I inserted an infected USB drive while AutoPlay was on. Am I infected?

[Sagar Limaye]

My PC is running Win 10. When I scanned the drive using ESET, it showed 62 threats with the following types of viruses -
Win32/Autorun.EK generic worm
Win32/Autorun.EB

ESET's website has no detailed info about these threats. It cleaned the USB flash drive after scan, and no threats came up when I did a rescan. Nothing actually happened when I inserted the drive, and there are no visible signs of infection; everything on the PC is working normally. I even did a full in-depth scan of the C: drive and nothing came up.
So is it safe to assume that I didn't get infected? Does AutoPlay execute programs upon inserting a USB stick without asking the user? The AutoPlay settings on my PC were not set to do anything, they were set to "Choose a default." If I am infected, would a full reset eliminate any threat, or should I clean install using the ISO?

 

[gpobernardo]

If your full in-depth scan (using the same antivirus software that detected the viruses in your flash drive) didn't detect anything in C:\, then it is highly unlikely that your PC has been infected.

 

[PratikMade]

Don't worry primarily your antivirus should fix these viruses and if you think that maybe via AutoPlay your system got infected, windows defender takes action before the virus is executed.

 

[Sagar Limaye]

If your full in-depth scan (using the same antivirus software that detected the viruses in your flash drive) didn't detect anything in C:\, then it is highly unlikely that your PC has been infected.

How can I be sure?

 

[gpobernardo]

You could always use another anti-virus software to give a "second opinion" on the findings of ESET. There are a lot of trial anti-virus software which you can try. I used Bitdefender in my Windows 7 but it got removed during the upgrade even though it wasn't listed as incompatible with my PC. Another "top" contender is Kaspersky. Then, there's the native Windows Defender.

Basically, the higher the number of software you use, the higher the chance that their findings are representative of the facts. However, the only "surest" way is to perform a clean install of the OS - the "holy grail of all PC solutions".

 

[Sagar Limaye]

Basically, the higher the number of software you use, the higher the chance that their findings are representative of the facts. However, the only "surest" way is to perform a clean install of the OS - the "holy grail of all PC solutions".

Thanks for the quick replies!
If I do a clean install, will my Windows 7 product key work to activate Win 10?
I don't want to install Win 7, download so many updates and wait for the upgrade notification.

 

[gpobernardo]

You're welcome.

I just recently learned that even though you intend to upgrade, e.g. from Windows 7, to Windows 10, your Windows 7 license won't work in activating Windows 10. Somewhere I've read that the license of your old OS will automatically be converted to a Windows 10 license, so a lot of users who went through the upgrade process (i.e. through Windows Update) weren't bothered by the license/product key node.

Here's another way you can check if your system has been infected: launch Task Manager and check the running processes - however, you'll have to be extremely familiar on what those processes really are since some of them may be actually legit Windows processes.

I'd relax about it a bit. I've used ESET before (back in Vista) and it was pretty reliable. If it doesn't detect anything now, update the definitions of both ESET and Windows Defender, and then scan your PC using both of them (one at a time). If nothing comes up, then you may move forward in peace. :smile:

 

[Sagar Limaye]

You're welcome.
I just recently learned that even though you intend to upgrade, e.g. from Windows 7, to Windows 10, your Windows 7 license won't work in activating Windows 10. Somewhere I've read that the license of your old OS will automatically be converted to a Windows 10 license, so a lot of users who went through the upgrade process (i.e. through Windows Update) weren't bothered by the license/product key node.

So that means I have to install Windows 7 first right, even if I had upgraded from it earlier?

Here's another way you can check if your system has been infected: launch Task Manager and check the running processes - however, you'll have to be extremely familiar on what those processes really are since some of them may be actually legit Windows processes.

Nothing weird going on that I can see. All processes and tasks look familiar.

I'd relax about it a bit. I've used ESET before (back in Vista) and it was pretty reliable. If it doesn't detect anything now, update the definitions of both ESET and Windows Defender, and then scan your PC using both of them (one at a time). If nothing comes up, then you may move forward in peace. :smile:

I know I may be panicking for no reason, and want to believe you, but my brother is convinced that the system is compromised because AutoPlay was turned on at the time I inserted the drive. We had an argument, and I conceded.

