3

I'd like to make my flash drive read-only just for the root to stymie the Trojan Dropper autorun.inf's and bad EXE's on computers I'm fixing.

Anyone have any good ideas to keep from getting these Trojan Dropper files and autorun.exe's?

Thanks! -JFV

Improve this question

5 Answers 5

Reset to default
5

There is a tool from Panda, which is called USB Vaccine and creates an unwritable autorun.inf file on your usb drive by abusing the FAT32 filesystem spec.

If you are using NTFS, you can just allow create folder and create files for child folders only. But keep in mind that usually those trojans will try to reset permissions to the root directory first (if they are running with Admin privileges or System privileges).

Improve this answer
1
  • I used this and so far it's working well! Thanks for the info for USB Vaccine!
    – JFV
    Commented Aug 19, 2009 at 4:15
2

I assume that you are working on other people's machines and you want to be able to get data off of them onto your USB. In that case here is what I would suggest. Have one USB key that is completely read only. On that one put all your cleanup utilities. Clean up the machine removing Trojan Dropper, etc. Then have a second USB device that you pull the data to. You should also be turning off USB auto run on all your machines anyway so auto running viruses would not be a concern.

Improve this answer
1
  • +1 for a good solution, but just a pain to implement (and update the cleanup utils and such). Thanks!
    – JFV
    Commented Aug 19, 2009 at 4:24
1

You can use an SD card reader. SD cards all have write-lock switches.

Improve this answer
2
  • This is not solution for this question . I didn't understand how it will be helpful for this solution
    – joe
    Commented Aug 17, 2009 at 16:20
  • You'd use a SD card reader with an SD card in it. The PC will treat it as a USB flash drive (Mass Storage Device), but SD cards can be locked with a switch, effectively read-only-ing the entire drive. Instead of looking for a lockable USB drive, every normal sized SD card has a lock swtich.
    – Grant
    Commented Aug 17, 2009 at 17:12
1

This is issue happeneing because of Zlob.DnsChanger, Downandup, Downadup, Kido, Conficker.

Here they mentioned lot of solutions for this issue :http://www.exterminate-it.com/how-to-prevent-your-flash-drive-from-being-infected.

Improve this answer
2
  • any reason for down vote ?
    – joe
    Commented Aug 17, 2009 at 16:19
  • Good info from the link... Not sure if the autorun.inf folder will hold up against these 'dropper' viruses though...
    – JFV
    Commented Aug 19, 2009 at 4:08
0

Some flash drives (like U3 enabled drives) come with a small partition that is read like a CD drive to the computer. This way the flash drive can load up software on computers that have CD autorun enabled, but Mass Storage Device (Flash drives) autorun disabled. That CD portion can be overridden with some work and effectively becomes a read-only section of the drive. It's not a whole lot of help in your case because A) there isn't a whole lot of room on the CD side and B) there is still a writable flash drive attached.

Improve this answer
2
  • I guess , this drive also do auto run operations
    – joe
    Commented Aug 17, 2009 at 16:04
  • Yes, that's why it's not very helpful in this situation, but more options are better than less options, as long as all the benefits and weaknesses are pointed out.
    – Grant
    Commented Aug 17, 2009 at 17:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .