Why does my antivirus or Windows warn about autorun.exe?
Years ago, viruses spread by copying an autorun.inf file onto USB drives. Because of that history, some security products treat any autorun.inf or autorun.exe on removable media with suspicion, even when it is completely harmless. A warning does not mean your project is infected. Here is what each warning means and what to do.
Antivirus deletes or quarantines autorun.inf on a USB drive
Some antivirus and "USB protection" tools remove every autorun.inf they find on a USB drive, whatever is in it. On Windows 10 and 11 a USB drive never autoruns anyway, so the only loss is your custom drive icon and name. Your users can still open the drive and double-click autorun.exe.
Antivirus flags autorun.exe as suspicious
This is a false positive. To clear it:
- Make sure you are using the latest version of AutoRun Wizard from our download page.
- Scan the Base Folder with Microsoft Defender (Windows Security), which ships with Windows 10 and 11.
- Report the false positive to the antivirus vendor. Every major vendor has a file submission page, and Microsoft's is the Microsoft Security Intelligence file submission site. Vendors usually clear a false positive within a few days.
"Windows protected your PC" (SmartScreen)
Microsoft Defender SmartScreen checks programs that came from the internet. Windows marks every downloaded file (and every file extracted from a downloaded ZIP or ISO) with a "Mark of the Web." When a marked program is not digitally signed or is not yet well known, SmartScreen shows "Windows protected your PC." The user can click More info and then Run anyway.
Files on a burned CD or DVD, or copied onto a USB drive from your own PC, do not carry the Mark of the Web, so SmartScreen normally stays quiet for them. It mostly appears when you distribute your autorun as a download. See distributing your autorun as an ISO or download.
Smart App Control (Windows 11)
On a clean install of Windows 11 with Smart App Control turned on, Windows blocks programs that are unsigned and unknown, with no "Run anyway" button. The user would have to turn Smart App Control off. If you distribute your own program from the disc, signing it with a code-signing certificate is the reliable fix.
Help your users
- Sign your own launch programs and installers with a code-signing certificate.
- Put a one-line instruction on the disc label or in your email: "Open the drive and double-click autorun.exe."
- Test on a second PC with default Windows security settings before you duplicate.