Anyways, here's the list of threats that were detected:

Scan Log
Version of virus signature database: 12026 (20150731)
Date: 8/1/2015 Time: 12:03:22 AM
Scanned disks, folders and files: G:\
G:\DATABASE.exe - a variant of Win32/AutoRun.Agent.ACM worm - cleaned by deleting - quarantined [1]
G:\gphone.exe ? AUTOIT ? script.au3 - Win32/Autoit.EB worm - cleaned by deleting - quarantined [1]
G:\gphone.exe ? AUTOIT ? script.bin - a variant of Win32/AutoRun.Autoit.EK worm - cleaned by deleting - quarantined [1]
G:\msbackup.exe - a variant of Win32/Packed.Themida.AAP trojan - cleaned by deleting - quarantined [1]
G:\FOUND.000\FILE0000.CHK ? AUTOIT ? script.au3 - Win32/Autoit.EB worm - cleaned by deleting - quarantined [1]
G:\FOUND.000\FILE0000.CHK ? AUTOIT ? script.bin - a variant of Win32/AutoRun.Autoit.EK worm - cleaned by deleting - quarantined [1]
G:\RECYCLER\RECYCLER.exe ? AUTOIT ? script.au3 - Win32/Autoit.EB worm - cleaned by deleting - quarantined [1]
G:\RECYCLER\RECYCLER.exe ? AUTOIT ? script.bin - a variant of Win32/AutoRun.Autoit.EK worm - cleaned by deleting - quarantined [1]
G:\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\S-5-3-42-2819952290-8240758988-879315005-3665.exe ? AUTOIT ? script.au3 - Win32/Autoit.EB worm - cleaned by deleting - quarantined [1]
G:\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\S-5-3-42-2819952290-8240758988-879315005-3665.exe ? AUTOIT ? script.bin - a variant of Win32/AutoRun.Autoit.EK worm - cleaned by deleting - quarantined [1]
G:\System_Volume_Information\System_Volume_Information.exe ? AUTOIT ? script.au3 - Win32/Autoit.EB worm - cleaned by deleting - quarantined [1]
G:\System_Volume_Information\System_Volume_Information.exe ? AUTOIT ? script.bin - a variant of Win32/AutoRun.Autoit.EK worm - cleaned by deleting - quarantined [1]
G:\System_Volume_Information\_restore{26864C17-18DD-4561-8410}\_restore{26864C17-18DD-4561-8410}.exe ? AUTOIT ? script.au3 - Win32/Autoit.EB worm - cleaned by deleting - quarantined [1]
G:\System_Volume_Information\_restore{26864C17-18DD-4561-8410}\_restore{26864C17-18DD-4561-8410}.exe ? AUTOIT ? script.bin - a variant of Win32/AutoRun.Autoit.EK worm - cleaned by deleting - quarantined [1]
G:\System_Volume_Information\_restore{26864C17-18DD-4561-8411}\_restore{26864C17-18DD-4561-8411}.exe ? AUTOIT ? script.au3 - Win32/Autoit.EB worm - cleaned by deleting - quarantined [1]
G:\System_Volume_Information\_restore{26864C17-18DD-4561-8411}\_restore{26864C17-18DD-4561-8411}.exe ? AUTOIT ? script.bin - a variant of Win32/AutoRun.Autoit.EK worm - cleaned by deleting - quarantined [1]
G:\System_Volume_Information\_restore{26864C17-18DD-4561-8411}\ABC\ABC.exe ? AUTOIT ? script.au3 - Win32/Autoit.EB worm - cleaned by deleting - quarantined [1]
G:\System_Volume_Information\_restore{26864C17-18DD-4561-8411}\ABC\ABC.exe ? AUTOIT ? script.bin - a variant of Win32/AutoRun.Autoit.EK worm - cleaned by deleting - quarantined [1]
G:\System_Volume_Information\_restore{26864C17-18DD-4561-8411}\ABC-FC0655666A5\ABC-FC0655666A5.exe ? AUTOIT ? script.au3 - Win32/Autoit.EB worm - cleaned by deleting - quarantined [1]
G:\System_Volume_Information\_restore{26864C17-18DD-4561-8411}\ABC-FC0655666A5\ABC-FC0655666A5.exe ? AUTOIT ? script.bin - a variant of Win32/AutoRun.Autoit.EK worm - cleaned by deleting - quarantined [1]
G:\System_Volume_Information\_restore{26864C17-18DD-4561-8411}\ADMIN-9FAC023BF\ADMIN-9FAC023BF.exe ? AUTOIT ? script.au3 - Win32/Autoit.EB worm - cleaned by deleting - quarantined [1]
G:\System_Volume_Information\_restore{26864C17-18DD-4561-8411}\ADMIN-9FAC023BF\ADMIN-9FAC023BF.exe ? AUTOIT ? script.bin - a variant of Win32/AutoRun.Autoit.EK worm - cleaned by deleting - quarantined [1]
G:\System_Volume_Information\_restore{26864C17-18DD-4561-8411}\ADMIN-PC\ADMIN-PC.exe ? AUTOIT ? script.au3 - Win32/Autoit.EB worm - cleaned by deleting - quarantined [1]
