.