File scan report
Verdict Suspicious
Is autorun.
This tiny autorun configuration file was flagged by one engine with a generic autorun label, but we lack the content or evidence from the test run needed to judge it.
Read the whole reasonShow less
Why Suspicious? One antivirus engine (Trellix (McAfee)) flags it; nothing else confirms it.
Limited evidence
Treat the file as unverified and do not open any program it references. If it appeared on removable media you did not set up, scan the entire drive with up-to-date security software.
What to do now4 steps
Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.
What to do
Don't open it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.
If you already opened it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
Not sure what to do?
Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
1 of 61 flagged
- Flagged 1
- No detection 60
- No result 14
- Code signing Not applicable
- Test run Not run
- First seen 13d ago
Chapter 02
Why we think so
3 points against it and 2 in its favour, checked against the scan evidence.
The reasoning behind this verdict
One of the 61 antivirus engines that checked it (TrellixENS) flags this 47-byte autorun file with a generic label, and all other major antivirus engines did not flag it. Autorun files can instruct older systems to launch a program from a USB drive. We could not see which program this one points to.
Only TrellixENS flagged the file, using a generic autorun detection, while 17 other major antivirus engines did not flag it. The file is a small text configuration file, so it cannot act on its own. However, autorun entries have been used by USB worms to start a malicious program automatically. Our static analysis was not available for these bytes, and there is no sandbox observation. The file was first seen on Oct 13, 2026 and has been submitted by one source. Without knowing what the file points to, the evidence does not support a firm call either way.
What We Detected
One of the 61 antivirus engines that checked it (TrellixENS) reports a generic autorun detection on this 47-byte configuration file. No other engine flagged it. There are no matches in public malware databases and no prior history in our records. The file was first seen on Oct 13, 2026.
Threat Behavior
An autorun file is plain text that can tell older Windows systems which program to start when removable media is inserted. Worms have used this to spread through USB drives. Whether this file does so depends on the program it references, which we could not inspect. No the test run is available.
What To Do Now
Do not run programs named inside this file unless you know where they came from. If the file appeared unexpectedly on a USB drive, scan the whole drive with up-to-date security software and keep your protection enabled.
Where this verdict could be wrong2 caveats
- Autorun files are plain text and cannot run anything themselves. Modern Windows also ignores autorun entries on USB drives, so the file may be harmless leftover media metadata.
- The single detection uses a generic label and no other engine agrees, which is a common false-positive pattern.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the other 74 engines flagged it
- Plain text file that cannot run code on its own
- One major antivirus engine flags it with a generic autorun detection
- Autorun files have been used by USB worms to launch programs automatically
- Rarely submitted, with only one known source
6 sources checked · 4 complete · 1 not run · 1 not needed or not applicable. See every source
Chapter 03
Technical details
1 of the 61 antivirus engines that checked it flags it.
Sources checked
Every check behind this verdict
6 sources checked · 4 complete · 1 not run · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
- TrellixENS (major engine)Generic!atr.b
File fingerprint
- Last analyzed
- Oct 13, 2026, 1:51 AM UTC
- SHA-256
b50925b6c06909a56c0ba3daa5eb768f276e549db4647a5ff46f4dd757d07eba- SHA-1
118144df4282f3feebdc232bd80149e8df90b964- MD5
52a7da1e35f616d48d01da2aab908d73
About this file
autorun.inf is an INI file of 47 B.
- Type and size
- INI · 47 B
- Signer
- Not applicable
- First seen
- Oct 13, 2026On VirusTotal.
- Submitted by
- 1 sourceRarely seen: few people have submitted this exact file.
First scanned Updated
Verdict history
- Safe
- Suspiciousafter a re-check of the saved evidence
Ratings change when antivirus engines, our checks or MalwareTips staff learn more about a file.
Includes every engine result (75) and how widely the file has been seen.
Show the technical evidenceChapter 04
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is autorun.inf safe, or is it malware?
What is autorun.inf?
How many antivirus engines detected autorun.inf?
I already downloaded and opened autorun.inf — what should I do?
What is the SHA-256 hash of autorun.inf?
How up to date is this analysis of autorun.inf?
Community
Member reviews and reports for this exact file hash.