up vote 3 down vote favorite
share [g+] share [fb]

When I inserting flash drive of my friend, how can I check that it is safe from infecting me with a viruses?

  1. Autorun.inf. This can be disabled with Shift while inserting or in registry
  2. anything other way of how can trojan get into my comp?
  3. ...
  4. folder.htt - seems to be disabled in modern XP
  5. boot floppy -ancient

Considering the default Windows XP SP2-SP3, flash is opened with Explorer.

Please, to this time I need no autorun.inf disablers, I want to learn other way, which virus can use on removable drives

UPDATE

What are possible attack vectors on Windows+Explorer, when I just insert flash drive and open the file listing in the Explorer? No any intendent document open, or program launch, only Windows XP SP2-SP3 and Explorer

link|improve this question
80% accept rate
Installing an anti-virus , set it on maximum, disable it and turn it on occasionally like when you get a pendrive. (Like Avast! Free. It eats 1.5mb at the moment, all shields turned off.) – Shiki Jun 13 '10 at 12:07
@shiki - this could be a valid answer instead of a comment, in my opinion. Most modern antivirus will catch infections from pen-drives before they can harm the computer. – Gnoupi Jun 13 '10 at 12:12
@gnoupi - To be honest I'm already confused. Started to comment, someone said I should write answers. Wrote answers, got a bunch of downvote. Guess its still better to receive nothing than going back to 1 point. :/ – Shiki Jun 13 '10 at 12:23
@Shiki: Don't give up - false down-voting is a fact of life on this site. Mathematically: down-vote is -1, while up-vote is +10. A good answer is always a winner. – harrymc Jun 13 '10 at 12:29
@harrymc - Will try. By the way, nice utility, thank you. Will come in handy (but double-checking wont hurt ^^) – Shiki Jun 13 '10 at 12:50
show 4 more comments
feedback

3 Answers

up vote 1 down vote accepted

Autorun and autoplay are the only USB attack vectors that don't require your active cooperation. All other methods require you to manually launch programs or multi-media files from the USB, by infecting files stored on it.

A very old example are the .exe virus family. A more recent example are the viruses that infect images, PDF and video.

That's why you should regularly update any software you have installed that deals with such files, and have some good anti-intrusion software installed.

link|improve this answer
And what about preview cache file, stored in each folder? – osgx Jun 17 '10 at 13:49
@osgx: The preview cache doesn't exist any more since Vista. It's now centralized by Windows in one database file on the hard disk. – harrymc Jun 17 '10 at 14:37
feedback
up vote 1 down vote

The best idea is to always disable autorun for USB and CD.

Panda USB Vaccine does double action: It not only disables autorun, it also sets up a read-only dummy autorun.inf on your USB, which will protect it from infection when plugged into an infected computer.

Panda USB Vaccine

If autorun is turned off, the only way for the virus to attack your computer is to use a weakness in a product that's already installed in the computer.

This may either be a product that is listening on the internet, such as IIS or Filezila. It also can be by using a multi-media product, such as Adobe reader (where you should turn off Javascript) or even the image-display software of Windows itself.

The most common vector of infection is the browser, since unintentionally you're executing the page without clicking on anything. Such viruses are capable of downloading themselves to your hard disk without your cooperation.

The propagation vector here can be JavaScript, Java, ActiveX, Flash and other plugins. Many such attacks are carried out through cross-site scripting.

You can find lots of information about Web attacks on the site of the popular Firefox extension NoScript.

link|improve this answer
Hmm, interesting feature. Though I'm curious how they protect the autorun.inf. What prevents it from being overwritten? – Gnoupi Jun 13 '10 at 14:19
1  
@Gnoupi: They idea is to create a non-empty directory called autorun.inf without permissions. – harrymc Jun 13 '10 at 14:54
@harrymc - thank you for details. Nice idea indeed. – Gnoupi Jun 13 '10 at 16:07
I want to get, how viruses can inject itself into computer with autorun disabled. I had disabled it a long time ago – osgx Jun 13 '10 at 21:28
1  
@osgx: I've added a new answer. BTW, the icons displayed by Explorer for files on the USB are since Vista no longer stored on the USB. So no way to get infected by just exploring. – harrymc Jun 16 '10 at 12:06
show 6 more comments
feedback
up vote 0 down vote

The likely answer is that someone tricked you into running the virus program while you held administrator privileges. HOW? Well, that list could be infinitely long... as witnessed by the continuing success of the bad guys to infect the "good guys".

Even if you have a virus checker there are "zero-day viruses". In other words, virii that have not been identified and have no signature (yet) in the virus checkers. If you get one of these it won't matter if you disable autorun and virus-check the USB because even though they are there they will not be identified and removed. Happens every day unfortunately.

Hotei

link|improve this answer
1) I do use admin account. And most users do. 2) Virus can inject itself into system w/o admin priv (there was recent study, that UAC in W7 does not prevent most viruses) 3) My Q is on mechnisms of infection with removable drive insertion. 4) I do know how viruses work, I analysed several of them, inc. LoveLetter and first scripted encoded viruses. I do know how exploits work and what is zeor day – osgx Jun 15 '10 at 18:32
If i will not run/open any file on flash, but open flash directory listing in explorer, what kinds of files can be dangerous? folder settings, autorun, what else? – osgx Jun 15 '10 at 18:35
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.