USB and protection for computers
USB antivirus software
http://antivirus.about.com/od/antivirussoftwarereviews/a/usbantivirus.htm
Edit - this article appears very dated. Found while scouting about looking for articles about USB and computer protection. Any posts directing to more up to date info would be appreciated.
How to disable the Autorun functionality in Windows
http://support.microsoft.com/kb/967715
Autorun Eater v2.4
http://oldmcdonald.wordpress.com/2009/06/02/autorun-eater-v24
Autorun Eater FAQ:
http://oldmcdonald.wordpress.com/frequently-asked-questions
avast! Virus Cleaner:
http://www.snapfiles.com/get/avastcleaner.html
Let your USB drive plugged and run Autorun Eater or Flash Disinfector, allowing them to clean up all drives. They would create hidden folders named autorun.inf in each partition and every USB drive plugged in when you ran it. These folders protect your drives from future infection. After that, reboot your computer.
To prevent infections from USB drives, you can install USB Firewall before using any USB drive.
USBVirusScan will launch any program you provide as a command line parameter each time a USB stick is inserted. I use it to start a full virus scan on the inserted USB drive: http://blog.didierstevens.com/programs/usbvirusscan/ The command-line that worked for me is:
“\USBVirusScan.exe” -c -i “\avast4\ashQuick.exe” x:
Where you need to change the for the both correct ones and the x: for the letter of your USB drive.
If you are running XP system with administrator account, the autorun should be feared. For 0-day type attacks, I think it would be good for us to think about taking more control in the autorun function.
Probably, this is the info for the most updated patch (optional) from Microsoft for USB security according to their security advisory.
For your peace of mind, you may want this tool introduced by polonus in the previous thread. It is a GUI tool for the registry tweak specialized in allowing the users to have more detailed control on the autorun feature.
Hi malware fighters,
This link should be here in this thread as well: http://www.uwe-sieber.de/drivetools_e.html#autorun
To protect your computer from viruses, Trojan or malware a good antivirus solution for your USB devices is a necessary. Mx One is such a free antivirus designed to protect you external storage devices like USB stick or pen drives , iPod., mp3, mp4, M2, SD, microSD. Download: http://jayaprakashkv.blogspot.com/2008/07/download-free-usb-sticks-antivirus-mx.html home-site for this tool: http://mxone.net/en/
Features.
polonus
Thanks for the input.
I’m still working my way through some of it. And covering some stuff in the previous thread that I overlooked.
I gather Autorun Eater is your preference, YoKenny? I downloaded a couple of times but never got around to running it. As I said in the previous post I have not had the problems that have been associated with Flash Disinfector. But that is up to this point in time.
I have Microsoft patches including the most updated patch KB971029 (26th Aug 2009).
The MX One might be what I am looking for at the moment. So I may give a run on a computer. Something along that line anyway, where the solution is amenable to use by people knowing little in depth about command line functions. Not so much for my own use at the moment.
At this point in time, I have kept a record of the info and will continue to take an interest in any new developments.
In addition to protecting my computer from USB infections, I also use this simple tool to protect my bootable USB recovery drives from infection from other computers I plug them into.
http://www.softpedia.com/get/Antivirus/NOD32-Dummy-File-Creator.shtml
Hi mkis,
There is another tool that is run in connection for instance with malware cleansing routines,
I think here in relation to removal of Trojan:Win32/Alureon.gen!
The tool is from a page on G2G so a reliable source
Explanation: USB storage devices are all the USB devices that get their own partition letter at connecting to the PC, e.g. flash drives (thumb/pen drives, USB sticks), external HDDs, MP3/MP4 players, digital cameras, memory cards (SD cards, Sony Memory Stick, MultiMedia Cards etc.), some mobile phones, some GPS navigation devices etc,
Just wanted to post this here for making our thread more complete…
polonus
Try the panda tool"usb vaccine"
or write the next lines in a .txt file then rename it to :example.reg then add it to registry:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom]
“AutoRun”=dword:00000000
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\NoDriveTypeAutoRun]
“NoDriveTypeAutoRun”=dword:000000b1
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
“NoDriveTypeAutoRun”=dword:000000b1
You shouldn’t need to resort to this as there have been recent security updates that disable autorun as YoKenny mentioned in Reply #1.
