.INF – Information Files

.INF – Information Files

Automated software installation generally requires the use of a script that copies the files to the correct location. Under Windows, there are also Registry settings and other requirements that vary from one installation to another. INF (“Information”) files provide the settings used by many applications during the installation process.

Files with the .inf extension generally are delivered as part of a software package, along with an InstallShield or other installation binary. Frequently the package also includes one or more .cab (“Cabinet”) files containing the application itself and any associated libraries.

INF files are usually flat ASCII in nature, so they can be opened and read using any text editor. Usually they contain several sections describing the files to be installed, settings to be created, and application version information. A given file might include sections similar to the following example. The “Add.Code” and other section names are pre-defined by Microsoft.

[Add.Code]
circ3.ocx=circ3.ocx
random.dll=random.dll
mfc40.dll=mfc40.dll
example.ocx=example.ocx

; Lines beginning with “;” represent a comment in the code.
; This is a comment.

[Setup Hooks]
hookname1=section-name4
hookname2=section-name5

[Version]
Signature=”$CHICAGO$”
AdvancedINF=2.0

A great deal of information regarding INF file syntax is available from Microsoft, and is required reading for anyone who’s attempting to write an installer package. Note that the “autorun.inf” file is a special case. This file generally is found at the top level of an installation CD, and causes the software installer located on the CD to run automatically when the CD is loaded into a drive on a Windows PC.

Generally, INF files can’t be used to transport malware. It’s conceivable someone could hijack a legitimate installer file and use it to alter system settings during installation of another package. Since most software is installed using an account with Administrator privileges, the altered installation package could affect any component or setting on the system. Also, malware could use an autorun.inf file to launch itself automatically when a folder is opened.

As always, you should obtain and run a reliable malware/virus scanner with a current set of definition files if you suspect your machine has been infected or compromised in any way.