Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Great Free Tool : that prevents AutoRun & USB infections


  • Please log in to reply
20 replies to this topic

#1 koolkat

koolkat

  • Banned
  • 71 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:38 PM

Posted 28 April 2009 - 09:11 AM

:thumbsup:


:inlove: Panda USB and AutoRun Vaccine

By Pedro Bustamante

The Microsoft Windows Operating Systems use the AUTORUN.INF file from removable drives in order to know which actions to perform when a new external storage device, such as a USB drive or CD/DVD, is inserted into the PC. The AUTORUN.INF file is a configuration file that is normally located in the root directory of removable media and contains, among other things, a reference to the icon that will be shown associated to the removable drive or volume, a description of its content and also the possibility to define a program which should be executed automatically when the unit is mounted.

The problem is that this feature, widely critizised by the security community, is used by malware in order to spread by infecting as soon as a new drive is inserted in a computer. The malware achieves this by copying a malicious executable in the drive and modifying the AUTORUN.INF file so that Windows opens the malicious file silently as soon as the drive is mounted. The most recent examples of this are the W32/Sality, W32/Virutas and also the W32/Conficker worm which, in addition to spreading via a vulnerability and network shares, also spreads via USB drives.

Due to the large amount of malware-related problems associated with Microsoft AutoRun we have created a free utility for our user community called Panda USB Vaccine.



Computer Vaccination

The free Panda USB Vaccine allows users to vaccinate their PCs in order to disable AutoRun completely so that no program from any USB/CD/DVD drive (regardless of whether they have been previously vaccinated or not) can auto-execute. This is a really helpful feature as there is no user friendly and easy way of completely disabling AutoRun on a Windows PC.


USB Vaccination

The free Panda USB Vaccine can be used on individual USB drives to disable its AUTORUN.INF file in order to prevent malware infections from spreading automatically. When applied on a USB drive, the vaccine permanently blocks an innocuous AUTORUN.INF file, preventing it from being read, created, deleted or modified. Once applied it effectivelly disables Windows from automatically executing any malicious file that might be stored in that particular USB drive. The drive can otherwise be used normally and files (even malware) copied to/from it, but they will be prevented from opening automatically. Panda USB Vaccine currently only works on FAT & FAT32 USB drives.

:cool: If you want to re-enable AUTORUN.INF , just click remove vaccine ( :trumpet: I don't reccomend this unless you absoulutely have to remove the vaccine).

:flowers: Download it here : http://download.cnet.com/Panda-USB-Vaccine...4-10909938.html

Edited by koolkat, 28 April 2009 - 09:27 AM.


BC AdBot (Login to Remove)

 


#2 Romeo29

Romeo29

    Learning To Bleep


  • Members
  • 3,194 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:127.0.0.1
  • Local time:07:38 PM

Posted 28 April 2009 - 10:45 PM

I have been using it for few months. Its great :-)

#3 garmanma

garmanma

    Computer Masochist


  • Staff Emeritus
  • 27,809 posts
  • OFFLINE
  •  
  • Location:Cleveland, Ohio
  • Local time:08:38 PM

Posted 03 May 2009 - 12:16 PM

A better alternative is Flash Drive Disinfector by sUBs
Direct download from our website:
http://download.bleepingcomputer.com/sUBs/...Disinfector.exe
Mark
Posted Image
why won't my laptop work?

Having grandkids is God's way of giving you a 2nd chance because you were too busy working your butt off the 1st time around
Do not send me PMs with problems that should be posted in the forums. Keep it in the forums, so everyone benefits
Become a BleepingComputer fan: Facebook and Twitter

#4 I_am_CanadianEh?

I_am_CanadianEh?

  • Members
  • 489 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:07:38 PM

Posted 04 May 2009 - 01:43 PM

A better alternative is Flash Drive Disinfector by sUBs
Direct download from our website:
http://download.bleepingcomputer.com/sUBs/...Disinfector.exe


I'm sure the file is harmless...but Antivir blocks access to this site and download.

#5 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,091 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:03:38 AM

Posted 04 May 2009 - 01:49 PM

Yep, my browser says the link is broken.

This one works.

Edited by elise025, 04 May 2009 - 01:51 PM.

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#6 Stofzuiger

Stofzuiger

  • Members
  • 332 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The inside
  • Local time:01:38 AM

Posted 04 May 2009 - 01:51 PM

Maybe some of you knew: Autorun is disabled in windows7, it there only works on CD's no longer on USB drives.

Edited by Stofzuiger, 04 May 2009 - 01:55 PM.

Every one goes fun fun fun


Who is this doin' this synthetic type of alpha beta psychedelic bleepin'? ~Chemical Brothers - Elektrobank


#7 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,091 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:03:38 AM

Posted 04 May 2009 - 01:54 PM

I have powertoys for XP installed for ages and that lets you (among other things) disable/enable autorun for whatever you want. Works like a charm.

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#8 garmanma

garmanma

    Computer Masochist


  • Staff Emeritus
  • 27,809 posts
  • OFFLINE
  •  
  • Location:Cleveland, Ohio
  • Local time:08:38 PM

Posted 04 May 2009 - 03:45 PM

I'm sure the file is harmless...but Antivir blocks access to this site and download.


Flash_Disinfector will create a hidden folder named autorun.inf in each partition and every USB drive that was plugged in when you ran it. Do not delete this folder...it will help protect your drives from future infection by keeping the autorun file from being installed on the root drive and running other malicious files.

This is probably why
Mark
Posted Image
why won't my laptop work?

