Question about how antivirus stops autorun/exe on USB

[jimdagys]

I know that autorun.inf/exe virus on a USB memory stick is a big problem. On my computer, to solve this problem, I just disabled the autorun using http://ask-leo.com/is_autorun_really_that_evil_and_if_so_how_do_i_turn_autorun_off.html
However, if someone does not disable the autorun, then the computer will immediately execute the exe virus when the USB is inserted.
My question is, how can antivirus software deal with this situation? It seems like, even with antivirus software, the computer will immediately execute the exe, before the antivirus has a chance to delete the exe.

[Soopafresh]

Create a folder on the USB stick and your C: drive called Autorun.inf . That will stop the Autorun.inf file from being able to be copied to the stick or drive to begin with.

I found an app which sits in the system tray waiting for USB drive/stick to be attached and immediately intercepts the Autorun.inf file from running. Can't recall the name at the moment.

Here's the link http://nunobrito.eu/ninja/

[jimdagys]

Create a folder on the USB stick and your C: drive called Autorun.inf . That will stop the Autorun.inf file from being able to be copied to the stick or drive to begin with.

Why does that work?

[El Heggunte]

Windows looks for the first thing named AUTORUN.INF in the root directory of the drive,
even if the Autorun.inf happens to be a directory , and in this case,
the OS will not try to find the actual file AutoEvil.inf.

[AlanHK]

My question is, how can antivirus software deal with this situation? It seems like, even with antivirus software, the computer will immediately execute the exe, before the antivirus has a chance to delete the exe.

Many antivirus applications hook themselves into Windows so they will check EVERY exe that is called before it is allowed to run.

[isogonic]

http://research.pandasecurity.com/Panda-USB-and-AutoRun-Vaccine/