BleepingComputer.com: Usb! Worm Targets Removable Memory Sticks

Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Page 1 of 1

You cannot start a new topic
You cannot reply to this topic

Usb! Worm Targets Removable Memory Sticks

#1 quietman7

Bleepin' Janitor

Group: Global Moderator
Posts: 25,113
Joined: 09-July 05
Location:Virginia, USA

Posted 05 May 2007 - 08:32 AM

Quote

...The W32/SillyFD-AA worm hunts for removable drives such as floppy disks and USB memory sticks, and then creates a hidden file called autorun.inf to ensure a copy of the worm is run the next time it is connected to a Windows PC.

It also changes the title of Internet Explorer windows to append the phrase "Hacked by 1BYTE". ...

sophos.com

Microsoft MVP - Consumer Security 2007-2012

Member of UNITE, Unified Network of Instructors and Trusted Eliminators

#2 rowal5555

Just enough info to be armed & dangerous...

Group: Members
Posts: 2,635
Joined: 18-March 06
Gender:Male
Location:St Kilda, Dunedin. South Island. NZ

Posted 09 May 2007 - 12:09 AM

It is recommended to disable the autorun feature in Windows to combat this worm. How?????

rowal5555 (Rob )
Avid supporter of Bleeping Computer's
Team 38444
You can help find a cure

#3 Budapest

Bleepin' Cynic

Group: Moderator
Posts: 21,855
Joined: 11-November 06
Gender:Male

Posted 09 May 2007 - 01:04 AM

Totally disable Autorun / AutoPlay in Windows XP

_{The power of accurate observation is commonly called cynicism by those who haven't got it.

—George Bernard Shaw}

#4 rowal5555

Just enough info to be armed & dangerous...

Group: Members
Posts: 2,635
Joined: 18-March 06
Gender:Male
Location:St Kilda, Dunedin. South Island. NZ

Posted 09 May 2007 - 01:16 AM

Thanks Budapest. I was running around in circles getting precisely nowhere. Good one.

Cheers

rowal5555 (Rob )
Avid supporter of Bleeping Computer's
Team 38444
You can help find a cure

#5 bloomcounty

Distinguished Member

Group: Members
Posts: 672
Joined: 11-February 07

Posted 12 May 2007 - 09:56 AM

In TweakUI, under My Computer --> AutoPlay --> Types, I've removed the checkmarks next to both "CD and DVD drives" and "removable drives".

However, under My Computer --> AutoPlay --> Drives, I still have checkmarks next to C: (main hard drive), D: (restore partition), and E: (cd/dvd drive).

Why would AutoPlay need to be active for your hard drive(s) here?

It sounds like having both the "CD and DVD drives" and "removable drives" unchecked in "Types" supersedes having the cd/dvd drive checked in "Drives", so that's probably covered as is, right?

But I'm uncertain about the hard drives and the settings in "Drives" in general and why they're set the way they are...

Any thoughts? Thanks! :thumbsup:

My stats: Windows XP Home SP2; Firefox 3.0.14 w/ Ad-Block Plus; IE 6.0 (used only for monthly Windows Critical Updates); ZoneAlarm 6.1.744.001 Free; AVG 8.5 A/V Free; SuperAntispyware Free 4.28.1010