Having grandkids is God's way of giving you a 2nd chance because you were too busy working your butt off the 1st time around
Do not send me PMs with problems that should be posted in the forums. Keep it in the forums, so everyone benefits
Become a BleepingComputer fan: Facebook and Twitter

#9 koolkat

koolkat
  • Topic Starter

  • Banned
  • 71 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:38 PM

Posted 05 May 2009 - 06:19 PM

:thumbsup: Panda USB and AutoRun Vaccine is made by a legimite company.

:trumpet: Flash Disinfector works great but it's made by a hacker & could be altered to be made malicious by another
hacker with bad intentions. Make sure you get it here from My Bleeping Computer or from the home site of Flash Disinfector .

:flowers: Windows 7 has compatibilty problems .

Another great free tool is Autorun Eater . :inlove: Which you can get here http://www.softpedia.com/get/Security/Secu...run-Eater.shtml

Edited by koolkat, 05 May 2009 - 06:25 PM.


#10 scff249

scff249

    Indecisive Lurker


  • Members
  • 1,319 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:A galaxy far, far away...
  • Local time:07:38 PM

Posted 05 May 2009 - 06:32 PM

:thumbsup: Flash Disinfector works great but it's made by a hacker & could be altered to be made malicious by another
hacker with bad intentions. Make sure you get it here from My Bleeping Computer or from the home site of Flash Disinfector .


Flash Disinfector was made by sUBs, who is a member here as an HJT Team member (who is also the author of Combofix).

I'm not aware of any home sites for Flash Disinfector, if there are any.

"Ototo'i wa usagi o mita no...Kino wa shika...Kyo wa anata." -Kotomi Ichinose (Clannad) [see below for translation]
"Day before yesterday I saw a rabbit, and yesterday a deer, and today, you." -The Dandelion Girl
"You are not alone, and you are not strange. You are you, and everyone has damage. Be the better person." -Katawa Shoujo


#11 garmanma

garmanma

    Computer Masochist


  • Staff Emeritus
  • 27,809 posts
  • OFFLINE
  •  
  • Location:Cleveland, Ohio
  • Local time:08:38 PM

Posted 05 May 2009 - 08:53 PM

Flash Disinfector works great but it's made by a hacker & could be altered to be made malicious by another
hacker with bad intentions. Make sure you get it here from My Bleeping Computer or from the home site of Flash Disinfector .


:thumbsup: :flowers: :trumpet: Please link me to where you get that information

Edited by garmanma, 05 May 2009 - 08:54 PM.

Mark
Posted Image
why won't my laptop work?

Having grandkids is God's way of giving you a 2nd chance because you were too busy working your butt off the 1st time around
Do not send me PMs with problems that should be posted in the forums. Keep it in the forums, so everyone benefits
Become a BleepingComputer fan: Facebook and Twitter

#12 koolkat

koolkat
  • Topic Starter

  • Banned
  • 71 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:38 PM

Posted 05 May 2009 - 08:55 PM

:flowers: Well that's why I said get it here. :inlove: I wasn't aware that the program was created here an most programs
have a home site. :thumbsup: Anyway I have seen Flash Disinfector ( to Garmanma ) on File Sharing sites and torrents and when I scaned ; it came up as a trojan ( I don't recall the links since it was malicious ) !!

:trumpet: So bottom line you should only get it here at My Bleeping Computer !

Edited by koolkat, 05 May 2009 - 09:49 PM.


#13 scff249

scff249

    Indecisive Lurker


  • Members
  • 1,319 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:A galaxy far, far away...
  • Local time:07:38 PM

Posted 05 May 2009 - 09:32 PM

Er.....why bother getting it through torrents? I don't see the point, especially since the download is relatively small, IIRC (I can't check it since I lost mine to Norton ever since it decided to act up on the .exe....:thumbsup: and I don't want to bother trying to download it again). Not just that, but there could possibly be some that really isn't Flash Disinfector and could be something truly malicious.

Also, virus scanners will detect Flash Disinfector as a threat because of how the program is made to run, or something along those lines (can't remember ATM).

One more note.....there's no My in bleepingcomputer.com.......

"Ototo'i wa usagi o mita no...Kino wa shika...Kyo wa anata." -Kotomi Ichinose (Clannad) [see below for translation]
"Day before yesterday I saw a rabbit, and yesterday a deer, and today, you." -The Dandelion Girl
"You are not alone, and you are not strange. You are you, and everyone has damage. Be the better person." -Katawa Shoujo


#14 koolkat

koolkat
  • Topic Starter

  • Banned
  • 71 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:38 PM

Posted 05 May 2009 - 09:48 PM

:trumpet: My scanners say Flash Disinfector is clean from here. I don't know what you use. An yes , I see plenty of small
files on torrents ( even though it does seem Ridicioulous :thumbsup: to download a small file through a torrent ).


Note : When their is a problem with "My" Bleeping Computer. That's why I come here. :flowers:

Edited by koolkat, 05 May 2009 - 09:53 PM.


#15 garmanma

garmanma

    Computer Masochist


  • Staff Emeritus
  • 27,809 posts
  • OFFLINE
  •  
  • Location:Cleveland, Ohio
  • Local time:08:38 PM

Posted 06 May 2009 - 04:57 PM

most programs have a home site.


That is not true. Many use mirror sites such as BC ,Geeks to Go, Cnet, etc.
They would rather create programs, than maintain and pay for a website
One of the reasons why it can be free

Somehow downloading AV scan tools from a torrent site seems rather counter-productive :thumbsup:
Mark
Posted Image
why won't my laptop work?

Having grandkids is God's way of giving you a 2nd chance because you were too busy working your butt off the 1st time around
Do not send me PMs with problems that should be posted in the forums. Keep it in the forums, so everyone benefits
Become a BleepingComputer fan: Facebook and Twitter




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users