G:\System_Volume_Information\_restore{26864C17-18DD-4561-8411}\ADMIN-PC\ADMIN-PC.exe ? AUTOIT ? script.bin - a variant of Win32/AutoRun.Autoit.EK worm - cleaned by deleting - quarantined [1]
G:\System_Volume_Information\_restore{26864C17-18DD-4561-8411}\COMP\COMP.exe ? AUTOIT ? script.au3 - Win32/Autoit.EB worm - cleaned by deleting - quarantined [1]
G:\System_Volume_Information\_restore{26864C17-18DD-4561-8411}\COMP\COMP.exe ? AUTOIT ? script.bin - a variant of Win32/AutoRun.Autoit.EK worm - cleaned by deleting - quarantined [1]
G:\System_Volume_Information\_restore{26864C17-18DD-4561-8411}\COMPUTER\COMPUTER.exe ? AUTOIT ? script.au3 - Win32/Autoit.EB worm - cleaned by deleting - quarantined [1]
G:\System_Volume_Information\_restore{26864C17-18DD-4561-8411}\COMPUTER\COMPUTER.exe ? AUTOIT ? script.bin - a variant of Win32/AutoRun.Autoit.EK worm - cleaned by deleting - quarantined [1]
G:\System_Volume_Information\_restore{26864C17-18DD-4561-8411}\COMPUTER_1\COMPUTER_1.exe ? AUTOIT ? script.au3 - Win32/Autoit.EB worm - cleaned by deleting - quarantined [1]
G:\System_Volume_Information\_restore{26864C17-18DD-4561-8411}\COMPUTER_1\COMPUTER_1.exe ? AUTOIT ? script.bin - a variant of Win32/AutoRun.Autoit.EK worm - cleaned by deleting - quarantined [1]
G:\System_Volume_Information\_restore{26864C17-18DD-4561-8411}\CONFERENCEROOM\CONFERENCEROOM.exe ? AUTOIT ? script.au3 - Win32/Autoit.EB worm - cleaned by deleting - quarantined [1]
G:\System_Volume_Information\_restore{26864C17-18DD-4561-8411}\CONFERENCEROOM\CONFERENCEROOM.exe ? AUTOIT ? script.bin - a variant of Win32/AutoRun.Autoit.EK worm - cleaned by deleting - quarantined [1]
G:\System_Volume_Information\_restore{26864C17-18DD-4561-8411}\IOCL-DF4FC24A50\IOCL-DF4FC24A50.exe ? AUTOIT ? script.au3 - Win32/Autoit.EB worm - cleaned by deleting - quarantined [1]
G:\System_Volume_Information\_restore{26864C17-18DD-4561-8411}\IOCL-DF4FC24A50\IOCL-DF4FC24A50.exe ? AUTOIT ? script.bin - a variant of Win32/AutoRun.Autoit.EK worm - cleaned by deleting - quarantined [1]
G:\System_Volume_Information\_restore{26864C17-18DD-4561-8411}\MHSOTRLBP300929\MHSOTRLBP300929.exe ? AUTOIT ? script.au3 - Win32/Autoit.EB worm - cleaned by deleting - quarantined [1]
G:\System_Volume_Information\_restore{26864C17-18DD-4561-8411}\MHSOTRLBP300929\MHSOTRLBP300929.exe ? AUTOIT ? script.bin - a variant of Win32/AutoRun.Autoit.EK worm - cleaned by deleting - quarantined [1]
G:\System_Volume_Information\_restore{26864C17-18DD-4561-8411}\MHSOTRMLB300859\MHSOTRMLB300859.exe ? AUTOIT ? script.au3 - Win32/Autoit.EB worm - cleaned by deleting - quarantined [1]
G:\System_Volume_Information\_restore{26864C17-18DD-4561-8411}\MHSOTRMLB300859\MHSOTRMLB300859.exe ? AUTOIT ? script.bin - a variant of Win32/AutoRun.Autoit.EK worm - cleaned by deleting - quarantined [1]
G:\System_Volume_Information\_restore{26864C17-18DD-4561-8411}\MHSOTRMLB300870\MHSOTRMLB300870.exe ? AUTOIT ? script.au3 - Win32/Autoit.EB worm - cleaned by deleting - quarantined [1]
G:\System_Volume_Information\_restore{26864C17-18DD-4561-8411}\MHSOTRMLB300870\MHSOTRMLB300870.exe ? AUTOIT ? script.bin - a variant of Win32/AutoRun.Autoit.EK worm - cleaned by deleting - quarantined [1]
G:\System_Volume_Information\_restore{26864C17-18DD-4561-8411}\MHSOTRMLB300956\MHSOTRMLB300956.exe ? AUTOIT ? script.au3 - Win32/Autoit.EB worm - cleaned by deleting - quarantined [1]
G:\System_Volume_Information\_restore{26864C17-18DD-4561-8411}\MHSOTRMLB300956\MHSOTRMLB300956.exe ? AUTOIT ? script.bin - a variant of Win32/AutoRun.Autoit.EK worm - cleaned by deleting - quarantined [1]
G:\System_Volume_Information\_restore{26864C17-18DD-4561-8411}\MHSOTRMLBP00621\MHSOTRMLBP00621.exe ? AUTOIT ? script.au3 - Win32/Autoit.EB worm - cleaned by deleting - quarantined [1]
