Worm.Win32.AutoRun.hr (and its variants like .RH or .AHR) is a self-propagating worm that spreads by creating a hidden autorun.inf file and executable copies of itself in the root directory of connected USB flash drives and network shares.
To reliably eliminate this persistent threat from your computer and connected drives, use these top 5 tools: 1. Malwarebytes Anti-Malware Purpose: Best-in-class on-demand remediation scanner.
How it works: It targets the worm’s hidden system components, registry entries, and dropped .exe or .tmp payload files.
Key Benefit: The free scanner from Malwarebytes cleanly terminates active memory processes tied to the virus so it cannot instantly regenerate. 2. Microsoft Defender & Microsoft Safety Scanner Purpose: Built-in OS protection and deep system scanning.
How it works: Microsoft officially tracks this specific threat variant. Microsoft Defender handles continuous protection, while the standalone Microsoft Safety Scanner provides a clean, portable second-opinion scan without interfering with other installed antiviruses.
Key Benefit: Safely restores default Windows system behavior altered by the worm. 3. Kaspersky Virus Removal Tool (KVRT)
Purpose: Free portable utility specialized in aggressive worm disinfection.
How it works: Kaspersky maintains a robust threat definition database specifically detailing Worm.Win32.AutoRun behavior. The tool forces memory disinfection and strips out unauthorized system hooks.
Key Benefit: It requires no installation, allowing it to run smoothly even if malware blocks standard installer files. 4. HitmanPro Purpose: Cloud-assisted behavior scanner.
How it works: It scans the system rapidly, using cloud intelligence from multiple security engines to find tracking traces or hidden files.
Key Benefit: Excellent at finding residual components that standard antiviruses overlook, such as modified startup entries or fake system files disguised as normal processes. 5. Emsisoft Emergency Kit (EEK)
Purpose: Fully portable malware cleaning toolkit for infected machines.
How it works: It contains a dual-engine scanner capable of clearing out deep-seated Trojans and auto-starting worms.
Key Benefit: Ideal for saving to a clean USB stick and running directly on an infected PC to neutralize the worm before it can infect the rescue drive. Alternative Free Fix: Manual Removal via Command Prompt Worm:Win32/Autorun.RH threat description – Microsoft