thumbdrive virus

Question

how does thumbdrive spread virus besides the autorun.inf?

are there bootsector virus that will infect thumbdrives?

Answer 1

There must be something that launches the virus, and there's no common way except for autorun.inf. Bootsector is read only on system boot, not when OS is operational.

That means if autorun.inf is disabled – you can relax unless no virus/useful-software enables it back again, or you run it manually :)

---

UPD: Sometimes a bug is found in some data-processing software: image/PDF viewers, video codecs, etc. If the bug allows to execute arbitrary code, a virus can enter your system inside the thumbnails generation process: this happens when a virus is hidden within some file's data in a way so it's executed by the buggy decoder. It's a rare case, however. Just keep your OS/software/libraries up to date and you're more or less secured :)

Answer 2

Not sure if it's related, but I once found an autorun.exe in my USB drive that can't be seen by XP but was visible on Vista. Of course, I set the options to show everything (hidden and system files).

BTW, doesn't this belong to superuser?

Answer 3

I have seen a few ways.

The most common is the autorun.inf way to install an application.

The next one which I haven't seen in a while is one that creates pictures or random files similar to picture.jpg.exe in order to trick you to run.

Lastly, I have seen ones that simply create vulnerable files that take advantage of 0-day hacks in programs such as Acrobat Reader.

It doesn't usually just infect, what happens typically is if it is on your machine, it will typically look for any removable media and copy itself, then it can be completly idle on another machine - but once run, it will do the same and try to infect any inserted media.

Once infected, who knows - the infection method is to do the above, the actual virus could do anything from steal passwords down to making you part of a botnet.