BleepingComputer.com: Great Free Tool : that prevents AutoRun & USB infections

Panda USB and AutoRun Vaccine

By Pedro Bustamante

The Microsoft Windows Operating Systems use the AUTORUN.INF file from removable drives in order to know which actions to perform when a new external storage device, such as a USB drive or CD/DVD, is inserted into the PC. The AUTORUN.INF file is a configuration file that is normally located in the root directory of removable media and contains, among other things, a reference to the icon that will be shown associated to the removable drive or volume, a description of its content and also the possibility to define a program which should be executed automatically when the unit is mounted.

The problem is that this feature, widely critizised by the security community, is used by malware in order to spread by infecting as soon as a new drive is inserted in a computer. The malware achieves this by copying a malicious executable in the drive and modifying the AUTORUN.INF file so that Windows opens the malicious file silently as soon as the drive is mounted. The most recent examples of this are the W32/Sality, W32/Virutas and also the W32/Conficker worm which, in addition to spreading via a vulnerability and network shares, also spreads via USB drives.

Due to the large amount of malware-related problems associated with Microsoft AutoRun we have created a free utility for our user community called Panda USB Vaccine.



Computer Vaccination

The free Panda USB Vaccine allows users to vaccinate their PCs in order to disable AutoRun completely so that no program from any USB/CD/DVD drive (regardless of whether they have been previously vaccinated or not) can auto-execute. This is a really helpful feature as there is no user friendly and easy way of completely disabling AutoRun on a Windows PC.


USB Vaccination

The free Panda USB Vaccine can be used on individual USB drives to disable its AUTORUN.INF file in order to prevent malware infections from spreading automatically. When applied on a USB drive, the vaccine permanently blocks an innocuous AUTORUN.INF file, preventing it from being read, created, deleted or modified. Once applied it effectivelly disables Windows from automatically executing any malicious file that might be stored in that particular USB drive. The drive can otherwise be used normally and files (even malware) copied to/from it, but they will be prevented from opening automatically. Panda USB Vaccine currently only works on FAT & FAT32 USB drives.

If you want to re-enable AUTORUN.INF , just click remove vaccine ( I don't reccomend this unless you absoulutely have to remove the vaccine).

Download it here : http://download.cnet.com/Panda-USB-Vaccine...4-10909938.html

I have been using it for few months. Its great :-)

A better alternative is Flash Drive Disinfector by sUBs
Direct download from our website:
http://download.bleepingcomputer.com/sUBs/...Disinfector.exe

Quote

I'm sure the file is harmless...but Antivir blocks access to this site and download.

Yep, my browser says the link is broken.

This one works.

Maybe some of you knew: Autorun is disabled in windows7, it there only works on CD's no longer on USB drives.

I have powertoys for XP installed for ages and that lets you (among other things) disable/enable autorun for whatever you want. Works like a charm.

Quote

Quote

This is probably why

Panda USB and AutoRun Vaccine is made by a legimite company.

Flash Disinfector works great but it's made by a hacker & could be altered to be made malicious by another
hacker with bad intentions. Make sure you get it here from My Bleeping Computer or from the home site of Flash Disinfector .

Windows 7 has compatibilty problems .

Another great free tool is Autorun Eater . Which you can get here http://www.softpedia.com/get/Security/Secu...run-Eater.shtml

koolkat, on May 5 2009, 06:19 PM, said:

Flash Disinfector was made by sUBs, who is a member here as an HJT Team member (who is also the author of Combofix).

I'm not aware of any home sites for Flash Disinfector, if there are any.

Quote

Please link me to where you get that information

Well that's why I said get it here. I wasn't aware that the program was created here an most programs
have a home site. Anyway I have seen Flash Disinfector ( to Garmanma ) on File Sharing sites and torrents and when I scaned ; it came up as a trojan ( I don't recall the links since it was malicious ) !!

So bottom line you should only get it here at My Bleeping Computer !

Er.....why bother getting it through torrents? I don't see the point, especially since the download is relatively small, IIRC (I can't check it since I lost mine to Norton ever since it decided to act up on the .exe.... and I don't want to bother trying to download it again). Not just that, but there could possibly be some that really isn't Flash Disinfector and could be something truly malicious.

Also, virus scanners will detect Flash Disinfector as a threat because of how the program is made to run, or something along those lines (can't remember ATM).

One more note.....there's no My in bleepingcomputer.com.......

My scanners say Flash Disinfector is clean from here. I don't know what you use. An yes , I see plenty of small
files on torrents ( even though it does seem Ridicioulous to download a small file through a torrent ).


Note : When their is a problem with "My" Bleeping Computer. That's why I come here.

Quote

That is not true. Many use mirror sites such as BC ,Geeks to Go, Cnet, etc.
They would rather create programs, than maintain and pay for a website
One of the reasons why it can be free

Somehow downloading AV scan tools from a torrent site seems rather counter-productive