Autorun.inf on USB Drives: Legitimate File or Malware Warning?

Finding autorun.inf on a USB drive can be alarming, especially when the same drive contains unexpected shortcuts or hidden folders. The file has legitimate historical uses, but it has also been abused to point Windows toward unwanted programs.

Its presence alone is not a malware diagnosis. The useful questions are: what does the file contain, what other files does it reference, and what behavior occurred when the drive was connected?

What autorun.inf is

autorun.inf is a text configuration file associated with Windows AutoRun and AutoPlay behavior. It can contain instructions and descriptive information for media, such as a label, icon, or a command. How Windows treats those entries depends on the device type, Windows version, and policy.

Microsoft documents AutoRun registry behavior and enterprise AutoPlay policies in the AutoRun documentation and AutoPlay policy reference. Modern Windows restrictions reduce some automatic behavior, but a configuration file can still be useful evidence during an investigation.

Legitimate reasons the file may exist

• Older commercial software or driver media may use it for setup instructions.
• A vendor may use it to set a volume label or icon.
• An organization may have created controlled removable media for a specific workflow.

A legitimate context should be consistent: the referenced program is expected, the publisher is known, and the drive came from a trusted source.

Warning signs that deserve investigation

• The file appeared at the same time as hidden folders or look-alike shortcuts.
• It points to an executable or script with a random or misleading name.
• The referenced file is hidden in an unexpected directory.
• The command uses a script host, command interpreter, encoded text, or several chained operations.
• The drive was used in an unknown or already compromised computer.

Do not run the referenced command to see what it does. A path can look harmless while passing dangerous arguments.

How to inspect the drive safely

1. Close any AutoPlay prompt without choosing an action.
2. Confirm the removable drive letter.
3. Run a Microsoft Defender custom scan on the drive.
4. Use Shortcut Remover to inspect unexpected .lnk files without launching them.
5. If you must read autorun.inf, open it only as text in a trusted editor. Do not execute any referenced program.
6. Scan the PC as well as the USB drive if files were hidden or replaced.

Changing an AutoPlay setting is defense in depth, not cleanup. It does not remove a malicious executable that is already on the drive.

Should you delete autorun.inf?

If the drive is yours, the file is unnecessary, and scans show that it references an unwanted item, removing it may be appropriate. Quarantine or preserve a copy first when you are investigating an incident. Deleting only autorun.inf does not remove the executable or script it references.

Do not modify business, recovery, installation, or vendor media without understanding its intended workflow. A legitimate installer may rely on the file for labeling or setup convenience, even if Windows no longer executes it automatically.

Focus on the whole incident

The highest-value evidence is the combination of changes: new shortcuts, hidden originals, unfamiliar executables, suspicious command lines, and recurrence after cleanup. Treat autorun.inf as one clue among several.

Related: Scan a USB drive without opening suspicious files and tell a shortcut-virus pattern from a broken shortcut.