So what you need to do is keep your OS up to date ;D
Hi pol
Here is reply to post http://forum.avast.com/index.php?topic=50498.msg427974#msg427974
See txt file below
F: drive is the USB I use mostly now in daily imput / output to removable media.
UsbNoRisk does not pick up my VMClite modem or Mouse understandably
My Canon Powershot had been left connected so batteries were flat and no pick up there either.
I am certain Flash Disinfector was run at one stage, maybe not this USB on this computer.
I ran this USB with Flash Disinfector on another computer the day after it picked up an infection.
Since then it has been good as gold. MSE detected the intrusion.
I recently mislaid an 8GB San Cruzer, my main removable, which was probably the device that was run with Flash Disinfector on this computer. Can run Flash Disinfector again and come back.
I better copy and paste the text doc
USBNoRisk 2.5 (26 July 2009) by bobby
Started at 11/4/2009 5:21:09 PM
The patches introduced there are mere prerequisites to disable Autorun.
After the prerequisites are installed, follow these steps to disable Autorun.After installing the patches corresponding to each OS, you could disable/tweak Autorun function by following the instruction given [url=http://support.microsoft.com/kb/967715]there[/url] as well. Alternatively, you can use [url=http://www.uwe-sieber.de/drivetools_e.html#autorun]the tool[/url] introduced by polonus.
Hi malware fighters,
I did install mxone Guardian with realtime usb protection. Updater works fine, scans swiftly, a real asset.
Report more here about this Mexican security solution for peripherals…
See it sitting there…
I tried to install mxone Guardian too but failed.
First, Spywareterminator blocked installation of the Guardian’s updater (it was detected as a trojan). I turned off ST’s protection but it was the turn of ThreatFire to alarm me about the updater. I turned off the TF’s protection too but my Vista refused to run the program - “Windows encountered a problem while running the program”.
Hi George Yves,
I do not know whether it will function on Vista, but on XP SP3 runs like a charm,
Threatfire alerted but I allowed it, Immunet Protect did not alert a thing on installing and downlaoding, nor did a scan with MBAM, SAS, and RUBotted, ThreatExpert Memory Scan, ESET Sys Inspector, a-squared-free did not flag it, scans are fast, pendrives with their own logo’s now sit protected.
I will test it a bit longer, seems to run fine next to avast and Immunet Protect and ThreatFire (no further alerts), and for the updater I get 2 heuristic flags: http://www.virustotal.com/nl/analisis/ccb02889d246641a68435019229bc97d771ce3b0dab91e92963fd43b4f5c04cd-1257455211
polonus
cross posted with Pol but I have posted anyway - program must be okay if Immunet Protect passes it.
I now have mxone installed on my computer and giving it a test run because I am looking for a program like this with a simple, clear, straightforward user interface that is easy for the average user to work with.
I had problems with download and install and have also ended up with Mex or spanish version, which may be only one available to me even though url was definitely reading /en on route to download page (/en indicates english, thats right isn’t it). I had to edit my hosts file to prevent the download being blocked (just checked now, still edited but will prob return deleted entry with next auto update of hosts file - so see how mxone updates run then).
Haven’t had time to translate spanish UI as yet so first run through I was going a bit blind but looks at moment like I’m only with ‘on demand’ setting (or version). I’m a bit too busy to do much right now but look to translate UI tonight. Had intended to have someone test this for me but under circumstances will have to do this myself, so program now on my most used PC. That okay - have USB in and out of here all time.
May look to download / install Panda USB vaccine to another computer to test run there.
http://www.pandasecurity.com/homeusers/downloads/usbvaccine/
Also will prepare a more comprehensive test run with some USB devices for USBNoRisk when have spare time.
Hi mkis,
The interface is also in English, you can install various languages, I like this program, let us test if it can be recommended to be used next to your resident av solution of choice. This is how it sits there on the pendrive,
see picture,
pol
Yes, exactly. Your install looks good.
bit rushed at the moment (10.30am) but more time later today. will reply post
Malwarebytes’ Anti-Malware IP protection blocks download from mxone.net/en/ 174.132.148.58
http://hosts-file.net/default.asp?s=174.132.148.58
I disabled IP protection but I could not find a download link that worked.
It looks like IOBit 360 to me.