G:\System_Volume_Information\_restore{26864C17-18DD-4561-8411}\MHSOTRMLBP00621\MHSOTRMLBP00621.exe ? AUTOIT ? script.bin - a variant of Win32/AutoRun.Autoit.EK worm - cleaned by deleting - quarantined [1]
G:\System_Volume_Information\_restore{26864C17-18DD-4561-8411}\MHSOTRMLBP12365\MHSOTRMLBP12365.exe ? AUTOIT ? script.au3 - Win32/Autoit.EB worm - cleaned by deleting - quarantined [1]
G:\System_Volume_Information\_restore{26864C17-18DD-4561-8411}\MHSOTRMLBP12365\MHSOTRMLBP12365.exe ? AUTOIT ? script.bin - a variant of Win32/AutoRun.Autoit.EK worm - cleaned by deleting - quarantined [1]
G:\System_Volume_Information\_restore{26864C17-18DD-4561-8411}\MHSOTRMLBP23627\MHSOTRMLBP23627.exe ? AUTOIT ? script.au3 - Win32/Autoit.EB worm - cleaned by deleting - quarantined [1]
G:\System_Volume_Information\_restore{26864C17-18DD-4561-8411}\MHSOTRMLBP23627\MHSOTRMLBP23627.exe ? AUTOIT ? script.bin - a variant of Win32/AutoRun.Autoit.EK worm - cleaned by deleting - quarantined [1]
G:\System_Volume_Information\_restore{26864C17-18DD-4561-8411}\MHSOTRMLBP30638\MHSOTRMLBP30638.exe ? AUTOIT ? script.au3 - Win32/Autoit.EB worm - cleaned by deleting - quarantined [1]
G:\System_Volume_Information\_restore{26864C17-18DD-4561-8411}\MHSOTRMLBP30638\MHSOTRMLBP30638.exe ? AUTOIT ? script.bin - a variant of Win32/AutoRun.Autoit.EK worm - cleaned by deleting - quarantined [1]
G:\System_Volume_Information\_restore{26864C17-18DD-4561-8411}\MHSOTRMLBP43144\MHSOTRMLBP43144.exe ? AUTOIT ? script.au3 - Win32/Autoit.EB worm - cleaned by deleting - quarantined [1]
G:\System_Volume_Information\_restore{26864C17-18DD-4561-8411}\MHSOTRMLBP43144\MHSOTRMLBP43144.exe ? AUTOIT ? script.bin - a variant of Win32/AutoRun.Autoit.EK worm - cleaned by deleting - quarantined [1]
G:\System_Volume_Information\_restore{26864C17-18DD-4561-8411}\MHSOTRMLBP65498\MHSOTRMLBP65498.exe ? AUTOIT ? script.au3 - Win32/Autoit.EB worm - cleaned by deleting - quarantined [1]
G:\System_Volume_Information\_restore{26864C17-18DD-4561-8411}\MHSOTRMLBP65498\MHSOTRMLBP65498.exe ? AUTOIT ? script.bin - a variant of Win32/AutoRun.Autoit.EK worm - cleaned by deleting - quarantined [1]
G:\System_Volume_Information\_restore{26864C17-18DD-4561-8411}\MHSOTRMLBP89173\MHSOTRMLBP89173.exe ? AUTOIT ? script.au3 - Win32/Autoit.EB worm - cleaned by deleting - quarantined [1]
G:\System_Volume_Information\_restore{26864C17-18DD-4561-8411}\MHSOTRMLBP89173\MHSOTRMLBP89173.exe ? AUTOIT ? script.bin - a variant of Win32/AutoRun.Autoit.EK worm - cleaned by deleting - quarantined [1]
G:\System_Volume_Information\_restore{26864C17-18DD-4561-8411}\MHSOTRMLC022339\MHSOTRMLC022339.exe ? AUTOIT ? script.au3 - Win32/Autoit.EB worm - cleaned by deleting - quarantined [1]
G:\System_Volume_Information\_restore{26864C17-18DD-4561-8411}\MHSOTRMLC022339\MHSOTRMLC022339.exe ? AUTOIT ? script.bin - a variant of Win32/AutoRun.Autoit.EK worm - cleaned by deleting - quarantined [1]
G:\System_Volume_Information\_restore{26864C17-18DD-4561-8411}\MHSOTRMLP300863\MHSOTRMLP300863.exe ? AUTOIT ? script.au3 - Win32/Autoit.EB worm - cleaned by deleting - quarantined [1]
G:\System_Volume_Information\_restore{26864C17-18DD-4561-8411}\MHSOTRMLP300863\MHSOTRMLP300863.exe ? AUTOIT ? script.bin - a variant of Win32/AutoRun.Autoit.EK worm - cleaned by deleting - quarantined [1]
G:\System_Volume_Information\_restore{26864C17-18DD-4561-8411}\MHSOTRMSC024080\MHSOTRMSC024080.exe ? AUTOIT ? script.au3 - Win32/Autoit.EB worm - cleaned by deleting - quarantined [1]
G:\System_Volume_Information\_restore{26864C17-18DD-4561-8411}\MHSOTRMSC024080\MHSOTRMSC024080.exe ? AUTOIT ? script.bin - a variant of Win32/AutoRun.Autoit.EK worm - cleaned by deleting - quarantined [1]
Number of scanned objects: 789
Number of threats found: 62
Number of cleaned objects: 62
Time of completion: 12:04:59 AM Total scanning time: 97 sec (00:01:37)

