USB drive trojan
in [Windows Viruses]
|
Prev: New Net Patch
Next: Is MBAM is a 100% safe application?
From: David H. Lipman on 29 Apr 2010 22:40 From: "lesio family" <blm333(a)rcn.com> | Dave , thank you very much for confirming/clarifying my questions | I already disabled autorun (I hope) - in my registry - I can not find the | string right now but I repalced key value 91 with b5 | I will closer at Avira | thanks again Excellent -- Good Luck and thanx for the update. -- Dave http://www.claymania.com/removal-trojan-adware.html Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp
From: VanguardLH on 1 May 2010 03:15 lesio family wrote: > I've read about trojan infected usb drives (I even got one trojan this way > myself :) > now I am clean > question: can this type of trojan/virus come from external HD enclousure? > I've bought one for my old SATA drive - drive was mine so it was clean but > more less since then I started to have multiple notifications about w32 , > sevebomba, gasgas.exe and others in my system. > so again : can enclousure contain a malware? it is not only a metal box, it > has some electronic components Any device that you plug in where you have [left] enabled the auto-run feature in the OS for that drive means, well, a program will automatically run when you plug in that device and the OS detects it. When you plug in a removable drive, and if auto-play is enabled, Windows is going to check if there is an autorun.inf file. In that file is specified a program to load. If you don't want programs starting automatically simply because you plugged in a drive (USB, flash card reader, etc) then disable auto-run in Windows. Auto-run is a security hazard in Windows. Get the TweakUI powertoy and go to the My Computer -> AutoPlay -> Types node and disable auto-run on all drive types. This can also be done by editing the registry but using TweakUI is easier (plus there are some other tweaks it gives you that you might want).
From: lesio family on 3 May 2010 22:38
thank you -- lb "VanguardLH" <V(a)nguard.LH> wrote in message news:hrgke0$7r3$1(a)news.albasani.net... > lesio family wrote: > >> I've read about trojan infected usb drives (I even got one trojan this >> way >> myself :) >> now I am clean >> question: can this type of trojan/virus come from external HD enclousure? >> I've bought one for my old SATA drive - drive was mine so it was clean >> but >> more less since then I started to have multiple notifications about w32 , >> sevebomba, gasgas.exe and others in my system. >> so again : can enclousure contain a malware? it is not only a metal box, >> it >> has some electronic components > > Any device that you plug in where you have [left] enabled the auto-run > feature in the OS for that drive means, well, a program will automatically > run when you plug in that device and the OS detects it. When you plug in > a > removable drive, and if auto-play is enabled, Windows is going to check if > there is an autorun.inf file. In that file is specified a program to > load. > If you don't want programs starting automatically simply because you > plugged > in a drive (USB, flash card reader, etc) then disable auto-run in Windows. > > Auto-run is a security hazard in Windows. Get the TweakUI powertoy and go > to the My Computer -> AutoPlay -> Types node and disable auto-run on all > drive types. This can also be done by editing the registry but using > TweakUI is easier (plus there are some other tweaks it gives you that you > might want). |