Where I live (Bolivia), it seems that around 2/3 of USB sticks that I encounter have malware that executes via autorun.inf
and tries to infect the host machine. Most internet access here is conducted on public computers where security and malware prevention is often lax.
After reading about Panda USB Vaccine recently I've been offering to "vaccinate" colleagues' USB sticks to prevent the crippling effects of this plague (autorun is disabled on all our machines but colleagues often work from home computers which kept getting b0rked this way). The vaccine works by creating a harmless autorun.inf
and attemtping to prevent other programs replacing it (I assume via ownership/permissions but I'm not a Windows guy so I don't really know).
This seemed to be working well until recently when many disks started to show up with rogue autorun.inf
files again. I'd like to try to understand how this could have happened and whether it's worth trying out other similar vaccine applications.
To put it another way, is realistic to expect any removable media vaccine to work or do insurmountable loopholes exist (if so what are the loopholes)?