Notes:
[1] Object has been deleted as it only contained the virus body.

 

[Sagar Limaye]

gpobernardo, I have replied to your last post, but my reply is waiting for approval from a mod

 

[gpobernardo]

I have seen your posts (#8 and #9), but I had to go somewhere earlier and couldn't reply immediately. I'll reply to your paragraphs sequentially. (Caution, long reply ahead. Proceed to end of post for a one-sentence, one-line summary. :smile

Since you have a Windows 7 license/product key, then it looks like you can only do a "legit" install of Windows 7 - which you can later upgrade to a legit Windows 10.

That's great then - as long as that's the case and nothing weird is going on with your computer, your PC should be fine.

There's enough reason to be concerned (believe me, I understand what you feel - I "used to be" an "anti-virus freak", updating my anti-virus almost hourly and scanning my PC almost every day at one point in time :wink. I even used to insert my flash drives in virus-infected computer shop PCs to intentionally infect the drive with viruses and then insert that drive into my PC - just to check if my anti-virus is working or not.

I'm not sure if you're referring to "Auto Play" or "Auto Run". From my understanding, "Auto Play" is a course of action the PC "takes" whenever a storage media is connected to it, e.g. it could either launch a particular app/software (explorer to view contents, Windows Phone app for desktop if it was a phone, Windows Media player for music/videos, etc.); while "Auto Run" is an executable file that is usually found in portable storage media (such as CD installers) - this is the thing that viruses usually attach themselves to or modify so that they can be copied into or run in your PC as soon as you insert the storage media. Based on the text you've included, it looks like you're referring to "Auto Run" but that's just a deduction - it appears that the anti-virus software was able to act on them before anyone of them could be launched so it's more likely that you're referring to "Auto Play" which isn't caused by a virus.

At any rate, the scan results says 62 out of 62 threats were addressed by deleting them, so that's a good indication. Also, your follow-up scans of your PC reported that there were no threats, so that's another good indication. Lastly, there are no weird processes running in Task Manager - a third good indication.


