You are here: Home > Protecting Your USB Flash Drives from Auto-Run Viruses

Protecting Your USB Flash Drives from Auto-Run Viruses

A few of our engineers at work approached me about protecting their USB flash drives when they go to customer sites and I found a pretty good solution:

http://www.addictivetips.com/windows-tips/how-to-protect-usb-drive-from-virus-when-attached-to-infected-computer/

Unfortunately I can’t seem to find an antivirus solution (I’ve only done 3 google search though), however making the drive read only is a pretty good idea for now I suppose.

What do you guys do to protect your USB drives?



, , , , , ,

  • dan

    hey matt,
    take at look at this program for usb protection Flash Disinfector http://www.myantispyware.com/2009/01/08/flash-disinfector-free-autoruninf-trojans-removal-tool/

  • Joe

    Easy. Dedicate a flash drive for use on infected machines. Have a copy of all of your utilities on your hard drive. Then, when you get home, boot from a Linux Live CD and use that to format it. Once the drive is formatted simply copy the utilities back.

    Or find one of those rare drives with a write protect switch…

  • http://www.drivesentry.com/drivesentry_goanywhere_download.html Mitch

    Drive sentry has a great usb AV/hips…

    http://www.drivesentry.com/drivesentry_goanywhere_download.html

    It is a trial of course, but seems to work great…

  • Adam

    I buy these types of USB sticks

    http://www.newegg.com/Product/Product.aspx?Item=N82E16820141486

    Pqi makes them. Apparently they are one of the very few which incorporate a write protection switch on their usb sticks. Which I think it’s retarded that they are one of the only ones

    I also have the 4gb models.

    On a side note sophos has released a tool which will protect your computer from the dreaded Lnk vunerablity until microsoft releases a patch.

    http://www.sophos.com/products/free-tools/sophos-windows-shortcut-exploit-protection-tool.html

  • giga

    Just make an folder named Autorun.inf in each USB drive you want then the autoruun files will have no longer effect. :D

  • Mark Hines-Cobb

    matt-
    I use Panda USB Vaccine. It works pretty well. the only con i have noticed is since it completely turns of autorun, you have to execute the good stuff manually but that is a small price to pay.

  • KinderMan

    I plug my USB everywhere and when i get home i clean it. :P
    KIS by default already stopped the autorun on USB and CD so the virus won’t run, plus, i got the settings to promp me a scan (quick or full) everytime i plug an USB too. :)

  • http://malwarekiller.co.ccandcneon.weebly.com/cneonsoftware.tk Christos (ballader1 on YT)

    Same with KinderMan

  • Jimmy James

    I don’t have a write-protected usb stick, but on the stick I put into clients machines there’s a folder called ‘autorun.inf’, which prevents any autoruns being created by malware. This will stop most of the infections, but you still have to be careful about file infectors like virut, which is why I keep an image of the flash drive at home

  • harry

    hi i know it might be a bit rubbish but i found a mcafee program that protects your flash drive i guess it is better than nothing

    http://www.softpedia.com/get/PORTABLE-SOFTWARE/Antivirus—Antispyware/Windows-Portable-Applications-McAfee-VirusScan-USB.shtml

  • no3171711

    use avast to scan it

  • Ross

    I’m pretty sure Drive Sentry has a “portable” AV. Never used but heard it was decent. http://www.drivesentry.com/AntiVirus-Firewall-gofeatures-for-computers-and-removable-media.html

  • http://realsecurity.web.officelive.com/default.aspx geohac

    Panda USB Vaccine Protects Your PC from Autorun Viruses; http://lifehacker.com/5470757/panda-usb-vaccine-protects-your-pc-from-autorun-viruses

    Simple and effective!

  • Raphoul

    Hi,
    excuse me for my english I’m french…
    I used trusport usb antivirus
    http://www.trustport.com/en/products/home-and-small-office/trustport-usb-antivirus

    it does a very good job and it is cheap.

  • Reynaldo Mtz

    Panda USB Vaccine does the job in prevention, I have been using it for about a year with good results…. another one that I have used with very good results in infected machines and USB’s is Flash desinfector.

    Tks.rmm

  • http://pccyber.com thomas

    I use a write protected flash drive and it’s great!
    http://pccyber.com/?v=Product&i=UKEY-KS-ALK-16G

  • Eric

    I use the Kanguru flash drives with write protect switch, however something on the more readily available if you have a spare SD card is a USB to SD Card reader adapter. Just slide the write inhibit tab on the SD card itself.

  • Misury

    One thing I do with my drives (i.e. UBUSB) is delete any autorun.inf and replace it with a folder called autorun.inf. This also helps to minimize chances of infection since a file cannot overwrite a folder. Just another safety step. :)

    Misury

  • H

    My flash drives haven’t got hardware write protect. I’ve tried a few programs but none of them seem to write protect the drive so as when I plug it into someone elses PC it remains write protected.

    I’ve encrypted it with Windows 7 Bitlocker and if I put it in an XP or Vista machine then they can only read it. Plugged into another Windows 7 machine is still a problem though.

  • SP

    what about ninja pendisk?.. anyone used this?. http://ninjapendisk.com/

  • http://www.dataprovider.se BOB

    Hi, the best full proof way I know of is using a usb drive with ‘physical write protection’. Unfortunately there r not many of the kind, so what I’ve done is using a Secure Digital memory card (SD, SDHC) which has a physical write protection mode, and stick that in a usb-card reader, and use it as my on-site usb flash drive.

    Also, love the video reviews, tnx.

  • http://www.rescuemygadget.com Jester_XJ12

    I put directory called autorun.inf then put a blank.ini file in it. Run cmd as an admin then set the attributes of the .ini file as a system file by attrib +R +S +H e:\autorun.inf\blank.ini . You probably want to hide the autorun.inf directory too.

    I have all my av and other software on thumb drives, and use them daily on infected machines. Between jobs I auto quick scan them with Kaspersky AV just to be safe. Never had a problem.

    Thanks for all your advise.

  • testerics

    Robin’s idea:

    Along comes Robin’s idea which works brilliantly. He mentioned how to only lock the autorun.inf file from being modified, deleted, opened, overwritten or the file attributes changed. The idea works by modified the file attribute on the disk level using a disk hex editor.

    First we create a blank autorun.inf on the USB key. Even we wanted to load up our own programs via autorun.inf it will not be possible as once the change is done to disk the autorun.inf file cannot be even opened for it to load so therefore best to just keep it blank.

    Next we use our disk hex editor to open up our USB device in read and write mode. Its best to make sure the USB key is blank or data backed up before editing the disk. We then search the disk for the string “autorun” in non-unicode form.

    41 55 54 4F 52 55 4E 20 49 4E 46 20
    A U T O R U N I N F

    The last byte we are only interested in and will need to be changed. The current value of the byte is 0×20 has the archive bit set. We change this byte to 0×40, which sets the device bit, which is never normally found on a disk. We save our changes and exit out of our hex editor.

    41 55 54 4F 52 55 4E 20 49 4E 46 40
    A U T O R U N I N F @

    Finally to test to see if our autorun.inf is protected we try to delete the file where then it will popup with an error.

    Cool, ha?

  • luham

    ok .. that is before usb get infected

    mine is infected autorun.inf & xp32.exe
    + it is some how write protected ….

    nothing seem to be able to kill the …. I have changed the write protect value to 0 … but no joy

  • Thomas

    @ luham: Did you try to delete the partition under windows disk managment? Also you might want to try Active KillDisk.

  • Ja Wat

    Flash Disinfector?


Remove-Malware Traffic Stats