Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

how does thumbdrive spread virus besides the autorun.inf?

are there bootsector virus that will infect thumbdrives?

share|improve this question

migrated from serverfault.com Jan 10 '10 at 19:39

This question came from our site for professional system and network administrators.

3 Answers 3

There must be something that launches the virus, and there's no common way except for autorun.inf. Bootsector is read only on system boot, not when OS is operational.

That means if autorun.inf is disabled – you can relax unless no virus/useful-software enables it back again, or you run it manually :)


UPD: Sometimes a bug is found in some data-processing software: image/PDF viewers, video codecs, etc. If the bug allows to execute arbitrary code, a virus can enter your system inside the thumbnails generation process: this happens when a virus is hidden within some file's data in a way so it's executed by the buggy decoder. It's a rare case, however. Just keep your OS/software/libraries up to date and you're more or less secured :)

share|improve this answer

Not sure if it's related, but I once found an autorun.exe in my USB drive that can't be seen by XP but was visible on Vista. Of course, I set the options to show everything (hidden and system files).

BTW, doesn't this belong to superuser?

share|improve this answer
    
Many games have autorun.exe on its CD :) Nothing works without an .inf file. You may have deleted it –  kolypto Jan 9 '10 at 18:08
    
It's not a CD. It's just a drive with no executables. Not even a reason to have .inf file there. –  RichN Jan 10 '10 at 6:28

I have seen a few ways.

The most common is the autorun.inf way to install an application.

The next one which I haven't seen in a while is one that creates pictures or random files similar to picture.jpg.exe in order to trick you to run.

Lastly, I have seen ones that simply create vulnerable files that take advantage of 0-day hacks in programs such as Acrobat Reader.

It doesn't usually just infect, what happens typically is if it is on your machine, it will typically look for any removable media and copy itself, then it can be completly idle on another machine - but once run, it will do the same and try to infect any inserted media.

Once infected, who knows - the infection method is to do the above, the actual virus could do anything from steal passwords down to making you part of a botnet.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.