But now, the case of being convinced by your brother is a totally different one. Auto Play may have been automatically deployed, but it seems that none of the viral executables were deployed upon insertion, so... I'd say that your PC is clean based on the information we have right now. Then again, let's go back to post #5 for some of the things we can do to be "sure" about the virus-free/infested state of our PC. Peace of mind is a rare thing to possess nowadays, so if you have the time and luxury of not losing any of the files you currently have in your PC (i.e. if all of them is backed-up), then you may proceed with a clean install of Windows 7 and then later on upgrade to Windows 10 - keeping in mind that you most likely will encounter the same kind of virus-related detection prompt in the future, in which case you may or may not need to again decide to reinstall Windows 7 and then upgrade to Windows 10. :wink:

In summary, do whatever will give you peace, but if I may suggest: a reinstallation doesn't seem to be necessary at this point. :smile:

 

[Sagar Limaye]

I have seen your posts (#8 and #9), but I had to go somewhere earlier and couldn't reply immediately. I'll reply to your paragraphs sequentially. (Caution, long reply ahead. Proceed to end of post for a one-sentence, one-line summary. :smile

Since you have a Windows 7 license/product key, then it looks like you can only do a "legit" install of Windows 7 - which you can later upgrade to a legit Windows 10.

Thanks! You've been a great help

I'm not sure if you're referring to "Auto Play" or "Auto Run".

I'm referring to AutoPlay, that according to my brother, can be exploited by malicious code executing without the user's permission right after he inserts the infected USB stick

From my understanding, "Auto Play" is a course of action the PC "takes" whenever a storage media is connected to it, e.g. it could either launch a particular app/software (explorer to view contents, Windows Phone app for desktop if it was a phone, Windows Media player for music/videos, etc.); while "Auto Run" is an executable file that is usually found in portable storage media (such as CD installers) - this is the thing that viruses usually attach themselves to or modify so that they can be copied into or run in your PC as soon as you insert the storage media. Based on the text you've included, it looks like you're referring to "Auto Run" but that's just a deduction - it appears that the anti-virus software was able to act on them before anyone of them could be launched so it's more likely that you're referring to "Auto Play" which isn't caused by a virus.

From what I understand upon reading on the Internet about AutoPlay, the system is somewhat connected to Autorun in that it takes information about what action to take from an Autorun.inf file, and can execute that action without permission from the user. This is what my brother is afraid of.

At any rate, the scan results says 62 out of 62 threats were addressed by deleting them, so that's a good indication. Also, your follow-up scans of your PC reported that there were no threats, so that's another good indication. Lastly, there are no weird processes running in Task Manager - a third good indication.

Yes, indeed, I have yet to see any erratic behaviour.

But now, the case of being convinced by your brother is a totally different one. Auto Play may have been automatically deployed, but it seems that none of the viral executables were deployed upon insertion, so... I'd say that your PC is clean based on the information we have right now. Then again, let's go back to post #5 for some of the things we can do to be "sure" about the virus-free/infested state of our PC. Peace of mind is a rare thing to possess nowadays, so if you have the time and luxury of not losing any of the files you currently have in your PC (i.e. if all of them is backed-up), then you may proceed with a clean install of Windows 7 and then later on upgrade to Windows 10 - keeping in mind that you most likely will encounter the same kind of virus-related detection prompt in the future, in which case you may or may not need to again decide to reinstall Windows 7 and then upgrade to Windows 10. :wink:

I know, but my brother isn't a huge fan of Windows security, especially AutoPlay. He insists that the system is weak and I really doubt that anything, even your cogent reply is going to convince him otherwise. I've given up haha.

In summary, do whatever will give you peace, but if I may suggest: a reinstallation doesn't seem to be necessary at this point. :smile:

Yes, I know. Again, gotta do what I gotta do. Thanks

 

[gpobernardo]

Once again, allow me to respond to all your paragraphs in two short ones:

I'm not technically armed to go into a discussion about what exactly the AutoRun feature of Windows do, but this we can logically agree on - that if the same antivirus that detected the viruses in the Flash Drive didn't detect anything in your PC, then it would appear that your PC wasn't infected at all; and that if the same antivirus reported that it was deleted upon inserting the Flash Drive, then this supports the fact that it couldn't detect the same virus in your PC when performing a PC scan. (Well, there was a time around 20 years ago when one of the PCs I was working on got infected by a virus, because the antivirus software itself got infected by the virus! But, again, that was 20 years ago - and it wasn't an earlier version Windows Defender. :wink

At any rate, it's always helpful to know someone who views things from a different perspective (your brother). Just let us know when something happens, hopefully not a bad one though.

 

[Sagar Limaye]

Reinstalled Win 10. I skipped entering the product key during installation. It got activated automatically after install.